omp-conductor 0.15.5 → 0.15.7

package/README.md

@@ -326,8 +326,16 @@ you decide. It is your fleet.
 
 ### What setup reads for you
 
-Rather than asking about your repos, setup reads them. Each probe is a short,
-confined session in a throwaway shallow clone, and **every answer is a proposal**:
+Setup discovers factual defaults before it asks for them. `git remote get-url
+origin` supplies the tracker repo and single-repo routing key; bounded `gh` calls
+supply the default branch, existing queue/state labels, branch-protection checks,
+environments, an unambiguous npm package name, and GitHub Projects/open milestones.
+Each discovered value is shown with its evidence and remains editable at the same
+prompt. Discovery only seeds a fresh interview: a re-run starts from the saved
+project, so an operator-edited value is never guessed again.
+
+Judgment and prose still belong to the existing confined model probes, and **every
+answer is a proposal**:
 
 - **Gates.** Reads each routing repo's CI workflows, `package.json` scripts and
   `Makefile`/`justfile`, then pre-fills the [gates](#configuration) prompt with the
@@ -340,15 +348,15 @@ confined session in a throwaway shallow clone, and **every answer is a proposal*
   confirm**. `POLICY.md` is re-read on every tick, so a paragraph you never read
   would become an instruction the orchestrator follows all week.
 
-A probe has **no shell, no editor and no verbs**: it reads files and answers, and a
-tool it was not given is refused rather than allowed. It is not a sandbox — it runs
-as your own user and reads what you can read — which is why it is pointed only at
-repos you configured yourself.
+A model probe has **no shell, no editor and no verbs**: it reads files and answers,
+and a tool it was not given is refused rather than allowed. It is not a sandbox —
+it runs as your own user and reads what you can read — which is why it is pointed
+only at repos you configured yourself.
 
-**Setup never fails because a probe did.** No omp peer on the host, a repo it cannot
-clone, a cap reached, prose where JSON was asked for: each costs one warning and
-leaves the shipped stub, which says what belongs there and how to fill it in. Every
-question is still asked.
+**Setup never fails because discovery or a probe did.** No `gh`, no auth or
+network, a private repo, no omp peer, a clone failure, a timeout, or a malformed
+reply each produces a warning and leaves the typed default in place. Every question
+is still asked.
 
 Skip the reading half entirely with `--no-ai`:
 
@@ -1480,6 +1488,32 @@ anything it still owes. If availability closes after a material report was
 queued but before its first attempt, the outbox atomically converts that row to
 the same held-notice path instead of leaking the update through quiet hours.
 
+### Answering a person, in the thread they wrote in
+
+A report is an update; an answer is a conversation, and it goes back where the
+question came from. `telegram_send` keeps the active forum topic **only while it
+names no chat** — `thread_id` defaults to the active topic when `chat_id` is
+omitted — so an orchestrator that helpfully supplied `chat_id` (and nothing
+else) answered three topic messages in the main chat instead (#366). The
+orchestrator floor now says to name **neither** target or **both**, and the
+dispatcher refuses `chat_id` without `thread_id` for a project that configured
+`escalation.telegramTopicId`. A flat-chat project is unaffected.
+
+A locally injected tick has no inbound message to inherit a topic from, so a
+bare `telegram_send` there has nothing to preserve. That turn addresses the
+operator from config instead:
+
+```bash
+omp-conductor message --text "<the message>"                  # this project's chat and topic
+omp-conductor message --text "QUESTION: cut 0.16.0 tonight?"  # carries the decision category
+```
+
+It is not a bypass of the interrupt policy: the same availability decision an
+autonomous Telegram tool call gets is applied, so a message the policy defers is
+durably held for the digest or the working-hours catch-up and the command prints
+that held-notice id instead of claiming delivery. It is also not a report — it
+leaves no `reports` row, and nothing retries it.
+
 ### Delivery is at-least-once, and the docs will not pretend otherwise
 
 The Telegram Bot API accepts no client-supplied idempotency key and offers the
@@ -1804,7 +1838,8 @@ A complete, valid config for one project with two target repos:
               { "cmd": "bun test", "cwd": "." }
             ],
             "graphProject": "~/.cache/conductor-graph/acme/api",
-            "migrations": { "dir": "backend/alembic/versions" }
+            "migrations": { "dir": "backend/alembic/versions" },
+            "release": { "versionFile": "omp/package.json" }
           },
           "worker": {
             "name": "worker",
@@ -1833,6 +1868,7 @@ A complete, valid config for one project with two target repos:
         "release": "human"
       },
       "releasePolicy": {
+        "version-bump-pr": "human",
         "git-tag": "human",
         "git-push-tags": "human",
         "package-publish": "human",
@@ -1853,6 +1889,13 @@ A complete, valid config for one project with two target repos:
           "environments": ["staging"]
         }
       },
+      "recoveryMerges": [
+        {
+          "prUrl": "https://github.com/acme/api/pull/381",
+          "headSha": "9a783d8f17071d63f2d5d764d43a29837c365920",
+          "reason": "operator-instructed"
+        }
+      ],
       "reporting": {
         "scope": "material"
       },
@@ -1871,6 +1914,7 @@ Field notes:
 | `defaults` | Every `Caps` field. Anything omitted falls back to the built-in default. |
 | `tracker.repo` | `owner/repo`. `tracker.kind` may be omitted; `"github"` is the only accepted value. |
 | `queueLabel` | The one label meaning "a human has signed this off as agent-ready". Matched exactly, case-sensitively. |
+| `release.versionFile` | Optional, per repo: a repo-relative JSON file with a top-level string `version`, such as `omp/package.json`. Declares that tags must match the version already landed on the live default branch. A delegated `git-tag` for such a repo requires delegated `version-bump-pr` too; otherwise config loading fails with the missing preparation path instead of granting an impossible release. Absolute paths and `..` are refused. |
 | `groomBelow` | Optional; default `4`. Routable candidates below this count make the orchestrator's tick prompt say the queue is running low and to groom it (Duty 2). An integer ≥ 1; anything else degrades to the default. |
 | `stateLabels` | Optional; defaults to `agent:in-progress`, `agent:blocked`, `agent:failed`. |
 | `routing.labelPrefix` | Optional; defaults to `repo:`. |
@@ -1882,7 +1926,8 @@ Field notes:
 | `escalation.fallbackToIssueComment` | Defaults to `true`. Absent means "yes, still tell me". |
 | `escalation.orchestrator` | Optional; `"embedded"` (default) or `"external"`. `external` means an orchestrator session already runs elsewhere: the daemon starts none, and tier-1 escalations post as issue comments for that session to drain. Any other value is an error. |
 | `authority` | Optional; `{ "merge": …, "release": … }`, each `"human"` (default) or `"orchestrator"`. It grants nothing to the daemon — it words the orchestrator's standing orders and the Releases paragraph of the rendered brief, so the config and the prompt cannot disagree about who holds the merge button. Unknown keys and any other value are errors, never folded to the default. |
-| `releasePolicy` | Optional; `"none"` (default) or `"operator-brief"`. `none` installs a pre-tool-call tripwire in worker, embedded-orchestrator and external-orchestrator sessions. It blocks `git tag`, tag pushes, package publishing, GitHub release creation and recognised deploy commands before execution. `operator-brief` opens that gate only for the procedure in the operator-owned brief. Unknown values are errors. Every rejection is written to `release-policy-blocks.jsonl`; the heartbeat carries that day's count into the daily digest so configured intent and observed behaviour cannot drift silently. This is the mechanical gate; `authority.release` still says who owns the decision. |
+| `releasePolicy` | Optional; a per-shape map whose values are `"human"` (default) or `"orchestrator"`. Shapes are `version-bump-pr`, `git-tag`, `git-push-tags`, `package-publish`, `github-release`, and `deploy`. The legacy `"none"` denies every shape; legacy `"operator-brief"` grants the artifact-producing shapes, including reviewed version preparation, but keeps deploy human-owned. The in-session tripwire blocks recognised raw release/deploy calls before execution. Every rejection is written to `release-policy-blocks.jsonl`; the heartbeat carries that day's count into the daily digest. This is the mechanical gate; `authority.release` still says who owns the decision. |
+| `recoveryMerges` | Optional, hand-edited recovery authority for a PR that has no conductor run record. Each entry is an exact `{ prUrl, headSha, reason: "operator-instructed" }` tuple. When all three values match, `conductor_pr_merge` may merge that one PR even while the fleet is held and even when standing merge authority is `"human"`. It still requires a routed project repo, an open PR at that exact live head, green checks, the migration-chain guard, and the single-flight lock—the same safety path as an ordinary merge. Duplicate PR URLs and malformed values make config loading fail closed. Setup preserves entries but never creates them. Remove an entry after the recovery is complete. |
 | `reporting` | Optional; a **legacy scope preset** (`reporting.scope` — `"material"` default, `"decisions"`, `"escalations"`) or the **explicit form** `{ "interruptOn": [...], "digest": { ... }, "availability": { ... } }`. The preset writes which categories may page the operator (`interruptOn`) and when the rollup happens (`digest.cadence`); the explicit form sets both directly and may add a weekly operator-availability window. The two forms are mutually exclusive in one config. See [Reporting policy](#reporting-policy-reporting). |
 | `orchestratorReadPaths` | **Retired in 0.4.3.** Still accepted in a config and ignored, so a fleet carrying it upgrades without an edit. It widened the orchestrator's file-tool allowlist; there is no allowlist any more — the orchestrator is [unconfined by design](#the-orchestrator-is-unconfined-deliberately). |
 | `policy` | Optional; the gating conditions a merge or a release must satisfy, in two sections — `policy.merge` and `policy.release`. Any member may be omitted and the loader fills it from the strict default; an unknown key in either section, or a value outside its vocabulary, is an error naming the field, never a silent downgrade. See [Merge and release preconditions](#merge-and-release-preconditions-policy). |
@@ -2326,6 +2371,7 @@ omp-conductor verb <conductor_*> [--project NAME] [--arg k=v ...]
 omp-conductor friction <escalation-digest|report-noise|report-surprise> --detail TEXT [--issue N] [--project NAME]
 omp-conductor event record --category NAME --summary TEXT --evidence REF [--occurred-at ISO] [--project NAME]
 omp-conductor report --text TEXT [--kind material|digest] [--events IDS] [--notices IDS] [--project NAME]
+omp-conductor message --text TEXT [--project NAME]
 omp-conductor decision open --question TEXT [--blocks TEXT] [--resolves-when COND] [--project NAME]
 omp-conductor decision resolve <id> --answer TEXT [--project NAME]
 omp-conductor decision withdraw <id> [--reason TEXT] [--project NAME]
@@ -2341,9 +2387,9 @@ omp-conductor help
 | `setup [area] [--no-ai] [--project NAME]` | The deterministic interview, in a plain terminal — the same prompts, the same one-writer apply sequence, and the same single consent gate as `omp-conductor setup`, which is now one dialog implementation of the shared surface rather than the only way in. Bare is a full first run, or — when the project already exists — a chooser of which area to amend. Naming an area positionally skips that chooser and amends only that area: `tracker`, `gates`, `caps`, `code-graph`, `authority`, `policy`, `escalation`, `reporting`, `brief`. `host` and `graph` are install subcommands rather than areas and are matched first; anything else exits `2` listing both vocabularies. Every prompt shows its current value as the default, and Enter accepts what you see; `Ctrl-C` at any prompt abandons the run and writes nothing. Setup also **reads your repos to propose answers**: the gates prompt is pre-filled from what CI actually runs, and the brief's `## Project context` and release procedure are drafted from every routing repo and shown for confirmation before anything is written. Each probe is a short session with **no shell, no editor and no verbs** in a throwaway shallow clone, and every answer is a proposal you edit or decline — a probe that cannot clone, cannot reach a model, or answers unusably costs you one warning and the shipped stub. `--no-ai` asks every question with the reading half removed. |
 | `setup host [--project NAME]` | Re-render and stage the systemd unit, then **run** the install: `install -m 0644` into `/etc/systemd/system`, `daemon-reload`, `enable`, `restart`. Every command is shown with its exact argv, one confirm covers the batch, and `sudo` asks for your password once before the first step — or is skipped entirely on a fleet that genuinely runs as root. The first failure stops the rest and prints the un-run remainder verbatim so you can finish by hand. Refuses an *escalated* invocation (`sudo`, or `sudo -i`/`su -` detected by the invoking account disagreeing with the fleet's) before writing anything, naming both accounts, because staging derives the unit's `User=`/`HOME=` from whoever ran it. On a non-Linux host the files are still staged and only the `systemctl` steps are refused. |
 | `setup graph [--no-seed] [--print] [--project NAME]` | The code-graph install end to end, in one preview and one confirm: check the prerequisites read-only and stop before installing anything when `codebase-memory-mcp` is absent or no MCP entry mounts it (printing the entry to add); `git clone` each missing index-only checkout **as you, never through sudo**; install and enable `cbm-reindex.timer` as root; then seed one indexing run so the first fetch happens while you watch, and verify with the same probe `status` uses. A repo that does not verify is a failure with the remediation, not a success — staged-but-not-trusted is how you discover months later that no worker read an index. `--no-seed` enables the timer without the seeding run and says plainly the graph is unusable until it first fires; it never skips the prerequisite or clone steps. `--print` changes nothing. Exits `1` when no repo has [`graphProject`](#configuration). |
-| `start` | Start `herdr-fleet.service` when that optional unit is installed, clearing a previous pane-recovery pin, then spawn the dispatch loop in the background and wait until it answers `GET /healthz` on `:8787`. Without systemd or that unit it keeps the standalone daemon behaviour. It never clears pause or arms ticks. Refuses if a daemon is already live, naming its pid; if the process dies or never serves, it cleans up and quotes the tail of `daemon.log`. |
+| `start` | Start `herdr-fleet.service` when that optional unit is installed, clearing a previous pane-recovery pin, then start the dispatch daemon and wait until it answers `GET /healthz`. When `omp-conductor.service` is installed, systemd is the only start path: even `start --project NAME` restores the shared unit and uses the name only to verify that `/healthz` serves the requested project. A detached daemon is allowed only when the unit is proven absent. It never clears pause or arms ticks. Refuses if a daemon is already live, naming its pid; manager refusal or unprovable ownership is an error rather than a detached fallback. |
 | `stop` | Prefer `systemctl stop omp-conductor.service` when that unit's MainPID is the live daemon — systemd then owns the stop and will not schedule a restart for the exit it just requested. Otherwise `SIGTERM`, then `SIGKILL` after a 10-second grace period. Prints `not running` when there is nothing to stop, and tags the confirmation with `(via systemctl)` when the unit path was used. |
-| `restart [--now] [--timeout SECONDS] [--port N] [--project NAME]` | Drains the fleet by default: pause new claims, wait until live workers reach `0 / N` (bounded by `--timeout SECONDS`, default 1800 = 30 min), restart, then restore the prior dispatch state. Prefer `systemctl restart` when the unit owns the live pid so the replacement stays supervised; otherwise `stop` then `start`, inheriting the running daemon's port and project unless a flag overrides them. `--now` skips the drain and restarts immediately, orphaning any live runs (old behaviour). A drain that hits `--timeout` restarts nothing and leaves dispatch paused — `omp-conductor resume` lifts it, or re-run `restart` to keep waiting. The new process **salvages dirty live worktrees before orphaning** those rows — see [Deploying a new package onto a busy fleet](#deploying-a-new-package-onto-a-busy-fleet). |
+| `restart [--now] [--timeout SECONDS] [--port N] [--project NAME]` | Drains the fleet by default: pause new claims, wait until live workers reach `0 / N` (bounded by `--timeout SECONDS`, default 1800 = 30 min), restart, then restore the prior dispatch state. A daemon serving multiple configured projects makes restart host-wide: `--project` is rejected because draining one queue and restarting the shared process would kill another project's workers. Prefer `systemctl restart` when the unit owns the live pid so the replacement stays supervised; only a host proven not to have the installed unit may fall back to the standalone stop/start path. `--now` skips the drain and restarts immediately, orphaning any live runs (old behaviour). A drain that hits `--timeout` restarts nothing and leaves dispatch paused — `omp-conductor resume` lifts it, or re-run `restart` to keep waiting. The new process **salvages dirty live worktrees before orphaning** those rows — see [Deploying a new package onto a busy fleet](#deploying-a-new-package-onto-a-busy-fleet). |
 | `upgrade [--to VERSION] [--project NAME]` | Deterministically update the Bun-global CLI, omp plugin, Herdr recovery plugin, and managed brief as one release. Resolves the npm version and exact `gitHead`, pauses only new claims, drains active workers, installs all surfaces, reloads Herdr and the daemon, waits for pane recovery, verifies identities and fleet health twice, then restores the original dispatch state. Host-wide by default: one daemon serves every configured project, so a bare run drains all of them and refreshes every brief. `--project` is rejected when the live daemon serves several projects — draining one queue and restarting the shared daemon would kill another's workers. A no-op when already current. Failure leaves dispatch paused. Must run outside a Herdr-managed session. |
 | `status [--project NAME]` | Layered fleet report first: `dispatch` / `ticks` / next scheduled tick / `pane` / `recovery` / `herdr` / `telegram` / `brief` / `decisions` / optional `failure classes` and `code graph` / `daemon`, then the project body. The project body includes the latest completed dispatch timestamp, ready/routed/admitted counts, bounded hold groups, and the GitHub API budget (`graphql` / `core` remaining and reset, in the caps block); API failures are marked `DEGRADED` so queue starvation cannot look idle. Active-run lines overlay cooperative worker `paused`/`pausing` from `/healthz` without changing SQLite `running` state or the live worker count. The next tick comes from the live heartbeat process, not a guess from log timestamps. Telegram health uses `getMe` to prove API authentication without sending a message and reports inbound bridge configuration separately. Configured graphs report prerequisites, indexed repos, timer state, and refresh freshness without blocking dispatch. A `reports` block lists everything the outbox has not delivered, with its age, and prints `pending` (nobody has it) differently from `SENDING` (outcome unknown, it may already have arrived) — see [Report delivery](#report-delivery-the-outbox). The daemon block includes `rss` from `/healthz`; live workers add a busy-deploy warning. A `.conductor-stalled` marker adds an `orchestrator STALLED since …` line. |
 | `ledger [--issue N] [--limit N]` | The action audit: every [mediated-verb](#the-mediated-verbs-126) mutation and every next-attempt turn budget. Verb entries include the arguments, decision, named refusal, and resulting SHA. Turn-budget entries remain after an override is replaced or consumed. Reads (`conductor_pr_status`) are absent so polling cannot bury the signal. `--issue` narrows both histories; `--limit` defaults to 50. Recent verb refusals and pending turn overrides also appear in `status`. |
@@ -2367,7 +2413,7 @@ omp-conductor help
 | `daemon` | Run the loop in the **foreground**, ticking every 5 minutes and serving `/healthz`. Admitted workers run in a tracked background pool, so settlement and capacity checks remain periodic while they work; shutdown drains the pool before closing the store. This is what `start` launches and what a systemd unit should call. |
 | `daemon --once` | Run a single tick, wait for workers admitted by that tick, and exit. No HTTP server or pidfile — a drill must not register itself as the daemon, or the next reader believes it and the real daemon's in-flight runs get reconciled as orphans. |
 | `--port N` | Accepted by `start`, `restart` and `daemon`. Both `--port 9000` and `--port=9000` work; missing or out of range exits `2` rather than falling back to the default, because probing the wrong endpoint is worse than a hard failure. |
-| `--project NAME` | Optional filter for `start`, `restart`, and `daemon`. Omit it to serve every configured project from one process (the unit path). Pass it only when you deliberately want a single-project daemon. |
+| `--project NAME` | Selects a project for project-scoped commands and foreground `daemon`. On an installed shared service, `start --project NAME` still starts the host-wide unit and uses the name only to verify `/healthz`; a draining `restart --project NAME` is rejected when that daemon serves multiple projects. A project-only daemon is available only through an explicit foreground `daemon --project NAME` or standalone start on a host proven not to have the unit. |
 | `pause [--reason TEXT]` | Stop new claims and work-starting mutations only. The running daemon notices on its next tick; runs already in flight finish. The orchestrator may still merge, update, or label runs admitted before the pause, and may release when the release policy's own preconditions hold. The orchestrator heartbeat keeps ticking if armed — its gate is the arm marker, not this flag. Per-worker pause is separate. Prefer `hold` to silence both. `--reason TEXT` is recorded in the pause sentinel, which `status` shows as the pause provenance. |
 | `resume [--project NAME]` | Clear pause and any `stop --pane` recovery pin — does **not** re-arm. Run `arm` after an inbound Telegram proof to resume ticks. |
 | `--version`, `-V`, `version` | Print the installed `omp-conductor` package version and exit `0`. Works from the global binary and npm/plugin install because it reads the package metadata beside the shipped CLI. |
@@ -2575,22 +2621,48 @@ daemon, across a process boundary, not in a prompt the model can rewrite.
 | `conductor_pr_create` | the worker owning the run | The run has no open PR (the same guard admission uses); head is the run branch; base is the repo's configured `defaultBranch`. |
 | `conductor_pr_status` | worker or orchestrator | Read-only. A worker reads only its own run's PR; an orchestrator may name any open PR in a routed project repo. |
 | `conductor_pr_update_branch` | orchestrator, or the worker owning the run | The PR belongs to this project and is open. A worker may only name its own run's PR. |
-| `conductor_pr_merge` | **orchestrator only** | `authority.merge` equals the caller; `headSha` equals the live head *at execution time*; checks green at that same SHA; the project's single merge slot is free. |
+| `conductor_pr_merge` | **orchestrator only** | Ordinarily, `authority.merge` equals the caller. A hand-edited `recoveryMerges` entry may instead authorize one exact unrecorded PR/head/reason while held. In both paths, `headSha` equals the live head *at execution time*; checks are green at that same SHA; the project route and migration chain are valid; the project's single merge slot is free. |
 | `conductor_label` | **orchestrator only** | The label is in the project's own vocabulary. Lifecycle labels stay the daemon's. |
-| `conductor_release` | **orchestrator only** | `authority.release` equals the caller; the per-shape grant permits it; the artefact or environment was declared; the release preconditions hold; the `reason` is in the closed enum. |
+| `conductor_release` | **orchestrator only** | `authority.release` equals the caller; the per-shape grant permits it; the artefact or environment was declared; the release preconditions hold; the `reason` is in the closed enum. `version-bump-pr` creates or re-validates one deterministic version-only PR and, on a later call, merges only its exact green head through the project's single merge slot. |
 
-Merge and release are the same rule written twice on purpose: **the caller's
+Standing merge and release authority use the same exact rule: **the caller's
 role must equal the configured holder.** `authority` has exactly two values, so
 a `!== "human"` test would have let a *worker* release. A worker is refused
-every release shape under the most permissive config there is.
-
-For Git-backed releases, `git-tag` is idempotent when the named tag exists
-locally but has not been pushed: it re-points the tag to the verified live
-default-branch head. `git-push-tags` performs the same re-point immediately
-before pushing if the default branch moved between the two calls. A tag already
-published on origin is immutable: an identical tag is accepted as already
-complete, while a different published target is refused and must use a new tag
-name.
+every release shape under the most permissive config there is. The exact
+operator-authored recovery tuple below is the sole authority exception inside
+`conductor_pr_merge`; a reviewed version bump is instead a `conductor_release`
+operation governed throughout by release authority.
+
+`recoveryMerges` is deliberately narrower than standing merge authority. It is
+an operator-authored, one-PR escape hatch for a recovery branch that cannot have
+a run row—for example, a conflict repair created after the fleet was held. It
+does not admit new work, unpause the fleet, widen repository routing, bypass
+live-head or check validation, or make a general class of PRs mergeable.
+Authorizations are re-read from config on every call and every attempted merge
+is written to the ordinary verb ledger, including refusals.
+
+For a repo with `release.versionFile`, call `conductor_release` with
+`shape=version-bump-pr` and the intended `v<semver>` tag. The requested version
+must be newer than the live semantic version. The first call creates
+`conductor/release-<version>` from the live default branch, changes only the
+declared JSON `version`, and opens a normal PR. Call it again after CI: the daemon
+re-reads that exact PR head, verifies the PR contains only the semantic version
+change, requires green checks, and merges with GitHub's exact-head guard. The
+ordinary action ledger records both calls. A raw source push is never delegated,
+and a worker makes no release decision.
+
+For Git-backed releases, a repo that declares `release.versionFile` refuses both
+tag creation and a new tag push until the live default branch's version matches
+the requested tag. `git-tag` is idempotent when the named tag exists locally but
+has not been pushed: it re-points the tag to the verified live default-branch
+head. `git-push-tags` performs the same re-point immediately before pushing if
+the default branch moved between the two calls. A tag already published on
+origin is immutable: an identical tag is accepted as already complete, while a
+different published target is refused and must use a new tag name.
+
+A `github-release` for the same repo likewise requires that reviewed tag to be
+present on origin and verifies the tag's version file before creating the
+release; it never lets GitHub synthesize the missing tag.
 
 ### The transport
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omp-conductor",
-  "version": "0.15.5",
+  "version": "0.15.7",
   "type": "module",
   "license": "MIT",
   "description": "A 24/7 dispatcher that takes ready GitHub issues to green, mergeable PRs using omp coding sessions, with tiered escalation first to an orchestrator session and then to a human.",

package/schema/config.schema.json

@@ -188,6 +188,19 @@
                         "dir"
                       ],
                       "additionalProperties": false
+                    },
+                    "release": {
+                      "type": "object",
+                      "properties": {
+                        "versionFile": {
+                          "type": "string",
+                          "minLength": 1
+                        }
+                      },
+                      "required": [
+                        "versionFile"
+                      ],
+                      "additionalProperties": false
                     }
                   },
                   "required": [
@@ -463,6 +476,32 @@
             },
             "additionalProperties": false
           },
+          "recoveryMerges": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "prUrl": {
+                  "type": "string",
+                  "pattern": "^https:\\/\\/github\\.com\\/[A-Za-z0-9_.-]+\\/[A-Za-z0-9_.-]+\\/pull\\/\\d+$"
+                },
+                "headSha": {
+                  "type": "string",
+                  "pattern": "^[0-9a-fA-F]{40}$"
+                },
+                "reason": {
+                  "type": "string",
+                  "const": "operator-instructed"
+                }
+              },
+              "required": [
+                "prUrl",
+                "headSha",
+                "reason"
+              ],
+              "additionalProperties": false
+            }
+          },
           "reporting": {
             "type": "object",
             "properties": {

package/src/board.ts

@@ -4,6 +4,7 @@ import { emitKeypressEvents } from "node:readline";
 import { findProject, loadConfig, resolveCaps } from "./config.ts";
 import { statusSnapshotFromStore, type StatusSnapshot } from "./daemon.ts";
 import {
+  classifyDaemonProjectHealth,
   codeGraphFromHealthz,
   fleetLayers,
   probeTelegramHealth,
@@ -926,39 +927,16 @@ export function renderBoard(
 async function probeBoardHealth(project: ProjectConfig): Promise<BoardHealthProbe> {
   const layers = fleetLayers(project.name);
   const record = livingDaemon();
+  // Same gate as status (#379): never health-check a record pinned to another
+  // project, and never invent a second membership convention beside
+  // classifyDaemonProjectHealth.
   const wrongRecord = record?.project !== undefined && record.project !== project.name;
   const [telegram, health] = await Promise.all([
     probeTelegramHealth(project.name),
     record === undefined || wrongRecord ? undefined : healthCheck(record.port),
   ]);
-  let daemon: DaemonBoardState;
-  if (record === undefined) daemon = "stopped";
-  else if (wrongRecord) daemon = "other-project";
-  else if (health?.ok !== true) daemon = "unreachable";
-  else {
-    try {
-      const payload = JSON.parse(health.body ?? "null") as unknown;
-      if (payload === null || typeof payload !== "object") {
-        daemon = "unreachable";
-      } else if (Reflect.get(payload, "project") === project.name) {
-        daemon = "ok";
-      } else {
-        const projects = Reflect.get(payload, "projects");
-        daemon =
-          Array.isArray(projects) &&
-          projects.some(
-            (entry) =>
-              entry !== null &&
-              typeof entry === "object" &&
-              Reflect.get(entry, "project") === project.name,
-          )
-            ? "ok"
-            : "other-project";
-      }
-    } catch {
-      daemon = "unreachable";
-    }
-  }
+  const classified = classifyDaemonProjectHealth(record, health, project.name);
+  const daemon: DaemonBoardState = classified.kind;
   const cachedGraph = daemon === "ok" ? codeGraphFromHealthz(health?.body, project.name) : undefined;
   return {
     health: {

package/src/briefs/orchestrator.md

@@ -273,8 +273,10 @@ never make one call per question, and never type a numbered menu into a plain
 message. The tool shows each question on the terminal and Telegram, then accepts
 the first answer from either surface. A returned answer proves an answer, not
 Telegram delivery. If the question must demonstrably reach the operator through
-Telegram, send it separately with `telegram_send` and prefix its text
-`QUESTION:` so the autonomous-tick gate applies the decision category. Still
+Telegram, send it separately: `omp-conductor message --text "QUESTION: …"` on a
+locally injected tick, or a `telegram_send` whose text begins `QUESTION:` while
+you are answering a live message in its own topic. Either way the marker is what
+makes the autonomous-tick gate apply the decision category. Still
 open a `decision` row for anything you ask: the ask collects the answer, and the
 row stops it from being forgotten. In both directions, the delivery
 contract is explicit: a message you did not explicitly send is a message that
@@ -289,6 +291,23 @@ text you merely write reaches nobody — if you do not call `telegram_send`, the
 person gets silence. While handling any turn, produce no visible commentary
 between tool calls — reasoning stays in thinking, actions stay in tools.
 
+**Reply where the message arrived.** `thread_id` defaults to the active topic
+*only while `chat_id` is omitted*, so a fleet whose Telegram is a forum topic
+loses the thread the moment you name a chat: omit **both** `chat_id` and
+`thread_id` and the reply lands in the topic the message came from, or pass
+**both** together. Passing `chat_id` alone is refused by the dispatcher — it
+would answer in the main chat, in front of everyone, while the person waits in
+the thread they wrote in.
+
+On a **locally injected tick** there is no inbound message and therefore no
+active topic to keep. When such a turn must reach your operator directly rather
+than through a report, run
+`omp-conductor message --text "<the message>"`: it resolves this project's own
+chat and topic from config, applies the same availability policy an autonomous
+Telegram call gets, and prints either the delivery or the held-notice id. Begin
+the text `QUESTION:` when you are asking for something, so it carries the
+decision category. Reports still go through `omp-conductor report`.
+
 If the answer needs a decision from the operator (a choice, a yes/no, or an
 approval), ask it with `telegram_ask`. Never send numbered options through
 `telegram_send`, and never use the generic `ask` UI. The tool returns the first
@@ -297,7 +316,8 @@ Telegram delivery. A cancelled or errored `telegram_ask` is not an answer.
 
 A message may also reach you **mid-tick** (delivery is steering: it arrives
 between two of your tool calls). Treat it as an interrupt, not a new tick:
-`telegram_send` the answer immediately, then return to the duty you were in the
+`telegram_send` the answer immediately — in that message's own topic, by naming
+neither target — then return to the duty you were in the
 middle of and finish it. Never abandon or restart the tick because a message
 arrived, and never batch the answer "for the report" — the person is waiting now.
 
@@ -389,6 +409,7 @@ the same checks and the same ledger rows, through the CLI:
 omp-conductor verb conductor_pr_merge --arg prUrl=<url> --arg headSha=<sha> --arg reason=<reason>
 omp-conductor verb conductor_label --arg issueUrl=<url> --arg label=<name> --arg action=add --arg reason=<reason>
 omp-conductor verb conductor_release --arg shape=git-tag --arg repo=<name> --arg reason=<reason> --arg tag=<tag>
+omp-conductor verb conductor_release --arg shape=version-bump-pr --arg repo=<name> --arg reason=<reason> --arg tag=<tag>
 omp-conductor verb conductor_pr_status --arg prUrl=<url>
 omp-conductor verb conductor_pr_update_branch --arg prUrl=<url>
 omp-conductor verb conductor_pr_update --arg prUrl=<url> --arg title=<title>
@@ -396,8 +417,10 @@ omp-conductor verb conductor_pr_update --arg prUrl=<url> --arg title=<title>
 
 Each `--arg k=v` is one argument, read as a string. Worker-only verbs
 (`conductor_push`, `conductor_pr_create`) are refused with `role-not-allowed` —
-an external orchestrator never pushes or opens a PR, exactly as this floor's
-sessions do not.
+an external orchestrator never pushes or opens a PR directly, exactly as this
+floor's sessions do not. A granted `version-bump-pr` asks the daemon to open the
+declared version-only PR; call the same shape again after its checks are green
+to land that exact head, then cut the tag.
 
 | Tool | Yours when | What the dispatcher checks before acting |
 | --- | --- | --- |
@@ -405,7 +428,7 @@ sessions do not.
 | `conductor_pr_update_branch` | always | The PR belongs to this project and is open. |
 | `conductor_pr_merge` | `authority.merge` is yours | You are the configured holder; `headSha` still equals the live head *at execution time*; checks green at that same SHA; the project's single merge slot is free. |
 | `conductor_label` | always | The label is one this project declared. Lifecycle labels (`agent:in-progress`, `agent:blocked`, `agent:failed`) are refused — those stay the dispatcher's, and `omp-conductor unblock` is how you clear them. |
-| `conductor_release` | `authority.release` is yours | You are the configured holder, the shape is granted, the artefact or environment was declared, and the release preconditions hold. |
+| `conductor_release` | `authority.release` is yours | You are the configured holder, the shape is granted, the artefact or environment was declared, and the release preconditions hold. `version-bump-pr` is the source-change exception: first call opens only the declared version-file change; a later call re-validates and merges its exact green head through the project's single merge slot. |
 
 ### Stopping and pausing
 
@@ -501,9 +524,10 @@ The protocol, in order:
    call `telegram_ask`; never use the generic `ask` UI. The tool shows the
    question on the terminal and Telegram, then returns the first answer from
    either surface. A returned answer proves an answer, not Telegram delivery.
-   If the proposal must demonstrably reach the operator through Telegram, send
-   the compact question separately with `telegram_send`. If `telegram_ask` is
-   unavailable, send the same single yes/no question with `telegram_send`.
+   If the proposal must demonstrably reach the operator through Telegram, or
+   `telegram_ask` is unavailable, send the compact yes/no question separately
+   with `omp-conductor message --text "QUESTION: …"` — on a tick that is the
+   only path that reaches this project's own topic.
    Wait for the operator's later reply, and never assume one. Telegram renders
    none of your markdown, so asterisks and backticks arrive as literal characters:
    - Lead with one plain sentence: what changes, and why, in your own words.
@@ -519,7 +543,7 @@ The protocol, in order:
    file is regenerated from the floor + `POLICY.md`). **On explicit no, drop
    it** forever and do not re-ask that amendment. A cancelled or errored
    `telegram_ask` is a delivery failure, not an operator answer. Re-deliver the
-   question with `telegram_send`, or report the channel as broken. Never infer
+   question with `omp-conductor message`, or report the channel as broken. Never infer
    rejection or “not now” from failed delivery. On an explicit “not now”, park
    it in the ledger rather than in your head — see below.
 4. **Log it.** Append one line to **Amendments** at the bottom of `POLICY.md`:

package/src/briefs/policy.md

@@ -110,12 +110,17 @@ deliberate, and a duplicate you can spot by its report id is the cheaper of the
 two mistakes. `omp-conductor status` lists anything still undelivered.
 
 `telegram_send` is still the right call for direct delivery to a person who is
-waiting — an answer to their message, or a question of your own. It is not a
-report: it leaves no record that anything went out. `telegram_ask` is the right
+waiting — an answer to their message, or a question of your own. Answer in the
+topic the message arrived in: name neither `chat_id` nor `thread_id`, or name
+both; naming the chat alone drops a forum reply into the main chat and is
+refused. A locally injected tick has no such message to answer, so its direct
+delivery is `omp-conductor message --text "…"`, which resolves this project's
+own chat and topic. Neither is a report: they leave no record that anything went
+out. `telegram_ask` is the right
 call for a decision. It shows the question on the terminal and Telegram, then
 returns the first answer from either surface. A returned answer proves an
 answer, not Telegram delivery. A cancelled or errored `telegram_ask` is not an
-answer: re-deliver the question with `telegram_send`, prefixing its text
+answer: re-deliver the question with text beginning
 `QUESTION:` so an autonomous tick applies the decision category, or report the
 channel as broken. It is never "asked once, no reply, dropped".
 

package/src/cli.ts

@@ -50,7 +50,11 @@ import {
   type RestartResult,
 } from "./lifecycle.ts";
 import { STALL_MARKER_FILE } from "./orchestrator-tick.ts";
-import { digestDedupeKey } from "./reports.ts";
+import {
+  deliverOperatorMessage,
+  digestDedupeKey,
+  type OperatorMessageOutcome,
+} from "./reports.ts";
 import { digestDue } from "./digest-schedule.ts";
 import {
   AMEND_AREA_IDS,
@@ -121,6 +125,7 @@ usage:
   omp-conductor friction <escalation-digest|report-noise|report-surprise> --detail TEXT [--issue N] [--project NAME]
   omp-conductor event record --category NAME --summary TEXT --evidence REF [--occurred-at ISO] [--project NAME]
   omp-conductor report --text TEXT [--kind material|digest] [--events IDS] [--notices IDS] [--project NAME]
+  omp-conductor message --text TEXT [--project NAME]
   omp-conductor decision open --question TEXT [--blocks TEXT] [--resolves-when COND] [--project NAME]
   omp-conductor decision resolve <id> --answer TEXT [--project NAME]
   omp-conductor decision withdraw <id> [--reason TEXT] [--project NAME]
@@ -219,6 +224,14 @@ usage:
            decided from the ledger rather than from what you remember sending.
            A digest associates the comma-separated --events and --notices rows
            atomically; omitted rows stay owed.
+  message  deliver one direct Telegram message to this project's own chat and
+           forum topic, resolved from config rather than from whichever chat
+           last wrote to the session. This is how a locally injected tick
+           answers or asks something directly: telegram_send keeps the active
+           topic only while it names no chat, and a tick has no active topic to
+           keep. Text beginning "QUESTION:" carries the decision category; the
+           operator's availability policy still decides between sending now and
+           holding a notice, exactly as it does for an autonomous tick.
   decision record, list and close the questions you have put to your operator.
            A question that lives only in a session's context is lost to the next
            compaction, so \`decision open\` writes it down and every tick's prompt
@@ -1316,6 +1329,53 @@ try {
       break;
     }
 
+    /**
+     * One direct message to the operator, on the project's own Telegram target.
+     *
+     * `telegram_send` inherits the chat of the last inbound message, and its
+     * `thread_id` defaults to the active topic *only* while `chat_id` is
+     * omitted — so a locally injected tick, which has no inbound message to
+     * inherit from, had no way to reach a project's forum topic and its answers
+     * landed in the main chat (#366). This resolves chat and topic from the
+     * project config instead of from session memory, and applies the same
+     * availability decision the autonomous tick gate applies, so the CLI is not
+     * a way around the operator's own interrupt policy.
+     */
+    case "message": {
+      const rawText = flag(argv, "text");
+      const body = rawText?.trim();
+      if (body === undefined || body.length === 0 || rawText?.startsWith("--") === true) {
+        process.stderr.write("omp-conductor: message needs --text with the message to deliver\n");
+        process.exit(2);
+      }
+      const project = findProject(loadConfig(), projectFlag);
+      const store = openStore(dbPath());
+      let outcome: OperatorMessageOutcome;
+      try {
+        outcome = await deliverOperatorMessage(project, body, {
+          store,
+          at: Date.now(),
+          noticeId: randomUUID(),
+        });
+      } catch (err) {
+        process.stderr.write(
+          `omp-conductor: message: ${err instanceof Error ? err.message : String(err)}\n`,
+        );
+        process.exit(2);
+      } finally {
+        store.close();
+      }
+      process.stdout.write(
+        outcome.kind === "sent"
+          ? `message delivered to ${project.name}'s configured Telegram ` +
+              `${project.escalation.telegramTopicId === undefined ? "chat" : "project topic"} (${outcome.category})\n`
+          : `held notice ${outcome.noticeId} queued for ${project.name} (${outcome.category}; ` +
+              `${outcome.reason === "availability" ? "outside the availability window" : "a digest-only category"})\n` +
+              "nothing was sent; the daemon releases it with the next digest or working-hours catch-up\n",
+      );
+      break;
+    }
+
     case "decision": {
       const sub = argv[1];
       const project = findProject(loadConfig(), projectFlag);

package/src/config-schema.ts

@@ -203,6 +203,21 @@ const projectPolicySchema = z
   })
   .strict();
 
+const recoveryMergesSchema = z.array(
+  z
+    .object({
+      prUrl: z
+        .string()
+        .regex(
+          /^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/pull\/\d+$/,
+          "must be a full https://github.com/<owner>/<repo>/pull/<n> URL",
+        ),
+      headSha: z.string().regex(/^[0-9a-fA-F]{40}$/, "must be an exact 40-character commit SHA"),
+      reason: z.literal("operator-instructed"),
+    })
+    .strict(),
+);
+
 // ---------------------------------------------------------------------------
 // Authority / escalation / release policy
 // ---------------------------------------------------------------------------
@@ -256,6 +271,10 @@ const repoTargetSchema = z
       .object({ dir: z.string().min(1, "must be a non-empty string") })
       .strict()
       .optional(),
+    release: z
+      .object({ versionFile: z.string().min(1, "must be a non-empty string") })
+      .strict()
+      .optional(),
   })
   .strict();
 
@@ -300,6 +319,7 @@ const projectSchema = z
     authority: authoritySchema.optional(),
     releasePolicy: releasePolicySchema.optional(),
     policy: projectPolicySchema.optional(),
+    recoveryMerges: recoveryMergesSchema.optional(),
     reporting: reportingSchema.optional(),
     // Roots silently fall back to the default when unusable, so the schema
     // admits any shape and the normaliser picks the usable path.