omp-conductor 0.17.0 → 0.17.1

package/REFERENCE.md

@@ -1864,7 +1864,7 @@ policy instead of restating it — no threshold lives in two places.
 
 | Field | Values | Default | Means |
 | --- | --- | --- | --- |
-| `requires` | `runs-settled`, `no-open-prs`, `queue-drained`, `base-branch-green`, `epic-children-closed` | `["runs-settled"]` | What must already have landed. `runs-settled` reads each active run's PR fact at release time: a pushed run whose PR has merged counts as settled even when the settle sweep has not yet written the terminal row — so a hold-drained release does not wait an extra tick the operator reached the gate by holding. Live workers and unmerged/unknown PRs still refuse, and the message names which is which. `base-branch-green` requires the current live head's push-triggered workflow verdict for that routed repository to be green; pending, unknown, red, or no observation refuses release. Order and duplicates do not matter; the loader canonicalises. |
+| `requires` | `runs-settled`, `fleet-runs-settled`, `no-open-prs`, `queue-drained`, `base-branch-green`, `epic-children-closed` | `["runs-settled"]` | What must already have landed. `runs-settled` reads each active run of the released repo's PR fact at release time: a pushed run whose PR has merged counts as settled even when the settle sweep has not yet written the terminal row — so a hold-drained release does not wait an extra tick the operator reached the gate by holding. Runs in other routed repos never gate a repo-scoped release — they cannot invalidate the artifact being shipped; a genuinely suite-wide shape (a pin or manifest consuming several repos) opts back into project-wide strictness with the named `fleet-runs-settled` requirement. Live workers and unmerged/unknown PRs still refuse, the message names which is which and which runs are blocking by repo and issue. `base-branch-green` requires the current live head's push-triggered workflow verdict for that routed repository to be green; pending, unknown, red, or no observation refuses release. Order and duplicates do not matter; the loader canonicali…
 | `requiredChecks` | any check names | `[]` | Checks that must be green on the branch being released. Empty means every check it reports. |
 | `artefacts` | any names | `[]` | The packages or images this project releases. **Empty denies**: nothing has been authorised to ship. |
 | `environments` | any names | `[]` | Deploy targets. **Empty denies** every environment. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omp-conductor",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "type": "module",
   "license": "MIT",
   "description": "A 24/7 dispatcher that takes ready GitHub issues to green, mergeable PRs using omp coding sessions, with tiered escalation first to an orchestrator session and then to a human.",

package/schema/config.schema.json

@@ -325,6 +325,21 @@
             },
             "additionalProperties": false
           },
+          "arm": {
+            "type": "object",
+            "properties": {
+              "proof": {
+                "default": "challenge",
+                "type": "string",
+                "enum": [
+                  "challenge",
+                  "claim-only"
+                ]
+              }
+            },
+            "additionalProperties": false,
+            "description": "How `arm` proves a human just approved arming"
+          },
           "authority": {
             "type": "object",
             "properties": {
@@ -433,6 +448,7 @@
                       "type": "string",
                       "enum": [
                         "runs-settled",
+                        "fleet-runs-settled",
                         "no-open-prs",
                         "queue-drained",
                         "base-branch-green",

package/src/admission.ts

@@ -19,6 +19,7 @@ import { log, errText, safeEscalate } from "./log.ts";
 import type {
   Caps,
   Escalation,
+  IssueComment,
   IssueSnapshot,
   OpenCloser,
   ProjectConfig,
@@ -28,7 +29,7 @@ import type {
   AdmissionHoldReason,
 } from "./types.ts";
 import { readPlanUsage, type PlanUsageStatus, type UsageSource } from "./usage.ts";
-import type { CriticalBaseProbe, CriticalBaseVerdict, RunLaneProbe } from "./gitops.ts";
+import type { CriticalBaseProbe, CriticalBaseVerdict, LaneFile, LaneSource, RunLaneProbe } from "./gitops.ts";
 import { repoSlugFor } from "./gitops.ts";
 import { branchName, type Routed } from "./routing.ts";
 import { parseDependsOn } from "./depends-on.ts";
@@ -77,10 +78,16 @@ export function hasFailedAttemptBudget(failures: number, maxAttempts: number): b
   return failures < maxAttempts;
 }
 
-/** A candidate cleared for dispatch, with the attempt number it will run as. */
+/** A candidate cleared for dispatch, with the attempt number it will run as.
+ *  `lane` is the effective file-lane declaration admission resolved for it
+ *  (#608): the exact snapshot the overlap gate enforced. Dispatch renders this
+ *  value into the worker brief, so a changed or failed second comment read can
+ *  neither hide nor reword the lane admission held — the gate and the
+ *  worker-visible brief are one value, not two reads of the same thread. */
 export interface Admission {
   r: Routed;
   attempt: number;
+  lane?: FileLane;
 }
 
 export interface AdmissionHold {
@@ -174,27 +181,82 @@ function planUsageEscalation(project: string, plan: PlanUsageStatus): Escalation
  * files an issue declares it will touch (#555).
  *
  * The orchestrator already writes exactly this list into every promotion brief
- * in prose; this parses that same sentence out of the issue body so the
- * interlock is load-bearing rather than advisory. A body line beginning with
- * "file lane" (case-insensitive, optional bold/heading markers) is accepted,
- * and paths are read as backtick-delimited spans (the brief form) with a bare
- * comma/space-separated fallback that keeps tokens that look like relative
- * paths. Anything else — including an absent line, which is the default — is
- * an empty lane: the issue is admitted exactly as today (`fail open`), and the
- * gate never refuse work for wanting a lane. Exported so the format is pinned
- * independent of admission.
+ * in prose; this parses that same sentence out of the issue body — or out of a
+ * pre-dispatch comment, which is the same sentence on a supported brief
+ * surface since #517 — so the interlock is load-bearing rather than advisory.
+ * A line beginning with "file lane" (case-insensitive, optional
+ * bold/heading markers) is accepted, and paths are read as backtick-delimited
+ * spans (the brief form) with a bare comma/space-separated fallback that keeps
+ * tokens that look like relative paths. A line whose tokens are not pathlike
+ * (like `File lane: none`) is not a declaration. Anything else — including an
+ * absent declaration, which is the default — is an empty lane: the issue is
+ * admitted exactly as today (`fail open`), and the gate never refuses work for
+ * wanting a lane. This is the one grammar for all surfaces; there is no second
+ * comment-only spelling.
  */
-export function declaredLane(body: string): string[] {
-  const match = body.match(
+export function laneDeclaration(text: string): LaneDeclaration | undefined {
+  const match = text.match(
     /^\s*(?:[#>*-]\s*)*file[- ]lane\s*[:=]\s*([^\n]*)$/im,
   );
-  if (match === null) return [];
+  if (match === null) return undefined;
   const rest = match[1] ?? "";
   const backticked = [...rest.matchAll(/`([^`]+)`/g)]
     .map((m) => m[1]!.trim())
     .filter(isPathLike);
-  if (backticked.length > 0) return [...new Set(backticked)];
-  return [...new Set(rest.split(/[,\s]+/).map((s) => s.trim()).filter(isPathLike))];
+  const files =
+    backticked.length > 0
+      ? [...new Set(backticked)]
+      : [...new Set(rest.split(/[,\s]+/).map((s) => s.trim()).filter(isPathLike))];
+  if (files.length === 0) return undefined;
+  return { files, source: match[0].trim() };
+}
+
+/** One parsed `File lane:` declaration: the paths and the verbatim source
+ *  line, so a renderer can reproduce the declaration itself rather than a
+ *  summary of it. Exported for the brief's guarantee that the gate's effective
+ *  lane is always visible to the worker (#608). */
+export interface LaneDeclaration {
+  files: string[];
+  /** The declaration line verbatim, as written on the surface it came from. */
+  source: string;
+}
+
+/**
+ * The effective file lane as both admission and the worker brief must read it
+ * (#608): the latest `File lane:` declaration among the issue body and every
+ * comment, in the tracker's oldest-first order. This is the "later correction
+ * visibly supersedes" contract applied across both surfaces at once, and it is
+ * the single source of truth the gate enforces and the brief renders — so a
+ * declaration can never control admission while staying invisible to the
+ * worker. `at` records which surface won (`"body"`, or the 0-based comment
+ * index), letting the brief reproduce the declaration verbatim when the
+ * winning comment sits beyond its rendered discussion budget.
+ */
+export interface FileLane extends LaneDeclaration {
+  at: "body" | number;
+}
+
+/** Who holds one file's lane this admission pass, and which read proved it.
+ *  `"declared"` is the same-pass half: an admitted candidate's own lane
+ *  occupies for the rest of the pass without any probe read. */
+export type LaneHolder = { issue: number; source: LaneSource | "declared" };
+
+/** Resolves the effective lane across the body and the whole comment thread. */
+export function effectiveLane(body: string, comments: IssueComment[]): FileLane | undefined {
+  let current: FileLane | undefined;
+  const bodyDecl = laneDeclaration(body);
+  if (bodyDecl !== undefined) current = { ...bodyDecl, at: "body" };
+  for (let i = 0; i < comments.length; i++) {
+    const decl = laneDeclaration(comments[i]!.body);
+    if (decl !== undefined) current = { ...decl, at: i };
+  }
+  return current;
+}
+
+/** The paths of an issue body's declared lane (empty for no declaration).
+ *  Exported so the format is pinned independent of admission. */
+export function declaredLane(body: string): string[] {
+  return laneDeclaration(body)?.files ?? [];
 }
 
 /** A plausible relative path: it has a `.` extension or a directory separator. */
@@ -271,14 +333,14 @@ export async function admitCandidates(
   // and one on the web repo are different files. Built lazily and once, only
   // when the first candidate that declares a lane reaches the gate, so a queue
   // of laneless issues pays nothing for it.
-  let laneOccupancy: Map<string, Map<string, number>> | undefined;
-  const ensureLaneOccupancy = async (): Promise<Map<string, Map<string, number>>> => {
+  let laneOccupancy: Map<string, Map<string, LaneHolder>> | undefined;
+  const ensureLaneOccupancy = async (): Promise<Map<string, Map<string, LaneHolder>>> => {
     if (laneOccupancy !== undefined) return laneOccupancy;
-    const occupied = new Map<string, Map<string, number>>();
+    const occupied = new Map<string, Map<string, LaneHolder>>();
     for (const run of activeRuns) {
       if (d.probeWorktreeLane === undefined) break;
       const base = project.routing.repos[run.repo]?.defaultBranch ?? "main";
-      let files: string[];
+      let files: LaneFile[];
       try {
         files = await d.probeWorktreeLane({
           worktree: run.worktree,
@@ -291,20 +353,64 @@ export async function admitCandidates(
         // well-formed issue because one probe could not be answered.
         files = [];
       }
-      for (const file of files) {
-        if (occupied.get(run.repo)?.has(file) === true) continue;
+      for (const { file, source } of files) {
         let perRepo = occupied.get(run.repo);
         if (perRepo === undefined) {
           perRepo = new Map();
           occupied.set(run.repo, perRepo);
         }
-        perRepo.set(file, run.issue);
+        // First read wins: a file the run both commits and edits in its
+        // worktree is tagged by its live uncommitted half.
+        if (!perRepo.has(file)) perRepo.set(file, { issue: run.issue, source });
       }
     }
     laneOccupancy = occupied;
     return occupied;
   };
 
+  // The candidate half of the file-lane interlock (#555): the machine-readable
+  // lane an issue declares. Since #517 a promotion brief may live in a
+  // pre-dispatch comment rather than the body, so the lane is read from both
+  // surfaces — the same two the worker brief renders — through the tracker's
+  // existing comment port, never a second comment reader. Body and comments
+  // share the one `laneDeclaration` grammar, and the brief's "later correction
+  // visibly supersedes" contract holds: the effective lane is the latest
+  // declaration among the body and the WHOLE thread, so a correction posted as
+  // a comment replaces an earlier body lane instead of widening it (#608).
+  //
+  // Reading every comment — not just the ones the brief's discussion budget
+  // renders — is deliberate: this is the same `effectiveLane` the brief
+  // renders, and the dispatch side guarantees the winning declaration appears
+  // in the brief verbatim even when it sits beyond the budget. The gate and
+  // the worker therefore agree on one lane, which is the #608 defect's shape.
+  //
+  // Comments are read at most once per issue per pass — the lane feeds both
+  // the gate and the same-pass sibling occupancy below, so the cache is what
+  // stops one candidate costing two comment reads. Unreadable comments fail
+  // open to the body declaration (a body lane stays load-bearing), and with no
+  // readable declaration at all the #555 fail-open admission is unchanged.
+  //
+  // The resolved `FileLane` — not just its paths — is what an admitted
+  // candidate carries into dispatch (#608): the gate and the brief must agree
+  // on the *same declaration* (paths, verbatim source line, and which surface
+  // it came from), so dispatch renders this cached value rather than reading
+  // the thread a second time and hoping it did not change.
+  const laneCache = new Map<number, FileLane | undefined>();
+  const laneFor = async (r: Routed): Promise<FileLane | undefined> => {
+    const issue = r.issue.number;
+    if (laneCache.has(issue)) return laneCache.get(issue);
+    let lane: FileLane | undefined;
+    try {
+      lane = effectiveLane(r.issue.body, await tracker.listComments(issue));
+    } catch (err) {
+      const bodyDecl = laneDeclaration(r.issue.body);
+      lane = bodyDecl === undefined ? undefined : { ...bodyDecl, at: "body" };
+      log(`#${issue} comments unreadable at admission; the body's file lane stands: ${errText(err)}`);
+    }
+    laneCache.set(issue, lane);
+    return lane;
+  };
+
   // The plan allowance is a fleet-wide question, so it is asked once per pass
   // and answers for every candidate — unlike every gate below it, which is
   // per-issue. It sits here rather than beside the spend cap in `tick` for one
@@ -505,25 +611,30 @@ export async function admitCandidates(
       }
       if (verdict.state === "unknown") {
         // Fail closed: a branch that cannot be *proven* to contain the marker
-        // is refused, and the reason names the unverifiable marker so the
-        // operator can fix the fetch or the marker rather than guess.
-        hold(issue, "stale-base");
+        // is refused. This is a verification/lookup failure — the mirror fetch
+        // failed, the marker did not resolve, or no probe is wired — never
+        // evidence that the branch predates the marker. Hold with a distinct
+        // reason so status and the friction rollup do not read a provider
+        // outage as branch staleness, and prescribe no branch change: the next
+        // admission pass re-runs the probe and admits the unchanged branch
+        // once verification succeeds.
+        hold(issue, "critical-base-verify-error");
         log(
-          `#${issue} held (stale-base): continuation branch ${branch} could not be verified ` +
+          `#${issue} held (critical-base-verify-error): continuation branch ${branch} could not be verified ` +
             `against critical-base marker(s) ${markers.join(", ")} (${verdict.error})`,
         );
         await safeEscalate(d, {
           tier: 1,
           project: project.name,
           issue,
-          summary: `#${issue} continuation branch could not be verified against a critical base safety commit and is held (stale-base)`,
+          summary: `#${issue} continuation branch could not be verified against a critical base safety commit and is held (critical-base-verify-error)`,
           detail: [
             r.issue.title,
             r.issue.url,
             `The retained branch ${branch} could not be verified against critical-base marker(s) ${markers.join(", ")}: ${verdict.error}`,
-            "Recovery: merge current base into the branch so it contains the marker, and the next",
-            "admission pass re-admits it automatically without losing the branch's work; or review",
-            "the branch by hand and clear the hold once the fix is present.",
+            "The branch is not claimed to predate the marker: this is a verification failure.",
+            "No branch change is prescribed. The next admission pass retries the critical-base",
+            "verification automatically and admits the unchanged branch once the probe succeeds.",
           ].join("\n"),
         });
         continue;
@@ -795,18 +906,23 @@ export async function admitCandidates(
     // a live run's *actual* lane is held until that run's work has merged, so
     // no second worker is sent at files another worker is still writing. The
     // gate is the mechanical version of the prose rule that failed three times
-    // in one day. Only the machine-readable lane participates: a candidate
-    // without one is admitted exactly as today (fail open), and a candidate's
-    // own retained run never holds it — that is the continuation it continues.
-    const lane = declaredLane(r.issue.body);
-    if (lane.length > 0) {
+    // in one day. Only the machine-readable lane participates — read from the
+    // body and pre-dispatch comments alike, so the gate sees the same surface
+    // the worker brief renders (#608) — and a candidate without one is
+    // admitted exactly as today (fail open), while a candidate's own retained
+    // run never holds it — that is the continuation it continues.
+    const lane = await laneFor(r);
+    if (lane !== undefined && lane.files.length > 0) {
       const occupied = await ensureLaneOccupancy();
       const perRepo = occupied.get(r.repo.name);
       let blocked = false;
-      for (const file of lane) {
+      for (const file of lane.files) {
         const holder = perRepo?.get(file);
-        if (holder !== undefined && holder !== issue) {
-          const detail = `${file} held by run #${holder}`;
+        if (holder !== undefined && holder.issue !== issue) {
+          // The source names the probe read that proved the occupancy, so a
+          // hold reads as authored work — worktree or branch — rather than the
+          // base-reconciliation noise #684 filters out of the probe entirely.
+          const detail = `${file} held by run #${holder.issue} (${holder.source})`;
           hold(issue, "file-lane", detail);
           log(`#${issue} held (file-lane): ${detail}`);
           blocked = true;
@@ -816,20 +932,20 @@ export async function admitCandidates(
       if (blocked) continue;
     }
 
-    admitted.push({ r, attempt: priorRuns + 1 });
+    admitted.push({ r, attempt: priorRuns + 1, lane });
     liveByRepo.set(r.repo.name, (liveByRepo.get(r.repo.name) ?? 0) + 1);
     // Same-pass sibling occupancy for the file-lane gate: once admitted, a
     // candidate's declared lane occupies for the rest of the pass, so a later
     // overlapping candidate is held rather than both clearing in one tick.
-    if (lane.length > 0) {
+    if (lane !== undefined && lane.files.length > 0) {
       const occupied = await ensureLaneOccupancy();
       let perRepo = occupied.get(r.repo.name);
       if (perRepo === undefined) {
         perRepo = new Map();
         occupied.set(r.repo.name, perRepo);
       }
-      for (const file of lane) {
-        if (!perRepo.has(file)) perRepo.set(file, issue);
+      for (const file of lane.files) {
+        if (!perRepo.has(file)) perRepo.set(file, { issue, source: "declared" });
       }
     }
     if (parent !== undefined) {

package/src/availability.ts

@@ -91,17 +91,35 @@ export function availabilityDisposition(
   return "availability";
 }
 
+/** A question-kind category. Every ask surface — `message --category
+ *  decision-needed`, a `QUESTION:`-marked message, and `conductor_ask`'s
+ *  default — resolves to this one category, so treating it as
+ *  availability-deferred covers the whole question pathway at once (#596). */
+export const QUESTION_KIND: InterruptCategory = "decision-needed";
+
 /**
  * Decide one tier-2 category. `digest` means the category policy itself defers
  * it; `availability` means it was otherwise interruptible and may be released
  * when the configured window next opens.
+ *
+ * A question is availability-deferred, never digest-deferred (#596): the
+ * category policy decides what may interrupt the operator's phone, but a
+ * question's deferral is literally "the operator is not available" — it waits
+ * for the window and the working-hours catch-up can release it at the next
+ * opening. With no window configured the next opening is now, so a question
+ * delivers rather than being silently bound to the daily digest. The
+ * `interruptOn` list never applies to a question's deferral.
  */
 export function interruptDisposition(
   policy: ReportingPolicy | undefined,
   category: InterruptCategory,
   at: number,
 ): InterruptDisposition {
-  if (policy !== undefined && !policy.interruptOn.includes(category)) return "digest";
+  if (
+    policy !== undefined &&
+    category !== QUESTION_KIND &&
+    !policy.interruptOn.includes(category)
+  ) return "digest";
   return availabilityDisposition(policy?.availability, category, at);
 }
 
@@ -148,6 +166,14 @@ export function formatZonedMinute(at: number, timezone: string): string {
   return `${local.date} ${local.clock} ${timezone} (${new Date(at).toISOString()})`;
 }
 
+/** Compact local timestamp for a one-line future, e.g. "2026-08-24 09:00 UTC":
+ *  the same instant as {@link formatZonedMinute} without the ISO tail, so a
+ *  held-notice line read on a phone says plainly when the window opens. */
+export function formatNextWindowOpening(at: number, timezone: string): string {
+  const local = localMinute(at, timezone);
+  return `${local.date} ${local.clock} ${timezone}`;
+}
+
 /** One prompt sentence; the runtime gate, not this prose, owns the decision. */
 export function availabilityPrompt(policy: ReportingPolicy | undefined, now: number): string {
   const state = availabilityState(policy, now);

package/src/briefs/worker.md

@@ -98,6 +98,8 @@ These are the exact gates for `{{REPO}}`:
 
 {{GATES}}
 
+{{SHARED_HOST_NOTICE}}
+
 Run every one of them, from the directory listed, over the **whole tree** — not
 just the directory you edited. Linting only the source dir is how an error in a
 migration, a config file or a script reaches the runners.

package/src/commands/arm.ts

@@ -12,14 +12,17 @@ import { withProgress } from "../ui/progress.ts";
 
 export async function armCommand(ctx: CommandContext): Promise<void> {
 for (const project of ctx.targetProjects()) {
+  // Proof-neutral wording: `claim-only` performs no Telegram send, so the
+  // progress line cannot promise a challenge that never goes out (#613). The
+  // result line names the proof that actually armed it.
   const r = await withProgress(
-    "arm: sending inbound Telegram challenge…",
-    "Inbound Telegram round-trip proved",
+    "arm: verifying the arming proof…",
+    "Arming proof verified",
     () => armTicks(project.name),
     { plainMessage: true },
   );
   process.stdout.write(
-    `ARMED — inbound round-trip proved with owner ${r.owner}; ticks are now live.\n` +
+    `ARMED — ${r.proof === "claim-only" ? "claim-only plumbing verdict proved" : `inbound round-trip proved with owner ${r.owner}`}; ticks are now live.\n` +
       `marker ${r.path}${r.alreadyArmed ? " (replaced previous marker)" : ""}\n`,
   );
 }

package/src/commands/message.ts

@@ -15,10 +15,11 @@
 
 import type { CommandContext } from "./context.ts";
 import { randomUUID } from "node:crypto";
+import { availabilityState, formatNextWindowOpening } from "../availability.ts";
 import { findProject, loadConfig } from "../config.ts";
 import { deliverOperatorMessage, operatorMessageCategory, type OperatorMessageOutcome } from "../reports.ts";
 import { dbPath, openStore } from "../store.ts";
-import { INTERRUPT_CATEGORIES, type DecisionRecord, type InterruptCategory } from "../types.ts";
+import { INTERRUPT_CATEGORIES, type DecisionRecord, type InterruptCategory, type ProjectConfig } from "../types.ts";
 import { validateQuestionShape } from "../ask.ts";
 
 /** The floor's "this needs an answer" marker, as every other classifier reads it. */
@@ -96,8 +97,35 @@ export async function messageCommand(ctx: CommandContext): Promise<void> {
       ? // Not "into the topic": a stale topic degrades to the flat chat with
         // its own warning on stderr, and this line must not contradict it.
         `message delivered to ${project.name}'s configured Telegram target (${outcome.category})\n`
-      : `held notice ${outcome.noticeId} queued for ${project.name} (${outcome.category}; ` +
-          `${outcome.reason === "availability" ? "outside the availability window" : "a digest-only category"})\n` +
-          "nothing was sent; the daemon releases it with the next digest or working-hours catch-up\n",
+      : heldLine(project, outcome),
+  );
+}
+
+/** The held-notice line names the future that releases it, in words an
+ *  operator can act on: the working-hours window opening, or the daily digest.
+ *  The earlier spelling — "the next digest or working-hours catch-up" — read
+ *  the same for both and hid exactly the 23-hour hold that #596 is about. */
+function heldLine(
+  project: ProjectConfig,
+  outcome: Extract<OperatorMessageOutcome, { kind: "held" }>,
+): string {
+  if (outcome.reason === "availability") {
+    const state = availabilityState(project.reporting, Date.now());
+    const opening =
+      state.mode === "quiet" && state.nextTransitionAt !== undefined && state.timezone !== undefined
+        ? ` at ${formatNextWindowOpening(state.nextTransitionAt, state.timezone)}`
+        : "";
+    return (
+      `held notice ${outcome.noticeId} queued for ${project.name} (${outcome.category}; ` +
+      `held until the working-hours window opens${opening})\n` +
+      "nothing was sent; the daemon releases it with the working-hours catch-up when your window opens\n"
+    );
+  }
+  const digestAt = project.reporting?.digest.at;
+  const when = digestAt === undefined ? "the next digest" : `the ${digestAt} digest`;
+  return (
+    `held notice ${outcome.noticeId} queued for ${project.name} (${outcome.category}; ` +
+    `digest-only — held until ${when})\n` +
+    `nothing was sent; the daemon releases it with ${when}\n`
   );
 }

package/src/config-schema.ts

@@ -22,10 +22,12 @@
 
 import { z } from "zod";
 import {
+  ARM_PROOFS,
   AUTHORITY_HOLDERS,
   BASE_FRESHNESS,
   BEHIND_BASE_ACTIONS,
   CONFIG_VERSION,
+  DEFAULT_ARM_PROOF,
   DEFAULT_AUTHORITY,
   DEFAULT_CAPS,
   DEFAULT_PROJECT_POLICY,
@@ -239,6 +241,21 @@ const escalationSchema = z
   })
   .strict();
 
+/**
+ * The per-project arming gate (conductor #613): how `arm` proves a human just
+ * approved dispatch. Absent or a legacy config without the key loads as
+ * `challenge` — the authenticated round-trip, which is what existing installs
+ * already run. `claim-only` arms on the shared live-plumbing verdict with no
+ * Telegram send or wait, so an unattended recovery can re-arm a project that
+ * opted in.
+ */
+const armSchema = z
+  .object({
+    proof: z.enum([...ARM_PROOFS]).default(DEFAULT_ARM_PROOF),
+  })
+  .strict()
+  .describe("How `arm` proves a human just approved arming");
+
 const releasePolicySchema = z.union([
   releasePolicyLegacyEnum,
   z.record(z.string(), authorityHolderEnum),
@@ -330,6 +347,9 @@ const projectSchema = z
     // overlay); anything else is dropped by the loader, like `workerModel`.
     workerAdvisor: z.unknown().optional(),
     escalation: escalationSchema.optional(),
+    // How `arm` proves a human approved arming (#613); absent loads as
+    // `challenge`, preserving today's authenticated round-trip.
+    arm: armSchema.optional(),
     authority: authoritySchema.optional(),
     releasePolicy: releasePolicySchema.optional(),
     policy: projectPolicySchema.optional(),

package/src/config.ts

@@ -17,10 +17,12 @@ import { homedir } from "node:os";
 import { dirname, isAbsolute, join } from "node:path";
 import { backupTimestamp, copyToUniqueBackup } from "./backups.ts";
 import {
+  ARM_PROOFS,
   AUTHORITY_HOLDERS,
   BASE_FRESHNESS,
   BEHIND_BASE_ACTIONS,
   CONFIG_VERSION,
+  DEFAULT_ARM_PROOF,
   DEFAULT_AUTHORITY,
   DEFAULT_CAPS,
   DEFAULT_PROJECT_POLICY,
@@ -55,6 +57,7 @@ import {
   type WeeklyAvailability,
   type RepoTarget,
   type ResolvedGrants,
+  type ArmProof,
 } from "./types.ts";
 import {
   AUTHORITY_HOLDER_LIST,
@@ -313,6 +316,20 @@ export function resolvePolicy(p: ProjectConfig): ProjectPolicy {
   return clonePolicy(p.policy ?? DEFAULT_PROJECT_POLICY);
 }
 
+/**
+ * How this project's `arm` proves a human just approved arming (#613),
+ * complete.
+ *
+ * The loader always materialises `arm` (finalizeProject), so this is only ever
+ * the fallback for a `ProjectConfig` that never went through it — a hand-built
+ * one in a test, or a config written before the key existed. Absent resolves
+ * to {@link DEFAULT_ARM_PROOF} (`challenge`): the authenticated round-trip,
+ * which is the behaviour every existing install already has.
+ */
+export function resolveArmProof(p: ProjectConfig): ArmProof {
+  return p.arm?.proof === "claim-only" ? "claim-only" : DEFAULT_ARM_PROOF;
+}
+
 /**
  * A policy with no array shared with its source.
  *
@@ -835,6 +852,9 @@ function clauseFor(rel: readonly PropertyKey[], issue: {
       return `reporting.availability must be an object`;
     }
     if (rel.length === 1 && relStr === "escalation") return `escalation must be an object`;
+    if (rel.length === 1 && relStr === "arm") {
+      return `arm must be an object with a "proof" of ${ARM_PROOF_LIST}`;
+    }
     if (rel.length === 1 && relStr === "authority") {
       return `authority must be an object with "merge", "release" and "promotion" of ${AUTHORITY_HOLDER_LIST}`;
     }
@@ -995,6 +1015,9 @@ function capProblem(key: string, found: string): string {
 const POLICY_MERGE_KEYS = quoteList(Object.keys(clonePolicy(DEFAULT_PROJECT_POLICY).merge));
 const POLICY_RELEASE_KEYS = quoteList(Object.keys(clonePolicy(DEFAULT_PROJECT_POLICY).release));
 
+/** The closed `arm.proof` vocabulary, for the not-an-object wording. */
+const ARM_PROOF_LIST = quoteList(ARM_PROOFS);
+
 // ---------------------------------------------------------------------------
 // residue: cross-field coherence, migrations, defaults, path expansion
 // ---------------------------------------------------------------------------
@@ -1062,6 +1085,7 @@ function finalizeProject(
 
   const stateLabels = p["stateLabels"] as Raw | undefined;
   const escalation = finalizeEscalation(p["escalation"] as Raw | undefined);
+  const arm = finalizeArm(p["arm"] as Raw | undefined);
   const authority = finalizeAuthority(p["authority"] as Raw | undefined);
   const releasePolicy = finalizeReleasePolicy(p["releasePolicy"], label, problems);
   const strandedTagRepos =
@@ -1183,6 +1207,7 @@ function finalizeProject(
     ...(modelFallbackThreshold === undefined ? {} : { modelFallbackThreshold }),
     ...(effectiveOmpSettings === undefined ? {} : { ompSettings: effectiveOmpSettings }),
     escalation,
+    arm,
     authority,
     releasePolicy,
     policy,
@@ -1194,6 +1219,18 @@ function finalizeProject(
   };
 }
 
+/**
+ * The project's arming gate (#613), complete. A config written before the key
+ * existed — or one that never answered — materialises as `challenge`, the
+ * authenticated round-trip every existing install already runs, so an upgrade
+ * changes no behaviour. zod has already rejected anything that is not a
+ * `"challenge"` / `"claim-only"` string, so this only fills the absent case.
+ */
+function finalizeArm(parsed: Raw | undefined): ProjectConfig["arm"] {
+  if (parsed === undefined) return { proof: DEFAULT_ARM_PROOF };
+  return { proof: (parsed["proof"] as ArmProof | undefined) ?? DEFAULT_ARM_PROOF };
+}
+
 function finalizeEscalation(parsed: Raw | undefined): ProjectConfig["escalation"] {
   if (parsed === undefined) {
     return { fallbackToIssueComment: true, orchestrator: "embedded" };