omp-conductor 0.14.0 → 0.15.0

package/src/setup.ts

@@ -1,5 +1,5 @@
 /**
- * The onboarding core behind `/conductor setup`.
+ * The onboarding core behind `omp-conductor setup`.
  *
  * Everything here is headless and synchronously testable: the plugin owns the
  * dialogs, this module owns the decisions. That split is the point — a wizard
@@ -72,6 +72,53 @@ import {
   type ResolvedGrants,
 } from "./types.ts";
 
+/**
+ * What the onboarding skill interviewed for and no probe can supply.
+ *
+ * The skill is explicit that reading a repo answers none of this: "a tracker
+ * shows what is open, never what matters" (`SKILL.md:337-341`), and a release
+ * boundary is a sentence only the operator can say. Every field here fills a
+ * stub the shipped `policy.md` already carries, which is what makes deleting the
+ * skill (#309) a move rather than a loss.
+ *
+ * Every field is optional because the object is what has been *collected so
+ * far*: an amend that never reaches these prompts carries none of them, and
+ * `judgment` itself is absent on a project re-read from disk, since none of this
+ * lives in `config.json`.
+ *
+ * `boundary` and everything under it is asked only when the orchestrator holds
+ * some release shape: a humans-release fleet has no boundary to draw, and asking
+ * for one would invite a procedure the config does not grant.
+ */
+export interface OperatorJudgment {
+  /** Where the roadmap lives and what is being shipped now. Always *asked*;
+   *  absent means the interview has not reached it (or the operator left it blank). */
+  roadmap?: string;
+  /** Where the orchestrator's leg ends, in one sentence. */
+  boundary?: string;
+  /** What may be released, and from which branch. */
+  releaseWhat?: string;
+  /** Batched how, after which *named* checks are green. */
+  releaseWhen?: string;
+  /** The proof that must be held first — results read, not an impression. */
+  releaseProof?: string;
+  /** What must still be asked, every time. */
+  releaseAsk?: string;
+  /** What stays permanently forbidden. */
+  releaseForbidden?: string;
+  /** The batching unit in the operator's own vocabulary. */
+  worthCutting?: string;
+  /** Who owns the rollback. A named person moves the boundary earlier. */
+  rollbackOwner?: string;
+  /**
+   * Whether the operator accepted the boundary-moves-earlier consequence of
+   * naming a person as the rollback owner. Recorded rather than enforced: the
+   * wizard states the consequence and offers to move the boundary, and an
+   * operator who declines has made a choice, not a mistake.
+   */
+  rollbackMovesBoundary?: boolean;
+}
+
 /**
  * Every decision the wizard needs, in one plain object. Collected by the UI,
  * consumed by `buildConfig`, so the prompt order can change without touching
@@ -93,6 +140,8 @@ export interface SetupAnswers {
    */
   workerModel?: string;
   telegramChatId?: string;
+  /** Forum topic for tier-2 Telegram pages; absent keeps flat-chat 0.13 behaviour. */
+  telegramTopicId?: number;
   fallbackToIssueComment: boolean;
   /** How loud the supervising orchestrator session should be. */
   reportScope: ReportScopeChoice;
@@ -128,6 +177,17 @@ export interface SetupAnswers {
    * prompt that asked it to the step that acts on it.
    */
   writeOrchestratorBrief: boolean;
+  /**
+   * The operator's own judgment, asked in the interview because no amount of
+   * repo reading produces it — and because `src/briefs/policy.md` ships stubs
+   * waiting for exactly these words (`:25-28`, `:53-56`).
+   *
+   * Not config: none of it is a key the daemon reads. It exists to reach
+   * `POLICY.md` — written directly, and offered to a prose probe as stated input
+   * the probe may not invent. It rides on the answers object because the wizard
+   * has to carry it from the prompt that asked it to the step that writes it.
+   */
+  judgment?: OperatorJudgment;
   /**
    * Who lands green PRs and who cuts releases. Both default to the human — see
    * {@link DEFAULT_AUTHORITY} — and the answer is what the rendered brief's
@@ -153,6 +213,16 @@ export interface SetupAnswers {
    * the same question four times to arrive at four siblings.
    */
   graphRoot?: string;
+  /**
+   * Where this project's worktrees live. Absent means {@link defaultWorkspaceRoot}
+   * under the state dir (the first-project layout). An added project seeds
+   * `~/.omp/conductor/projects/<name>/worktrees` instead; an amend carries the
+   * path already on disk so a re-run never migrates a neighbour.
+   */
+  workspaceRoot?: string;
+  /** Bare mirrors for this project; same seeding rules as {@link workspaceRoot}. */
+  mirrorRoot?: string;
+
 }
 
 /** What `gh auth status` says the active token may do. */
@@ -642,6 +712,13 @@ export function buildProject(a: SetupAnswers): ProjectConfig {
   if (a.telegramChatId !== undefined && a.telegramChatId.trim().length > 0) {
     escalation.telegramChatId = a.telegramChatId.trim();
   }
+  if (
+    a.telegramTopicId !== undefined &&
+    Number.isFinite(a.telegramTopicId) &&
+    Number.isSafeInteger(a.telegramTopicId)
+  ) {
+    escalation.telegramTopicId = a.telegramTopicId;
+  }
 
   const caps: Partial<Caps> = {};
   // Drops `undefined` members so an unanswered cap is absent from the JSON
@@ -679,8 +756,10 @@ export function buildProject(a: SetupAnswers): ProjectConfig {
     reporting: reportingFromAnswers(a),
     // Both under the state dir so one `rm -rf ~/.omp/conductor` is a complete
     // uninstall, and neither can land in a repo the daemon then tries to commit.
-    workspaceRoot: defaultWorkspaceRoot(),
-    mirrorRoot: defaultMirrorRoot(),
+    // An explicit answer wins (added projects seed under projects/<name>/; amends
+    // carry the path already on disk). Absence keeps the first-project flat layout.
+    workspaceRoot: a.workspaceRoot?.trim() || defaultWorkspaceRoot(),
+    mirrorRoot: a.mirrorRoot?.trim() || defaultMirrorRoot(),
   };
 }
 
@@ -695,6 +774,16 @@ export function buildProject(a: SetupAnswers): ProjectConfig {
 export function buildConfig(a: SetupAnswers, existing?: ConductorConfig): ConductorConfig {
   const project = buildProject(a);
   const previous = existing?.projects ?? [];
+  const collision = previous.find(
+    (p) => p.name !== project.name && p.workspaceRoot === project.workspaceRoot,
+  );
+  if (collision !== undefined) {
+    throw new Error(
+      `workspaceRoot ${project.workspaceRoot} collides between projects ` +
+        `"${collision.name}" and "${project.name}" — two fleet sessions cannot share a cwd ` +
+        `(one tick config would clobber the other). Pick a different workspaceRoot for one of them.`,
+    );
+  }
 
   return {
     version: CONFIG_VERSION,
@@ -719,7 +808,14 @@ export function buildConfig(a: SetupAnswers, existing?: ConductorConfig): Conduc
  * default at each prompt, which is how one prompt comes to disagree with the
  * config key it writes.
  */
-export function defaultAnswers(projectName: string): SetupAnswers {
+export function defaultAnswers(projectName: string, opts: { added?: boolean } = {}): SetupAnswers {
+  // Added projects live under projects/<name>/ so two fleets never share a cwd
+  // with the first project's flat worktrees/mirrors. The first project keeps
+  // those flat paths; buildProject falls back to defaultWorkspaceRoot() when
+  // these are absent.
+  const scopedBase = opts.added === true && projectName.trim().length > 0
+    ? join(stateDir(), "projects", projectName.trim())
+    : undefined;
   return {
     projectName,
     // Empty rather than a plausible guess: both are required, and a pre-filled
@@ -737,6 +833,12 @@ export function defaultAnswers(projectName: string): SetupAnswers {
     orchestratorMode: SETUP_DEFAULTS.orchestratorMode,
     reportScope: SETUP_DEFAULT_REPORT_SCOPE,
     writeOrchestratorBrief: false,
+    ...(scopedBase === undefined
+      ? {}
+      : {
+          workspaceRoot: defaultWorkspaceRoot(scopedBase),
+          mirrorRoot: defaultMirrorRoot(scopedBase),
+        }),
   };
 }
 
@@ -835,6 +937,7 @@ export function answersFromProject(p: ProjectConfig): SetupAnswers {
   // what keeps the rewritten config identical to the one that was read.
   if (p.workerModel !== undefined) answers.workerModel = p.workerModel;
   if (p.escalation.telegramChatId !== undefined) answers.telegramChatId = p.escalation.telegramChatId;
+  if (p.escalation.telegramTopicId !== undefined) answers.telegramTopicId = p.escalation.telegramTopicId;
   if (p.reporting?.digest.at !== undefined) answers.dailyDigestAt = p.reporting.digest.at;
   if (p.reporting?.digest.timezone !== undefined) {
     answers.reportingTimezone = p.reporting.digest.timezone;
@@ -850,6 +953,9 @@ export function answersFromProject(p: ProjectConfig): SetupAnswers {
   }
   const graphed = graphRepos(p)[0];
   if (graphed !== undefined) answers.graphRoot = dirname(graphed.graphProject);
+  if (p.workspaceRoot.length > 0) answers.workspaceRoot = p.workspaceRoot;
+  if (p.mirrorRoot.length > 0) answers.mirrorRoot = p.mirrorRoot;
+
 
   return answers;
 }
@@ -894,7 +1000,7 @@ function briefVarsForProject(p: ProjectConfig): Record<string, string> {
 function policySourceLine(p: ProjectConfig): string {
   return (
     `They are in \`${configPath()}\` under \`projects[] "${p.name}" policy\`, and they change with ` +
-    `\`/conductor setup\` → "${AMEND_AREAS.policy.name}". Never by hand in this file.`
+    `\`omp-conductor setup policy\` ("${AMEND_AREAS.policy.name}"). Never by hand in this file.`
   );
 }
 
@@ -943,8 +1049,48 @@ export function orchestratorBriefPath(a: SetupAnswers): string {
 }
 
 /** Wizard-time render, via the project the answers describe. */
-export function renderOrchestratorBrief(a: SetupAnswers): string {
-  return renderBriefForProject(buildProject(a));
+export function renderOrchestratorBrief(a: SetupAnswers, prose: ProbedProse = {}): string {
+  // Rendered through the same judgment fill the writer applies, so "what setup
+  // would write" and "what setup writes" cannot diverge — the preview an operator
+  // consents to is the file they get.
+  const project = buildProject(a);
+  return composeOrchestrator(renderFloorForProject(project), renderPolicy(a, prose));
+}
+
+/** `POLICY.md` for these answers: the project's own template plus the interview. */
+export function renderPolicy(a: SetupAnswers, prose: ProbedProse = {}): string {
+  return fillJudgment(renderPolicyForProject(buildProject(a)), a.judgment, prose);
+}
+
+/**
+ * The body of `## Project context`.
+ *
+ * **One writer, not two.** Confirmed prose is the whole section: the probe was
+ * handed the roadmap answer as a stated input and told to carry it as its fourth
+ * item, so synthesising a roadmap line here as well would print the operator's
+ * priority twice — once out of the product/repos/grooming order the section is
+ * written to be read in.
+ *
+ * Without prose — `--no-ai`, a declined preview, an unreachable peer — the roadmap
+ * answer is still the one part of this section the interview *did* collect, so it
+ * is written above a note naming what is left.
+ */
+function contextSection(roadmap: string | undefined, context: string | undefined): string {
+  const written = context?.trim();
+  if (written !== undefined && written.length > 0) {
+    // The heading came from the template; a probe that repeated it would leave two.
+    return written.replace(/^##\s*Project context[^\n]*\n+/, "");
+  }
+
+  const stated = roadmap?.trim();
+  return [
+    ...(stated === undefined || stated.length === 0
+      ? []
+      : [`**Roadmap and current priority.** ${stated}`, "", "Judge grooming priority against that, not against recency.", ""]),
+    "Still to fill in, by hand or by re-running `omp-conductor setup brief`: the",
+    "product in a paragraph, a map of which repo owns what, and the grooming guidance",
+    "Duty 2 needs to spot issues that would collide.",
+  ].join("\n");
 }
 
 /**
@@ -956,17 +1102,109 @@ export function renderOrchestratorBrief(a: SetupAnswers): string {
  * that dialog's answer un-actionable — an operator who says "yes, overwrite it"
  * must get an overwrite.
  */
-export function writeOrchestratorBrief(a: SetupAnswers): string {
+export function writeOrchestratorBrief(a: SetupAnswers, prose: ProbedProse = {}): string {
   const project = buildProject(a);
   const policyPath = policyPathForProject(project);
   const orchestratorPath = briefPathForProject(project);
   mkdirSync(dirname(orchestratorPath), { recursive: true });
-  const policy = renderPolicyForProject(project);
+  const policy = renderPolicy(a, prose);
   writeFileSync(policyPath, policy);
   writeFileSync(orchestratorPath, composeOrchestrator(renderFloorForProject(project), policy));
   return orchestratorPath;
 }
 
+/** The stub `policy.md` ships where the operator's own priority pointer belongs. */
+const CONTEXT_STUB =
+  "Empty until setup fills it in: the product in a paragraph, a map of which repo\n" +
+  "owns what, the grooming guidance Duty 2 needs to judge priority and spot issues\n" +
+  "that would collide, and where the roadmap lives. `omp-conductor setup` asks for\n" +
+  "the last of those and proposes the rest.";
+
+/**
+ * Prose a probe read out of the repos and the **operator confirmed**.
+ *
+ * Separate from {@link SetupAnswers} on purpose: these are paragraphs of the
+ * operator's brief, not configuration. Nothing here is ever written unconfirmed,
+ * and every field is optional — a declined preview, an unreachable peer and
+ * `--no-ai` all arrive here as the same absence.
+ */
+export interface ProbedProse {
+  /** The product, the repo map and the grooming guidance Duty 2 needs. */
+  projectContext?: string;
+  /** This repo's real release machinery, expressing the operator's stated intent. */
+  releaseProcedure?: string;
+}
+
+/**
+ * Writes the interview's answers, and any confirmed probe prose, into the two
+ * `POLICY.md` stubs that were waiting for them.
+ *
+ * Text substitution rather than a template variable, because these are the
+ * *operator's* words in the operator's file: the conductor renders `POLICY.md`
+ * once and never reads it back, so anything here has to land as prose they can
+ * then edit freely.
+ *
+ * Absent answers leave the shipped guidance in place — a stub that still explains
+ * what belongs there is more use than a heading with nothing under it. What no
+ * outcome leaves behind is a pointer at the onboarding skill #309 deleted: the
+ * template no longer carries one, and `setup.test.ts` pins its absence, because a
+ * stub telling an operator to load something that does not ship is exactly the
+ * capability loss #307 and #309 were sequenced to avoid.
+ */
+export function fillJudgment(
+  policy: string,
+  judgment: OperatorJudgment | undefined,
+  prose: ProbedProse = {},
+): string {
+  const j = judgment ?? {};
+  let out = policy;
+
+  const procedure = prose.releaseProcedure?.trim();
+  const releases = [...releaseLines(j), ...(procedure === undefined || procedure.length === 0 ? [] : ["", procedure])];
+  if (releases.length > 0) {
+    // Appended under the four bullets rather than replacing them: the bullets say
+    // what a good answer contains, and keeping them beside the answer is what
+    // makes a later edit self-checking.
+    out = out.replace(
+      "  forbidden everywhere, always.\n",
+      `  forbidden everywhere, always.\n\n${releases.join("\n")}\n`,
+    );
+  }
+
+  out = out.replace(CONTEXT_STUB, contextSection(j.roadmap, prose.projectContext));
+
+  return out;
+}
+
+/** The operator's release intent, as the brief's own bullet shape. */
+function releaseLines(j: OperatorJudgment): string[] {
+  const lines: string[] = [];
+  const add = (label: string, value: string | undefined): void => {
+    if (value !== undefined && value.trim().length > 0) lines.push(`- **${label}** ${value.trim()}`);
+  };
+  add("Your leg ends:", j.boundary);
+  add("What may be released:", j.releaseWhat);
+  add("When:", j.releaseWhen);
+  add("Proof held first:", j.releaseProof);
+  add("Always ask about:", j.releaseAsk);
+  add("Permanently forbidden:", j.releaseForbidden);
+  add("A release worth cutting:", j.worthCutting);
+  add("Rollback owner:", j.rollbackOwner);
+  if (lines.length === 0) return lines;
+  return [
+    "Answered during setup — yours to edit:",
+    "",
+    ...lines,
+    ...(j.rollbackMovesBoundary === true
+      ? [
+          "",
+          "The rollback owner is a person, so the boundary above ends *before* the",
+          "irreversible step: prepare and verify it, then hand it over.",
+        ]
+      : []),
+  ];
+}
+
 /**
  * Recompose `ORCHESTRATOR.md` from the package floor + live `POLICY.md`.
  *
@@ -1155,8 +1393,8 @@ export function summarisePlan(
     for (const r of graphed) lines.push(`                 ${r.name}  ${r.graphProject}`);
     lines.push(
       "               conductor's own index-only clones — nothing human edits them, and",
-      "               nothing here creates them. Run `omp-conductor graph-setup` after",
-      "               setup: it prints the clone, index and systemd-timer commands.",
+      "               nothing here creates them. Run `omp-conductor setup graph` after",
+      "               setup: it clones, installs the timer and seeds the first index.",
     );
   }
 
@@ -1171,8 +1409,12 @@ export function summarisePlan(
 
   lines.push("", "escalation");
   if (a.telegramChatId !== undefined && a.telegramChatId.trim().length > 0) {
+    const topic =
+      a.telegramTopicId !== undefined && Number.isSafeInteger(a.telegramTopicId)
+        ? ` topic ${a.telegramTopicId}`
+        : " flat chat";
     lines.push(
-      `  tier 2         Telegram chat ${a.telegramChatId.trim()}` +
+      `  tier 2         Telegram chat ${a.telegramChatId.trim()}${topic}` +
         (tg.hasToken ? "" : "  — WARNING: no bot token found, this will not send"),
       `  via            omp-telegram at ${tg.stateDir}`,
     );
@@ -1294,16 +1536,16 @@ export function formatGates(gates: readonly { cmd: string; cwd: string }[]): str
  * The wizard's questions, grouped as the areas a re-run can amend one of, in the
  * order the full interview asks them.
  *
- * Data rather than a switch so the menu, the exhaustiveness of the dialog table
- * in ./plugin.ts, and the amend summary all enumerate the same nine areas: an
- * added area fails to compile until it has a name, a current value and a set of
- * questions.
+ * Data rather than a switch so the menu, the CLI's positional area vocabulary,
+ * ./setup-wizard.ts's `AREA_ASKERS` table and the amend summary all enumerate the
+ * same nine areas: an added area fails to compile until it has a name, a current
+ * value and a set of questions.
  */
 export const AMEND_AREA_IDS = [
   "tracker",
   "gates",
   "caps",
-  "graph",
+  "code-graph",
   "authority",
   "policy",
   "escalation",
@@ -1370,7 +1612,7 @@ export const AMEND_AREAS: {
       );
     },
   },
-  graph: {
+  "code-graph": {
     name: "code graph",
     asks: "whether workers query a code-graph index, and the root its one-clone-per-repo lives under",
     describe: (p) => {
@@ -1414,12 +1656,14 @@ export const AMEND_AREAS: {
   },
   escalation: {
     name: "escalation & triage",
-    asks: "the tier-2 Telegram chat, whether escalations also comment, and where the orchestrator session lives",
+    asks: "the tier-2 Telegram chat, optional forum topic, whether escalations also comment, and where the orchestrator session lives",
     describe: (p) =>
       [
         p.escalation.telegramChatId === undefined
           ? "tier 2 by issue comment only"
-          : `tier 2 pages Telegram ${p.escalation.telegramChatId}`,
+          : p.escalation.telegramTopicId === undefined
+            ? `tier 2 pages Telegram ${p.escalation.telegramChatId} (flat chat)`
+            : `tier 2 pages Telegram ${p.escalation.telegramChatId} topic ${p.escalation.telegramTopicId}`,
         p.escalation.fallbackToIssueComment ? "comments too" : "no comment fallback",
         `triage ${p.escalation.orchestrator}`,
       ].join(", "),

package/src/types.ts

@@ -112,7 +112,7 @@ export interface RepoTarget {
    *   So this names a disposable clone nothing human ever edits, which is what
    *   makes the reset both safe and deterministic.
    *
-   * `omp-conductor graph-setup` prints how to create and refresh it. Nothing in
+   * `omp-conductor setup graph` creates and refreshes it. Nothing in
    * this package reads an index itself: the daemon only passes this path into
    * the worker brief.
    */
@@ -594,7 +594,7 @@ export interface ProjectConfig {
    * How a stuck run reaches a human, what to do when it cannot, and who runs
    * the session that triages it. See {@link ORCHESTRATOR_MODES}.
    */
-  escalation: { telegramChatId?: string; fallbackToIssueComment: boolean; orchestrator: OrchestratorMode };
+  escalation: { telegramChatId?: string; telegramTopicId?: number; fallbackToIssueComment: boolean; orchestrator: OrchestratorMode };
   /**
    * Who lands green PRs and who cuts releases. The daemon never acts on this
    * itself — it words the orchestrator's standing orders and the rendered brief

package/src/upgrade.ts

@@ -2,7 +2,15 @@ import { existsSync, readFileSync } from "node:fs";
 import { backupTimestamp, copyToUniqueBackup } from "./backups.ts";
 import { inspectBriefLayout, type BriefLayout } from "./brief-upgrade.ts";
 import { setPaused, statusSnapshot } from "./daemon.ts";
-import { fleetLayers, telegramStateDir, type DispatchLayer, type FleetLayers } from "./fleet.ts";
+import {
+  DEFAULT_HERDR_SESSION,
+  fleetLayers,
+  LEGACY_HERDR_SESSION_HINT,
+  resolveHerdrSession,
+  telegramStateDir,
+  type DispatchLayer,
+  type FleetLayers,
+} from "./fleet.ts";
 import { livingDaemon, restartDaemon } from "./lifecycle.ts";
 import { configBackupDir, configPath, findProject, loadConfig, resolveCaps, writeConfigRaw } from "./config.ts";
 import { renderBriefForProject } from "./setup.ts";
@@ -45,7 +53,7 @@ export interface UpgradeDeps {
   layers(project?: string): FleetLayers;
   brief(project?: string): { kind: BriefLayout["kind"]; current: boolean };
   daemonIdentity(): { running: boolean; project?: string };
-  setPaused(value: boolean): void;
+  setPaused(value: boolean, project?: string): void;
   restartDaemon(): Promise<void>;
   sleep(ms: number): Promise<void>;
   env: NodeJS.ProcessEnv;
@@ -85,7 +93,8 @@ export const DEFAULT_DEPS: UpgradeDeps = {
     const daemon = livingDaemon();
     return daemon === undefined ? { running: false } : { running: true, project: daemon.project };
   },
-  setPaused: (v) => setPaused(v, { source: "upgrade", reason: "upgrade, draining" }),
+  setPaused: (v, project) =>
+    setPaused(v, { source: "upgrade", reason: "upgrade, draining" }, project),
   restartDaemon: async () => {
     await restartDaemon({});
   },
@@ -170,7 +179,32 @@ interface InstalledSurfaces {
 }
 
 async function inspectSurfaces(deps: UpgradeDeps): Promise<InstalledSurfaces> {
-  const session = deps.env["HERDR_SESSION"] || "fleet";
+  // HERDR_SESSION is authoritative. Otherwise prefer DEFAULT_HERDR_SESSION, with
+  // #320's one-release bridge to a populated legacy "fleet" session.
+  let session = resolveHerdrSession(deps.env);
+  if (deps.env["HERDR_SESSION"] === undefined || deps.env["HERDR_SESSION"] === "") {
+    // Prefer a session that answers plugin list; fall back to conductor.
+    let conductorOk = false;
+    let fleetOk = false;
+    try {
+      const r = await deps.run("herdr", ["--session", DEFAULT_HERDR_SESSION, "plugin", "list"]);
+      conductorOk = r.code === 0;
+    } catch {
+      conductorOk = false;
+    }
+    try {
+      const r = await deps.run("herdr", ["--session", "fleet", "plugin", "list"]);
+      fleetOk = r.code === 0;
+    } catch {
+      fleetOk = false;
+    }
+    if (!conductorOk && fleetOk) {
+      session = "fleet";
+      deps.log(LEGACY_HERDR_SESSION_HINT);
+    } else {
+      session = DEFAULT_HERDR_SESSION;
+    }
+  }
   const [cli, omp, herdr] = await Promise.all([
     mustRun(deps, "omp-conductor", ["--version"]),
     mustRun(deps, "omp", ["plugin", "list", "--json"]),
@@ -245,10 +279,10 @@ export async function drainAndRestart(
   o: { project?: string; timeoutMs: number },
 ): Promise<void> {
   const initial = deps.layers(o.project);
-  if (!initial.paused) deps.setPaused(true);
+  if (!initial.paused) deps.setPaused(true, o.project);
   await waitForDrain(deps, o.project, Date.now() + o.timeoutMs);
   await deps.restartDaemon();
-  if (!initial.paused) deps.setPaused(false);
+  if (!initial.paused) deps.setPaused(false, o.project);
 }
 
 function recoveryProblem(
@@ -534,7 +568,7 @@ export async function upgradeConductor(
   deps.log(`target release: omp-conductor@${release.version} (${release.gitHead})`);
   if (!initial.paused) {
     deps.log("safety: pausing new issue claims");
-    deps.setPaused(true);
+    deps.setPaused(true, project);
   }
   deps.log("drain: waiting for live omp worker sessions");
   try {
@@ -606,7 +640,7 @@ export async function upgradeConductor(
     await deps.sleep(1_000);
     await waitForRecovery(deps, initial, project);
 
-    if (!initial.paused) deps.setPaused(false);
+    if (!initial.paused) deps.setPaused(false, project);
     const restoredDispatch = deps.layers(project).dispatch;
     if (restoredDispatch !== initial.dispatch) {
       throw new Error(
@@ -615,9 +649,9 @@ export async function upgradeConductor(
     }
   } catch (err) {
     try {
-      if (!deps.layers(project).paused) deps.setPaused(true);
+      if (!deps.layers(project).paused) deps.setPaused(true, project);
     } catch {
-      deps.setPaused(true);
+      deps.setPaused(true, project);
     }
     const failure = err instanceof Error ? err.message : String(err);
     deps.log(`upgrade failed: ${failure}`);

package/src/verbs/server.ts

@@ -43,7 +43,7 @@ import { createServer, type Server, type Socket } from "node:net";
 
 import { resolvePolicy, resolveReleaseGrants } from "../config.ts";
 import { chainEntriesFromDiff, chainViolations } from "../chain-check.ts";
-import type { readBaseChain as readBaseChainType } from "../gitops.ts";
+import { repoSlugFor, type readBaseChain as readBaseChainType } from "../gitops.ts";
 import { releaseRefusal } from "../release-policy.ts";
 import { LIVE_STATES } from "../store.ts";
 import type {
@@ -61,6 +61,7 @@ import type {
   VerbName,
   VerbRefusal,
 } from "../types.ts";
+import { prUrlParts } from "../tracker/github.ts";
 import { parseVerbRequest, roleRefusal, VERB_SPECS, type VerbReply } from "./protocol.ts";
 import {
   peerVerdict,
@@ -637,6 +638,20 @@ function runForPr(deps: VerbDeps, project: string, prUrl: string): RunRecord | u
     .find((candidate) => candidate.prUrl === prUrl);
 }
 
+/**
+ * Whether a PR URL names a repository this project routes.
+ *
+ * Orchestrator status / update-branch may act on open project PRs that no run
+ * opened (workflow-generated release pins, etc.). Scope is the routed clone
+ * slugs — not "any PR a run once recorded".
+ */
+function prInProjectRouting(project: ProjectConfig, prUrl: string): boolean {
+  const parts = prUrlParts(prUrl);
+  if (parts === undefined) return false;
+  const slug = `${parts.owner}/${parts.repo}`;
+  return Object.values(project.routing.repos).some((repo) => repoSlugFor(repo) === slug);
+}
+
 /** Refuse an orchestrator completion mutation that cannot prove a pre-pause run. */
 function orchestratorPauseRefusal(
   deps: VerbDeps,
@@ -688,8 +703,12 @@ async function prUpdateBranchVerb(
     target = own;
   } else {
     target = runForPr(deps, project.name, prUrl);
-    if (target === undefined) {
-      return refuse("pr-not-this-run", `refused: ${prUrl} is not a pull request any run in ${project.name} opened.`);
+    if (target === undefined && !prInProjectRouting(project, prUrl)) {
+      return refuse(
+        "pr-not-this-run",
+        `refused: ${prUrl} is not a pull request in ${project.name}'s routed repositories ` +
+          `(${Object.values(project.routing.repos).map(repoSlugFor).join(", ") || "none"}).`,
+      );
     }
   }
 
@@ -709,15 +728,15 @@ async function prUpdateBranchVerb(
       state === undefined
         ? `refused: the tracker could not say whether ${prUrl} is open. Refusing rather than acting on an unknown state.`
         : `refused: ${prUrl} is ${state}, not open.`,
-      target.issue,
+      target?.issue,
     );
   }
 
   const outcome = await deps.actions.updatePrBranch(prUrl);
   if (!outcome.ok) {
-    return refuse("action-failed", `refused: gh could not update the branch:\n${outcome.stderr}`, target.issue);
+    return refuse("action-failed", `refused: gh could not update the branch:\n${outcome.stderr}`, target?.issue);
   }
-  return allow(`updated ${prUrl} with its base branch. Re-check its checks before merging.`, outcome.sha, target.issue);
+  return allow(`updated ${prUrl} with its base branch. Re-check its checks before merging.`, outcome.sha, target?.issue);
 }
 
 async function prMergeVerb(
@@ -1061,11 +1080,15 @@ async function prStatusVerb(
       return refuse("malformed-argument", "refused: conductor_pr_status needs prUrl when it has no run to infer one from.");
     }
     const target = runForPr(deps, project.name, asked);
-    if (target === undefined) {
-      return refuse("pr-not-this-run", `refused: ${asked} is not a pull request any run in ${project.name} opened.`);
+    if (target === undefined && !prInProjectRouting(project, asked)) {
+      return refuse(
+        "pr-not-this-run",
+        `refused: ${asked} is not a pull request in ${project.name}'s routed repositories ` +
+          `(${Object.values(project.routing.repos).map(repoSlugFor).join(", ") || "none"}).`,
+      );
     }
     prUrl = asked;
-    issue = target.issue;
+    issue = target?.issue;
   }
 
   const askedHead = args["headSha"];