omp-conductor 0.13.0 → 0.15.0

package/src/setup.ts

@@ -1,5 +1,5 @@
 /**
- * The onboarding core behind `/conductor setup`.
+ * The onboarding core behind `omp-conductor setup`.
  *
  * Everything here is headless and synchronously testable: the plugin owns the
  * dialogs, this module owns the decisions. That split is the point — a wizard
@@ -52,22 +52,73 @@ import {
   DEFAULT_REPORT_SCOPE,
   DENIED_RELEASE_GRANTS,
   RELEASE_SHAPES,
+  WEEKDAYS,
   type BaseFreshness,
   type BehindBaseAction,
   type Caps,
   type ConductorConfig,
+  type DigestCadence,
   type DraftPolicy,
   type OrchestratorMode,
+  type InterruptCategory,
   type ProjectConfig,
   type ProjectPolicy,
   type ReleaseRequirement,
-  type ReportScope,
   type ReportScopeChoice,
   type ReportingPolicy,
+  type Weekday,
+  type WeeklyAvailability,
   type RepoTarget,
   type ResolvedGrants,
 } from "./types.ts";
 
+/**
+ * What the onboarding skill interviewed for and no probe can supply.
+ *
+ * The skill is explicit that reading a repo answers none of this: "a tracker
+ * shows what is open, never what matters" (`SKILL.md:337-341`), and a release
+ * boundary is a sentence only the operator can say. Every field here fills a
+ * stub the shipped `policy.md` already carries, which is what makes deleting the
+ * skill (#309) a move rather than a loss.
+ *
+ * Every field is optional because the object is what has been *collected so
+ * far*: an amend that never reaches these prompts carries none of them, and
+ * `judgment` itself is absent on a project re-read from disk, since none of this
+ * lives in `config.json`.
+ *
+ * `boundary` and everything under it is asked only when the orchestrator holds
+ * some release shape: a humans-release fleet has no boundary to draw, and asking
+ * for one would invite a procedure the config does not grant.
+ */
+export interface OperatorJudgment {
+  /** Where the roadmap lives and what is being shipped now. Always *asked*;
+   *  absent means the interview has not reached it (or the operator left it blank). */
+  roadmap?: string;
+  /** Where the orchestrator's leg ends, in one sentence. */
+  boundary?: string;
+  /** What may be released, and from which branch. */
+  releaseWhat?: string;
+  /** Batched how, after which *named* checks are green. */
+  releaseWhen?: string;
+  /** The proof that must be held first — results read, not an impression. */
+  releaseProof?: string;
+  /** What must still be asked, every time. */
+  releaseAsk?: string;
+  /** What stays permanently forbidden. */
+  releaseForbidden?: string;
+  /** The batching unit in the operator's own vocabulary. */
+  worthCutting?: string;
+  /** Who owns the rollback. A named person moves the boundary earlier. */
+  rollbackOwner?: string;
+  /**
+   * Whether the operator accepted the boundary-moves-earlier consequence of
+   * naming a person as the rollback owner. Recorded rather than enforced: the
+   * wizard states the consequence and offers to move the boundary, and an
+   * operator who declines has made a choice, not a mistake.
+   */
+  rollbackMovesBoundary?: boolean;
+}
+
 /**
  * Every decision the wizard needs, in one plain object. Collected by the UI,
  * consumed by `buildConfig`, so the prompt order can change without touching
@@ -89,11 +140,24 @@ export interface SetupAnswers {
    */
   workerModel?: string;
   telegramChatId?: string;
+  /** Forum topic for tier-2 Telegram pages; absent keeps flat-chat 0.13 behaviour. */
+  telegramTopicId?: number;
   fallbackToIssueComment: boolean;
   /** How loud the supervising orchestrator session should be. */
   reportScope: ReportScopeChoice;
-  /** The daily digest wall-clock (`HH:MM`) for the `quiet` choice, blank = model-timed. */
-  quietDigestAt?: string;
+  /** One IANA zone shared by the configured window and its daily digest. */
+  reportingTimezone?: string;
+  /** Daily digest wall-clock (`HH:MM`) when an explicit daily policy is chosen. */
+  dailyDigestAt?: string;
+  /** Digest cadence when preserving or explicitly editing a reporting policy. */
+  digestCadence?: DigestCadence;
+  /** Weekly window without its shared timezone; absent keeps 24-hour interrupts. */
+  availability?: Omit<WeeklyAvailability, "timezone">;
+  /**
+   * Exact policy read from disk. Unrelated amend areas carry this through
+   * untouched; the reporting interview deletes it before applying new answers.
+   */
+  preservedReporting?: ReportingPolicy;
   /**
    * Mechanical gate for release/deploy-shaped tool calls, per shape. Always
    * complete: the wizard asks about every shape, so an answer object can never
@@ -113,6 +177,17 @@ export interface SetupAnswers {
    * prompt that asked it to the step that acts on it.
    */
   writeOrchestratorBrief: boolean;
+  /**
+   * The operator's own judgment, asked in the interview because no amount of
+   * repo reading produces it — and because `src/briefs/policy.md` ships stubs
+   * waiting for exactly these words (`:25-28`, `:53-56`).
+   *
+   * Not config: none of it is a key the daemon reads. It exists to reach
+   * `POLICY.md` — written directly, and offered to a prose probe as stated input
+   * the probe may not invent. It rides on the answers object because the wizard
+   * has to carry it from the prompt that asked it to the step that writes it.
+   */
+  judgment?: OperatorJudgment;
   /**
    * Who lands green PRs and who cuts releases. Both default to the human — see
    * {@link DEFAULT_AUTHORITY} — and the answer is what the rendered brief's
@@ -138,6 +213,16 @@ export interface SetupAnswers {
    * the same question four times to arrive at four siblings.
    */
   graphRoot?: string;
+  /**
+   * Where this project's worktrees live. Absent means {@link defaultWorkspaceRoot}
+   * under the state dir (the first-project layout). An added project seeds
+   * `~/.omp/conductor/projects/<name>/worktrees` instead; an amend carries the
+   * path already on disk so a re-run never migrates a neighbour.
+   */
+  workspaceRoot?: string;
+  /** Bare mirrors for this project; same seeding rules as {@link workspaceRoot}. */
+  mirrorRoot?: string;
+
 }
 
 /** What `gh auth status` says the active token may do. */
@@ -189,7 +274,7 @@ export const REPORT_SCOPE_CHOICES: readonly {
     scope: "decisions",
     label: "Decisions interrupt, rest batches",
     description:
-      "tier-2 decisions and fleet-stopping conditions immediately; every other material event ships with the tick report",
+      "tier-2 decisions and fleet-stopping conditions immediately; every other material event ships with the configured digest",
   },
   {
     scope: "material",
@@ -510,6 +595,88 @@ export async function createMissingLabels(trackerRepo: string, plan: LabelPlan[]
   return created;
 }
 
+const QUIET_INTERRUPT_ON: InterruptCategory[] = [
+  "tier2",
+  "fleet-stopped",
+  "confirmed-failure",
+];
+
+function interruptCategories(scope: ReportScopeChoice): InterruptCategory[] {
+  return scope === "quiet"
+    ? [...QUIET_INTERRUPT_ON]
+    : [...(SCOPE_PRESETS[scope] ?? SCOPE_PRESETS[DEFAULT_REPORT_SCOPE]).interruptOn];
+}
+
+/** Copy policy arrays so a setup amend cannot mutate the config it was seeded from. */
+function cloneReportingPolicy(policy: ReportingPolicy): ReportingPolicy {
+  return {
+    interruptOn: [...policy.interruptOn],
+    digest: { ...policy.digest },
+    ...(policy.availability === undefined
+      ? {}
+      : {
+          availability: {
+            ...policy.availability,
+            days: [...policy.availability.days],
+            bypass: [...policy.availability.bypass],
+          },
+        }),
+    ...(policy.scopePreset === undefined ? {} : { scopePreset: policy.scopePreset }),
+  };
+}
+
+/** Turn the wizard's local notification answers into the runtime policy. */
+function reportingFromAnswers(a: SetupAnswers): ReportingPolicy {
+  if (a.preservedReporting !== undefined) return cloneReportingPolicy(a.preservedReporting);
+
+  const digest = (fallback: DigestCadence): ReportingPolicy["digest"] => {
+    const cadence = a.digestCadence ?? fallback;
+    if (cadence !== "daily") return { cadence };
+    const at = a.dailyDigestAt?.trim();
+    const timezone = a.reportingTimezone?.trim();
+    return {
+      cadence,
+      ...(at === undefined || at.length === 0 ? {} : { at }),
+      ...(timezone === undefined || timezone.length === 0 ? {} : { timezone }),
+    };
+  };
+
+  const timezone = a.reportingTimezone?.trim();
+  if (a.availability !== undefined) {
+    if (timezone === undefined || timezone.length === 0) {
+      throw new Error("operator availability requires an IANA reporting timezone");
+    }
+    return {
+      interruptOn: interruptCategories(a.reportScope),
+      digest: digest("daily"),
+      availability: {
+        timezone,
+        days: [...a.availability.days],
+        start: a.availability.start,
+        end: a.availability.end,
+        bypass: [...a.availability.bypass],
+      },
+    };
+  }
+  if (a.reportScope === "quiet") {
+    return {
+      interruptOn: [...QUIET_INTERRUPT_ON],
+      digest: digest("daily"),
+    };
+  }
+  const preset = SCOPE_PRESETS[a.reportScope] ?? SCOPE_PRESETS[DEFAULT_REPORT_SCOPE];
+  const resolvedDigest = digest(preset.digest.cadence);
+  const presetDigest =
+    resolvedDigest.cadence === preset.digest.cadence &&
+    resolvedDigest.at === preset.digest.at &&
+    resolvedDigest.timezone === preset.digest.timezone;
+  return {
+    interruptOn: [...preset.interruptOn],
+    digest: resolvedDigest,
+    ...(presetDigest ? { scopePreset: preset.scopePreset } : {}),
+  };
+}
+
 /**
  * The single `ProjectConfig` the answers describe.
  *
@@ -545,6 +712,13 @@ export function buildProject(a: SetupAnswers): ProjectConfig {
   if (a.telegramChatId !== undefined && a.telegramChatId.trim().length > 0) {
     escalation.telegramChatId = a.telegramChatId.trim();
   }
+  if (
+    a.telegramTopicId !== undefined &&
+    Number.isFinite(a.telegramTopicId) &&
+    Number.isSafeInteger(a.telegramTopicId)
+  ) {
+    escalation.telegramTopicId = a.telegramTopicId;
+  }
 
   const caps: Partial<Caps> = {};
   // Drops `undefined` members so an unanswered cap is absent from the JSON
@@ -576,28 +750,16 @@ export function buildProject(a: SetupAnswers): ProjectConfig {
     // and a release require without anyone having to know a default (#129).
     policy: clonePolicy(a.policy),
     // Written out even when it is the default, so an operator amending the
-    // volume has a line in the file to point at. A `scope` answer is
-    // materialised as its preset policy (with `scopePreset` set) so the file
-    // and the prompt agree with no migration rule; `quiet` is the explicit
-    // form — a curated interrupt list and a scheduled digest (#229).
-    reporting:
-      a.reportScope === "quiet"
-        ? {
-            interruptOn: ["tier2", "fleet-stopped", "confirmed-failure"],
-            digest: {
-              cadence: "daily",
-              ...(a.quietDigestAt !== undefined && a.quietDigestAt.length > 0 ? { at: a.quietDigestAt } : {}),
-            },
-          }
-        : {
-            interruptOn: [...(SCOPE_PRESETS[a.reportScope] ?? SCOPE_PRESETS[DEFAULT_REPORT_SCOPE]).interruptOn],
-            digest: { ...(SCOPE_PRESETS[a.reportScope] ?? SCOPE_PRESETS[DEFAULT_REPORT_SCOPE]).digest },
-            scopePreset: (SCOPE_PRESETS[a.reportScope] ?? SCOPE_PRESETS[DEFAULT_REPORT_SCOPE]).scopePreset,
-          },
+    // volume has a line in the file to point at. Opting into availability makes
+    // the schedule explicit and daily; omitting it preserves the preset's
+    // legacy 24-hour behaviour (#273).
+    reporting: reportingFromAnswers(a),
     // Both under the state dir so one `rm -rf ~/.omp/conductor` is a complete
     // uninstall, and neither can land in a repo the daemon then tries to commit.
-    workspaceRoot: defaultWorkspaceRoot(),
-    mirrorRoot: defaultMirrorRoot(),
+    // An explicit answer wins (added projects seed under projects/<name>/; amends
+    // carry the path already on disk). Absence keeps the first-project flat layout.
+    workspaceRoot: a.workspaceRoot?.trim() || defaultWorkspaceRoot(),
+    mirrorRoot: a.mirrorRoot?.trim() || defaultMirrorRoot(),
   };
 }
 
@@ -612,6 +774,16 @@ export function buildProject(a: SetupAnswers): ProjectConfig {
 export function buildConfig(a: SetupAnswers, existing?: ConductorConfig): ConductorConfig {
   const project = buildProject(a);
   const previous = existing?.projects ?? [];
+  const collision = previous.find(
+    (p) => p.name !== project.name && p.workspaceRoot === project.workspaceRoot,
+  );
+  if (collision !== undefined) {
+    throw new Error(
+      `workspaceRoot ${project.workspaceRoot} collides between projects ` +
+        `"${collision.name}" and "${project.name}" — two fleet sessions cannot share a cwd ` +
+        `(one tick config would clobber the other). Pick a different workspaceRoot for one of them.`,
+    );
+  }
 
   return {
     version: CONFIG_VERSION,
@@ -636,7 +808,14 @@ export function buildConfig(a: SetupAnswers, existing?: ConductorConfig): Conduc
  * default at each prompt, which is how one prompt comes to disagree with the
  * config key it writes.
  */
-export function defaultAnswers(projectName: string): SetupAnswers {
+export function defaultAnswers(projectName: string, opts: { added?: boolean } = {}): SetupAnswers {
+  // Added projects live under projects/<name>/ so two fleets never share a cwd
+  // with the first project's flat worktrees/mirrors. The first project keeps
+  // those flat paths; buildProject falls back to defaultWorkspaceRoot() when
+  // these are absent.
+  const scopedBase = opts.added === true && projectName.trim().length > 0
+    ? join(stateDir(), "projects", projectName.trim())
+    : undefined;
   return {
     projectName,
     // Empty rather than a plausible guess: both are required, and a pre-filled
@@ -654,6 +833,12 @@ export function defaultAnswers(projectName: string): SetupAnswers {
     orchestratorMode: SETUP_DEFAULTS.orchestratorMode,
     reportScope: SETUP_DEFAULT_REPORT_SCOPE,
     writeOrchestratorBrief: false,
+    ...(scopedBase === undefined
+      ? {}
+      : {
+          workspaceRoot: defaultWorkspaceRoot(scopedBase),
+          mirrorRoot: defaultMirrorRoot(scopedBase),
+        }),
   };
 }
 
@@ -667,19 +852,60 @@ export function defaultAnswers(projectName: string): SetupAnswers {
  * changing an unrelated one. `buildProject(answersFromProject(p))` is pinned to
  * `p` by a test for exactly that reason.
  *
- * Three fields cannot be a straight copy:
+ * Four fields cannot be a straight copy:
  *
  * - `writeOrchestratorBrief` is a decision rather than a value, and it starts
  *   `false` so an amend that never visits the brief area leaves that file alone.
- * - `reportScope` reads through {@link DEFAULT_REPORT_SCOPE}, because the key is
- *   optional on disk. A config written before it existed gains it explicitly on
- *   the next write, saying what it already meant.
+ * - `reportScope` recognizes both preset metadata and the explicit quiet
+ *   category set, because an availability schedule intentionally has no preset.
+ * - The reporting timezone is shared by availability and the daily digest in
+ *   the wizard even though runtime config stores it in both places.
  * - `graphRoot` is one answer for a whole project while the config stores one
  *   path per repo, so it comes back from whichever repo already has one. Repos
  *   that disagree — only a hand-edit can produce that — widen to all of them on
  *   the next write exactly as a full re-run would, and the plan summary names
  *   every clone before anything is written.
  */
+function sameInterruptCategories(
+  actual: readonly InterruptCategory[],
+  expected: readonly InterruptCategory[],
+): boolean {
+  return (
+    actual.length === expected.length &&
+    actual.every((category) => expected.includes(category))
+  );
+}
+
+export function reportScopeFromPolicy(policy: ReportingPolicy | undefined): ReportScopeChoice {
+  if (policy?.scopePreset !== undefined) return policy.scopePreset;
+  const actual = policy?.interruptOn ?? SCOPE_PRESETS[DEFAULT_REPORT_SCOPE].interruptOn;
+  if (sameInterruptCategories(actual, QUIET_INTERRUPT_ON)) return "quiet";
+  for (const scope of ["material", "decisions", "escalations"] as const) {
+    if (sameInterruptCategories(actual, SCOPE_PRESETS[scope].interruptOn)) return scope;
+  }
+  return DEFAULT_REPORT_SCOPE;
+}
+
+function reportScopeDescriptionForPolicy(policy: ReportingPolicy | undefined): string {
+  const scope = reportScopeFromPolicy(policy);
+  const choice = REPORT_SCOPE_CHOICES.find((candidate) => candidate.scope === scope);
+  const expectedCadence =
+    scope === "quiet" ? "daily" : SCOPE_PRESETS[scope].digest.cadence;
+  const configured = policy?.digest ?? SCOPE_PRESETS[DEFAULT_REPORT_SCOPE].digest;
+  if (configured.cadence === expectedCadence) {
+    return choice?.description ?? "unknown scope";
+  }
+  const digest =
+    configured.cadence === "none"
+      ? "disabled"
+      : configured.cadence === "per-tick"
+        ? "every tick"
+        : `daily at ${configured.at ?? "(model-timed)"}${
+            configured.timezone === undefined ? "" : ` ${configured.timezone}`
+          }`;
+  return `${choice?.label ?? scope}; configured digest ${digest}`;
+}
+
 export function answersFromProject(p: ProjectConfig): SetupAnswers {
   const answers: SetupAnswers = {
     projectName: p.name,
@@ -699,16 +925,37 @@ export function answersFromProject(p: ProjectConfig): SetupAnswers {
     releaseGrants: resolveReleaseGrants(p),
     policy: resolvePolicy(p),
     orchestratorMode: p.escalation.orchestrator,
-    reportScope: p.reporting?.scopePreset ?? DEFAULT_REPORT_SCOPE,
+    reportScope: reportScopeFromPolicy(p.reporting),
     writeOrchestratorBrief: false,
   };
+  if (p.reporting !== undefined) {
+    answers.preservedReporting = cloneReportingPolicy(p.reporting);
+    answers.digestCadence = p.reporting.digest.cadence;
+  }
 
   // Set only when present, never as an explicit `undefined`: an absent key is
   // what keeps the rewritten config identical to the one that was read.
   if (p.workerModel !== undefined) answers.workerModel = p.workerModel;
   if (p.escalation.telegramChatId !== undefined) answers.telegramChatId = p.escalation.telegramChatId;
+  if (p.escalation.telegramTopicId !== undefined) answers.telegramTopicId = p.escalation.telegramTopicId;
+  if (p.reporting?.digest.at !== undefined) answers.dailyDigestAt = p.reporting.digest.at;
+  if (p.reporting?.digest.timezone !== undefined) {
+    answers.reportingTimezone = p.reporting.digest.timezone;
+  }
+  if (p.reporting?.availability !== undefined) {
+    answers.reportingTimezone = p.reporting.availability.timezone;
+    answers.availability = {
+      days: [...p.reporting.availability.days],
+      start: p.reporting.availability.start,
+      end: p.reporting.availability.end,
+      bypass: [...p.reporting.availability.bypass],
+    };
+  }
   const graphed = graphRepos(p)[0];
   if (graphed !== undefined) answers.graphRoot = dirname(graphed.graphProject);
+  if (p.workspaceRoot.length > 0) answers.workspaceRoot = p.workspaceRoot;
+  if (p.mirrorRoot.length > 0) answers.mirrorRoot = p.mirrorRoot;
+
 
   return answers;
 }
@@ -736,7 +983,6 @@ function briefVarsForProject(p: ProjectConfig): Record<string, string> {
     QUEUE_LABEL: p.queueLabel,
     RELEASES_DEFAULT: RELEASES_DEFAULTS[`${p.authority.merge}/${p.authority.release}`],
     MERGE_DUTY: MERGE_DUTY[p.authority.merge],
-    REPORT_SCOPE: p.reporting?.scopePreset ?? DEFAULT_REPORT_SCOPE,
     POLICY_SOURCE: policySourceLine(p),
   };
 }
@@ -754,7 +1000,7 @@ function briefVarsForProject(p: ProjectConfig): Record<string, string> {
 function policySourceLine(p: ProjectConfig): string {
   return (
     `They are in \`${configPath()}\` under \`projects[] "${p.name}" policy\`, and they change with ` +
-    `\`/conductor setup\` → "${AMEND_AREAS.policy.name}". Never by hand in this file.`
+    `\`omp-conductor setup policy\` ("${AMEND_AREAS.policy.name}"). Never by hand in this file.`
   );
 }
 
@@ -803,8 +1049,48 @@ export function orchestratorBriefPath(a: SetupAnswers): string {
 }
 
 /** Wizard-time render, via the project the answers describe. */
-export function renderOrchestratorBrief(a: SetupAnswers): string {
-  return renderBriefForProject(buildProject(a));
+export function renderOrchestratorBrief(a: SetupAnswers, prose: ProbedProse = {}): string {
+  // Rendered through the same judgment fill the writer applies, so "what setup
+  // would write" and "what setup writes" cannot diverge — the preview an operator
+  // consents to is the file they get.
+  const project = buildProject(a);
+  return composeOrchestrator(renderFloorForProject(project), renderPolicy(a, prose));
+}
+
+/** `POLICY.md` for these answers: the project's own template plus the interview. */
+export function renderPolicy(a: SetupAnswers, prose: ProbedProse = {}): string {
+  return fillJudgment(renderPolicyForProject(buildProject(a)), a.judgment, prose);
+}
+
+/**
+ * The body of `## Project context`.
+ *
+ * **One writer, not two.** Confirmed prose is the whole section: the probe was
+ * handed the roadmap answer as a stated input and told to carry it as its fourth
+ * item, so synthesising a roadmap line here as well would print the operator's
+ * priority twice — once out of the product/repos/grooming order the section is
+ * written to be read in.
+ *
+ * Without prose — `--no-ai`, a declined preview, an unreachable peer — the roadmap
+ * answer is still the one part of this section the interview *did* collect, so it
+ * is written above a note naming what is left.
+ */
+function contextSection(roadmap: string | undefined, context: string | undefined): string {
+  const written = context?.trim();
+  if (written !== undefined && written.length > 0) {
+    // The heading came from the template; a probe that repeated it would leave two.
+    return written.replace(/^##\s*Project context[^\n]*\n+/, "");
+  }
+
+  const stated = roadmap?.trim();
+  return [
+    ...(stated === undefined || stated.length === 0
+      ? []
+      : [`**Roadmap and current priority.** ${stated}`, "", "Judge grooming priority against that, not against recency.", ""]),
+    "Still to fill in, by hand or by re-running `omp-conductor setup brief`: the",
+    "product in a paragraph, a map of which repo owns what, and the grooming guidance",
+    "Duty 2 needs to spot issues that would collide.",
+  ].join("\n");
 }
 
 /**
@@ -816,17 +1102,109 @@ export function renderOrchestratorBrief(a: SetupAnswers): string {
  * that dialog's answer un-actionable — an operator who says "yes, overwrite it"
  * must get an overwrite.
  */
-export function writeOrchestratorBrief(a: SetupAnswers): string {
+export function writeOrchestratorBrief(a: SetupAnswers, prose: ProbedProse = {}): string {
   const project = buildProject(a);
   const policyPath = policyPathForProject(project);
   const orchestratorPath = briefPathForProject(project);
   mkdirSync(dirname(orchestratorPath), { recursive: true });
-  const policy = renderPolicyForProject(project);
+  const policy = renderPolicy(a, prose);
   writeFileSync(policyPath, policy);
   writeFileSync(orchestratorPath, composeOrchestrator(renderFloorForProject(project), policy));
   return orchestratorPath;
 }
 
+/** The stub `policy.md` ships where the operator's own priority pointer belongs. */
+const CONTEXT_STUB =
+  "Empty until setup fills it in: the product in a paragraph, a map of which repo\n" +
+  "owns what, the grooming guidance Duty 2 needs to judge priority and spot issues\n" +
+  "that would collide, and where the roadmap lives. `omp-conductor setup` asks for\n" +
+  "the last of those and proposes the rest.";
+
+/**
+ * Prose a probe read out of the repos and the **operator confirmed**.
+ *
+ * Separate from {@link SetupAnswers} on purpose: these are paragraphs of the
+ * operator's brief, not configuration. Nothing here is ever written unconfirmed,
+ * and every field is optional — a declined preview, an unreachable peer and
+ * `--no-ai` all arrive here as the same absence.
+ */
+export interface ProbedProse {
+  /** The product, the repo map and the grooming guidance Duty 2 needs. */
+  projectContext?: string;
+  /** This repo's real release machinery, expressing the operator's stated intent. */
+  releaseProcedure?: string;
+}
+
+/**
+ * Writes the interview's answers, and any confirmed probe prose, into the two
+ * `POLICY.md` stubs that were waiting for them.
+ *
+ * Text substitution rather than a template variable, because these are the
+ * *operator's* words in the operator's file: the conductor renders `POLICY.md`
+ * once and never reads it back, so anything here has to land as prose they can
+ * then edit freely.
+ *
+ * Absent answers leave the shipped guidance in place — a stub that still explains
+ * what belongs there is more use than a heading with nothing under it. What no
+ * outcome leaves behind is a pointer at the onboarding skill #309 deleted: the
+ * template no longer carries one, and `setup.test.ts` pins its absence, because a
+ * stub telling an operator to load something that does not ship is exactly the
+ * capability loss #307 and #309 were sequenced to avoid.
+ */
+export function fillJudgment(
+  policy: string,
+  judgment: OperatorJudgment | undefined,
+  prose: ProbedProse = {},
+): string {
+  const j = judgment ?? {};
+  let out = policy;
+
+  const procedure = prose.releaseProcedure?.trim();
+  const releases = [...releaseLines(j), ...(procedure === undefined || procedure.length === 0 ? [] : ["", procedure])];
+  if (releases.length > 0) {
+    // Appended under the four bullets rather than replacing them: the bullets say
+    // what a good answer contains, and keeping them beside the answer is what
+    // makes a later edit self-checking.
+    out = out.replace(
+      "  forbidden everywhere, always.\n",
+      `  forbidden everywhere, always.\n\n${releases.join("\n")}\n`,
+    );
+  }
+
+  out = out.replace(CONTEXT_STUB, contextSection(j.roadmap, prose.projectContext));
+
+  return out;
+}
+
+/** The operator's release intent, as the brief's own bullet shape. */
+function releaseLines(j: OperatorJudgment): string[] {
+  const lines: string[] = [];
+  const add = (label: string, value: string | undefined): void => {
+    if (value !== undefined && value.trim().length > 0) lines.push(`- **${label}** ${value.trim()}`);
+  };
+  add("Your leg ends:", j.boundary);
+  add("What may be released:", j.releaseWhat);
+  add("When:", j.releaseWhen);
+  add("Proof held first:", j.releaseProof);
+  add("Always ask about:", j.releaseAsk);
+  add("Permanently forbidden:", j.releaseForbidden);
+  add("A release worth cutting:", j.worthCutting);
+  add("Rollback owner:", j.rollbackOwner);
+  if (lines.length === 0) return lines;
+  return [
+    "Answered during setup — yours to edit:",
+    "",
+    ...lines,
+    ...(j.rollbackMovesBoundary === true
+      ? [
+          "",
+          "The rollback owner is a person, so the boundary above ends *before* the",
+          "irreversible step: prepare and verify it, then hand it over.",
+        ]
+      : []),
+  ];
+}
+
 /**
  * Recompose `ORCHESTRATOR.md` from the package floor + live `POLICY.md`.
  *
@@ -931,6 +1309,12 @@ function pairedOwner(accessPath: string): string | undefined {
   return undefined;
 }
 
+function describeAvailabilityDays(days: readonly Weekday[]): string {
+  return days.length === WEEKDAYS.length && WEEKDAYS.every((day) => days.includes(day))
+    ? "every day"
+    : days.join(",");
+}
+
 /**
  * Everything that would change, as plain text, with no side effects at all.
  *
@@ -1009,8 +1393,8 @@ export function summarisePlan(
     for (const r of graphed) lines.push(`                 ${r.name}  ${r.graphProject}`);
     lines.push(
       "               conductor's own index-only clones — nothing human edits them, and",
-      "               nothing here creates them. Run `omp-conductor graph-setup` after",
-      "               setup: it prints the clone, index and systemd-timer commands.",
+      "               nothing here creates them. Run `omp-conductor setup graph` after",
+      "               setup: it clones, installs the timer and seeds the first index.",
     );
   }
 
@@ -1025,8 +1409,12 @@ export function summarisePlan(
 
   lines.push("", "escalation");
   if (a.telegramChatId !== undefined && a.telegramChatId.trim().length > 0) {
+    const topic =
+      a.telegramTopicId !== undefined && Number.isSafeInteger(a.telegramTopicId)
+        ? ` topic ${a.telegramTopicId}`
+        : " flat chat";
     lines.push(
-      `  tier 2         Telegram chat ${a.telegramChatId.trim()}` +
+      `  tier 2         Telegram chat ${a.telegramChatId.trim()}${topic}` +
         (tg.hasToken ? "" : "  — WARNING: no bot token found, this will not send"),
       `  via            omp-telegram at ${tg.stateDir}`,
     );
@@ -1083,12 +1471,27 @@ export function summarisePlan(
     `  environments ${a.policy.release.environments.join(", ") || "none declared — every deploy target is refused"}`,
   );
 
-  const chosen = REPORT_SCOPE_CHOICES.find((c) => c.scope === a.reportScope);
+  const reporting = project.reporting as ReportingPolicy;
   const briefPath = orchestratorBriefPath(a);
   lines.push(
     "",
     "reporting",
-    `  scope          ${a.reportScope} — ${chosen?.description ?? "unknown scope"}`,
+    `  scope          ${a.reportScope} — ${reportScopeDescriptionForPolicy(reporting)}`,
+  );
+  if (reporting.availability === undefined) {
+    lines.push("  availability   continuous — interrupt categories may page 24 hours a day");
+  } else {
+    lines.push(
+      `  availability   ${describeAvailabilityDays(reporting.availability.days)} ` +
+        `${reporting.availability.start}-${reporting.availability.end} ${reporting.availability.timezone}`,
+      `  bypass         ${reporting.availability.bypass.join(", ") || "none"}`,
+    );
+  }
+  lines.push(
+    `  digest         ${reporting.digest.cadence}` +
+      (reporting.digest.cadence === "daily"
+        ? ` at ${reporting.digest.at ?? "(model-timed)"}${reporting.digest.timezone ? ` ${reporting.digest.timezone}` : ""}`
+        : ""),
   );
   if (a.writeOrchestratorBrief) {
     const policyPath = briefPath.replace(/ORCHESTRATOR\.md$/, "POLICY.md");
@@ -1133,16 +1536,16 @@ export function formatGates(gates: readonly { cmd: string; cwd: string }[]): str
  * The wizard's questions, grouped as the areas a re-run can amend one of, in the
  * order the full interview asks them.
  *
- * Data rather than a switch so the menu, the exhaustiveness of the dialog table
- * in ./plugin.ts, and the amend summary all enumerate the same nine areas: an
- * added area fails to compile until it has a name, a current value and a set of
- * questions.
+ * Data rather than a switch so the menu, the CLI's positional area vocabulary,
+ * ./setup-wizard.ts's `AREA_ASKERS` table and the amend summary all enumerate the
+ * same nine areas: an added area fails to compile until it has a name, a current
+ * value and a set of questions.
  */
 export const AMEND_AREA_IDS = [
   "tracker",
   "gates",
   "caps",
-  "graph",
+  "code-graph",
   "authority",
   "policy",
   "escalation",
@@ -1209,7 +1612,7 @@ export const AMEND_AREAS: {
       );
     },
   },
-  graph: {
+  "code-graph": {
     name: "code graph",
     asks: "whether workers query a code-graph index, and the root its one-clone-per-repo lives under",
     describe: (p) => {
@@ -1253,12 +1656,14 @@ export const AMEND_AREAS: {
   },
   escalation: {
     name: "escalation & triage",
-    asks: "the tier-2 Telegram chat, whether escalations also comment, and where the orchestrator session lives",
+    asks: "the tier-2 Telegram chat, optional forum topic, whether escalations also comment, and where the orchestrator session lives",
     describe: (p) =>
       [
         p.escalation.telegramChatId === undefined
           ? "tier 2 by issue comment only"
-          : `tier 2 pages Telegram ${p.escalation.telegramChatId}`,
+          : p.escalation.telegramTopicId === undefined
+            ? `tier 2 pages Telegram ${p.escalation.telegramChatId} (flat chat)`
+            : `tier 2 pages Telegram ${p.escalation.telegramChatId} topic ${p.escalation.telegramTopicId}`,
         p.escalation.fallbackToIssueComment ? "comments too" : "no comment fallback",
         `triage ${p.escalation.orchestrator}`,
       ].join(", "),
@@ -1267,9 +1672,8 @@ export const AMEND_AREAS: {
     name: "reporting scope",
     asks: "how much the orchestrator says unprompted",
     describe: (p) => {
-      const scope = p.reporting?.scopePreset ?? DEFAULT_REPORT_SCOPE;
-      const choice = REPORT_SCOPE_CHOICES.find((c) => c.scope === scope);
-      return `${scope} — ${choice?.description ?? "unknown scope"}`;
+      const scope = reportScopeFromPolicy(p.reporting);
+      return `${scope} — ${reportScopeDescriptionForPolicy(p.reporting)}`;
     },
   },
   brief: {