omp-conductor 0.15.9 → 0.15.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omp-conductor",
-  "version": "0.15.9",
+  "version": "0.15.11",
   "type": "module",
   "license": "MIT",
   "description": "A 24/7 dispatcher that takes ready GitHub issues to green, mergeable PRs using omp coding sessions, with tiered escalation first to an orchestrator session and then to a human.",
@@ -24,10 +24,11 @@
     "systemd",
     "schema",
     "README.md",
+    "REFERENCE.md",
     "LICENSE"
   ],
   "scripts": {
-    "check": "tsc --noEmit",
+    "check": "tsc --noEmit && bun run src/check-trailing-newlines.ts",
     "test": "bun test",
     "schema": "bun run src/generate-schema.ts"
   },

package/schema/config.schema.json

@@ -167,9 +167,6 @@
                             "default": "."
                           }
                         },
-                        "required": [
-                          "cwd"
-                        ],
                         "additionalProperties": false
                       }
                     },
@@ -317,10 +314,6 @@
                 ]
               }
             },
-            "required": [
-              "fallbackToIssueComment",
-              "orchestrator"
-            ],
             "additionalProperties": false
           },
           "authority": {
@@ -341,12 +334,16 @@
                   "human",
                   "orchestrator"
                 ]
+              },
+              "promotion": {
+                "default": "human",
+                "type": "string",
+                "enum": [
+                  "human",
+                  "orchestrator"
+                ]
               }
             },
-            "required": [
-              "merge",
-              "release"
-            ],
             "additionalProperties": false
           },
           "releasePolicy": {
@@ -413,12 +410,6 @@
                     ]
                   }
                 },
-                "required": [
-                  "requiredChecks",
-                  "baseFreshness",
-                  "drafts",
-                  "whenBehindBase"
-                ],
                 "additionalProperties": false
               },
               "release": {
@@ -465,12 +456,6 @@
                     }
                   }
                 },
-                "required": [
-                  "requires",
-                  "requiredChecks",
-                  "artefacts",
-                  "environments"
-                ],
                 "additionalProperties": false
               }
             },

package/src/arm-challenge.ts

@@ -0,0 +1,112 @@
+/**
+ * Authenticated pending-challenge state for the arming handshake (conductor
+ * #415).
+ *
+ * `armTicks` (fleet.ts) sends a short-lived `FLEET-…` code to the operator and
+ * proves the reply by scanning the orchestrator session transcript. That reply
+ * also lands in the orchestrator as an ordinary user turn, where the model once
+ * ad-libbed pairing-safety prose because it had no trusted way to recognise it.
+ *
+ * This module is the bridge between the two roles without an import cycle:
+ * `fleet.ts` imports `daemon.ts`, `daemon.ts` imports `orchestrator-tick.ts`,
+ * so `orchestrator-tick.ts` can never import `fleet.ts`. Both already import
+ * `config.ts`, so the pending-challenge record lives next to the other state
+ * under `stateDir()` and both sides reach it through *this* leaf module.
+ *
+ * Only the sha-256 of the code is ever persisted — never the code, whose
+ * plaintext appearance in the protected session transcript is already the
+ * backend proof and must not leak into a durable report, an issue comment, or a
+ * diagnostic line the way a new artifact could. The orchestrator classifies a
+ * reply by hashing its tokens against this record, so nothing on the east side
+ * of the boundary trusts a `FLEET-` prefix.
+ */
+
+import { createHash } from "node:crypto";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { stateDir } from "./config.ts";
+
+const ARM_CHALLENGE_FILE = "arm-challenge.json";
+
+interface PendingChallenge {
+  /** sha-256 hex of the challenge code — never the code itself. */
+  hash: string;
+  /** Unix ms after which a matching reply is no longer an active proof. */
+  expiresAt: number;
+}
+
+/** Keyed by project name; `""` is the pre-multi-project (un-named) spelling. */
+type PendingChallenges = Record<string, PendingChallenge>;
+
+function challengesPath(): string {
+  return join(stateDir(), ARM_CHALLENGE_FILE);
+}
+
+function projectKey(project?: string): string {
+  return project ?? "";
+}
+
+function readChallenges(): PendingChallenges {
+  try {
+    const parsed: unknown = JSON.parse(readFileSync(challengesPath(), "utf8"));
+    if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) {
+      return parsed as PendingChallenges;
+    }
+  } catch {
+    /* absent or unreadable — no active challenge */
+  }
+  return {};
+}
+
+function writeChallenges(map: PendingChallenges): void {
+  const path = challengesPath();
+  mkdirSync(dirname(path), { recursive: true });
+  // 0600 like the other conductor state an operator never shares; the record is
+  // only a hash, but there is no reason to be less careful with it.
+  writeFileSync(path, `${JSON.stringify(map)}\n`, { mode: 0o600 });
+}
+
+/** sha-256 hex of the challenge code — the persisted token, never the code. */
+function challengeHash(code: string): string {
+  return createHash("sha256").update(code).digest("hex");
+}
+
+/** Register a new active arming challenge, replacing any prior one for the project. */
+export function recordArmChallenge(project: string | undefined, code: string, expiresAt: number): void {
+  const map = readChallenges();
+  map[projectKey(project)] = { hash: challengeHash(code), expiresAt };
+  writeChallenges(map);
+}
+
+/** Drop the active challenge for a project once arming completed or timed out. */
+export function clearArmChallenge(project: string | undefined): void {
+  const map = readChallenges();
+  const key = projectKey(project);
+  if (!(key in map)) return;
+  delete map[key];
+  writeChallenges(map);
+}
+
+/**
+ * Authenticated classification for the orchestrator's turn adapter: a reply is
+ * an active arming proof iff the project has a non-expired pending challenge
+ * and one of the reply's whitespace-separated tokens hashes to it. The code is
+ * matched by hash — matching `transcriptHasUserCode`'s leniency (the code
+ * appears as a token) without ever trusting a `FLEET-` prefix or exposing the
+ * code to the model's other reads. An unsolicited lookalike that matches no
+ * active challenge, and a reply in the wrong project, both stay inert.
+ *
+ * Clears nothing: the host (`armTicks`) owns clearance once its transcript
+ * proof lands, so the two sides cannot race for the record.
+ */
+export function isActiveArmProof(project: string | undefined, replyText: string, now: number): boolean {
+  const pending = readChallenges()[projectKey(project)];
+  if (pending === undefined || now >= pending.expiresAt) return false;
+  const targetHash = pending.hash;
+  // Challenge codes contain no whitespace, so tokenising on whitespace never
+  // splits one; empty replies simply yield no token.
+  for (const token of replyText.trim().split(/\s+/)) {
+    if (token.length > 0 && challengeHash(token) === targetHash) return true;
+  }
+  return false;
+}

package/src/ask.ts

@@ -0,0 +1,434 @@
+/**
+ * The bounded ask surface for an orchestrator tick (#438).
+ *
+ * On 2026-08-16 the orchestrator called `telegram_ask` for a genuine tier-2
+ * contract decision (PR #432 / issue #368) and the operator was asleep. The
+ * tool does not time out: it blocked the turn for just over six hours, and a
+ * tick prompt timestamped 01:14Z did not execute until after the answer at
+ * 07:04Z. Every duty behind the ask — draining, merging, grooming — stopped
+ * with it. `telegram_ask` is omp-telegram's tool and this package cannot tell
+ * it how long it may wait, so an autonomous tick gets a different ask surface:
+ * {@link ASK_TOOL}. It records the question durably (a decision row, plus the
+ * same delivery path the `message` command uses), waits at most a configured
+ * ceiling — minutes by default, never hours — and then resolves the declared
+ * non-answer outcome itself:
+ *
+ * - `auto-proceed`: the recommended option is applied and the decision row is
+ *   resolved with `"<option> (auto-applied on ask timeout)"`, so the record can
+ *   never be read back as a human choice;
+ * - `park`: the row stays open and pending — re-surfaced in every tick prompt —
+ *   and the caller is told to take the blocked item out of the claimable queue
+ *   with its state recorded.
+ *
+ * A timeout is "nobody answered yet". It is never a cancelled ask, an errored
+ * ask, or an operator "no": the only writes it makes are the auto-apply
+ * resolution (which names itself as auto-applied) or none at all. The existing
+ * seven-day decision expiry bounds a parked row exactly like any other open
+ * decision — nothing here reopens that clock.
+ */
+
+import type { DecisionRecord, InterruptCategory, Store } from "./types.ts";
+import { INTERRUPT_CATEGORIES } from "./types.ts";
+
+/** The bounded ask tool this package registers on an orchestrator session. */
+export const ASK_TOOL = "conductor_ask";
+
+/** The two legal non-answer outcomes, declared by the ask, never inferred. */
+export const ASK_TIMEOUT_OUTCOMES = ["auto-proceed", "park"] as const;
+export type AskTimeoutOutcome = (typeof ASK_TIMEOUT_OUTCOMES)[number];
+
+/**
+ * The ceiling bounds. Minutes by default, never hours; an ask that is issued
+ * without a `timeoutSeconds` gets {@link DEFAULT_ASK_TIMEOUT_SECONDS}, and one
+ * that names a ceiling outside the bounds is refused rather than obeyed.
+ */
+export const MIN_ASK_TIMEOUT_SECONDS = 60;
+export const MAX_ASK_TIMEOUT_SECONDS = 3_600;
+export const DEFAULT_ASK_TIMEOUT_SECONDS = 300;
+
+/**
+ * The suffix a decision row carries when nobody human chose the answer. Fixed
+ * wording on purpose — the same reason `types.ts` gives for closed vocabularies
+ * everywhere else: a marker a tick or an operator has to match by reading it
+ * must be one no two spellings disagree on.
+ */
+export const AUTO_APPLIED_SUFFIX = "(auto-applied on ask timeout)";
+
+/** How often the bounded wait re-reads the decision row while waiting. */
+export const ASK_POLL_MS = 1_000;
+
+/** One option the operator may pick, as rendered in the delivered question. */
+export interface AskOption {
+  label: string;
+  description?: string;
+}
+
+/** The validated argument surface of {@link ASK_TOOL}. */
+export interface AskRequest {
+  /** The question verbatim, as it is archived on the decision row. */
+  question: string;
+  /** What the ask does when nobody answers within the ceiling. */
+  onTimeout: AskTimeoutOutcome;
+  /** Optional ceiling in whole seconds; defaults to the configured ceiling. */
+  timeoutSeconds?: number;
+  /** What is waiting on the answer, for the decision row and the digest. */
+  blocks?: string;
+  /** The option applied by `auto-proceed`; required exactly for that outcome. */
+  recommended?: string;
+  /** The choices shown to the operator, with {@link AskRequest.recommended} named. */
+  options?: AskOption[];
+  /** Escalation category for the delivered question; defaults to `decision-needed`. */
+  category?: InterruptCategory;
+}
+
+type AskParse =
+  | { ok: true; request: AskRequest }
+  | { ok: false; problem: string };
+
+function isInterruptCategory(value: unknown): value is InterruptCategory {
+  return typeof value === "string" && (INTERRUPT_CATEGORIES as readonly string[]).includes(value);
+}
+
+/**
+ * Validate one raw tool call. Strict like the verb arguments: an unknown shape
+ * is refused with the reason, never coerced into a default that could hide what
+ * the asker actually sent. The one tolerant field is the omitted `timeoutSeconds`
+ * — the issue's whole point is that the ceiling holds even when the model does
+ * not name one.
+ */
+export function parseAskRequest(raw: unknown): AskParse {
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+    return { ok: false, problem: "conductor_ask arguments must be an object" };
+  }
+  const input = raw as Record<string, unknown>;
+
+  const question = input["question"];
+  if (typeof question !== "string" || question.trim().length === 0) {
+    return { ok: false, problem: `conductor_ask needs "question": the question you put to the operator` };
+  }
+
+  const onTimeoutRaw = input["on-timeout"];
+  if (
+    typeof onTimeoutRaw !== "string" ||
+    !(ASK_TIMEOUT_OUTCOMES as readonly string[]).includes(onTimeoutRaw)
+  ) {
+    return {
+      ok: false,
+      problem: `conductor_ask needs "on-timeout": one of ${ASK_TIMEOUT_OUTCOMES.join(" or ")} — what happens when nobody answers within the ceiling`,
+    };
+  }
+  const onTimeout = onTimeoutRaw as AskTimeoutOutcome;
+
+  const recommendedRaw = input["recommended"];
+  const recommended =
+    typeof recommendedRaw === "string" && recommendedRaw.trim().length > 0
+      ? recommendedRaw.trim()
+      : undefined;
+  if (onTimeout === "auto-proceed" && recommended === undefined) {
+    return {
+      ok: false,
+      problem:
+        'conductor_ask with "on-timeout": "auto-proceed" needs "recommended": the option to apply when nobody answers, ' +
+        "because the decision row must record what was auto-applied",
+    };
+  }
+
+  const timeoutRaw = input["timeoutSeconds"];
+  let timeoutSeconds: number | undefined;
+  if (timeoutRaw !== undefined) {
+    if (typeof timeoutRaw !== "number" || !Number.isInteger(timeoutRaw)) {
+      return { ok: false, problem: "conductor_ask timeoutSeconds must be a whole number of seconds when present" };
+    }
+    if (timeoutRaw < MIN_ASK_TIMEOUT_SECONDS || timeoutRaw > MAX_ASK_TIMEOUT_SECONDS) {
+      return {
+        ok: false,
+        problem: `conductor_ask timeoutSeconds must be between ${MIN_ASK_TIMEOUT_SECONDS} and ${MAX_ASK_TIMEOUT_SECONDS}`,
+      };
+    }
+    timeoutSeconds = timeoutRaw;
+  }
+
+  const blocksRaw = input["blocks"];
+  const blocks = typeof blocksRaw === "string" && blocksRaw.trim().length > 0 ? blocksRaw.trim() : undefined;
+
+  const optionsRaw = input["options"];
+  let options: AskOption[] | undefined;
+  if (optionsRaw !== undefined) {
+    if (!Array.isArray(optionsRaw)) {
+      return { ok: false, problem: "conductor_ask options must be an array of { label, description? }" };
+    }
+    const parsedOptions: AskOption[] = [];
+    for (const entry of optionsRaw) {
+      if (entry === null || typeof entry !== "object" || Array.isArray(entry)) {
+        return { ok: false, problem: "conductor_ask options entries must be objects with a label" };
+      }
+      const option = entry as Record<string, unknown>;
+      const label = option["label"];
+      if (typeof label !== "string" || label.trim().length === 0) {
+        return { ok: false, problem: "conductor_ask options entries need a non-empty label" };
+      }
+      const descriptionRaw = option["description"];
+      parsedOptions.push({
+        label: label.trim(),
+        ...(typeof descriptionRaw === "string" && descriptionRaw.trim().length > 0
+          ? { description: descriptionRaw.trim() }
+          : {}),
+      });
+    }
+    options = parsedOptions;
+  }
+
+  const categoryRaw = input["category"];
+  if (categoryRaw !== undefined && !isInterruptCategory(categoryRaw)) {
+    return {
+      ok: false,
+      problem: `conductor_ask category must be one of ${INTERRUPT_CATEGORIES.join(", ")} when present`,
+    };
+  }
+
+  return {
+    ok: true,
+    request: {
+      question: question.trim(),
+      onTimeout,
+      ...(timeoutSeconds === undefined ? {} : { timeoutSeconds }),
+      ...(blocks === undefined ? {} : { blocks }),
+      ...(recommended === undefined ? {} : { recommended }),
+      ...(options === undefined ? {} : { options }),
+      ...(categoryRaw === undefined ? {} : { category: categoryRaw as InterruptCategory }),
+    },
+  };
+}
+
+/**
+ * The JSON Schema the harness advertises for {@link ASK_TOOL}, shaped like the
+ * verb parameter schemas: plain JSON Schema, `additionalProperties: false`,
+ * required lists spelled out.
+ */
+export function askParameterSchema(): Record<string, unknown> {
+  return {
+    type: "object",
+    properties: {
+      question: {
+        type: "string",
+        description:
+          "The question, written for a phone: one plain sentence, your recommendation, and the options with their consequences.",
+      },
+      "on-timeout": {
+        type: "string",
+        enum: [...ASK_TIMEOUT_OUTCOMES],
+        description:
+          "What happens when nobody answers within the ceiling: auto-proceed applies the recommended option and resolves the decision row naming the auto-application; park leaves the row open and pending, re-surfaced every tick.",
+      },
+      timeoutSeconds: {
+        type: "number",
+        description: `Ceiling before the ask times out. Optional — an ask issued without one still gets the default ceiling (${DEFAULT_ASK_TIMEOUT_SECONDS}s, capped at the turn budget). Range ${MIN_ASK_TIMEOUT_SECONDS}–${MAX_ASK_TIMEOUT_SECONDS}.`,
+      },
+      recommended: {
+        type: "string",
+        description:
+          "The option applied on auto-proceed. Required when on-timeout is auto-proceed, because the row must record what was auto-applied.",
+      },
+      blocks: {
+        type: "string",
+        description: "What is waiting on the answer (an issue, a PR, a release) for the decision row.",
+      },
+      options: {
+        type: "array",
+        items: {
+          type: "object",
+          properties: {
+            label: { type: "string", description: "Short button label." },
+            description: { type: "string", description: "Optional tradeoff detail." },
+          },
+          required: ["label"],
+          additionalProperties: false,
+        },
+        description: "The choices shown to the operator; name the recommended one in `recommended`.",
+      },
+      category: {
+        type: "string",
+        enum: [...INTERRUPT_CATEGORIES],
+        description: "Escalation category for the delivered question. Optional; defaults to decision-needed.",
+      },
+    },
+    required: ["question", "on-timeout"],
+    additionalProperties: false,
+  };
+}
+
+/**
+ * The ceiling for one ask, in whole seconds. The model may name one, but the
+ * enforcement never depends on it: an ask without a `timeoutSeconds` gets the
+ * configured ceiling, and both are capped at the turn budget so the ask can
+ * never outlive the turn it runs in.
+ */
+export function resolveAskCeilingSeconds(
+  requestedSeconds: number | undefined,
+  configuredSeconds: number | undefined,
+  turnBudgetSeconds: number,
+): number {
+  const base = requestedSeconds ?? configuredSeconds ?? DEFAULT_ASK_TIMEOUT_SECONDS;
+  return Math.min(base, Math.max(MIN_ASK_TIMEOUT_SECONDS, turnBudgetSeconds));
+}
+
+/** The row resolution for an auto-applied outcome — exactly the acceptance text. */
+export function autoApplyResolution(recommended: string): string {
+  return `${recommended} ${AUTO_APPLIED_SUFFIX}`;
+}
+
+/** The question exactly as it is delivered, durable prefix and all. */
+export function askMessageFor(request: AskRequest): string {
+  const lines = [`QUESTION: ${request.question}`];
+  if (request.options !== undefined && request.options.length > 0) {
+    lines.push(
+      `Options: ${request.options
+        .map((option) =>
+          option.description === undefined
+            ? option.label
+            : `${option.label} — ${option.description}`,
+        )
+        .join("; ")}`,
+    );
+  }
+  if (request.recommended !== undefined) lines.push(`Recommended: ${request.recommended}`);
+  return lines.join("\n");
+}
+
+/** One read of the decision row; `undefined` means the id is unknown. */
+export type DecisionReader = (id: string) => DecisionRecord | undefined;
+
+export interface BoundedAskDeps {
+  decisionId: string;
+  ceilingMs: number;
+  read: DecisionReader;
+  /** Advance one poll; injected so tests stay deterministic. */
+  wait: (ms: number) => Promise<void>;
+  now: () => number;
+}
+
+export type BoundedAskOutcome =
+  | { kind: "answered"; answer: string }
+  | { kind: "withdrawn" }
+  | { kind: "timed-out" };
+
+/**
+ * The wait itself: read the row, leave when someone closed it, time out at the
+ * deadline. Pure by construction — every clock and sleep is injected — so the
+ * whole "does the ask come back bounded" contract is a deterministic test, not
+ * a timer gamble.
+ */
+export async function runBoundedAsk(deps: BoundedAskDeps): Promise<BoundedAskOutcome> {
+  const deadline = deps.now() + deps.ceilingMs;
+  for (;;) {
+    const row = deps.read(deps.decisionId);
+    if (row !== undefined && row.state !== "open") {
+      return row.state === "answered"
+        ? { kind: "answered", answer: row.resolution ?? "" }
+        : { kind: "withdrawn" };
+    }
+    if (deps.now() >= deadline) return { kind: "timed-out" };
+    await deps.wait(ASK_POLL_MS);
+  }
+}
+
+/** What delivering the question to the operator returned, for the result text. */
+export interface AskDeliveryResult {
+  kind: "sent" | "held";
+  category: InterruptCategory;
+  noticeId?: string;
+}
+
+/** What one {@link ASK_TOOL} call produced, and the exact text the model reads. */
+export interface AskResult {
+  outcome: BoundedAskOutcome;
+  decisionId: string;
+  text: string;
+}
+
+export interface AskDeps {
+  store: Store;
+  project: string;
+  /** The tick config's `askTimeoutSeconds`, already validated. */
+  configuredCeilingSeconds?: number;
+  /** The tick config's `budgetSeconds`, already validated. */
+  turnBudgetSeconds?: number;
+  /** Delivers the question through the sanctioned durable path. */
+  deliver(questionText: string, category: InterruptCategory): Promise<AskDeliveryResult>;
+  wait?: (ms: number) => Promise<void>;
+  now?: () => number;
+}
+
+/** Real-time default for the injected wait; tests hand their own. */
+const sleep = (ms: number): Promise<void> => {
+  const { promise, resolve } = Promise.withResolvers<void>();
+  setTimeout(resolve, ms);
+  return promise;
+};
+
+/**
+ * One bounded ask, end to end: durable row first, then delivery, then the wait,
+ * then the declared timeout outcome. The row exists before the delivery
+ * attempt, so a crash at any point leaves a recorded question — never one that
+ * lived only in the model's context.
+ */
+export async function performAsk(request: AskRequest, deps: AskDeps): Promise<AskResult> {
+  const now = deps.now ?? Date.now;
+  const wait = deps.wait ?? sleep;
+
+  const row = deps.store.createDecision({
+    project: deps.project,
+    question: request.question,
+    ...(request.blocks === undefined ? {} : { blocks: request.blocks }),
+    at: now(),
+  });
+
+  const delivery = await deps.deliver(askMessageFor(request), request.category ?? "decision-needed");
+
+  const ceilingSeconds = resolveAskCeilingSeconds(
+    request.timeoutSeconds,
+    deps.configuredCeilingSeconds,
+    deps.turnBudgetSeconds ?? DEFAULT_ASK_TIMEOUT_SECONDS,
+  );
+  const outcome = await runBoundedAsk({
+    decisionId: row.id,
+    ceilingMs: ceilingSeconds * 1_000,
+    read: (id) => deps.store.decision(id),
+    wait,
+    now,
+  });
+
+  let text: string;
+  if (outcome.kind === "answered") {
+    text =
+      `conductor_ask ${row.id}: the operator answered — ${outcome.answer}. ` +
+      `The decision row is resolved with that answer. Proceed to apply it.`;
+  } else if (outcome.kind === "withdrawn") {
+    text =
+      `conductor_ask ${row.id}: the decision was withdrawn by whoever holds the row before the ` +
+      `ceiling elapsed. No answer was given and nothing was auto-applied. Treat it as "the question is ` +
+      `closed", not as an answer.`;
+  } else if (request.onTimeout === "auto-proceed") {
+    const resolution = autoApplyResolution(request.recommended!);
+    deps.store.resolveDecision(row.id, "answered", resolution, now());
+    text =
+      `conductor_ask ${row.id}: no answer within ${ceilingSeconds}s — auto-proceeding as declared. ` +
+      `The recommended option "${request.recommended}" is applied, and the decision row was resolved ` +
+      `with the answer "${resolution}" so the record shows nobody human chose it. Proceed to apply ` +
+      `that recommendation to the blocked work now.`;
+  } else {
+    text =
+      `conductor_ask ${row.id}: no answer within ${ceilingSeconds}s — parking as declared. ` +
+      `The decision row stays open and pending, re-surfaced in every tick prompt until answered or the ` +
+      `seven-day expiry. Park the blocked work now: take it out of the claimable queue and record its ` +
+      `state (e.g. unlabel it or move it to a parked state), then note it in your report.`;
+  }
+
+  const delivered =
+    delivery.kind === "sent"
+      ? `The question went to the operator as a ${delivery.category} message.`
+      : `The question is durably held (notice ${delivery.noticeId ?? "?"}, ${delivery.category}); the ` +
+        "daemon releases it with the next digest or working-hours catch-up.";
+
+  return { outcome, decisionId: row.id, text: `${delivered}\n${text}` };
+}