omp-conductor 0.15.10 → 0.15.12

package/src/commands/doctor.ts

@@ -0,0 +1,100 @@
+/**
+ * `doctor` — read-only deployment health, one finding per past failure mode
+ * (#287, legibility 1/5).
+ *
+ * The probe logic lives in ../doctor.ts with every I/O seam injectable; this
+ * module only parses the doctor's own flags, renders the findings the runner
+ * produced (the same findings `--json` emits), and derives the exit code:
+ * nonzero iff the report contains a failing finding.
+ */
+
+import type { CommandContext } from "./context.ts";
+import { runDoctor, type DoctorReport, type FindingStatus } from "../doctor.ts";
+
+const DOCTOR_USAGE = `omp-conductor doctor — check the deployment faults that have already cost
+debugging sessions, mechanically and read-only.
+
+usage:
+  omp-conductor doctor [--project NAME] [--json] [--probe-telegram]
+
+Checks, each one the mechanical version of a past production incident:
+  gh auth         token alive and scopes cover every configured repo (a token
+                  that expired under a live daemon failed every tracker call
+                  silently)
+  labels          every configured routing/state label exists with exact case
+                  — label matching is case-sensitive and a mismatch fails
+                  silently (README Limitations)
+  systemd unit    the installed units vs the staged render (User=, environment,
+                  working directory, exec, restart/success status) and the
+                  ownership/modes of the unit and runtime dirs (the worker
+                  die-at-turn-0 class)
+  config          config.json validates, and its pre-write backup exists and
+                  is fresh
+  store           PRAGMA integrity_check
+  spend telemetry every completed run recording $0.00 means the USD cap cannot
+                  fire — $0.00 is not proof of no spend
+  timezone        reporting timezones are known IANA zones
+  telegram        bot health, and one self-identified probe message
+
+flags:
+  --json                 print the stable report shape {project, checkedAt,
+                         status, findings:[{id,status,summary,fix?}]} — the CI
+                         contract
+  --probe-telegram       the ONE opt-in side effect: send one self-identified
+                         test message through the report transport
+  --project NAME         narrow to one project. With no name, the host-wide
+                         facts are checked once and every configured project's
+                         per-project facts (labels, timezone, telegram) are
+                         checked, each named.
+
+Exit code is 0 only when nothing failed; warnings do not fail the run.`;
+
+const LABEL_BY_STATUS: Record<FindingStatus, string> = { pass: "PASS", warn: "WARN", fail: "FAIL" };
+
+/** Renders the same findings `--json` emits, so the two cannot disagree. */
+export function renderDoctorReport(report: DoctorReport): string {
+  const width = Math.max(...report.findings.map((f) => f.id.length).concat(0), 8);
+  const lines = [
+    `omp-conductor doctor — ${report.project}`,
+    `status: ${report.status.toUpperCase()} (${report.findings.filter((f) => f.status === "fail").length} failed · ${report.findings.filter((f) => f.status === "warn").length} warnings) · checked ${report.checkedAt}`,
+    "",
+  ];
+  for (const f of report.findings) {
+    const pad = " ".repeat(Math.max(0, width - f.id.length));
+    lines.push(`  ${LABEL_BY_STATUS[f.status].padEnd(5)}  ${f.id}${pad}  ${f.summary}`);
+    if (f.fix !== undefined) lines.push(`        ${" ".repeat(width)}  fix: ${f.fix}`);
+  }
+  return `${lines.join("\n")}\n`;
+}
+
+export async function doctorCommand(ctx: CommandContext): Promise<void> {
+  // Help first: parsing stops before any probe, config read, or side effect.
+  if (ctx.argv[1] === "--help" || ctx.argv[1] === "-h") {
+    process.stdout.write(`${DOCTOR_USAGE}\n`);
+    return;
+  }
+  // Every remaining token after the verb is accounted for: the two flag
+  // presence markers and the `--project NAME` pair cli.ts already parsed.
+  const DOCTOR_FLAGS: Record<string, true> = {
+    "--json": true,
+    "--probe-telegram": true,
+    "--project": true,
+  };
+  for (let i = 1; i < ctx.argv.length; i++) {
+    const token = ctx.argv[i];
+    if (token === undefined) continue;
+    if (DOCTOR_FLAGS[token] !== true) {
+      process.stderr.write(`omp-conductor: doctor: unexpected argument "${token}"\n`);
+      process.exit(2);
+    }
+    if (token === "--project") i += 1;
+  }
+
+  const report = await runDoctor(ctx.projectFlag, {
+    probeTelegram: ctx.argv.includes("--probe-telegram"),
+  });
+  if (ctx.argv.includes("--json")) process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+  else process.stdout.write(renderDoctorReport(report));
+  // The one contract CI reads: nonzero iff something failed. Warnings pass.
+  if (report.status === "fail") process.exitCode = 1;
+}

package/src/commands/event.ts

@@ -0,0 +1,62 @@
+/**
+ * `event` — persist one ordinary material outcome without sending it.
+ *
+ * Moved out of cli.ts's switch by the per-verb module split (#462);
+ * only the case wrapper, the injected `ctx` lookups and the imports
+ * changed from the original bodies.
+ */
+
+import type { CommandContext } from "./context.ts";
+import { findProject, loadConfig } from "../config.ts";
+import { dbPath, openStore } from "../store.ts";
+
+export async function eventCommand(ctx: CommandContext): Promise<void> {
+if (ctx.argv[1] !== "record") {
+  process.stderr.write("omp-conductor: event needs the record subcommand\n");
+  process.exit(2);
+}
+const category = ctx.flag("category");
+const summary = ctx.flag("summary")?.replace(/\s+/g, " ").trim();
+const evidence = ctx.flag("evidence")?.replace(/\s+/g, " ").trim();
+if (
+  category === undefined ||
+  !/^[a-z0-9][a-z0-9-]{0,31}$/.test(category) ||
+  summary === undefined ||
+  summary.length === 0 ||
+  summary.length > 240 ||
+  summary.startsWith("--") ||
+  evidence === undefined ||
+  evidence.length === 0 ||
+  evidence.length > 500 ||
+  evidence.startsWith("--")
+) {
+  process.stderr.write(
+    "omp-conductor: event record needs --category with a lowercase slug, --summary (1-240 chars), and --evidence (1-500 chars)\n",
+  );
+  process.exit(2);
+}
+const rawOccurredAt = ctx.flag("occurred-at");
+const recordedAt = Date.now();
+const occurredAt = rawOccurredAt === undefined ? recordedAt : Date.parse(rawOccurredAt);
+if (!Number.isFinite(occurredAt)) {
+  process.stderr.write("omp-conductor: event record --occurred-at needs an ISO timestamp\n");
+  process.exit(2);
+}
+const project = findProject(loadConfig(), ctx.projectFlag);
+const store = openStore(dbPath());
+try {
+  const event = store.recordMaterialEvent({
+    project: project.name,
+    category,
+    summary,
+    evidence,
+    occurredAt,
+    recordedAt,
+  });
+  process.stdout.write(
+    `event ${event.id} recorded for ${project.name} (${event.category}, ${new Date(event.occurredAt).toISOString()}) — nothing sent\n`,
+  );
+} finally {
+  store.close();
+}
+}

package/src/commands/extend.ts

@@ -0,0 +1,64 @@
+/**
+ * `extend` — raise a live run's turn ceiling, or set a bounded one-shot ceiling after a failed, killed, orphaned or blocked run.
+ *
+ * Moved out of cli.ts's switch by the per-verb module split (#462);
+ * only the case wrapper, the injected `ctx` lookups and the imports
+ * changed from the original bodies.
+ */
+
+import type { CommandContext } from "./context.ts";
+import { findProject, loadConfig } from "../config.ts";
+import { livingDaemon } from "../lifecycle.ts";
+
+export async function extendCommand(ctx: CommandContext): Promise<void> {
+const issue = ctx.issueArg("extend", ctx.argv[1]);
+const maxTurns = ctx.turnsFlag();
+const project = findProject(loadConfig(), ctx.projectFlag);
+const daemon = livingDaemon();
+if (daemon === undefined) throw new Error("daemon is not running");
+if (daemon.project !== undefined && daemon.project !== project.name) {
+  throw new Error(
+    `daemon serves project "${daemon.project}", not requested project "${project.name}"`,
+  );
+}
+const response = await fetch(
+  `http://127.0.0.1:${daemon.port}/runs/${issue}/turn-limit`,
+  {
+    method: "PUT",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ project: project.name, maxTurns }),
+  },
+);
+const payload = (await response.json()) as {
+  error?: unknown;
+  kind?: unknown;
+  runId?: unknown;
+  maxTurns?: unknown;
+  issue?: unknown;
+  nextAttemptMaxTurns?: unknown;
+  baseMaxTurns?: unknown;
+};
+if (!response.ok) {
+  throw new Error(
+    typeof payload.error === "string" ? payload.error : `daemon returned HTTP ${response.status}`,
+  );
+}
+if (
+  payload.kind === "next-attempt" &&
+  payload.issue === issue &&
+  typeof payload.nextAttemptMaxTurns === "number" &&
+  typeof payload.baseMaxTurns === "number"
+) {
+  process.stdout.write(
+    `#${issue} next attempt turn ceiling set to ${payload.nextAttemptMaxTurns} ` +
+      `(project base ${payload.baseMaxTurns})\n`,
+  );
+  return;
+}
+if (typeof payload.runId !== "string" || typeof payload.maxTurns !== "number") {
+  throw new Error("daemon returned an invalid turn-extension response");
+}
+process.stdout.write(
+  `#${issue} turn ceiling extended to ${payload.maxTurns} (run ${payload.runId})\n`,
+);
+}

package/src/commands/friction.ts

@@ -0,0 +1,56 @@
+/**
+ * `friction` — record a bounded observation the daemon cannot classify itself.
+ *
+ * Moved out of cli.ts's switch by the per-verb module split (#462);
+ * only the case wrapper, the injected `ctx` lookups and the imports
+ * changed from the original bodies.
+ */
+
+import type { CommandContext } from "./context.ts";
+import { findProject, loadConfig } from "../config.ts";
+import { dbPath, openStore } from "../store.ts";
+
+const FRICTION_FEEDBACK_KINDS = {
+  "escalation-digest": "feedback:escalation-should-digest",
+  "report-noise": "feedback:report-noise",
+  "report-surprise": "feedback:report-surprise",
+} as const;
+
+type FrictionFeedbackName = keyof typeof FRICTION_FEEDBACK_KINDS;
+
+export async function frictionCommand(ctx: CommandContext): Promise<void> {
+const name = ctx.argv[1] as FrictionFeedbackName | undefined;
+if (name === undefined || !Object.hasOwn(FRICTION_FEEDBACK_KINDS, name)) {
+  process.stderr.write(
+    "omp-conductor: friction needs one of: escalation-digest, report-noise, report-surprise\n",
+  );
+  process.exit(2);
+}
+const rawDetail = ctx.flag("detail");
+const detail = rawDetail?.replace(/\s+/g, " ").trim();
+if (
+  detail === undefined ||
+  detail.length === 0 ||
+  detail.length > 160 ||
+  rawDetail?.startsWith("--") === true
+) {
+  process.stderr.write("omp-conductor: friction needs --detail with 1-160 characters\n");
+  process.exit(2);
+}
+const issueText = ctx.flag("issue");
+const issue = issueText === undefined ? undefined : ctx.issueArg("friction --issue", issueText);
+const project = findProject(loadConfig(), ctx.projectFlag);
+const store = openStore(dbPath());
+try {
+  store.recordFriction(project.name, {
+    kind: FRICTION_FEEDBACK_KINDS[name],
+    occurrences: 1,
+    ...(issue === undefined ? {} : { issue }),
+    sample: detail,
+    at: Date.now(),
+  });
+} finally {
+  store.close();
+}
+process.stdout.write(`friction recorded for ${project.name}: ${name} — ${detail}\n`);
+}

package/src/commands/help.ts

@@ -0,0 +1,9 @@
+/**
+ * `help` / `--help` / `-h`: print the shared usage text. The text itself stays
+ * in cli.ts as `USAGE` — the contract of the per-verb module split (#462) keeps
+ * the shared usage text next to the registration table, so it is passed in
+ * rather than re-exported.
+ */
+export function helpCommand(usage: string): void {
+  process.stdout.write(`${usage}\n`);
+}

package/src/commands/hold.ts

@@ -0,0 +1,26 @@
+/**
+ * `hold` — soft stop: pause claiming AND disarm ticks; daemon and pane stay up.
+ *
+ * Moved out of cli.ts's switch by the per-verb module split (#462);
+ * only the case wrapper, the injected `ctx` lookups and the imports
+ * changed from the original bodies.
+ */
+
+import type { CommandContext } from "./context.ts";
+import { hold } from "../fleet.ts";
+
+export async function holdCommand(ctx: CommandContext): Promise<void> {
+const keepTicks = ctx.argv.includes("--keep-ticks");
+for (const project of ctx.targetProjects()) {
+  const r = hold(project.name, "hold", keepTicks ? { keepTicks: true } : {});
+  process.stdout.write(
+    `held — claiming paused` +
+      `${r.wasPaused ? " (already paused)" : ""}` +
+      (r.disarmed === undefined
+        ? "; ticks left armed — resume restores the fleet with no new arm challenge"
+        : `; ticks disarmed at ${r.disarmed.path}` +
+          `${r.disarmed.wasArmed ? "" : " (was already disarmed)"}`) +
+      `\ndaemon and pane left running; stop to stop the daemon too\n`,
+  );
+}
+}

package/src/commands/intake.ts

@@ -0,0 +1,155 @@
+/**
+ * `intake` — capture a raw idea durably before it becomes anything (#298).
+ *
+ * The store is the point of the verb: an idea captured at 02:00 is still there
+ * after a restart, and `status` counts what is still pending so a backlog
+ * cannot quietly empty itself. This surface records, lists, dismisses and —
+ * once the orchestrator has groomed an idea into an issue (#300) — marks the
+ * provenance of that grooming via `resolveIntake`'s `groomed` path.
+ */
+
+import type { CommandContext } from "./context.ts";
+import { findProject, loadConfig } from "../config.ts";
+import { dbPath, openStore } from "../store.ts";
+
+const INTAKE_USAGE = `omp-conductor intake — capture raw ideas durably.
+
+usage:
+  omp-conductor intake "<text>" [--project NAME]
+  omp-conductor intake list [--project NAME]
+  omp-conductor intake dismiss <id> [--project NAME]
+  omp-conductor intake groomed <id> --issue <url> [--project NAME]
+
+Captures one raw idea into the local store and prints its id. list shows what
+is still pending (id, age, text), oldest first; dismiss drops one by id. The
+capture is durable — it lives in the sqlite store, not in a session — so it
+survives daemon restarts. The orchestrator files the idea as an issue and then
+marks that provenance with groomed: an id already resolved is a no-op with a
+message, never an error, because ticks retry.`;
+
+/** Flags the intake surface understands. `--project` is consumed by
+ *  {@link CommandContext.projectFlag}; the value token stays in argv. */
+const INTAKE_FLAGS: Record<string, true> = { "--project": true, "--issue": true };
+
+/** Every remaining token after the subverb must be one of the known flags
+ *  (or its value), otherwise the operator typo'd something that would be
+ *  silently ignored — the same exit-2 scan `stats` runs (#462). */
+function assertKnownArgs(ctx: CommandContext, from: number): void {
+  for (let i = from; i < ctx.argv.length; i++) {
+    const token = ctx.argv[i];
+    if (token === undefined) continue;
+    if (INTAKE_FLAGS[token] === true) {
+      i += 1;
+      continue;
+    }
+    if (token.startsWith("--project=")) continue;
+    process.stderr.write(`omp-conductor: intake: unexpected argument "${token}"\n`);
+    process.exit(2);
+  }
+}
+
+export async function intakeCommand(ctx: CommandContext): Promise<void> {
+  const sub = ctx.argv[1];
+  if (sub === "--help" || sub === "-h") {
+    process.stdout.write(INTAKE_USAGE);
+    return;
+  }
+  const project = findProject(loadConfig(), ctx.projectFlag);
+  const store = openStore(dbPath());
+  try {
+    if (sub === "list") {
+      assertKnownArgs(ctx, 2);
+      const pending = store.pendingIntake(project.name);
+      if (pending.length === 0) {
+        process.stdout.write("no pending ideas\n");
+        return;
+      }
+      const now = Date.now();
+      for (const item of pending) {
+        // Age at capture granularity: minutes for a fresh idea, hours once it
+        // has been waiting a while — the unit the operator actually cares about.
+        const minutes = Math.max(0, Math.round((now - item.createdAt) / 60_000));
+        const age = minutes < 60 ? `${minutes}m` : `${Math.floor(minutes / 60)}h`;
+        process.stdout.write(`${item.id}  ${age.padStart(5)}  ${item.text}\n`);
+      }
+      return;
+    }
+
+    if (sub === "dismiss") {
+      assertKnownArgs(ctx, 3);
+      const id = ctx.argv[2];
+      if (id === undefined || id.startsWith("--")) {
+        process.stderr.write("omp-conductor: intake dismiss needs the idea id\n");
+        process.exit(2);
+      }
+      if (!store.resolveIntake(id, "dismissed")) {
+        process.stderr.write(
+          `omp-conductor: no intake item ${id} for ${project.name} — it was already resolved, or the id is wrong\n`,
+        );
+        process.exit(1);
+      }
+      process.stdout.write(`intake ${id} dismissed\n`);
+      return;
+    }
+
+    if (sub === "groomed") {
+      assertKnownArgs(ctx, 3);
+      const id = ctx.argv[2];
+      const url = ctx.flag("issue")?.trim();
+      if (id === undefined || id.startsWith("--") || url === undefined || url.length === 0) {
+        process.stderr.write("omp-conductor: intake groomed needs the idea id and --issue <url>\n");
+        process.exit(2);
+      }
+      if (!store.resolveIntake(id, "groomed", url)) {
+        // Ticks retry: an id that is already groomed (or unknown) is a no-op
+        // with a message, not an error, so a re-filed tick never fails here.
+        process.stdout.write(`intake ${id} already resolved or unknown — nothing to do\n`);
+        return;
+      }
+      process.stdout.write(`intake ${id} groomed → ${url}\n`);
+      return;
+    }
+
+    if (sub !== undefined && sub.startsWith("--") && INTAKE_FLAGS[sub] !== true) {
+      process.stderr.write(`omp-conductor: intake: unexpected argument "${sub}"\n`);
+      process.exit(2);
+    }
+
+    // Capture: the text is the first non-flag token, wherever it sits. Flags
+    // may come before or after it; anything beyond one text token is a typo.
+    let text: string | undefined;
+    for (let i = 1; i < ctx.argv.length; i++) {
+      const token = ctx.argv[i];
+      if (token === undefined) continue;
+      if (INTAKE_FLAGS[token] === true) {
+        i += 1;
+        continue;
+      }
+      if (token.startsWith("--project=")) continue;
+      if (token.startsWith("--")) {
+        process.stderr.write(`omp-conductor: intake: unexpected argument "${token}"\n`);
+        process.exit(2);
+      }
+      if (text !== undefined) {
+        process.stderr.write(`omp-conductor: intake: unexpected argument "${token}"\n`);
+        process.exit(2);
+      }
+      text = token;
+    }
+    const trimmed = text?.trim();
+    if (trimmed === undefined || trimmed.length === 0) {
+      process.stderr.write(
+        "omp-conductor: intake needs a non-empty idea text — e.g. omp-conductor intake \"ship the intake command\"\n",
+      );
+      process.exit(2);
+    }
+    const item = store.recordIntake({
+      project: project.name,
+      text: trimmed,
+      at: Date.now(),
+    });
+    process.stdout.write(`intake ${item.id} recorded — see it with: omp-conductor intake list\n`);
+  } finally {
+    store.close();
+  }
+}

package/src/commands/ledger.ts

@@ -0,0 +1,69 @@
+/**
+ * `ledger` — every conductor-verb call and how the daemon decided it, plus the durable per-issue turn budgets.
+ *
+ * Moved out of cli.ts's switch by the per-verb module split (#462);
+ * only the case wrapper, the injected `ctx` lookups and the imports
+ * changed from the original bodies.
+ */
+
+import type { CommandContext } from "./context.ts";
+import { findProject, loadConfig } from "../config.ts";
+import { dbPath, openStore } from "../store.ts";
+import { formatVerbLedgerEntry } from "../verbs/ledger.ts";
+
+export async function ledgerCommand(ctx: CommandContext): Promise<void> {
+const cfg = loadConfig();
+const p = findProject(cfg, ctx.projectFlag);
+const issueFlag = ctx.flag("issue");
+const issue = issueFlag === undefined ? undefined : ctx.issueArg("ledger", issueFlag);
+const limitFlag = ctx.flag("limit");
+const limit = limitFlag === undefined ? 50 : Number.parseInt(limitFlag, 10);
+if (!Number.isSafeInteger(limit) || limit < 1) {
+  process.stderr.write(`omp-conductor: ledger --limit needs a positive integer, got "${limitFlag ?? ""}"\n`);
+  process.exitCode = 1;
+  return;
+}
+// Read-only, WAL, same as `tail`: this never contends with the daemon
+// writing the rows it is printing.
+const store = openStore(dbPath());
+try {
+  const entries = store.verbLedger(p.name, {
+    ...(issue === undefined ? {} : { issue }),
+    limit,
+  });
+  const overrides = store.turnOverrideLedger(p.name, {
+    ...(issue === undefined ? {} : { issue }),
+    limit,
+  });
+  if (entries.length === 0 && overrides.length === 0) {
+    process.stdout.write(
+      `no conductor actions recorded for ${p.name}` +
+        `${issue === undefined ? "" : ` on #${String(issue)}`}\n`,
+    );
+    return;
+  }
+  const blocks: string[] = [];
+  if (entries.length > 0) {
+    const refused = entries.filter((e) => e.decision === "refused").length;
+    blocks.push(
+      `${p.name} — ${entries.length} verb call(s), ${refused} refused (newest first)\n` +
+        entries.flatMap(formatVerbLedgerEntry).join("\n"),
+    );
+  }
+  if (overrides.length > 0) {
+    blocks.push(
+      `${p.name} — ${overrides.length} turn override(s) (newest first)\n` +
+        overrides
+          .map(
+            (entry) =>
+              `  ${new Date(entry.setAt).toISOString()}  #${entry.issue}  ` +
+              `${entry.maxTurns} turns`,
+          )
+          .join("\n"),
+    );
+  }
+  process.stdout.write(`${blocks.join("\n\n")}\n`);
+} finally {
+  store.close();
+}
+}

package/src/commands/message.ts

@@ -0,0 +1,96 @@
+/**
+ * `message` — deliver one direct Telegram message to the project's own chat and forum topic, applying the same availability policy as a tick.
+ *
+ * A question-shaped message — text that begins with the floor's `QUESTION:`
+ * marker, or an explicitly declared escalation `--category` that is not
+ * `material` — is an ask, not a send: the row is recorded before anything is
+ * delivered (#520), so "asked once, no reply" is a durable open decision row
+ * re-surfaced in every tick until answered or the seven-day expiry, and the
+ * caller never has to remember a separate `decision open`.
+ *
+ * Moved out of cli.ts's switch by the per-verb module split (#462);
+ * only the case wrapper, the injected `ctx` lookups and the imports
+ * changed from the original bodies.
+ */
+
+import type { CommandContext } from "./context.ts";
+import { randomUUID } from "node:crypto";
+import { findProject, loadConfig } from "../config.ts";
+import { deliverOperatorMessage, operatorMessageCategory, type OperatorMessageOutcome } from "../reports.ts";
+import { dbPath, openStore } from "../store.ts";
+import { INTERRUPT_CATEGORIES, type DecisionRecord, type InterruptCategory } from "../types.ts";
+
+/** The floor's "this needs an answer" marker, as every other classifier reads it. */
+const QUESTION_MARKER = /^\s*QUESTION:\s/i;
+
+export async function messageCommand(ctx: CommandContext): Promise<void> {
+  const rawText = ctx.flag("text");
+  const body = rawText?.trim();
+  if (body === undefined || body.length === 0 || rawText?.startsWith("--") === true) {
+    process.stderr.write("omp-conductor: message needs --text with the message to deliver\n");
+    process.exit(2);
+  }
+  const categoryRaw = ctx.flag("category");
+  if (
+    categoryRaw !== undefined &&
+    !(INTERRUPT_CATEGORIES as readonly string[]).includes(categoryRaw)
+  ) {
+    process.stderr.write(
+      `omp-conductor: message category must be one of ${INTERRUPT_CATEGORIES.join(", ")} — a question's category is part of the ask, never a text prefix\n`,
+    );
+    process.exit(2);
+  }
+  const category = categoryRaw as InterruptCategory | undefined;
+  const blocks = ctx.flag("blocks")?.trim();
+
+  const project = findProject(loadConfig(), ctx.projectFlag);
+  const store = openStore(dbPath());
+  // The durable row exists before the delivery attempt, exactly like the
+  // `conductor_ask` tool: a crash at any point leaves a recorded question, so
+  // the "asked, awaiting the operator" half of the ask cannot be lost. Silence
+  // means the row stays open — re-surfaced in every tick until answered or the
+  // seven-day expiry; it never records an approval.
+  const effectiveCategory = category ?? operatorMessageCategory(body);
+  const isAsk = QUESTION_MARKER.test(body) || effectiveCategory !== "material";
+  let row: DecisionRecord | undefined;
+  let outcome: OperatorMessageOutcome;
+  try {
+    if (isAsk) {
+      row = store.createDecision({
+        project: project.name,
+        // The row archives the question, not the delivery prefix.
+        question: body.replace(QUESTION_MARKER, "").trim(),
+        ...(blocks === undefined ? {} : { blocks }),
+        at: Date.now(),
+      });
+    }
+    outcome = await deliverOperatorMessage(project, body, {
+      store,
+      at: Date.now(),
+      noticeId: randomUUID(),
+      ...(category === undefined ? {} : { category }),
+    });
+  } catch (err) {
+    process.stderr.write(
+      `omp-conductor: message: ${err instanceof Error ? err.message : String(err)}\n`,
+    );
+    process.exit(2);
+  } finally {
+    store.close();
+  }
+  if (row !== undefined) {
+    process.stdout.write(
+      `decision ${row.id} recorded — parked on silence: the question stays open until answered or the seven-day expiry. ` +
+        `Resolve it later with: omp-conductor decision resolve ${row.id} --answer "..."\n`,
+    );
+  }
+  process.stdout.write(
+    outcome.kind === "sent"
+      ? // Not "into the topic": a stale topic degrades to the flat chat with
+        // its own warning on stderr, and this line must not contradict it.
+        `message delivered to ${project.name}'s configured Telegram target (${outcome.category})\n`
+      : `held notice ${outcome.noticeId} queued for ${project.name} (${outcome.category}; ` +
+          `${outcome.reason === "availability" ? "outside the availability window" : "a digest-only category"})\n` +
+          "nothing was sent; the daemon releases it with the next digest or working-hours catch-up\n",
+  );
+}