omp-conductor 0.15.9 → 0.15.11

package/src/board.ts

@@ -21,6 +21,7 @@ import { makeTracker } from "./tracker/github.ts";
 import { planUsageBadge, readPlanUsage, sharedUsageSource } from "./usage.ts";
 import type {
   AdmissionHoldReason,
+  Caps,
   PrVerification,
   ProjectConfig,
   ReadyIssue,
@@ -730,7 +731,9 @@ function admissionLine(snapshot: BoardSnapshot): string {
   const queue =
     dispatch === undefined
       ? "dispatch not recorded"
-      : `${dispatch.degraded ? "DEGRADED · " : ""}${dispatch.ready} ready · ${dispatch.claimed ?? 0} in flight · ${dispatch.routed} spare · ${dispatch.admitted} admitted`;
+      : dispatch.paused === true
+        ? `held pass — nothing admitted${(dispatch.settled ?? 0) > 0 ? ` · settled ${dispatch.settled}` : ""}`
+        : `${dispatch.degraded ? "DEGRADED · " : ""}${dispatch.ready} ready · ${dispatch.claimed ?? 0} in flight · ${dispatch.routed} spare · ${dispatch.admitted} admitted`;
   const holdText = dispatch?.holds.map((hold) => `${hold.reason} ${hold.count}`).join(", ");
   const holds = holdText === undefined || holdText === "" ? "none" : holdText;
   return (
@@ -1177,14 +1180,57 @@ export function boardJson(snapshot: BoardSnapshot): string {
   );
 }
 
+export interface BoardConfigState {
+  project: ProjectConfig;
+  caps: Caps;
+  /** The last refresh could not read the config; `project`/`caps` are the last
+   *  good values and the board renders the failure instead of the values. */
+  error?: string;
+  /** Whether the last successful refresh resolved different values. */
+  changed: boolean;
+}
+
+/**
+ * Re-resolve the board's project and caps from the config, once per refresh
+ * cycle (#370). The board renders `project` and `caps` on every repaint, so
+ * this read — never the render path — is what keeps a cap changed while the
+ * board is open from going stale. A config that cannot be read returns the
+ * previous values with the failure, exactly how the daemon holds boot values
+ * across a failed hot reload instead of wedging its tick.
+ */
+export function reloadBoardConfig(
+  projectName: string | undefined,
+  previous?: { project: ProjectConfig; caps: Caps },
+): BoardConfigState {
+  try {
+    const cfg = loadConfig();
+    const project = findProject(cfg, projectName);
+    const caps = resolveCaps(project, cfg.defaults);
+    const unchanged =
+      previous !== undefined &&
+      JSON.stringify(project) === JSON.stringify(previous.project) &&
+      JSON.stringify(caps) === JSON.stringify(previous.caps);
+    return { project, caps, changed: !unchanged };
+  } catch (err) {
+    if (previous === undefined) throw err;
+    return {
+      project: previous.project,
+      caps: previous.caps,
+      changed: false,
+      error: err instanceof Error ? err.message : String(err),
+    };
+  }
+}
+
 export async function runBoard(projectName?: string): Promise<void> {
   if (!process.stdin.isTTY || !process.stdout.isTTY) {
     throw new Error("board needs an interactive terminal (TTY)");
   }
 
-  const cfg = loadConfig();
-  const project = findProject(cfg, projectName);
-  const caps = resolveCaps(project, cfg.defaults);
+  // The config is read at boot (an unreadable one still fails the board), then
+  // re-read on the health cadence below so the board tracks what the daemon
+  // hot-reloads per tick.
+  let { project, caps, error: configError } = reloadBoardConfig(projectName);
   const store: Store = openStore(dbPath());
   const cursor: BoardCursor = { column: 2, card: 0, detail: false, transcriptOffset: 0 };
   const queue: KeyInput[] = [];
@@ -1243,18 +1289,30 @@ export async function runBoard(projectName?: string): Promise<void> {
       const now = Date.now();
       if (now - healthAt >= HEALTH_REFRESH_MS && healthRefresh === undefined) {
         healthAt = now;
-        healthRefresh = Promise.all([
-          probeBoardHealth(project),
+        healthRefresh = (async () => {
+          // #370: the config is re-read on the health cadence, not the 1 Hz
+          // repaint — the daemon hot-reloads per tick, so a cap changed while
+          // the board is open must land here too. A config that cannot be read
+          // keeps the last good project/caps and marks the board stale instead
+          // of tearing it down: the daemon's own boot-values rule.
+          const reloaded = reloadBoardConfig(projectName, { project, caps });
           // On the health cadence, not the 1s repaint: the provider read is a
           // subprocess, and an allowance does not move at 1 Hz.
-          readPlanUsage(caps.planUsage, sharedUsageSource()),
-        ])
-          .then(([nextProbe, nextPlanUsage]) => {
-            health = nextProbe.health;
-            pausedPhases = nextProbe.pausedPhases;
-            planUsage = nextPlanUsage;
-            enqueue(queue, { name: "refresh" }, wake);
-          })
+          const [nextProbe, nextPlanUsage] = await Promise.all([
+            probeBoardHealth(reloaded.project),
+            readPlanUsage(reloaded.caps.planUsage, sharedUsageSource()),
+          ]);
+          project = reloaded.project;
+          caps = reloaded.caps;
+          configError = reloaded.error;
+          health = nextProbe.health;
+          pausedPhases = nextProbe.pausedPhases;
+          planUsage = nextPlanUsage;
+          if (reloaded.error === undefined && reloaded.changed) {
+            notice = "config reloaded - changes applied";
+          }
+          enqueue(queue, { name: "refresh" }, wake);
+        })()
           .catch((err: unknown) => {
             notice = `health refresh failed: ${err instanceof Error ? err.message : String(err)}`;
           })
@@ -1313,7 +1371,15 @@ export async function runBoard(projectName?: string): Promise<void> {
         now,
       };
       normalizeCursor(snapshot, cursor);
-      process.stdout.write(`${CSI}H${renderBoard(snapshot, cursor, process.stdout.columns, process.stdout.rows, notice, help)}${CSI}J`);
+      // An unreadable config pins the footer to the last-good warning for as
+      // long as the config stays broken, instead of clearing after the one
+      // frame a transient notice gets (#370); the cap on screen is last good
+      // and says so. Transient notices get their slot back on a good read.
+      const frameNotice =
+        configError === undefined
+          ? notice
+          : `config unreadable — ${configError} — showing last good values`;
+      process.stdout.write(`${CSI}H${renderBoard(snapshot, cursor, process.stdout.columns, process.stdout.rows, frameNotice, help)}${CSI}J`);
       notice = "";
 
       const key = await waitForInput(queue, (next) => {

package/src/brief-upgrade.ts

@@ -34,6 +34,14 @@ export const POLICY_BRIEF_NAME = "POLICY.md";
 /** Composed view the session / AGENTS.md symlink historically pointed at. */
 export const ORCHESTRATOR_BRIEF_NAME = "ORCHESTRATOR.md";
 
+/**
+ * Host-wide operator policy, one file applying to every project on this host.
+ *
+ * Lives beside `config.json` under the state root (see {@link sharedPolicyPath})
+ * because it is operator text that outlives any one project's workspace.
+ */
+export const SHARED_POLICY_BRIEF_NAME = "SHARED_POLICY.md";
+
 /** Topic keys that belong in POLICY.md (matched like {@link topicKey}). */
 export const OWNED_TOPIC_KEYS = ["releases", "project context", "reporting", "amendments"] as const;
 
@@ -46,6 +54,39 @@ export const COMPOSE_BANNER = [
   "<!-- ==================================================================== -->",
 ].join("\n");
 
+/**
+ * Banner for the three-layer compose: names every source so a reader can tell
+ * which layer a paragraph came from, and states the precedence — the project's
+ * own `POLICY.md` overrides the host-wide shared layer where they conflict.
+ *
+ * Only used when a shared policy actually exists. With none, composition is
+ * byte-identical to the two-layer `COMPOSE_BANNER` form above (#363).
+ */
+export const COMPOSE_BANNER_WITH_SHARED = [
+  "<!-- ==================================================================== -->",
+  "<!-- YOURS TO EDIT — live copy of POLICY.md. Edit POLICY.md, not here.   -->",
+  "<!-- This composed ORCHESTRATOR.md is regenerated from package floor +   -->",
+  "<!-- SHARED_POLICY.md + POLICY.md; hand-edits above or below the         -->",
+  "<!-- banners will not last.                                              -->",
+  "<!--                                                                      -->",
+  "<!-- Shared operator policy (SHARED_POLICY.md beside config.json)         -->",
+  "<!-- applies to every project on this host. The project's POLICY.md       -->",
+  "<!-- below overrides it where the two conflict.                           -->",
+  "<!-- ==================================================================== -->",
+].join("\n");
+
+/**
+ * Divider between the shared layer and the project's own `POLICY.md` half.
+ *
+ * Carries its own edit marker so the two operator layers each end at a "yours
+ * to edit" boundary instead of running into each other.
+ */
+export const PROJECT_POLICY_DIVIDER = [
+  "<!-- ==================================================================== -->",
+  "<!-- YOURS TO EDIT — live copy of the project's POLICY.md below.          -->",
+  "<!-- ==================================================================== -->",
+].join("\n");
+
 /**
  * A brief split into the package's half and the operator's half.
  *
@@ -255,6 +296,32 @@ export function orchestratorPathForRoot(workspaceRoot: string): string {
   return join(workspaceRoot, ORCHESTRATOR_BRIEF_NAME);
 }
 
+/** Where the host-wide shared policy lives: beside `config.json` (see stateDir). */
+export function sharedPolicyPath(): string {
+  return join(stateDir(), SHARED_POLICY_BRIEF_NAME);
+}
+
+/**
+ * Shared policy text from the host-wide file, or `undefined` when it is absent.
+ *
+ * `undefined` is the "two-layer fleet" answer: absent shared policy composes
+ * byte-identically to today, so callers pass this straight into
+ * {@link composeOrchestrator}.
+ */
+export function readSharedPolicy(): string | undefined {
+  const path = sharedPolicyPath();
+  return existsSync(path) ? readFileSync(path, "utf8") : undefined;
+}
+
+/**
+ * Shared policy text from an explicitly-named file, or `undefined` when the
+ * file does not exist. The refresh/migrate paths take the path as an option so
+ * their tests stay hermetic; {@link readSharedPolicy} is the state-dir version.
+ */
+function readSharedAt(path: string | undefined): string | undefined {
+  return path !== undefined && existsSync(path) ? readFileSync(path, "utf8") : undefined;
+}
+
 /**
  * Classifies what sits in the workspace: overlay, migratable legacy, or absent.
  *
@@ -283,11 +350,19 @@ export function inspectBriefLayout(
   };
 }
 
-/** Join rendered floor + live policy into the composed session brief. */
-export function composeOrchestrator(floor: string, policy: string): string {
+/**
+ * Join rendered floor + live policy into the composed session brief.
+ *
+ * An optional host-wide shared policy composes between the floor and the
+ * project policy. Absent one (`undefined`), the output is byte-identical to
+ * the two-layer form — a single-project fleet sees no change at all.
+ */
+export function composeOrchestrator(floor: string, policy: string, sharedPolicy?: string): string {
   const f = floor.replace(/\s+$/, "\n");
   const p = policy.replace(/^\s+/, "").replace(/\s+$/, "\n");
-  return `${f}\n${COMPOSE_BANNER}\n\n${p}`;
+  if (sharedPolicy === undefined) return `${f}\n${COMPOSE_BANNER}\n\n${p}`;
+  const s = sharedPolicy.replace(/^\s+/, "").replace(/\s+$/, "\n");
+  return `${f}\n${COMPOSE_BANNER_WITH_SHARED}\n\n${s}\n${PROJECT_POLICY_DIVIDER}\n\n${p}`;
 }
 
 /**
@@ -370,6 +445,8 @@ export function migrateToPolicy(opts: {
   floor: string;
   /** When set, use this owned text instead of splitting the live file. */
   owned?: string;
+  /** Optional host-wide shared policy file; absent one composes two-layer. */
+  sharedPolicyPath?: string;
   /** Override the conductor backup directory (tests). */
   backupRoot?: string;
 }): MigrateResult {
@@ -386,7 +463,11 @@ export function migrateToPolicy(opts: {
     policyBody.endsWith("\n") ? policyBody : `${policyBody}\n`,
     opts.backupRoot,
   );
-  const composed = composeOrchestrator(opts.floor, readFileSync(opts.policyPath, "utf8"));
+  const composed = composeOrchestrator(
+    opts.floor,
+    readFileSync(opts.policyPath, "utf8"),
+    readSharedAt(opts.sharedPolicyPath),
+  );
   const orchestratorBackup = writeWithBackup(opts.orchestratorPath, composed, opts.backupRoot);
   return {
     policyPath: opts.policyPath,
@@ -407,6 +488,8 @@ export function repairPolicyBannerCrumbs(opts: {
   orchestratorPath: string;
   policyPath: string;
   floor: string;
+  /** Optional host-wide shared policy file; absent one composes two-layer. */
+  sharedPolicyPath?: string;
   /** Override the conductor backup directory (tests). */
   backupRoot?: string;
 }): MigrateResult | undefined {
@@ -415,7 +498,10 @@ export function repairPolicyBannerCrumbs(opts: {
   const cleaned = stripLeadingBannerCrumbs(before);
   if (cleaned === before) {
     // Still recompose so the floor matches this package even when POLICY was clean.
-    writeFileSync(opts.orchestratorPath, composeOrchestrator(opts.floor, before));
+    writeFileSync(
+      opts.orchestratorPath,
+      composeOrchestrator(opts.floor, before, readSharedAt(opts.sharedPolicyPath)),
+    );
     return undefined;
   }
   const policyBackup = writeWithBackup(
@@ -423,7 +509,11 @@ export function repairPolicyBannerCrumbs(opts: {
     cleaned.endsWith("\n") ? cleaned : `${cleaned}\n`,
     opts.backupRoot,
   );
-  const composed = composeOrchestrator(opts.floor, readFileSync(opts.policyPath, "utf8"));
+  const composed = composeOrchestrator(
+    opts.floor,
+    readFileSync(opts.policyPath, "utf8"),
+    readSharedAt(opts.sharedPolicyPath),
+  );
   const orchestratorBackup = writeWithBackup(opts.orchestratorPath, composed, opts.backupRoot);
   return {
     policyPath: opts.policyPath,
@@ -442,13 +532,18 @@ export function refreshComposedBrief(opts: {
   orchestratorPath: string;
   policyPath: string;
   floor: string;
+  /** Optional host-wide shared policy file; absent one composes two-layer. */
+  sharedPolicyPath?: string;
   /** Override the conductor backup directory (tests). */
   backupRoot?: string;
 }): boolean {
   migrateLegacyBriefBackups([opts.policyPath, opts.orchestratorPath], opts.backupRoot);
   if (!existsSync(opts.policyPath)) return false;
   const policy = readFileSync(opts.policyPath, "utf8");
-  writeFileSync(opts.orchestratorPath, composeOrchestrator(opts.floor, policy));
+  writeFileSync(
+    opts.orchestratorPath,
+    composeOrchestrator(opts.floor, policy, readSharedAt(opts.sharedPolicyPath)),
+  );
   return true;
 }
 
@@ -557,13 +652,24 @@ export function applyRetrofit(path: string, proposal: RetrofitProposal, backupRo
  * is now the only classifier. The pre-overlay pair it replaced described two
  * further states ("mergeable", "current") that only the deleted single-file
  * merge could act on (#131).
+ *
+ * `sharedPolicyPath` is the optional host-wide shared-policy file; the overlay
+ * report lists it when present so the operator can see which layers compose.
  */
-export function formatBriefReport(path: string, layout: BriefLayout, missing: readonly string[]): string {
+export function formatBriefReport(
+  path: string,
+  layout: BriefLayout,
+  missing: readonly string[],
+  sharedPolicyPath?: string,
+): string {
   if (layout.kind === "overlay") {
     return [
       `brief overlay active`,
       "",
       `  floor        package template → recomposed into ${layout.orchestratorPath} each tick`,
+      `  shared       ${
+        sharedPolicyPath ?? "(none — composing package floor + POLICY.md)"
+      } — host-wide operator policy; the project's POLICY.md overrides it`,
       `  policy       ${layout.policyPath} (Learning loop / operator edits)`,
       "",
       "Protocol updates: upgrade omp-conductor in this host's existing install root (same package manager), then restart the daemon — no brief-upgrade --apply.",

package/src/briefs/orchestrator.md

@@ -139,24 +139,25 @@ Never leave an orphan holding a slot "to be safe": a label nobody is working und
 is not safety, it is a deadlocked fleet that looks busy.
 
 **Then read the settlement flags.** The conductor no longer takes a worker's word
-for what it changed. When a run settles, its report's `changed:` line is
-reconciled against the pull request's actual diff, and the diff is checked for
+for what it changed — it does not even ask. When a run settles, the `changed:`
+line of its report is **derived from the pull request's own diff**: the worker
+writes the narrative, the daemon writes the file list, so an undisclosed file
+cannot exist as a concept. What the audit checks instead is the diff itself, for
 weakened tests. Anything it finds is a **settlement audit** flag: it appears
 under the run in `omp-conductor status`, in the settlement report, and — once,
 at settlement — as a tier-1 escalation to you.
 
 A flag is evidence, not a verdict. It never blocks anything: the run settled
 normally, the PR is open and mergeable, and nothing is waiting on you. What it
-says is that one specific sentence in the worker's own account of its work did
-not survive contact with the diff, and that a human's usual review would have
-to notice it unaided.
+says is that something specific about the run did not survive contact with the
+diff — above all a weakened test, the one thing a reviewer's usual pass is
+poorly placed to notice. (The file list is derived, so the only disclosure flag
+left is a settlement that could not read the PR at all — read its file list
+straight from GitHub.)
 
 | Flag | What it means | What it invites |
 | --- | --- | --- |
-| `undisclosed-file` | The PR touched a file the report never mentioned. | Open the diff for that file. An undisclosed edit is usually incidental — a lockfile, a formatter — and occasionally the whole story. |
-| `changed-line-missing` | The report disclosed nothing at all. | Read the diff before merging; you have no summary of it. |
-| `unmatched-claim` | The report named a file the PR never touched. | Weak on its own. Two or three together mean the report was written from memory rather than from `git diff`, so trust the rest of it less. |
-| `report-format-unparsed` | The audit could not parse the report's format. | Not a trust signal against the worker — read the diff directly. |
+| `changed-line-missing` | The settlement could not read the PR's diff, so no file list was derived. | The one disclosure fault left, and it is a tree-read failure, not a worker's: read the PR's file list directly. |
 | `test-file-deleted` | A test file left the tree and no rename explains it. | The one that most deserves a human. Was the behaviour it defended deleted too, or only its test? |
 | `test-disabled` | A `.skip` / `.only` / `xit` / `t.Skip` marker was added. | Ask what turned red. A skip added in the same PR as the change it stopped failing is the shape to look for. |
 | `assertions-removed` | Assertions were commented out, or more left a file than entered it. | Compare against the issue's acceptance criteria: an assertion removed because the spec changed is fine, one removed because it failed is not. |
@@ -259,26 +260,44 @@ text before anything is sent and prints a durable handoff id: a report id when
 delivery is allowed, or a held-notice id until a digest or working-hours
 catch-up claims it. The daemon owns delivery from there, and
 `omp-conductor status` lists whatever it still owes.
+An escalation that must reach the operator now — the fleet is stopped, a
+tier-2 block — is handed over the same way with its own category as the kind:
+`omp-conductor report --kind fleet-stopped --text "<account>"` (or `--kind
+tier2`, `decision-needed`, `confirmed-failure`). The reporting policy decides
+between immediate delivery and a durable hold exactly as it does for a daemon
+escalation of that category; do not resend the same escalation while it is
+still queued undelivered — once it lands, the identical text is a new event.
 Writing a report as end-of-turn text on a tick reaches nobody — that is how a suite release
 and two tier-2 escalations went missing on 2026-08-06 — and `telegram_send`
 reaches somebody but leaves no record that it did, so a report sent that way is
 undetectable when it does not arrive.
 
 A report is an update. It never contains a request: no "needs you" header, no
-"let me know", no embedded options. Use `telegram_ask` for each decision,
-approval, or answer that you need. Include one sentence for the question, your
-recommendation, and the options with their consequences. Mark the recommended
-option. Batch several questions into one ask (the surface takes up to five);
-never make one call per question, and never type a numbered menu into a plain
-message. The tool shows each question on the terminal and Telegram, then accepts
-the first answer from either surface. A returned answer proves an answer, not
-Telegram delivery. If the question must demonstrably reach the operator through
-Telegram, send it separately: `omp-conductor message --text "QUESTION: …"` on a
-locally injected tick, or a `telegram_send` whose text begins `QUESTION:` while
-you are answering a live message in its own topic. Either way the marker is what
-makes the autonomous-tick gate apply the decision category. Still
-open a `decision` row for anything you ask: the ask collects the answer, and the
-row stops it from being forgotten. In both directions, the delivery
+"let me know", no embedded options. On a locally injected tick, ask for each
+decision, approval, or answer with `conductor_ask` — the bounded ask surface.
+One question per call: one sentence for the question, your recommendation, and
+the options with their consequences. Mark the recommended option, and declare
+`on-timeout` — what happens when nobody answers within the ceiling:
+`auto-proceed` applies your recommendation and resolves the decision row with
+`"<option> (auto-applied on ask timeout)"`, so the record never reads as a
+human choice; `park` leaves the row open and pending until answered or the
+seven-day expiry, and you then take the blocked work out of the claimable
+queue with its state recorded. The ceiling applies even when you omit
+`timeoutSeconds` — an ask issued without one gets the default — and the raw
+`telegram_ask` tool is refused on a locally injected tick precisely because it
+would wait for your operator as long as the answer takes: an unanswered
+question must never hold the loop. If the question must demonstrably reach the
+operator through Telegram, send it separately: `omp-conductor message --text
+"QUESTION: …"` on a locally injected tick, or a `telegram_send` whose text
+begins `QUESTION:` while you are answering a live message in its own topic.
+Either way the marker is what makes the autonomous-tick gate apply the decision
+category. When the question is itself the escalation — a condition that stops
+the fleet, a tier-2 block the policy may page for — pass `category` on the ask
+(`"fleet-stopped"`, `"tier2"`, `"decision-needed"`, `"confirmed-failure"`) so
+the delivery is admitted under the configured scope; an untagged ask is treated
+as an ordinary decision-needed question. The decision row a `conductor_ask`
+seeds is what stops the question from being forgotten: trust the digest, never
+your recollection of having asked. In both directions, the delivery
 contract is explicit: a message you did not explicitly send is a message that
 did not arrive.
 
@@ -309,7 +328,10 @@ the text `QUESTION:` when you are asking for something, so it carries the
 decision category. Reports still go through `omp-conductor report`.
 
 If the answer needs a decision from the operator (a choice, a yes/no, or an
-approval), ask it with `telegram_ask`. Never send numbered options through
+approval) while you are answering a live message, ask it with `telegram_ask`:
+you are mid-conversation and the person is there. On a locally injected tick
+that tool is refused as unbounded — ask with `conductor_ask` and declare
+`on-timeout` instead. Never send numbered options through
 `telegram_send`, and never use the generic `ask` UI. The tool returns the first
 answer from the terminal or Telegram. A returned answer proves an answer, not
 Telegram delivery. A cancelled or errored `telegram_ask` is not an answer.
@@ -520,12 +542,16 @@ The protocol, in order:
 1. **Draft the exact replacement** against `POLICY.md`. Quote the lines as they
    stand, then the lines you propose. A diff, not a description of one. This full
    text is what you *apply* on a yes — it is not what you send.
-2. **Ask, once — a single yes/no question, written for a phone.** Explicitly
-   call `telegram_ask`; never use the generic `ask` UI. The tool shows the
-   question on the terminal and Telegram, then returns the first answer from
-   either surface. A returned answer proves an answer, not Telegram delivery.
+2. **Ask, once — a single yes/no question, written for a phone.** Call
+   `conductor_ask` — never use the generic `ask` UI. The tool shows the question
+   on the terminal and Telegram, then returns the first answer from either surface,
+   bounded by the ceiling. An amendment never auto-applies:
+   declare `"on-timeout": "park"` so an unanswered yes/no stays pending (the
+   row is re-surfaced in every tick) instead of being recorded as approved —
+   "auto-proceed" exists for decisions, and it must also record itself as
+   auto-applied, which this protocol never does for POLICY.md. A returned answer proves an answer, not Telegram delivery.
    If the proposal must demonstrably reach the operator through Telegram, or
-   `telegram_ask` is unavailable, send the compact yes/no question separately
+   `conductor_ask` is unavailable, send the compact yes/no question separately
    with `omp-conductor message --text "QUESTION: …"` — on a tick that is the
    only path that reaches this project's own topic.
    Wait for the operator's later reply, and never assume one. Telegram renders

package/src/briefs/policy.md

@@ -50,6 +50,10 @@ replaced while this text still reads plausible. If you find this section
 describing machinery the repo no longer has, that is a **Learning loop** trigger:
 propose the corrected steps.
 
+## Promotion — who adds `{{QUEUE_LABEL}}`
+
+{{PROMOTION_DUTY}}
+
 ## Project context (filled during onboarding)
 
 Empty until setup fills it in: the product in a paragraph, a map of which repo
@@ -116,13 +120,18 @@ both; naming the chat alone drops a forum reply into the main chat and is
 refused. A locally injected tick has no such message to answer, so its direct
 delivery is `omp-conductor message --text "…"`, which resolves this project's
 own chat and topic. Neither is a report: they leave no record that anything went
-out. `telegram_ask` is the right
-call for a decision. It shows the question on the terminal and Telegram, then
-returns the first answer from either surface. A returned answer proves an
-answer, not Telegram delivery. A cancelled or errored `telegram_ask` is not an
+out. `telegram_ask` is the decision primitive for a live conversation — and on a
+locally injected tick it is refused as unbounded, so the ask surface there is
+`conductor_ask`: the same question, a declared `on-timeout`
+(`auto-proceed` — applies your recommendation and records the row as auto-applied —
+or `park` — leaves the row pending, re-surfaced in every tick), and a ceiling
+that applies even when the ask names none. A returned answer proves an
+answer, not Telegram delivery. A cancelled or errored ask is not an
 answer: re-deliver the question with text beginning
 `QUESTION:` so an autonomous tick applies the decision category, or report the
-channel as broken. It is never "asked once, no reply, dropped".
+channel as broken. A timed-out ask is "nobody answered yet" — it either
+auto-applied its recorded recommendation or is still pending; it is never
+"asked once, no reply, dropped".
 
 Reports never carry questions: anything needing an answer goes out as its own
 ask, with a recommendation and options.

package/src/briefs/worker.md

@@ -213,10 +213,16 @@ pr:      <url or "none">
 head:    <40-character head SHA or "none">
 state:   pushed-green | blocked | failed
 gates:   <exact commands run and their results>
-changed: <files touched, one line>
+changed: <the settlement derives this from the PR diff — omit the line>
 next:    <nothing | the specific decision needed>
 ```
 
+The `changed:` line is not yours to write from memory: the settlement replaces
+it with the actual file list from the PR's diff. Omit it, or write it wrongly —
+the settled report carries the diff's list either way. The narrative in your
+report (what you changed and why, above these lines) is the part only you can
+write, and it is the part a reviewer reads.
+
 Never report success you have not observed. "Should pass CI" is not a state, and
 `pushed-green` means you watched the checks go green — not that you expect them
 to.

package/src/chain-check.ts

@@ -154,4 +154,4 @@ export function chainViolations(input: ChainViolationInput): string[] {
   }
 
   return violations;
-}
+}

package/src/check-trailing-newlines.ts

@@ -0,0 +1,82 @@
+/**
+ * Gate: tracked text files must end with a final newline and no trailing
+ * blank lines.
+ *
+ * Run via `bun run check` from the package root (after `tsc --noEmit`).
+ * Neither tsc nor the test suite has an opinion about the last byte of a
+ * file, so worker-authored files kept landing without one — each a spurious
+ * two-line hunk on the next edit. This is the cheap mechanical check that
+ * closes that gap: it walks `git ls-files`, checks every tracked text file
+ * by extension, and names every offender in a single run.
+ */
+
+import { execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+/** Tracked text suffixes the gate applies to. */
+export const INCLUDED_SUFFIXES: readonly string[] = [
+  ".ts", ".js", ".css", ".html", ".md", ".json", ".yml", ".yaml", ".toml", ".sh",
+];
+
+/**
+ * Generated files the gate must not police, named explicitly rather than
+ * guessed at by content. Paths are repo-root-relative, as `git ls-files`
+ * reports them.
+ */
+export const EXCLUDED_PATHS: readonly string[] = [
+  "omp/bun.lock", // regenerated by `bun install`
+  "omp/schema/config.schema.json", // regenerated by `bun run schema`
+];
+
+/** Reason this file's ending fails the gate, or null when it is correct. */
+export function checkEnding(bytes: Uint8Array): string | null {
+  let trailingNewlines = 0;
+  for (let i = bytes.length - 1; i >= 0 && bytes[i] === 0x0a; i--) {
+    trailingNewlines++;
+  }
+  if (trailingNewlines === 0) return "missing trailing newline";
+  if (trailingNewlines > 2) return `ends with ${trailingNewlines - 1} blank lines`;
+  return null;
+}
+
+/**
+ * Check every file, returning one violation line per offender so a single
+ * run names every bad path instead of dying on the first.
+ */
+export function findViolations(
+  paths: readonly string[],
+  read: (path: string) => Uint8Array = readFileSync,
+): string[] {
+  const violations: string[] = [];
+  for (const path of paths) {
+    const bytes = read(path);
+    if (bytes.length === 0) continue; // nothing to terminate
+    const reason = checkEnding(bytes);
+    if (reason !== null) violations.push(`${path}: ${reason}`);
+  }
+  return violations;
+}
+
+function repoRoot(): string {
+  return execFileSync("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8" }).trim();
+}
+
+if (import.meta.main) {
+  const root = repoRoot();
+  const tracked = execFileSync("git", ["-C", root, "ls-files"], { encoding: "utf8" })
+    .split("\n")
+    .filter((path) => path.length > 0);
+  const textFiles = tracked.filter(
+    (path) =>
+      INCLUDED_SUFFIXES.some((suffix) => path.endsWith(suffix)) &&
+      !EXCLUDED_PATHS.includes(path),
+  );
+  const violations = findViolations(textFiles, (path) => readFileSync(join(root, path)));
+  if (violations.length > 0) {
+    for (const violation of violations) console.error(violation);
+    console.error(`trailing newline gate: ${violations.length} file(s) need fixing`);
+    process.exit(1);
+  }
+  console.log("trailing newline gate: ok");
+}