omp-conductor 0.15.10 → 0.15.12

package/src/board.ts

@@ -21,6 +21,7 @@ import { makeTracker } from "./tracker/github.ts";
 import { planUsageBadge, readPlanUsage, sharedUsageSource } from "./usage.ts";
 import type {
   AdmissionHoldReason,
+  Caps,
   PrVerification,
   ProjectConfig,
   ReadyIssue,
@@ -730,7 +731,9 @@ function admissionLine(snapshot: BoardSnapshot): string {
   const queue =
     dispatch === undefined
       ? "dispatch not recorded"
-      : `${dispatch.degraded ? "DEGRADED · " : ""}${dispatch.ready} ready · ${dispatch.claimed ?? 0} in flight · ${dispatch.routed} spare · ${dispatch.admitted} admitted`;
+      : dispatch.paused === true
+        ? `held pass — nothing admitted${(dispatch.settled ?? 0) > 0 ? ` · settled ${dispatch.settled}` : ""}`
+        : `${dispatch.degraded ? "DEGRADED · " : ""}${dispatch.ready} ready · ${dispatch.claimed ?? 0} in flight · ${dispatch.routed} spare · ${dispatch.admitted} admitted`;
   const holdText = dispatch?.holds.map((hold) => `${hold.reason} ${hold.count}`).join(", ");
   const holds = holdText === undefined || holdText === "" ? "none" : holdText;
   return (
@@ -1177,14 +1180,57 @@ export function boardJson(snapshot: BoardSnapshot): string {
   );
 }
 
+export interface BoardConfigState {
+  project: ProjectConfig;
+  caps: Caps;
+  /** The last refresh could not read the config; `project`/`caps` are the last
+   *  good values and the board renders the failure instead of the values. */
+  error?: string;
+  /** Whether the last successful refresh resolved different values. */
+  changed: boolean;
+}
+
+/**
+ * Re-resolve the board's project and caps from the config, once per refresh
+ * cycle (#370). The board renders `project` and `caps` on every repaint, so
+ * this read — never the render path — is what keeps a cap changed while the
+ * board is open from going stale. A config that cannot be read returns the
+ * previous values with the failure, exactly how the daemon holds boot values
+ * across a failed hot reload instead of wedging its tick.
+ */
+export function reloadBoardConfig(
+  projectName: string | undefined,
+  previous?: { project: ProjectConfig; caps: Caps },
+): BoardConfigState {
+  try {
+    const cfg = loadConfig();
+    const project = findProject(cfg, projectName);
+    const caps = resolveCaps(project, cfg.defaults);
+    const unchanged =
+      previous !== undefined &&
+      JSON.stringify(project) === JSON.stringify(previous.project) &&
+      JSON.stringify(caps) === JSON.stringify(previous.caps);
+    return { project, caps, changed: !unchanged };
+  } catch (err) {
+    if (previous === undefined) throw err;
+    return {
+      project: previous.project,
+      caps: previous.caps,
+      changed: false,
+      error: err instanceof Error ? err.message : String(err),
+    };
+  }
+}
+
 export async function runBoard(projectName?: string): Promise<void> {
   if (!process.stdin.isTTY || !process.stdout.isTTY) {
     throw new Error("board needs an interactive terminal (TTY)");
   }
 
-  const cfg = loadConfig();
-  const project = findProject(cfg, projectName);
-  const caps = resolveCaps(project, cfg.defaults);
+  // The config is read at boot (an unreadable one still fails the board), then
+  // re-read on the health cadence below so the board tracks what the daemon
+  // hot-reloads per tick.
+  let { project, caps, error: configError } = reloadBoardConfig(projectName);
   const store: Store = openStore(dbPath());
   const cursor: BoardCursor = { column: 2, card: 0, detail: false, transcriptOffset: 0 };
   const queue: KeyInput[] = [];
@@ -1243,18 +1289,30 @@ export async function runBoard(projectName?: string): Promise<void> {
       const now = Date.now();
       if (now - healthAt >= HEALTH_REFRESH_MS && healthRefresh === undefined) {
         healthAt = now;
-        healthRefresh = Promise.all([
-          probeBoardHealth(project),
+        healthRefresh = (async () => {
+          // #370: the config is re-read on the health cadence, not the 1 Hz
+          // repaint — the daemon hot-reloads per tick, so a cap changed while
+          // the board is open must land here too. A config that cannot be read
+          // keeps the last good project/caps and marks the board stale instead
+          // of tearing it down: the daemon's own boot-values rule.
+          const reloaded = reloadBoardConfig(projectName, { project, caps });
           // On the health cadence, not the 1s repaint: the provider read is a
           // subprocess, and an allowance does not move at 1 Hz.
-          readPlanUsage(caps.planUsage, sharedUsageSource()),
-        ])
-          .then(([nextProbe, nextPlanUsage]) => {
-            health = nextProbe.health;
-            pausedPhases = nextProbe.pausedPhases;
-            planUsage = nextPlanUsage;
-            enqueue(queue, { name: "refresh" }, wake);
-          })
+          const [nextProbe, nextPlanUsage] = await Promise.all([
+            probeBoardHealth(reloaded.project),
+            readPlanUsage(reloaded.caps.planUsage, sharedUsageSource()),
+          ]);
+          project = reloaded.project;
+          caps = reloaded.caps;
+          configError = reloaded.error;
+          health = nextProbe.health;
+          pausedPhases = nextProbe.pausedPhases;
+          planUsage = nextPlanUsage;
+          if (reloaded.error === undefined && reloaded.changed) {
+            notice = "config reloaded - changes applied";
+          }
+          enqueue(queue, { name: "refresh" }, wake);
+        })()
           .catch((err: unknown) => {
             notice = `health refresh failed: ${err instanceof Error ? err.message : String(err)}`;
           })
@@ -1313,7 +1371,15 @@ export async function runBoard(projectName?: string): Promise<void> {
         now,
       };
       normalizeCursor(snapshot, cursor);
-      process.stdout.write(`${CSI}H${renderBoard(snapshot, cursor, process.stdout.columns, process.stdout.rows, notice, help)}${CSI}J`);
+      // An unreadable config pins the footer to the last-good warning for as
+      // long as the config stays broken, instead of clearing after the one
+      // frame a transient notice gets (#370); the cap on screen is last good
+      // and says so. Transient notices get their slot back on a good read.
+      const frameNotice =
+        configError === undefined
+          ? notice
+          : `config unreadable — ${configError} — showing last good values`;
+      process.stdout.write(`${CSI}H${renderBoard(snapshot, cursor, process.stdout.columns, process.stdout.rows, frameNotice, help)}${CSI}J`);
       notice = "";
 
       const key = await waitForInput(queue, (next) => {

package/src/brief-upgrade.ts

@@ -34,6 +34,14 @@ export const POLICY_BRIEF_NAME = "POLICY.md";
 /** Composed view the session / AGENTS.md symlink historically pointed at. */
 export const ORCHESTRATOR_BRIEF_NAME = "ORCHESTRATOR.md";
 
+/**
+ * Host-wide operator policy, one file applying to every project on this host.
+ *
+ * Lives beside `config.json` under the state root (see {@link sharedPolicyPath})
+ * because it is operator text that outlives any one project's workspace.
+ */
+export const SHARED_POLICY_BRIEF_NAME = "SHARED_POLICY.md";
+
 /** Topic keys that belong in POLICY.md (matched like {@link topicKey}). */
 export const OWNED_TOPIC_KEYS = ["releases", "project context", "reporting", "amendments"] as const;
 
@@ -46,6 +54,39 @@ export const COMPOSE_BANNER = [
   "<!-- ==================================================================== -->",
 ].join("\n");
 
+/**
+ * Banner for the three-layer compose: names every source so a reader can tell
+ * which layer a paragraph came from, and states the precedence — the project's
+ * own `POLICY.md` overrides the host-wide shared layer where they conflict.
+ *
+ * Only used when a shared policy actually exists. With none, composition is
+ * byte-identical to the two-layer `COMPOSE_BANNER` form above (#363).
+ */
+export const COMPOSE_BANNER_WITH_SHARED = [
+  "<!-- ==================================================================== -->",
+  "<!-- YOURS TO EDIT — live copy of POLICY.md. Edit POLICY.md, not here.   -->",
+  "<!-- This composed ORCHESTRATOR.md is regenerated from package floor +   -->",
+  "<!-- SHARED_POLICY.md + POLICY.md; hand-edits above or below the         -->",
+  "<!-- banners will not last.                                              -->",
+  "<!--                                                                      -->",
+  "<!-- Shared operator policy (SHARED_POLICY.md beside config.json)         -->",
+  "<!-- applies to every project on this host. The project's POLICY.md       -->",
+  "<!-- below overrides it where the two conflict.                           -->",
+  "<!-- ==================================================================== -->",
+].join("\n");
+
+/**
+ * Divider between the shared layer and the project's own `POLICY.md` half.
+ *
+ * Carries its own edit marker so the two operator layers each end at a "yours
+ * to edit" boundary instead of running into each other.
+ */
+export const PROJECT_POLICY_DIVIDER = [
+  "<!-- ==================================================================== -->",
+  "<!-- YOURS TO EDIT — live copy of the project's POLICY.md below.          -->",
+  "<!-- ==================================================================== -->",
+].join("\n");
+
 /**
  * A brief split into the package's half and the operator's half.
  *
@@ -255,6 +296,32 @@ export function orchestratorPathForRoot(workspaceRoot: string): string {
   return join(workspaceRoot, ORCHESTRATOR_BRIEF_NAME);
 }
 
+/** Where the host-wide shared policy lives: beside `config.json` (see stateDir). */
+export function sharedPolicyPath(): string {
+  return join(stateDir(), SHARED_POLICY_BRIEF_NAME);
+}
+
+/**
+ * Shared policy text from the host-wide file, or `undefined` when it is absent.
+ *
+ * `undefined` is the "two-layer fleet" answer: absent shared policy composes
+ * byte-identically to today, so callers pass this straight into
+ * {@link composeOrchestrator}.
+ */
+export function readSharedPolicy(): string | undefined {
+  const path = sharedPolicyPath();
+  return existsSync(path) ? readFileSync(path, "utf8") : undefined;
+}
+
+/**
+ * Shared policy text from an explicitly-named file, or `undefined` when the
+ * file does not exist. The refresh/migrate paths take the path as an option so
+ * their tests stay hermetic; {@link readSharedPolicy} is the state-dir version.
+ */
+function readSharedAt(path: string | undefined): string | undefined {
+  return path !== undefined && existsSync(path) ? readFileSync(path, "utf8") : undefined;
+}
+
 /**
  * Classifies what sits in the workspace: overlay, migratable legacy, or absent.
  *
@@ -283,11 +350,19 @@ export function inspectBriefLayout(
   };
 }
 
-/** Join rendered floor + live policy into the composed session brief. */
-export function composeOrchestrator(floor: string, policy: string): string {
+/**
+ * Join rendered floor + live policy into the composed session brief.
+ *
+ * An optional host-wide shared policy composes between the floor and the
+ * project policy. Absent one (`undefined`), the output is byte-identical to
+ * the two-layer form — a single-project fleet sees no change at all.
+ */
+export function composeOrchestrator(floor: string, policy: string, sharedPolicy?: string): string {
   const f = floor.replace(/\s+$/, "\n");
   const p = policy.replace(/^\s+/, "").replace(/\s+$/, "\n");
-  return `${f}\n${COMPOSE_BANNER}\n\n${p}`;
+  if (sharedPolicy === undefined) return `${f}\n${COMPOSE_BANNER}\n\n${p}`;
+  const s = sharedPolicy.replace(/^\s+/, "").replace(/\s+$/, "\n");
+  return `${f}\n${COMPOSE_BANNER_WITH_SHARED}\n\n${s}\n${PROJECT_POLICY_DIVIDER}\n\n${p}`;
 }
 
 /**
@@ -370,6 +445,8 @@ export function migrateToPolicy(opts: {
   floor: string;
   /** When set, use this owned text instead of splitting the live file. */
   owned?: string;
+  /** Optional host-wide shared policy file; absent one composes two-layer. */
+  sharedPolicyPath?: string;
   /** Override the conductor backup directory (tests). */
   backupRoot?: string;
 }): MigrateResult {
@@ -386,7 +463,11 @@ export function migrateToPolicy(opts: {
     policyBody.endsWith("\n") ? policyBody : `${policyBody}\n`,
     opts.backupRoot,
   );
-  const composed = composeOrchestrator(opts.floor, readFileSync(opts.policyPath, "utf8"));
+  const composed = composeOrchestrator(
+    opts.floor,
+    readFileSync(opts.policyPath, "utf8"),
+    readSharedAt(opts.sharedPolicyPath),
+  );
   const orchestratorBackup = writeWithBackup(opts.orchestratorPath, composed, opts.backupRoot);
   return {
     policyPath: opts.policyPath,
@@ -407,6 +488,8 @@ export function repairPolicyBannerCrumbs(opts: {
   orchestratorPath: string;
   policyPath: string;
   floor: string;
+  /** Optional host-wide shared policy file; absent one composes two-layer. */
+  sharedPolicyPath?: string;
   /** Override the conductor backup directory (tests). */
   backupRoot?: string;
 }): MigrateResult | undefined {
@@ -415,7 +498,10 @@ export function repairPolicyBannerCrumbs(opts: {
   const cleaned = stripLeadingBannerCrumbs(before);
   if (cleaned === before) {
     // Still recompose so the floor matches this package even when POLICY was clean.
-    writeFileSync(opts.orchestratorPath, composeOrchestrator(opts.floor, before));
+    writeFileSync(
+      opts.orchestratorPath,
+      composeOrchestrator(opts.floor, before, readSharedAt(opts.sharedPolicyPath)),
+    );
     return undefined;
   }
   const policyBackup = writeWithBackup(
@@ -423,7 +509,11 @@ export function repairPolicyBannerCrumbs(opts: {
     cleaned.endsWith("\n") ? cleaned : `${cleaned}\n`,
     opts.backupRoot,
   );
-  const composed = composeOrchestrator(opts.floor, readFileSync(opts.policyPath, "utf8"));
+  const composed = composeOrchestrator(
+    opts.floor,
+    readFileSync(opts.policyPath, "utf8"),
+    readSharedAt(opts.sharedPolicyPath),
+  );
   const orchestratorBackup = writeWithBackup(opts.orchestratorPath, composed, opts.backupRoot);
   return {
     policyPath: opts.policyPath,
@@ -442,13 +532,18 @@ export function refreshComposedBrief(opts: {
   orchestratorPath: string;
   policyPath: string;
   floor: string;
+  /** Optional host-wide shared policy file; absent one composes two-layer. */
+  sharedPolicyPath?: string;
   /** Override the conductor backup directory (tests). */
   backupRoot?: string;
 }): boolean {
   migrateLegacyBriefBackups([opts.policyPath, opts.orchestratorPath], opts.backupRoot);
   if (!existsSync(opts.policyPath)) return false;
   const policy = readFileSync(opts.policyPath, "utf8");
-  writeFileSync(opts.orchestratorPath, composeOrchestrator(opts.floor, policy));
+  writeFileSync(
+    opts.orchestratorPath,
+    composeOrchestrator(opts.floor, policy, readSharedAt(opts.sharedPolicyPath)),
+  );
   return true;
 }
 
@@ -557,13 +652,24 @@ export function applyRetrofit(path: string, proposal: RetrofitProposal, backupRo
  * is now the only classifier. The pre-overlay pair it replaced described two
  * further states ("mergeable", "current") that only the deleted single-file
  * merge could act on (#131).
+ *
+ * `sharedPolicyPath` is the optional host-wide shared-policy file; the overlay
+ * report lists it when present so the operator can see which layers compose.
  */
-export function formatBriefReport(path: string, layout: BriefLayout, missing: readonly string[]): string {
+export function formatBriefReport(
+  path: string,
+  layout: BriefLayout,
+  missing: readonly string[],
+  sharedPolicyPath?: string,
+): string {
   if (layout.kind === "overlay") {
     return [
       `brief overlay active`,
       "",
       `  floor        package template → recomposed into ${layout.orchestratorPath} each tick`,
+      `  shared       ${
+        sharedPolicyPath ?? "(none — composing package floor + POLICY.md)"
+      } — host-wide operator policy; the project's POLICY.md overrides it`,
       `  policy       ${layout.policyPath} (Learning loop / operator edits)`,
       "",
       "Protocol updates: upgrade omp-conductor in this host's existing install root (same package manager), then restart the daemon — no brief-upgrade --apply.",

package/src/briefs/orchestrator.md

@@ -139,24 +139,25 @@ Never leave an orphan holding a slot "to be safe": a label nobody is working und
 is not safety, it is a deadlocked fleet that looks busy.
 
 **Then read the settlement flags.** The conductor no longer takes a worker's word
-for what it changed. When a run settles, its report's `changed:` line is
-reconciled against the pull request's actual diff, and the diff is checked for
+for what it changed — it does not even ask. When a run settles, the `changed:`
+line of its report is **derived from the pull request's own diff**: the worker
+writes the narrative, the daemon writes the file list, so an undisclosed file
+cannot exist as a concept. What the audit checks instead is the diff itself, for
 weakened tests. Anything it finds is a **settlement audit** flag: it appears
 under the run in `omp-conductor status`, in the settlement report, and — once,
 at settlement — as a tier-1 escalation to you.
 
 A flag is evidence, not a verdict. It never blocks anything: the run settled
 normally, the PR is open and mergeable, and nothing is waiting on you. What it
-says is that one specific sentence in the worker's own account of its work did
-not survive contact with the diff, and that a human's usual review would have
-to notice it unaided.
+says is that something specific about the run did not survive contact with the
+diff — above all a weakened test, the one thing a reviewer's usual pass is
+poorly placed to notice. (The file list is derived, so the only disclosure flag
+left is a settlement that could not read the PR at all — read its file list
+straight from GitHub.)
 
 | Flag | What it means | What it invites |
 | --- | --- | --- |
-| `undisclosed-file` | The PR touched a file the report never mentioned. | Open the diff for that file. An undisclosed edit is usually incidental — a lockfile, a formatter — and occasionally the whole story. |
-| `changed-line-missing` | The report disclosed nothing at all. | Read the diff before merging; you have no summary of it. |
-| `unmatched-claim` | The report named a file the PR never touched. | Weak on its own. Two or three together mean the report was written from memory rather than from `git diff`, so trust the rest of it less. |
-| `report-format-unparsed` | The audit could not parse the report's format. | Not a trust signal against the worker — read the diff directly. |
+| `changed-line-missing` | The settlement could not read the PR's diff, so no file list was derived. | The one disclosure fault left, and it is a tree-read failure, not a worker's: read the PR's file list directly. |
 | `test-file-deleted` | A test file left the tree and no rename explains it. | The one that most deserves a human. Was the behaviour it defended deleted too, or only its test? |
 | `test-disabled` | A `.skip` / `.only` / `xit` / `t.Skip` marker was added. | Ask what turned red. A skip added in the same PR as the change it stopped failing is the shape to look for. |
 | `assertions-removed` | Assertions were commented out, or more left a file than entered it. | Compare against the issue's acceptance criteria: an assertion removed because the spec changed is fine, one removed because it failed is not. |
@@ -228,6 +229,48 @@ Keep the queue worth draining.
 - Examine widely, promote narrowly. Sixteen examined and four promoted is the
   shape to aim for — the cap is on what you **promote**, never on what you look at.
 
+### Grooming from intake
+
+Ideas arrive cheap — `omp-conductor intake "<text>"` from anywhere, at any hour —
+and every tick's prompt lists what is still pending (id and text, oldest
+first) whenever any idea is waiting. Pending intake is a filing duty, not a
+promotion duty:
+
+For each pending item, file **exactly one** issue on **{{TRACKER_REPO}}**:
+
+- the **title states the problem**, plainly;
+- the **body carries the product rationale** (why this is worth building, from
+  the idea's own words) **and the acceptance criteria as a checklist** — the
+  same bar Duty 2 applies to any issue a worker will be handed;
+- it carries the routing label (`repo:<repo>` — the prefix your setup renamed)
+  **and a priority**; what priority means here is project taste — see `POLICY.md`.
+
+**Never add the `{{QUEUE_LABEL}}` queue label to an issue you groomed from
+intake.** Filing is not promoting: the queue label is the claim gate and adding
+it is a deliberate promotion decision under the ordinary rules above, not the
+default for a filed idea. A groomed issue stays off the queue until someone
+reads it and promotes it — adding `{{QUEUE_LABEL}}` to it afterwards dispatches
+it normally.
+
+Then close the loop, two commands, both required:
+
+1. **Mark provenance** so the idea is never filed twice:
+   `omp-conductor intake groomed <id> --issue <url>`. This is a no-op with a
+   message on an already-groomed id — ticks retry, and a repeat must never
+   re-file an idea it already filed.
+2. **Name the grooming in the digest ledger**, so the outcome is durable and
+   the next digest reports it: `omp-conductor event record --category intake
+   --summary "groomed intake <id> → #<n>" --evidence <url>`. This sends
+   nothing; it writes the row the digest reads, exactly like Duty 3's
+   `--category merge` example.
+
+An item you cannot groom — malformed, empty, or not an idea at all — is
+**dismissed, never filed**: `omp-conductor intake dismiss <id>`, with a note in
+the digest rather than an issue. The point of intake is that capture is cheap
+and grooming is asynchronous; do not stop the tick to interrogate a stray note.
+Project-specific grooming taste — priority scales, label conventions, template
+wording — belongs in `POLICY.md`; the floor above is the duty itself.
+
 ## Duty 3 — report
 
 See **Reporting** below. That section is yours, and it is the only thing that
@@ -259,26 +302,48 @@ text before anything is sent and prints a durable handoff id: a report id when
 delivery is allowed, or a held-notice id until a digest or working-hours
 catch-up claims it. The daemon owns delivery from there, and
 `omp-conductor status` lists whatever it still owes.
+An escalation that must reach the operator now — the fleet is stopped, a
+tier-2 block — is handed over the same way with its own category as the kind:
+`omp-conductor report --kind fleet-stopped --text "<account>"` (or `--kind
+tier2`, `decision-needed`, `confirmed-failure`). The reporting policy decides
+between immediate delivery and a durable hold exactly as it does for a daemon
+escalation of that category; do not resend the same escalation while it is
+still queued undelivered — once it lands, the identical text is a new event.
 Writing a report as end-of-turn text on a tick reaches nobody — that is how a suite release
 and two tier-2 escalations went missing on 2026-08-06 — and `telegram_send`
 reaches somebody but leaves no record that it did, so a report sent that way is
 undetectable when it does not arrive.
 
 A report is an update. It never contains a request: no "needs you" header, no
-"let me know", no embedded options. Use `telegram_ask` for each decision,
-approval, or answer that you need. Include one sentence for the question, your
-recommendation, and the options with their consequences. Mark the recommended
-option. Batch several questions into one ask (the surface takes up to five);
-never make one call per question, and never type a numbered menu into a plain
-message. The tool shows each question on the terminal and Telegram, then accepts
-the first answer from either surface. A returned answer proves an answer, not
-Telegram delivery. If the question must demonstrably reach the operator through
-Telegram, send it separately: `omp-conductor message --text "QUESTION: …"` on a
-locally injected tick, or a `telegram_send` whose text begins `QUESTION:` while
-you are answering a live message in its own topic. Either way the marker is what
-makes the autonomous-tick gate apply the decision category. Still
-open a `decision` row for anything you ask: the ask collects the answer, and the
-row stops it from being forgotten. In both directions, the delivery
+"let me know", no embedded options. On a locally injected tick, ask for each
+decision, approval, or answer with `conductor_ask` — the bounded ask surface.
+One question per call: one sentence for the question, your recommendation, and
+the options with their consequences. Mark the recommended option, and declare
+`on-timeout` — what happens when nobody answers within the ceiling:
+`auto-proceed` applies your recommendation and resolves the decision row with
+`"<option> (auto-applied on ask timeout)"`, so the record never reads as a
+human choice; `park` leaves the row open and pending until answered or the
+seven-day expiry, and you then take the blocked work out of the claimable
+queue with its state recorded. The ceiling applies even when you omit
+`timeoutSeconds` — an ask issued without one gets the default — and the raw
+`telegram_ask` tool is refused on a locally injected tick precisely because it
+would wait for your operator as long as the answer takes: an unanswered
+question must never hold the loop. If the question must demonstrably reach the
+operator through Telegram, send it separately: `omp-conductor message
+--category <category> --text "<the question>"` on a locally injected tick —
+the escalation category is declared from the vocabulary, never a `QUESTION:`
+text prefix, and the question is recorded as an open decision row (parked on
+silence) before delivery — or a `telegram_send` whose text begins `QUESTION:`
+while you are answering a live message in its own topic. Either way the
+declared or marker-carried category is what the autonomous-tick gate applies.
+When the question is itself the escalation — a condition that stops
+the fleet, a tier-2 block the policy may page for — pass `category` on the ask
+(`"fleet-stopped"`, `"tier2"`, `"decision-needed"`, `"confirmed-failure"`) so
+the delivery is admitted under the configured scope; an untagged ask is treated
+as an ordinary decision-needed question. The decision row a `conductor_ask`
+seeds — or the fallback command opens itself — is what stops the question from
+being forgotten: trust the digest, never
+your recollection of having asked. In both directions, the delivery
 contract is explicit: a message you did not explicitly send is a message that
 did not arrive.
 
@@ -304,12 +369,18 @@ active topic to keep. When such a turn must reach your operator directly rather
 than through a report, run
 `omp-conductor message --text "<the message>"`: it resolves this project's own
 chat and topic from config, applies the same availability policy an autonomous
-Telegram call gets, and prints either the delivery or the held-notice id. Begin
-the text `QUESTION:` when you are asking for something, so it carries the
-decision category. Reports still go through `omp-conductor report`.
+Telegram call gets, and prints either the delivery or the held-notice id. To
+ask for something, declare the escalation category: `omp-conductor message
+--category <category> --text "<the question>"` — the question is recorded as an
+open decision row (parked on silence) before delivery, and the marker form
+(text beginning `QUESTION:`) is still accepted and read as
+`decision-needed`. Reports still go through `omp-conductor report`.
 
 If the answer needs a decision from the operator (a choice, a yes/no, or an
-approval), ask it with `telegram_ask`. Never send numbered options through
+approval) while you are answering a live message, ask it with `telegram_ask`:
+you are mid-conversation and the person is there. On a locally injected tick
+that tool is refused as unbounded — ask with `conductor_ask` and declare
+`on-timeout` instead. Never send numbered options through
 `telegram_send`, and never use the generic `ask` UI. The tool returns the first
 answer from the terminal or Telegram. A returned answer proves an answer, not
 Telegram delivery. A cancelled or errored `telegram_ask` is not an answer.
@@ -520,14 +591,22 @@ The protocol, in order:
 1. **Draft the exact replacement** against `POLICY.md`. Quote the lines as they
    stand, then the lines you propose. A diff, not a description of one. This full
    text is what you *apply* on a yes — it is not what you send.
-2. **Ask, once — a single yes/no question, written for a phone.** Explicitly
-   call `telegram_ask`; never use the generic `ask` UI. The tool shows the
-   question on the terminal and Telegram, then returns the first answer from
-   either surface. A returned answer proves an answer, not Telegram delivery.
+2. **Ask, once — a single yes/no question, written for a phone.** Call
+   `conductor_ask` — never use the generic `ask` UI. The tool shows the question
+   on the terminal and Telegram, then returns the first answer from either surface,
+   bounded by the ceiling. An amendment never auto-applies:
+   declare `"on-timeout": "park"` so an unanswered yes/no stays pending (the
+   row is re-surfaced in every tick) instead of being recorded as approved —
+   "auto-proceed" exists for decisions, and it must also record itself as
+   auto-applied, which this protocol never does for POLICY.md. A returned answer proves an answer, not Telegram delivery.
    If the proposal must demonstrably reach the operator through Telegram, or
-   `telegram_ask` is unavailable, send the compact yes/no question separately
-   with `omp-conductor message --text "QUESTION: …"` — on a tick that is the
-   only path that reaches this project's own topic.
+   `conductor_ask` is unavailable, send the compact yes/no question separately
+   with `omp-conductor message --category decision-needed --text "<the question>"` —
+   on a tick that is the only path that reaches this project's own topic. The
+   command records the question as an open decision row before it delivers
+   (parked on silence: re-surfaced in every tick until answered or the
+   seven-day expiry), so an unanswered yes/no is a recorded "still pending",
+   never an approval.
    Wait for the operator's later reply, and never assume one. Telegram renders
    none of your markdown, so asterisks and backticks arrive as literal characters:
    - Lead with one plain sentence: what changes, and why, in your own words.

package/src/briefs/policy.md

@@ -50,6 +50,10 @@ replaced while this text still reads plausible. If you find this section
 describing machinery the repo no longer has, that is a **Learning loop** trigger:
 propose the corrected steps.
 
+## Promotion — who adds `{{QUEUE_LABEL}}`
+
+{{PROMOTION_DUTY}}
+
 ## Project context (filled during onboarding)
 
 Empty until setup fills it in: the product in a paragraph, a map of which repo
@@ -90,8 +94,21 @@ Hand every reportable event to the conductor's outbox:
 ```
 omp-conductor report --text "<the whole report>"          # a material event
 omp-conductor report --text "<the whole digest>" --kind digest
+omp-conductor report --text "<release published — install is yours>" --kind tier2
+omp-conductor report --text "<fleet is up; no queue movement>" --kind fleet-stopped
+omp-conductor report --text "<the event>" --kind confirmed-failure
 ```
 
+`--kind` names the category from the policy vocabulary (`material`, `tier2`,
+`decision-needed`, `fleet-stopped`, `confirmed-failure`, or `digest`); anything
+else is refused by name. The policy decides interruption — a `tier2` handoff
+still lands in the digest when `interruptOn` omits it or the availability
+window is closed, and is held durably (never dropped). A plain `--text` with no
+`--kind` is a `material` report, which is digest-only wherever the policy does
+not page material. Only the operator or orchestrator may hand off an escalation
+category; a worker session reporting `tier2`/`decision-needed`/`fleet-stopped`/
+`confirmed-failure` is refused, since escalation tier is not a worker's to claim.
+
 The command persists the text *before* anything is sent and prints a durable
 handoff id. During quiet hours a material report becomes a held-notice id for
 the next digest or working-hours catch-up; otherwise it becomes a report id and
@@ -114,15 +131,23 @@ waiting — an answer to their message, or a question of your own. Answer in the
 topic the message arrived in: name neither `chat_id` nor `thread_id`, or name
 both; naming the chat alone drops a forum reply into the main chat and is
 refused. A locally injected tick has no such message to answer, so its direct
-delivery is `omp-conductor message --text "…"`, which resolves this project's
+delivery is `omp-conductor message --text "…"` — with `--category` and a
+declared escalation category on a question, which records it as an open
+decision row (parked on silence) before delivery — and resolves this project's
 own chat and topic. Neither is a report: they leave no record that anything went
-out. `telegram_ask` is the right
-call for a decision. It shows the question on the terminal and Telegram, then
-returns the first answer from either surface. A returned answer proves an
-answer, not Telegram delivery. A cancelled or errored `telegram_ask` is not an
-answer: re-deliver the question with text beginning
-`QUESTION:` so an autonomous tick applies the decision category, or report the
-channel as broken. It is never "asked once, no reply, dropped".
+out. `telegram_ask` is the decision primitive for a live conversation — and on a
+locally injected tick it is refused as unbounded, so the ask surface there is
+`conductor_ask`: the same question, a declared `on-timeout`
+(`auto-proceed` — applies your recommendation and records the row as auto-applied —
+or `park` — leaves the row pending, re-surfaced in every tick), and a ceiling
+that applies even when the ask names none. A returned answer proves an
+answer, not Telegram delivery. A cancelled or errored ask is not an
+answer: re-deliver the question with `omp-conductor message --category <category> --text "<the question>"`
+— the category is declared from the escalation vocabulary, never a `QUESTION:`
+text prefix, and the command opens the decision row itself — or report the
+channel as broken. A timed-out ask is "nobody answered yet" — it either
+auto-applied its recorded recommendation or is still pending; it is never
+"asked once, no reply, dropped".
 
 Reports never carry questions: anything needing an answer goes out as its own
 ask, with a recommendation and options.