omp-conductor 0.15.10 → 0.15.12

package/src/privileged.ts

@@ -90,6 +90,14 @@ export interface RunPrivilegedOptions {
   title?: string;
   /** Extra lines shown above the step list — what this batch is for. */
   preamble?: readonly string[];
+  /**
+   * Runs after the confirm and the sudo priming, immediately before the first
+   * step. A caller that must do something between consent and execution — the
+   * pause/drain of a draining restart — does it here, under the same confirm,
+   * so the operator authorises the whole batch at once. A throw propagates to
+   * the caller with nothing restarted.
+   */
+  beforeRun?: () => Promise<void>;
 }
 
 /**
@@ -211,6 +219,8 @@ export async function runPrivileged(
     }
   }
 
+  await options.beforeRun?.();
+
   const softFailures: { step: PrivilegedStep; stderr: string }[] = [];
   for (const [index, step] of steps.entries()) {
     ui.notify(`[${index + 1}/${steps.length}] ${step.title}`, "info");

package/src/release-policy.ts

@@ -39,13 +39,26 @@ export const RELEASE_POLICY_AUDIT_FILE = "release-policy-blocks.jsonl";
 export interface ReleaseBlockContext {
   tool: string;
   reason: string;
+  /**
+   * What the shape matcher fired on: the offending command segment for a shell
+   * call, the deciding token for a tool name. Present on every record written
+   * from #491 on, so a fixture hit is visible as one; absent only on older
+   * lines, which the digest still renders.
+   */
+  matched?: string;
+  /**
+   * The blocked shell command itself, with anything credential-shaped redacted
+   * and the whole string bounded. Only a `bash` call sets it — every other
+   * tool's redacted {@link args} already name the invocation.
+   */
+  invocation?: string;
   args: Record<string, string>;
 }
 
 export interface ReleaseBlock extends Partial<ReleaseBlockContext> {
   project: string;
   source: "worker" | "orchestrator";
-  shape: ReleaseShape;
+  shape: GateShape;
   at: string;
   issue?: number;
   runId?: string;
@@ -53,12 +66,108 @@ export interface ReleaseBlock extends Partial<ReleaseBlockContext> {
 
 export type ReleaseDecision = { block: true; reason: string };
 
+/**
+ * The shared-host heavy-gate shape (#428): whole-package test runs and the
+ * shell suites a worker must be *unable* to run on the operator's shared host,
+ * rather than merely told not to.
+ *
+ * Deliberately **not** a {@link ReleaseShape}: no grant covers it. An operator
+ * is never refused — the operator owns the host, and CI owns the full suite —
+ * and a worker is always, whatever the config says. So it stays out of the
+ * configurable grant vocabulary (`releaseShapeEnum` is drawn straight from
+ * {@link RELEASE_SHAPES}); it only rides the release-policy classifier and the
+ * block ledger so one seam sees it and its refusals land where the next tick
+ * already reads drift.
+ */
+export const SHARED_HOST_SHAPE = "shared-host-gate" as const;
+export type SharedHostShape = typeof SHARED_HOST_SHAPE;
+
+/** Every shape the classifier reports, grantable or not. */
+export type GateShape = ReleaseShape | SharedHostShape;
+
 const GIT_PUSH_TAG_SHAPE =
   /(?:--tags\b|--follow-tags\b|refs\/tags\/|(?:^|\s)(?:tag\s+)?v\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?(?=[:\s]|$))/;
 
+/** The separators the original quote-blind splitter divides a command on. Kept
+ *  for the unterminated-quote fallback, which must reproduce today's behaviour
+ *  rather than silently pass a command through. */
+const COMMAND_SEPARATORS = /(?:&&|\|\||[;\n|])/;
+
+/**
+ * Split a shell command on its operators, ignoring ones inside single or
+ * double quotes. The old splitter was quote-blind, so a `|` inside a quoted
+ * argument (a grep alternation's `\|`, a `--jq` filter, a heredoc) shredded
+ * the command into phantom segments and a gated verb inside a string literal
+ * was refused as a release attempt (#526). A small scanner is enough: no shell
+ * parser, no dependency. An unterminated quote falls back to the original
+ * quote-blind split, because a gated command must not slip through merely
+ * because a quote never closed.
+ */
+function splitCommandSegments(command: string): string[] {
+  const segments: string[] = [];
+  let current = "";
+  let quote: "'" | '"' | null = null;
+
+  const push = () => {
+    segments.push(current);
+    current = "";
+  };
+
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i];
+
+    // Inside a quote only its closing quote matters — separators are data. A
+    // `\"` inside double quotes is a literal quote and must not close it.
+    if (quote !== null) {
+      current += ch;
+      if (ch === "\\" && quote === '"') {
+        if (i + 1 < command.length) current += command[++i];
+        continue;
+      }
+      if (ch === quote) quote = null;
+      continue;
+    }
+
+    // Outside quotes a backslash escapes the next character, so a literal
+    // `\|`, `\;` or `\"` is data, never an operator or the start of a quote.
+    if (ch === "\\") {
+      current += ch;
+      if (i + 1 < command.length) current += command[++i];
+      continue;
+    }
+
+    if (ch === "'") {
+      quote = "'";
+      current += ch;
+      continue;
+    }
+    if (ch === '"') {
+      quote = '"';
+      current += ch;
+      continue;
+    }
+
+    if ((ch === "&" && command[i + 1] === "&") || (ch === "|" && command[i + 1] === "|")) {
+      push();
+      i++;
+      continue;
+    }
+    if (ch === "|" || ch === ";" || ch === "\n") {
+      push();
+      continue;
+    }
+
+    current += ch;
+  }
+
+  if (quote !== null) return command.split(COMMAND_SEPARATORS);
+
+  push();
+  return segments;
+}
+
 function commandSegments(command: string): string[] {
-  return command
-    .split(/(?:&&|\|\||[;\n|])/)
+  return splitCommandSegments(command)
     .map((segment) => segment.trim())
     .filter((segment) => segment.length > 0);
 }
@@ -71,28 +180,107 @@ function stripCommandPrefix(segment: string): string {
 }
 
 /** Recognise the explicit release/deploy command shapes this policy promises to gate. */
-export function releaseShapeFromCommand(command: string): ReleaseShape | undefined {
+export function releaseShapeFromCommand(command: string): GateShape | undefined {
+  return releaseCommandMatch(command)?.shape;
+}
+
+/**
+ * A whole-package `bun test`: `bun test` with no positional naming a specific
+ * test file. Flags alone — or nothing at all — still run the whole project,
+ * which is the gate (#428), and so do the path spellings of "everything":
+ * `bun test .`, `bun test ./`, `bun test src`. A command whose positional
+ * targets are test files — basename carrying the `*.test.*` / `*_test.*`
+ * marker bun itself keys on — is a focused run, a worker's proof path, and
+ * must stay available. A flag's own value is not a focused target: a
+ * `--preload x.ts` run with no file runs the whole package with a preload,
+ * while `--preload ./setup.ts src/daemon.test.ts` is still a test-file run.
+ */
+function wholePackageBunTest(segment: string): boolean {
+  const head = /^bun\s+test\b/.exec(segment);
+  if (head === null) return false;
+  const rest = segment.slice(head[0].length);
+  return !rest
+    .split(/\s+/)
+    .filter((token) => token.length > 0)
+    .filter((token) => !token.startsWith("-"))
+    .some((token) => /\.test\.|_test\./.test(token.slice(token.lastIndexOf("/") + 1)));
+}
+
+/**
+ * The shared-host run/shell suites a worker must not execute on the operator's
+ * host (#428): `herdr/test/recover-test.sh`, `test/setup-test.sh` and
+ * `setup.sh`, each under the invocation prefixes a worker actually uses —
+ * plain `bash`/`sh`/`zsh`, POSIX `. ` and `source` (all so the script loads),
+ * and a bare or `./` path. Returns the script path that fired, for the
+ * matched-segment ledger record.
+ *
+ * `bash -n` is deliberately not a match: parsing a script never executes it,
+ * and the pre-push parse gate every worker brief runs is
+ * `bash -n herdr/bin/recover.sh herdr/test/recover-test.sh setup.sh
+ * test/setup-test.sh` — blocking that would make the gate unfollowable without
+ * buying a single byte of protection. A flag beyond `-n` (`bash -x`, `-e`) is
+ * a real execution and is not covered either: the incidents that overloaded
+ * the host were all plain invocations, and refusing the sanctioned parse check
+ * would teach workers to skip it rather than stop the load.
+ */
+const SHARED_HOST_SCRIPTS = [
+  "herdr/test/recover-test.sh",
+  "test/setup-test.sh",
+  "setup.sh",
+];
+
+const SHARED_HOST_PREFIX = /^(?:(?:bash|sh|zsh|source)\s+|\.\s+)?\.?\/?/;
+
+function sharedHostScriptMatch(segment: string): string | undefined {
+  const path = segment.replace(SHARED_HOST_PREFIX, "");
+  for (const script of SHARED_HOST_SCRIPTS) {
+    if (path === script || path.startsWith(`${script} `) || path.startsWith(`${script}\t`)) {
+      return script;
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Classify a shell command and the segment that fired. The segment is what a
+ * triager reads: `bun test src/foo.test.ts && npm publish` matches on its
+ * `npm publish` half, and the record says so instead of folding the whole
+ * command into the shape.
+ */
+function releaseCommandMatch(command: string): { shape: GateShape; matched: string } | undefined {
   for (const raw of commandSegments(command)) {
     const segment = stripCommandPrefix(raw);
-    if (/^git(?:\s+-[Cc]\s+\S+)*\s+tag(?:\s|$)/.test(segment)) return "git-tag";
+    // Patching the running conductor is gated like a release act: `upgrade`,
+    // the detached `upgrade-install`/`upgrade-rollback` executor entries and
+    // any future spelling under the upgrade family all need the install shape,
+    // and a session without that grant is refused before the shell runs.
+    if (/^omp-conductor\s+upgrade(?:\b|$)/.test(segment)) return { shape: "install", matched: segment };
+    if (/^git(?:\s+-[Cc]\s+\S+)*\s+tag(?:\s|$)/.test(segment)) return { shape: "git-tag", matched: segment };
     if (
       /^git(?:\s+-[Cc]\s+\S+)*\s+push\b/.test(segment) &&
       GIT_PUSH_TAG_SHAPE.test(segment)
     ) {
-      return "git-push-tags";
+      return { shape: "git-push-tags", matched: segment };
     }
     if (/^(?:npm|pnpm|bun)\s+(?:publish|stage\s+publish)\b/.test(segment)) {
-      return "package-publish";
+      return { shape: "package-publish", matched: segment };
     }
-    if (/^yarn\s+npm\s+publish\b/.test(segment)) return "package-publish";
-    if (/^gh\s+release\s+create\b/.test(segment)) return "github-release";
+    if (/^yarn\s+npm\s+publish\b/.test(segment)) return { shape: "package-publish", matched: segment };
+    if (/^gh\s+release\s+create\b/.test(segment)) return { shape: "github-release", matched: segment };
     if (
       /^(?:kubectl\s+(?:apply|create|replace)|helm\s+(?:install|upgrade)|terraform\s+apply|pulumi\s+up|(?:fly|vercel|wrangler)\s+deploy|docker\s+push)\b/.test(
         segment,
       )
     ) {
-      return "deploy";
+      return { shape: "deploy", matched: segment };
     }
+    // The shared-host gate (#428). Disjoint from every release shape above, so
+    // it is checked last without disturbing any of them. `matched` names the
+    // script path for a suite and the offending segment for a whole-package
+    // `bun test`, so the ledger and the digest say exactly which one fired.
+    if (wholePackageBunTest(segment)) return { shape: SHARED_HOST_SHAPE, matched: segment };
+    const script = sharedHostScriptMatch(segment);
+    if (script !== undefined) return { shape: SHARED_HOST_SHAPE, matched: script };
   }
   return undefined;
 }
@@ -187,8 +375,11 @@ const RELEASE_ACTIONS: Record<string, true> = {
  * only asks a question — while a read verb *after* the action verb is not:
  * `DeployStackAndWatch` deploys.
  */
-function releaseShapeFromTokens(tokens: readonly string[]): ReleaseShape | undefined {
+function releaseTokenMatch(
+  tokens: readonly string[],
+): { shape: ReleaseShape; matched: string } | undefined {
   if (tokens[tokens.length - 1] === "status") return undefined;
+  let action: string | undefined;
   for (const token of tokens) {
     if (READ_VERBS[token] === true) return undefined;
     if (
@@ -196,31 +387,39 @@ function releaseShapeFromTokens(tokens: readonly string[]): ReleaseShape | undef
       RELEASE_ACTIONS[token] === true ||
       PUBLISH_ACTIONS[token] === true
     ) {
+      action = token;
       break;
     }
   }
+  if (action === undefined) return undefined;
 
   // `release` first: `PublishRelease` cuts a GitHub release, it does not publish
-  // a package, and both vocabularies claim `publish`.
+  // a package, and both vocabularies claim `publish`. `matched` names the token
+  // the shape was read off, so a name that only grazes a vocabulary shows it.
   if (
     tokens.some((t) => t === "release" || t === "releases") &&
     tokens.some((t) => RELEASE_ACTIONS[t] === true)
   ) {
-    return "github-release";
+    return { shape: "github-release", matched: "release" };
   }
-  if (tokens.some((t) => PUBLISH_ACTIONS[t] === true)) return "package-publish";
-  if (tokens.some((t) => DEPLOY_ACTIONS[t] === true)) return "deploy";
+  if (tokens.some((t) => PUBLISH_ACTIONS[t] === true)) return { shape: "package-publish", matched: action };
+  if (tokens.some((t) => DEPLOY_ACTIONS[t] === true)) return { shape: "deploy", matched: action };
   return undefined;
 }
 
-/** Release-shaped device/tool invocations that do not pass through a shell. */
-export function releaseShapeFromTool(
+/**
+ * Classify a release-shaped tool call and what matched, like
+ * {@link releaseShapeFromTool} plus the substring the shape was read off. One
+ * classifier sits behind decisions, audit records and tick prompts, so they
+ * cannot disagree about which call was blocked.
+ */
+export function releaseToolMatch(
   toolName: string,
   input: Record<string, unknown> | undefined,
-): ReleaseShape | undefined {
+): { shape: GateShape; matched: string } | undefined {
   if (input === undefined) return undefined;
   if (toolName === "bash") {
-    return typeof input.command === "string" ? releaseShapeFromCommand(input.command) : undefined;
+    return typeof input.command === "string" ? releaseCommandMatch(input.command) : undefined;
   }
 
   // An MCP tool reached through the device path: the path *is* the tool name, so
@@ -228,11 +427,40 @@ export function releaseShapeFromTool(
   // `write` to `src/deploy.ts` is source code, not a deploy.
   const path = typeof input.path === "string" ? input.path : "";
   if (toolName === "write" && path.startsWith("xd://")) {
-    const viaDevice = releaseShapeFromTokens(releaseTokens(path));
+    const viaDevice = releaseTokenMatch(releaseTokens(path));
     if (viaDevice !== undefined) return viaDevice;
   }
 
-  return releaseShapeFromTokens(releaseTokens(toolName));
+  return releaseTokenMatch(releaseTokens(toolName));
+}
+
+/** Release-shaped device/tool invocations that do not pass through a shell. */
+export function releaseShapeFromTool(
+  toolName: string,
+  input: Record<string, unknown> | undefined,
+): GateShape | undefined {
+  return releaseToolMatch(toolName, input)?.shape;
+}
+
+/**
+ * The refusal wording for the shared-host gate (#428). The whole-package
+ * `bun test` form names the focused alternative (a guard that only denies
+ * teaches nothing and gets worked around); the shell suites get their own
+ * because there is no focused form of a suite script.
+ */
+function sharedHostRefusalReason(matched: string | undefined): string {
+  if (matched !== undefined && /^bun\s+test\b/.test(matched)) {
+    return (
+      "Blocked by sharedHostPolicy: the whole-package `bun test` is not a worker's proof path on this shared " +
+      "host (it overloads the 4-core VPS and, before #399, SIGTERMed the production daemon). " +
+      "Run a focused `bun test <file>.test.ts` instead."
+    );
+  }
+  return (
+    "Blocked by sharedHostPolicy: this shell suite is not a worker's proof path on this shared host " +
+    "(it overloads the 4-core VPS that also runs Langfuse and the fleet). " +
+    "Run focused `bun test <file>.test.ts` unit tests instead."
+  );
 }
 
 /**
@@ -249,8 +477,16 @@ export function releaseShapeFromTool(
 export function releaseRefusal(
   grants: ResolvedGrants,
   role: SessionRole,
-  shape: ReleaseShape,
+  shape: GateShape,
 ): ReleaseDecision | undefined {
+  // The shared-host gate is not a grant anyone holds: a worker is always
+  // refused — the shared operator host cannot absorb a whole-package suite,
+  // which is the exact load that stopped it — and an operator session is
+  // never, because the operator owns the host and CI owns the full suite.
+  if (shape === SHARED_HOST_SHAPE) {
+    if (role !== "worker") return undefined;
+    return { block: true, reason: sharedHostRefusalReason(undefined) };
+  }
   const holder = grants[shape];
   if (holder === role) return undefined;
   return {
@@ -272,11 +508,22 @@ export function releaseDecision(
   role: SessionRole,
   toolName: string,
   input: Record<string, unknown>,
-): { shape: ReleaseShape; decision: ReleaseDecision } | undefined {
-  const shape = releaseShapeFromTool(toolName, input);
-  if (shape === undefined) return undefined;
-  const decision = releaseRefusal(grants, role, shape);
-  return decision === undefined ? undefined : { shape, decision };
+): { shape: GateShape; matched: string; decision: ReleaseDecision } | undefined {
+  const match = releaseToolMatch(toolName, input);
+  if (match === undefined) return undefined;
+  const decision = releaseRefusal(grants, role, match.shape);
+  if (decision === undefined) return undefined;
+  // The shared-host gate's wording is matched-specific (name the focused form
+  // for a whole-package `bun test`, name the suite for a script), so it is
+  // read off the offending segment here rather than from `releaseRefusal`.
+  if (match.shape === SHARED_HOST_SHAPE) {
+    return {
+      shape: match.shape,
+      matched: match.matched,
+      decision: { block: true, reason: sharedHostRefusalReason(match.matched) },
+    };
+  }
+  return { shape: match.shape, matched: match.matched, decision };
 }
 
 const RELEASE_ARG_ALLOWLIST = new Set([
@@ -305,6 +552,64 @@ export function redactReleaseArgs(input: Record<string, unknown>): Record<string
   return redacted;
 }
 
+/** Credential-shaped text a blocked invocation must not carry into the audit
+ *  file, each with the replacement that takes its place. */
+const CREDENTIAL_PATTERNS: Array<readonly [RegExp, string]> = [
+  // Armoured private keys, in full so a key cannot survive as its own body.
+  [/-----BEGIN [A-Z0-9 ]+PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]+PRIVATE KEY-----/g, "[redacted]"],
+  // GitHub classic and fine-grained PATs.
+  [/gh[pousr]_[A-Za-z0-9]{20,}/g, "[redacted]"],
+  [/github_pat_[A-Za-z0-9_]{20,}/g, "[redacted]"],
+  // Slack tokens.
+  [/xox[baprs]-[A-Za-z0-9-]{10,}/g, "[redacted]"],
+  // AWS access key ids. The secret half is caught by the long-run rule below.
+  [/AKIA[0-9A-Z]{16}/g, "[redacted]"],
+  // OpenAI-style `sk-` secrets.
+  [/sk-[A-Za-z0-9]{16,}/g, "[redacted]"],
+  // `--token x`, `--password=x` and friends. The token word must end at the
+  // separator, so `--author` stays a git flag rather than dying as a
+  // credential. The flag name survives so the record says what kind of
+  // credential rode on the call; only its value is replaced.
+  [
+    /--([a-z0-9-]*(?:token|secret|password|passwd|api-?key|auth(?:orization)?))(?=[\s=])(?:\s+|=)\S+/gi,
+    "--$1 [redacted]",
+  ],
+  // `TOKEN=…`, `NPM_CONFIG_TOKEN=…` style assignments.
+  [/[A-Z][A-Z0-9_]*(?:TOKEN|PASSWORD|PASSWD|SECRET|API_?KEY|CREDENTIAL)[A-Z0-9_]*=\S+/g, "[redacted]"],
+  // `Bearer …` / `Basic …` header values.
+  [/\b(?:Bearer|Basic)\s+\S+/g, "[redacted]"],
+  // Long unbroken runs are token-shaped whatever scheme they belong to. A
+  // commit sha is a stranger in a blocked command worth keeping; a leaked
+  // token is not worth the triage convenience.
+  [/[A-Za-z0-9_-]{32,}/g, "[redacted]"],
+];
+
+/** The bound a recorded invocation is cut to. Long enough to read a heredoc,
+ *  short enough that a fixture dump cannot bloat the audit file. */
+const RELEASE_INVOCATION_MAX = 400;
+
+/** Redact anything credential-shaped in a blocked command, then bound its
+ *  length. Redaction runs before truncation so a cut cannot leak a token
+ *  fragment past its own pattern. */
+export function redactReleaseCommand(command: string): string {
+  let safe = command;
+  for (const [pattern, replacement] of CREDENTIAL_PATTERNS) {
+    safe = safe.replace(pattern, replacement);
+  }
+  return safe.length <= RELEASE_INVOCATION_MAX ? safe : `${safe.slice(0, RELEASE_INVOCATION_MAX)}…`;
+}
+
+/** The invocation a block records: the shell command for a `bash` call, and
+ *  nothing for other tools — their redacted args already name the call. */
+export function releaseBlockedInvocation(
+  toolName: string,
+  input: Record<string, unknown>,
+): string | undefined {
+  return toolName === "bash" && typeof input.command === "string"
+    ? redactReleaseCommand(input.command)
+    : undefined;
+}
+
 interface ReleasePolicyPi {
   on(
     event: "tool_call",
@@ -319,16 +624,19 @@ interface ReleasePolicyPi {
 export function releasePolicyTripwire(
   grants: ResolvedGrants,
   role: SessionRole,
-  onBlocked: (shape: ReleaseShape, context: ReleaseBlockContext) => void = () => {},
+  onBlocked: (shape: GateShape, context: ReleaseBlockContext) => void = () => {},
 ): (pi: ReleasePolicyPi) => void {
   return (pi) => {
     pi.on("tool_call", (event) => {
       const blocked = releaseDecision(grants, role, event.toolName, event.input);
       if (blocked === undefined) return undefined;
       try {
+        const invocation = releaseBlockedInvocation(event.toolName, event.input);
         onBlocked(blocked.shape, {
           tool: event.toolName,
           reason: blocked.decision.reason,
+          matched: blocked.matched,
+          ...(invocation === undefined ? {} : { invocation }),
           args: redactReleaseArgs(event.input),
         });
       } catch {
@@ -342,7 +650,7 @@ export function releasePolicyTripwire(
 export function recordReleaseBlock(
   project: string,
   source: ReleaseBlock["source"],
-  shape: ReleaseShape,
+  shape: GateShape,
   details: Omit<ReleaseBlock, "project" | "source" | "shape" | "at"> = {},
   root = stateDir(),
   now = new Date(),
@@ -350,13 +658,15 @@ export function recordReleaseBlock(
   mkdirSync(root, { recursive: true });
   // Redact again at the durable boundary. Callers normally pass the tripwire's
   // already-safe context, but no alternate recorder path gets to rely on that.
-  const { args, ...attribution } = details;
+  const { args, invocation, matched, ...attribution } = details;
   const record: ReleaseBlock = {
     project,
     source,
     shape,
     ...attribution,
     ...(args === undefined ? {} : { args: redactReleaseArgs(args) }),
+    ...(invocation === undefined ? {} : { invocation: redactReleaseCommand(invocation) }),
+    ...(matched === undefined ? {} : { matched: redactReleaseCommand(matched) }),
     at: now.toISOString(),
   };
   appendFileSync(join(root, RELEASE_POLICY_AUDIT_FILE), `${JSON.stringify(record)}\n`, { mode: 0o600 });
@@ -416,6 +726,8 @@ export function releaseDriftDigestLine(
     ...(latest.issue === undefined ? [] : [`issue #${latest.issue}`]),
     ...(latest.runId === undefined ? [] : [`run ${latest.runId}`]),
     ...(latest.tool === undefined ? [] : [`tool ${latest.tool}`]),
+    ...(latest.invocation === undefined ? [] : [`attempted "${latest.invocation}"`]),
+    ...(latest.matched === undefined ? [] : [`matched "${latest.matched}"`]),
   ].join(", ");
   return (
     `Release-policy drift today: ${drift.count} release/deploy tool call(s) were blocked ` +

package/src/reports.ts

@@ -219,15 +219,22 @@ export function formatOpenReports(
 
 /** Durable rows still owed to a future digest. Always rendered in `status`: a
  * quiet line proves the accumulator is empty, while a non-zero line makes loss
- * or backlog visible without asking the session what it remembers. */
+ * or backlog visible without asking the session what it remembers. Held
+ * notices are split by what releases them: `releaseOnAvailable` rows are
+ * interrupt-worthy notices waiting only for the operator's working window,
+ * everything else is ordinary digest-bound backlog. One noun for both was how
+ * a routine material backlog read as stranded escalations (#492). */
 export function formatDigestBacklog(backlog: DigestBacklog, now: number = Date.now()): string[] {
   const age = (at: number | undefined): string =>
     at === undefined ? "" : ` (oldest ${humanAge(Math.max(0, now - at))})`;
+  const heldForAvailability = backlog.availabilityHeldNoticeCount ?? 0;
+  const heldForDigest = Math.max(0, backlog.heldNoticeCount - heldForAvailability);
   return [
     "",
     "digest backlog",
-    `  material events    ${backlog.materialCount}${age(backlog.materialOldestAt)}`,
-    `  held escalations   ${backlog.heldNoticeCount}${age(backlog.heldNoticeOldestAt)}`,
+    `  material events         ${backlog.materialCount}${age(backlog.materialOldestAt)}`,
+    `  held for digest         ${heldForDigest}${age(backlog.digestHeldNoticeOldestAt ?? backlog.heldNoticeOldestAt)}`,
+    `  held for availability   ${heldForAvailability}${age(backlog.availabilityHeldNoticeOldestAt)}`,
   ];
 }
 
@@ -315,9 +322,16 @@ export function operatorMessageCategory(text: string): InterruptCategory {
 export async function deliverOperatorMessage(
   project: ProjectConfig,
   text: string,
-  deps: { store: Store; at: number; noticeId: string; send?: ReportSend },
+  deps: {
+    store: Store;
+    at: number;
+    noticeId: string;
+    send?: ReportSend;
+    /** Declared escalation category; overrides the `QUESTION:`-prefix read. */
+    category?: InterruptCategory;
+  },
 ): Promise<OperatorMessageOutcome> {
-  const category = operatorMessageCategory(text);
+  const category = deps.category ?? operatorMessageCategory(text);
   const disposition = interruptDisposition(project.reporting, category, deps.at);
   if (disposition !== "interrupt") {
     deps.store.addHeldNotice({

package/src/session-host.ts

@@ -22,9 +22,8 @@
 import { connect } from "node:net";
 
 import { createLocalSession, disposeSession, type AgentSessionLike } from "./omp.ts";
-import type { ReleaseBlockContext } from "./release-policy.ts";
-
-import type { ReleaseShape, ResolvedGrants, SessionRole } from "./types.ts";
+import type { GateShape, ReleaseBlockContext } from "./release-policy.ts";
+import type { ResolvedGrants, SessionRole } from "./types.ts";
 
 /**
  * Everything the child needs to build the session. Plain JSON on purpose:
@@ -68,7 +67,7 @@ export type HostToParent =
   | { t: "session-file"; path: string }
   | { t: "prompt-result"; id: number; ok: boolean; error?: string }
   | { t: "park-result"; id: number; ok: boolean; error?: string }
-  | ({ t: "release-blocked"; shape: ReleaseShape } & ReleaseBlockContext);
+  | ({ t: "release-blocked"; shape: GateShape } & ReleaseBlockContext);
 
 /**
  * Depth at which a harness event stops being copied for the wire.
@@ -196,7 +195,14 @@ export async function runSessionHost(
     });
   } catch (err) {
     send({ t: "start-error", message: err instanceof Error ? err.message : String(err) });
-    socket.end();
+    // The frame must reach the parent before this process exits: `process.exit`
+    // does not flush the socket, and a parent that only observes the exit used
+    // to report a bare exit code instead of the child's own words.
+    await new Promise<void>((resolve) => {
+      socket.once("finish", () => resolve());
+      socket.once("error", () => resolve());
+      socket.end();
+    });
     return;
   }