omp-conductor 0.17.0 → 0.17.1

package/src/orchestrator-tick.ts

@@ -103,7 +103,7 @@ import {
   type AskResult,
 } from "./ask.ts";
 import { deliverOperatorMessage } from "./reports.ts";
-import type { RecoveryAction, RunRecord } from "./types.ts";
+import type { ProjectConfig, RecoveryAction, RunRecord } from "./types.ts";
 import { dbPath, openStore } from "./store.ts";
 import { digestDue, localDayKey } from "./digest-schedule.ts";
 import { heldNoticeId } from "./notices.ts";
@@ -305,11 +305,20 @@ interface TickApi {
    * `@oh-my-pi/pi-coding-agent/src/extensibility/extensions/types.ts:1267-1268`.
    */
   getActiveTools(): string[];
+  /**
+   * Replace the session's active tool set by name. The bounded ask surface
+   * ({@link ASK_TOOL}) is registered with `defaultInactive` (#594) and brought
+   * into the live set here only when the current tick config resolves a
+   * project — so an unusable tool schema is never model-visible on a degraded
+   * heartbeat. Signature matches the SDK: `setActiveTools(toolNames)`.
+   */
+  setActiveTools(toolNames: string[]): Promise<void>;
   /**
    * Register one tool on this session — the same shape the verb client uses
    * (`verbs/client.ts`). The bounded ask surface ({@link ASK_TOOL}) is mounted
    * with it, so the orchestrator's only waiting ask can never outlive its
-   * ceiling.
+   * ceiling. `defaultInactive` has the SDK meaning: registered but not in the
+   * initial active set, activated later via {@link setActiveTools}.
    */
   registerTool(tool: {
     name: string;
@@ -317,6 +326,7 @@ interface TickApi {
     description: string;
     parameters: unknown;
     approval?: "read" | "write" | "exec";
+    defaultInactive?: boolean;
     execute(
       toolCallId: string,
       params: Record<string, unknown>,
@@ -776,32 +786,6 @@ export const TICK_ASK_RULE =
   `The ${TELEGRAM_APPROVAL_TOOL} tool is refused here: it would wait for your operator for as long as the answer ` +
   `takes, and an unanswered question must never hold the loop.`;
 
-/**
- * What a tick says when the bounded ask surface did not actually mount on this
- * session (#520). {@link TICK_ASK_RULE} is appended only to a tick whose live
- * mounted set carries {@link ASK_TOOL}; this is the other half of that
- * agreement, and it has to carry the ask's semantics rather than just its text:
- * the escalation category is declared from the vocabulary that already exists
- * (the `conductor_ask` category is the same one), and the fallback command
- * records the question as an open decision row, so "nobody answered" is a
- * durable pending row re-surfaced in every tick — never "asked once, no reply,
- * dropped". It also names the #524 consequence of a plain send: delivery
- * follows the fleet's reporting policy, so a category the policy defers waits
- * for the scheduled digest, and a *blocking* question must declare a category
- * the fleet interrupts on.
- */
-export const TICK_ASK_UNAVAILABLE_RULE =
-  `The ${ASK_TOOL} tool is NOT mounted on this tick, so the bounded ask surface is unavailable on this session. ` +
-  `Ask through the CLI fallback instead: run \`omp-conductor message --category <category> --text "<the question>"\` ` +
-  `with the escalation category declared from the policy vocabulary — fleet-stopped, tier2 or decision-needed — ` +
-  `never smuggled through a "QUESTION:" text prefix. The command records the question as an open decision row before ` +
-  `delivering, parked on silence: nobody answering keeps the row open and pending, re-surfaced in every tick until ` +
-  `answered or the seven-day expiry, never an approval. Delivery follows the same reporting policy as the tick — a ` +
-  `category the fleet's interruptOn list defers waits for the next digest or working-hours catch-up and prints a ` +
-  `held-notice id, so a blocking question must declare a category the fleet interrupts on (tier2 or fleet-stopped). ` +
-  `Wait for the operator's reply on a later turn, then resolve the row with \`omp-conductor decision resolve <id> --answer "..."\`. ` +
-  `A returned answer proves an answer, not Telegram delivery.`;
-
 /**
  * The gate's refusal for a raw {@link TELEGRAM_APPROVAL_TOOL} / `write
  * xd://telegram_ask` call on a locally injected tick (#438). Fixed wording the
@@ -2220,12 +2204,78 @@ interface TickSession {
   activeLocalTick?: ActiveLocalTick;
 }
 
+/**
+ * Resolve the project an {@link ASK_TOOL} call routes to, re-reading the live
+ * tick config so a restamp (un-stamped → stamped, or project A → B) binds the
+ * current routing rather than the session-start stamp the ask session closed
+ * over. Only the routing is live; the ceiling and turn budget stay startup-only
+ * (the same contract `budgetSeconds` already has). Mirrors
+ * {@link resolveTickScope}'s decision about when a heartbeat may advertise the
+ * ask surface: a project resolves exactly when a tick would append
+ * {@link TICK_ASK_RULE}, so the model-visible tool and the prompt line never
+ * disagree. Returns the resolved project for delivery, or the failure the tool
+ * reports verbatim.
+ */
+function resolveAskProject(
+  cwd: string,
+  startup: TickConfig,
+): { kind: "ok"; project: ProjectConfig } | { kind: "error"; problem: string } {
+  const live = currentConfig(cwd, startup);
+  try {
+    return { kind: "ok", project: findProject(loadConfig(), live.project) };
+  } catch (err) {
+    return { kind: "error", problem: err instanceof Error ? err.message : String(err) };
+  }
+}
+
+/**
+ * Reconcile the bounded ask's model-visible presentation with the current
+ * routing contract. Registered at extension-factory time with
+ * `defaultInactive` (#594), {@link ASK_TOOL} is NOT in the initial active set
+ * — this activates it only once (and for as long as) the live tick config
+ * resolves a project, and deactivates it when resolution degrades (unreadable
+ * config, un-stamped multi-project). That keeps an unusable tool schema out of
+ * the model's view rather than merely omitting the prompt line that names it —
+ * and a restamp (un-stamped → stamped) brings it back on the next resolved
+ * beat. Latched by membership: `setActiveTools` fires only on a state flip,
+ * never per tick.
+ *
+ * Returns whether the requested state now actually holds in the live set
+ * (#683). `true` only after the `setActiveTools` reconciliation is awaited AND
+ * the live membership read confirms it — an already-reconciled beat is
+ * confirmed by the membership read alone. A call that rejected, or one that
+ * resolved without the tool landing in the live set, returns `false`; the
+ * caller must then treat the beat as degraded and never advertise the ask
+ * surface. A flip failure is logged, never fatal — the tool then stays in its
+ * prior state, and executing it still fails closed when it cannot route.
+ */
+async function ensureAskSurface(pi: TickApi, resolvable: boolean): Promise<boolean> {
+  const current = pi.getActiveTools();
+  const present = current.includes(ASK_TOOL);
+  if (resolvable === present) return true;
+  try {
+    await pi.setActiveTools(
+      resolvable ? [...current, ASK_TOOL] : current.filter((name) => name !== ASK_TOOL),
+    );
+  } catch (err) {
+    pi.logger.error(
+      `[omp-conductor] could not ${resolvable ? "activate" : "deactivate"} ${ASK_TOOL}: ${
+        err instanceof Error ? err.message : String(err)
+      }`,
+    );
+    return false;
+  }
+  // An awaited call is not yet confirmation: the live membership read after the
+  // reconciliation is what proves the tool is really model-visible.
+  return pi.getActiveTools().includes(ASK_TOOL) === resolvable;
+}
+
 /**
  * One tick: gather the three facts, ask `tickDecision`, log the reason either
  * way. Skips are deliberately silent in the UI — a disarmed fleet would
  * otherwise emit a notification every interval, forever.
  */
-function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSession): void {
+async function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSession): Promise<void> {
   const live = currentConfig(ctx.cwd, config);
   const arm = live.armedFile === undefined ? undefined : resolveArmState(live.armedFile, live.project);
   if (arm?.legacy === "stranded" && !session.legacyArmLogged) {
@@ -2378,13 +2428,44 @@ function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSe
     // tick — it would wait unbounded — so the tick names the replacement
     // surface up front, custom message included.
     content = `${content}\n${availabilityPrompt(scope.policy, Date.now())}`;
-    // The ask rule names the surface this session can actually call (#520):
-    // the bounded ask is registered at `session_start`, so the live mounted
-    // set read here — between turns, in the heartbeat timer — is the honest
-    // source for whether the registration took. A tick that mandates a tool
-    // the session does not carry is #114 all over again, so a missing surface
-    // degrades to the CLI path that exists and carries the ask's semantics.
-    content = `${content}\n${pi.getActiveTools().includes(ASK_TOOL) ? TICK_ASK_RULE : TICK_ASK_UNAVAILABLE_RULE}`;
+    // The ask rule names the bounded surface this session can call. It is
+    // guarded on a resolved project for the same reason {@link ASK_TOOL} is:
+    // the tool needs the project to file the decision row against and resolve
+    // the delivery target. On a degraded heartbeat (`resolveTickScope` falls
+    // back to DEFAULT_REPORT_SCOPE with no projectName — an unreadable config
+    // or a legacy un-stamped multi-project tick) the tool cannot route, so the
+    // prompt must not advertise it. There is no prose to fall back to — the CLI
+    // `omp-conductor message` fallback is deleted (#594), and a registration
+    // failure is a bug to fix, not a surface to name. So the degraded beat
+    // simply names nothing about asking, rather than naming a tool that would
+    // fail closed. The `telegram_ask` refusal stays: it would wait for the
+    // operator for as long as the answer takes (#438).
+    //
+    // The rule is appended only after the ask surface is CONFIRMED
+    // model-visible (#683): a `defaultInactive` registration is not in the
+    // live set until this beat's `setActiveTools` reconciliation lands, so
+    // appending the rule and then firing the reconciliation off in the
+    // background rendered a promise of a tool the next turn might not carry.
+    // The reconciliation is awaited and verified by live membership before the
+    // rule is appended; when it cannot be confirmed, this beat takes the same
+    // degraded branch as an unresolvable project — no rule, tool kept out of
+    // the live set, never the deleted CLI prose fallback — so a tick can never
+    // advertise an ask surface that may still be inactive.
+    const activated = await ensureAskSurface(pi, true);
+    if (activated) {
+      content = `${content}\n${TICK_ASK_RULE}`;
+    } else {
+      // Keeps the tool out of the model-visible set on this beat, matching the
+      // degraded-project branch below: 'not named in the prompt' must not
+      // diverge from 'not callable' (#644).
+      await ensureAskSurface(pi, false);
+    }
+  } else {
+    // Degraded heartbeat: no project to route to, so the bounded tool must not
+    // be model-visible (omitting the prompt line is not enough while the
+    // registration still exposed the schema). A later restamp brings it back on
+    // the next resolved beat.
+    await ensureAskSurface(pi, false);
   }
   let frictionStore: Store | undefined;
   let frictionSignals: FrictionSignal[] = [];
@@ -2598,12 +2679,20 @@ function writeTickRuntimeStatus(pi: TickApi, cwd: string, intervalSeconds: numbe
  * drift: both must fire the same "do not wait a full interval after a poke"
  * behaviour. Every path still runs {@link tick} → {@link tickDecision}, so a
  * live turn coalesces rather than stacking concurrent ticks.
+ *
+ * The two fire-and-forget sites below (mid-interval poll, arm-time poke)
+ * attach their own `.catch`: `tick` is async, the poll callback returns
+ * nothing for ManagedTimers to route, and the arm-time call's handler
+ * dispatch cannot see a rejection — an escaped one reaches the process-level
+ * unhandledRejection handler and takes the session down. The primary
+ * heartbeat interval keeps handing its promise to the harness, which routes
+ * rejections to the extension error channel on its own.
  */
 function armTickHeartbeat(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSession): void {
   writeTickRuntimeStatus(pi, ctx.cwd, config.intervalSeconds);
-  const runScheduledTick = (): void => {
+  const runScheduledTick = async (): Promise<void> => {
     try {
-      tick(pi, ctx, config, session);
+      await tick(pi, ctx, config, session);
     } finally {
       writeTickRuntimeStatus(pi, ctx.cwd, config.intervalSeconds);
     }
@@ -2640,13 +2729,30 @@ function armTickHeartbeat(pi: TickApi, ctx: TickContext, config: TickConfig, ses
       pi.logger.info(
         `[omp-conductor] tick requested by ${reason} — firing without waiting for the interval`,
       );
-      runScheduledTick();
+      // Fire-and-forget like the arm-time poke, with the same containment: the
+      // callback is not async, so the harness has no promise to attach a catch
+      // to — a rejected tick would escape to the process-level
+      // unhandledRejection handler. Log through the same channel instead, and
+      // the fixed heartbeat stays the fallback for this request line.
+      runScheduledTick().catch((err) => {
+        pi.logger.error(
+          `[omp-conductor] poked tick failed: ${err instanceof Error ? err.message : String(err)}`,
+        );
+      });
     }, pollMs);
   }
   if (!existsSync(join(ctx.cwd, TICK_REQUESTED_FILE))) return;
   const reason = readTickRequestReason(ctx.cwd) ?? "wake";
   pi.logger.info(`[omp-conductor] tick requested by ${reason} — firing without waiting for the interval`);
-  tick(pi, ctx, config, session);
+  // Fire-and-forget with the same containment as the mid-interval poll: the
+  // call runs inside the session_start handler dispatch, which cannot see an
+  // async rejection — an escaped one reaches the process-level
+  // unhandledRejection handler and takes the session down.
+  void tick(pi, ctx, config, session).catch((err) => {
+    pi.logger.error(
+      `[omp-conductor] arm-time tick failed: ${err instanceof Error ? err.message : String(err)}`,
+    );
+  });
 }
 
 /**
@@ -2686,7 +2792,21 @@ function armTickGuard(pi: TickApi, ctx: TickContext, budgetMs: number): void {
   });
 }
 
-export default function orchestratorTickExtension(pi: TickApi): void {
+/**
+ * Factory-time seams for the extension, used by tests. Production runs
+ * `orchestratorTickExtension(pi)` with no options and gets the module's own
+ * real-time defaults; the `ask` seam hands the registered {@link ASK_TOOL} an
+ * injected clock (`wait`/`now`) so the two timeout outcomes can be proven
+ * through the real tool deterministically, without real timers (#683).
+ */
+export interface OrchestratorTickExtensionOptions {
+  ask?: { wait?: (ms: number) => Promise<void>; now?: () => number };
+}
+
+export default function orchestratorTickExtension(
+  pi: TickApi,
+  options: OrchestratorTickExtensionOptions = {},
+): void {
   // Scoped to this registration rather than the module, so a second
   // `session_start` can neither install a second heartbeat on the same session
   // nor repeat the ownership decline — which is logged exactly once, because it
@@ -2706,8 +2826,21 @@ export default function orchestratorTickExtension(pi: TickApi): void {
   };
   let releaseGateArmed = false;
   let availabilityGateArmed = false;
-  let askToolArmed = false;
   let guardArmed = false;
+  // The bounded ask tool's session state. The tool itself is registered at
+  // extension-factory time, before any session exists, because OMP snapshots
+  // the extension's active tool set before it emits `session_start` — a tool
+  // registered there never reaches the session's model-visible set. So the
+  // registration is unconditional, and the state it needs to act is filled
+  // here — by `session_start`, and only for a session whose ownership is
+  // accepted (the fleet agent) — because a non-owner or unresolved session in
+  // the fleet cwd must not be able to execute the model-visible tool and
+  // create or deliver decisions. `config` is the startup tick config that
+  // owns the ceiling (timeout/budget is startup-only); `cwd` lets the tool
+  // re-read the *live* tick config at execution so routing follows the current
+  // project post-restamp. A call before that — or on a session that never
+  // composed a tick — finds `undefined` and fails closed.
+  let askSession: { cwd: string; config: TickConfig } | undefined;
   // An activation file makes this a fleet directory before Herdr can prove
   // which pane owns it. The gate therefore starts closed and only honours a
   // configured grant after ownership is accepted.
@@ -2874,115 +3007,143 @@ export default function orchestratorTickExtension(pi: TickApi): void {
     );
   };
 
-  /**
-   * Mount the bounded ask surface (#438). One registration per session, next to
-   * the gates it complements: raw {@link TELEGRAM_APPROVAL_TOOL} is refused on
-   * autonomous ticks, so the session must own the tool that asks instead. The
-   * ceiling comes from the tick config the heartbeat started with — the same
-   * startup-only contract `budgetSeconds` already has — and is capped at the
-   * turn budget by the tool itself, so no combination of config and arguments
-   * produces an unbounded wait.
-   *
-   * The tool is inert unless the config resolves this fleet's project: it needs
-   * the project to file the decision row against and to resolve the delivery
-   * target. An unreadable/ambiguous config makes the tool say so and record
-   * nothing, which is the same fail-closed posture the autonomous gate takes.
-   */
-  const armAskTool = (config: TickConfig, configuredProject: string | undefined): void => {
-    if (askToolArmed) return;
-    pi.registerTool({
-      name: ASK_TOOL,
-      label: ASK_TOOL,
-      description:
-        `Ask your operator one question and wait up to a bounded ceiling for the answer. ` +
-        `Records the question durably (decision row + the same delivery path as \`omp-conductor message\`), ` +
-        `delivers it to the operator per the reporting policy, and waits at most the ceiling ` +
-        `(default ${DEFAULT_ASK_TIMEOUT_SECONDS}s, capped at the turn budget; pass "timeoutSeconds" to ` +
-        `shorten or extend within ${MIN_ASK_TIMEOUT_SECONDS}–${MAX_ASK_TIMEOUT_SECONDS}s — an ask issued without ` +
-        `one still gets the default). When nobody answers, the declared "on-timeout" decides: ` +
-        `"auto-proceed" applies your recommended option and resolves the decision row naming the ` +
-        `auto-application ("<option> (auto-applied on ask timeout)"); "park" leaves the row open and ` +
-        `pending — re-surfaced in every tick prompt until answered or the seven-day expiry — and you then ` +
-        `take the blocked work out of the claimable queue and record its state. A timeout is "nobody ` +
-        `answered yet", never a cancellation, an error, or an operator "no".`,
-      parameters: askParameterSchema(),
-      approval: "write",
-      execute: async (_toolCallId, params) => {
-        const parsed = parseAskRequest(params);
-        if (!parsed.ok) {
-          return { content: [{ type: "text", text: parsed.problem }], isError: true };
-        }
-        let projectConfig;
-        try {
-          projectConfig = findProject(loadConfig(), configuredProject);
-        } catch (err) {
-          return {
-            content: [
-              {
-                type: "text",
-                text:
-                  `${ASK_TOOL}: conductor config unreadable (${err instanceof Error ? err.message : String(err)}); ` +
-                  "nothing was asked or recorded. Repair the config, do not ask through another path.",
-              },
-            ],
-            isError: true,
-          };
-        }
-        const store = openStore(dbPath());
-        let result: AskResult;
-        try {
-          result = await performAsk(parsed.request, {
-            store,
-            project: projectConfig.name,
-            configuredCeilingSeconds: config.askTimeoutSeconds,
-            turnBudgetSeconds: config.budgetSeconds ?? DEFAULT_TICK_BUDGET_SECONDS,
-            deliver: async (text, category) => {
-              const at = Date.now();
-              const noticeId = randomUUID();
-              try {
-                const delivered = await deliverOperatorMessage(projectConfig, text, {
-                  store,
-                  at,
-                  noticeId,
-                  category,
-                });
-                return delivered.kind === "sent"
-                  ? { kind: "sent", category: delivered.category }
-                  : { kind: "held", category: delivered.category, noticeId: delivered.noticeId };
-              } catch (err) {
-                // A failed immediate send must not drop the question: fall back
-                // to the durable hold exactly like the gate's own hold path, and
-                // let the daemon retry with the digest.
-                store.addHeldNotice({
-                  id: noticeId,
-                  project: projectConfig.name,
-                  category,
-                  summary: text.split("\n", 1)[0]!.slice(0, 240),
-                  detail: text,
-                  createdAt: at,
-                });
-                pi.logger.error(
-                  `[omp-conductor] ${ASK_TOOL} could not deliver the ask directly (${err instanceof Error ? err.message : String(err)}); held durably`,
-                );
-                return { kind: "held", category, noticeId };
-              }
+  // Mount the bounded ask surface (#438) at extension-factory time, not in
+  // `session_start`: OMP 17.2.9 snapshots the extension's active tool set
+  // before it emits `session_start`, so a tool registered there mutates the
+  // registry but never reaches this session's model-visible set. Registering
+  // here is the only seam that lands the tool in the real snapshot. Next to
+  // the gates it complements: raw {@link TELEGRAM_APPROVAL_TOOL} is refused on
+  // autonomous ticks, so the session must own the tool that asks instead.
+  //
+  // It registers `defaultInactive`: the OMP snapshot auto-includes extension
+  // tools in the initial active set unless the definition opts out, so without
+  // this flag an unreadable or un-stamped multi-project session would expose
+  // the tool's schema even though it cannot route. Inactive by default, the
+  // surface is brought into the live set by {@link tick} — and only for as
+  // long as the current tick config resolves a project.
+  //
+  // The ceiling comes from the tick config the heartbeat started with — the
+  // same startup-only contract `budgetSeconds` already has — and is capped at
+  // the turn budget by the tool itself, so no combination of config and
+  // arguments produces an unbounded wait. That session state is read lazily
+  // from {@link askSession}, filled by `session_start` only once ownership is
+  // accepted for a session that goes on to compose a tick; a call on any
+  // other session fails closed.
+  //
+  // The tool is inert unless the config resolves this fleet's project: it needs
+  // the project to file the decision row against and to resolve the delivery
+  // target. An unreadable/ambiguous config makes the tool say so and record
+  // nothing, which is the same fail-closed posture the autonomous gate takes.
+  pi.registerTool({
+    name: ASK_TOOL,
+    label: ASK_TOOL,
+    defaultInactive: true,
+    description:
+      `Ask your operator one question and wait up to a bounded ceiling for the answer. ` +
+      `Records the question durably (decision row + the same delivery path as \`omp-conductor message\`), ` +
+      `delivers it to the operator per the reporting policy, and waits at most the ceiling ` +
+      `(default ${DEFAULT_ASK_TIMEOUT_SECONDS}s, capped at the turn budget; pass "timeoutSeconds" to ` +
+      `shorten or extend within ${MIN_ASK_TIMEOUT_SECONDS}–${MAX_ASK_TIMEOUT_SECONDS}s — an ask issued without ` +
+      `one still gets the default). When nobody answers, the declared "on-timeout" decides: ` +
+      `"auto-proceed" applies your recommended option and resolves the decision row naming the ` +
+      `auto-application ("<option> (auto-applied on ask timeout)"); "park" leaves the row open and ` +
+      `pending — re-surfaced in every tick prompt until answered or the seven-day expiry — and you then ` +
+      `take the blocked work out of the claimable queue and record its state. A timeout is "nobody ` +
+      `answered yet", never a cancellation, an error, or an operator "no".`,
+    parameters: askParameterSchema(),
+    approval: "write",
+    execute: async (_toolCallId, params) => {
+      const parsed = parseAskRequest(params);
+      if (!parsed.ok) {
+        return { content: [{ type: "text", text: parsed.problem }], isError: true };
+      }
+      const session = askSession;
+      if (session === undefined) {
+        // Not a conductor tick session (subagent, or a session that never
+        // composed a tick). Same fail-closed posture as an unresolvable config:
+        // say so, record nothing, and never route the question elsewhere.
+        return {
+          content: [
+            {
+              type: "text",
+              text: `${ASK_TOOL}: not available in this session (no orchestrator tick); nothing was asked or recorded.`,
             },
-          });
-        } finally {
-          store.close();
-        }
-        return { content: [{ type: "text", text: result.text }] };
-      },
-    });
-    // Latched after the registration returns, not before: a throw inside
-    // `registerTool` must not leave the surface permanently unmounted — the
-    // latch would otherwise turn a transient registration failure into a
-    // missing ask surface for the whole session (#520). On a real harness
-    // `session_start` fires once, so this is a retry on the next session
-    // rather than a loop, but it is the difference between a recovery and a
-    // permanent divergence between the prompt and the mounted set.
-    askToolArmed = true;
-  };
+          ],
+          isError: true,
+        };
+      }
+      // Routing follows the *live* tick config, not the session-start stamp:
+      // a restamp (un-stamped → stamped, or project A → B) must make the next
+      // tick's toolbox land on the project the turn actually ticks for, and an
+      // abandoned stamp must not keep recording against a project that is no
+      // longer this fleet's. Only the ceiling stays startup-only (from
+      // `config` below) — routing is re-read every call.
+      const { cwd, config } = session;
+      const routed = resolveAskProject(cwd, config);
+      if (routed.kind === "error") {
+        return {
+          content: [
+            {
+              type: "text",
+              text:
+                `${ASK_TOOL}: conductor config unreadable (${routed.problem}); ` +
+                "nothing was asked or recorded. Repair the config, do not ask through another path.",
+            },
+          ],
+          isError: true,
+        };
+      }
+      const projectConfig = routed.project;
+      const store = openStore(dbPath());
+      let result: AskResult;
+      try {
+        result = await performAsk(parsed.request, {
+          store,
+          project: projectConfig.name,
+          configuredCeilingSeconds: config.askTimeoutSeconds,
+          turnBudgetSeconds: config.budgetSeconds ?? DEFAULT_TICK_BUDGET_SECONDS,
+          // Test seam (#683): production omits `wait`/`now` and `performAsk`
+          // falls back to the module's real-time defaults; a test that wants
+          // the timeout outcomes deterministically hands both in.
+          ...(options.ask === undefined ? {} : options.ask),
+          deliver: async (text, category) => {
+            const at = Date.now();
+            const noticeId = randomUUID();
+            try {
+              const delivered = await deliverOperatorMessage(projectConfig, text, {
+                store,
+                at,
+                noticeId,
+                category,
+              });
+              return delivered.kind === "sent"
+                ? { kind: "sent", category: delivered.category }
+                : { kind: "held", category: delivered.category, noticeId: delivered.noticeId };
+            } catch (err) {
+              // A failed immediate send must not drop the question: fall back
+              // to the durable hold exactly like the gate's own hold path, and
+              // let the daemon retry with the digest.
+              store.addHeldNotice({
+                id: noticeId,
+                project: projectConfig.name,
+                category,
+                summary: text.split("\n", 1)[0]!.slice(0, 240),
+                detail: text,
+                createdAt: at,
+              });
+              pi.logger.error(
+                `[omp-conductor] ${ASK_TOOL} could not deliver the ask directly (${err instanceof Error ? err.message : String(err)}); held durably`,
+              );
+              return { kind: "held", category, noticeId };
+            }
+          },
+        });
+      } finally {
+        store.close();
+      }
+      return { content: [{ type: "text", text: result.text }] };
+    },
+  });
 
   pi.on("session_start", (_event, ctx) => {
     if (decided) return;
@@ -3016,7 +3177,13 @@ export default function orchestratorTickExtension(pi: TickApi): void {
     const configuredProject = result.kind === "ok" ? result.config.project : undefined;
     armReleaseGate(configuredProject);
     armAvailabilityGate(configuredProject);
-    if (result.kind === "ok") armAskTool(result.config, configuredProject);
+    // The tool is already registered (extension-factory time); only the session
+    // state it acts on is filled, and only once ownership is accepted below.
+    // `configuredProject` isn't closed over at all — routing is re-read from
+    // the live tick config at execution, so a restamp binds the current
+    // project. Ownership gating is the point: a declined or unresolved session
+    // in the fleet cwd must never be able to execute the model-visible tool
+    // and create or deliver decisions.
 
     if (result.kind === "invalid") {
       const detail = `${result.path}: ${result.problem}`;
@@ -3094,6 +3261,11 @@ export default function orchestratorTickExtension(pi: TickApi): void {
         }
         if (next.note !== undefined) pi.logger.error(`[omp-conductor] tick ownership: ${next.note}`);
         releaseAuthorityAccepted = true;
+        // Ownership finally resolved to the fleet agent — only now may the
+        // model-visible ask be executable (defect: non-owner sessions must
+        // not create or deliver decisions). `cwd` is for re-reading the live
+        // tick config at execution, `config` for the startup-only ceiling.
+        askSession = { cwd: ctx.cwd, config };
         armTickHeartbeat(pi, ctx, config, session);
         if (!guardArmed) {
           guardArmed = true;
@@ -3112,6 +3284,10 @@ export default function orchestratorTickExtension(pi: TickApi): void {
     }
     if (ownership.note !== undefined) pi.logger.error(`[omp-conductor] tick ownership: ${ownership.note}`);
     releaseAuthorityAccepted = true;
+    // Only the fleet agent may execute the bounded ask (see the retry path for
+    // why): a declined or unresolved session keeps `askSession` undefined and
+    // the tool fails closed.
+    askSession = { cwd: ctx.cwd, config };
     armTickHeartbeat(pi, ctx, config, session);
     if (!guardArmed) {
       guardArmed = true;