omp-conductor 0.18.1 → 0.19.0

package/src/orchestrator-tick.ts

@@ -98,8 +98,15 @@ import {
 import { repoSlugFor } from "./gitops.ts";
 import { makeTracker } from "./tracker/github.ts";
 import { formatDecisionDigest } from "./decisions.ts";
+import { installSurfaceMismatch } from "./status-render.ts";
 import {
   ASK_TOOL,
+  type AskDeliveryResult,
+  MAX_QUESTIONNAIRE_ITEMS,
+  QUESTIONNAIRE_TOOL,
+  parseQuestionnaireRequest,
+  performQuestionnaire,
+  questionnaireParameterSchema,
   askAnswerRowWrite,
   askParameterSchema,
   DEFAULT_ASK_TIMEOUT_SECONDS,
@@ -114,18 +121,22 @@ import {
   type AskResult,
 } from "./ask.ts";
 import { deliverOperatorMessage } from "./reports.ts";
+import { effectiveLabels } from "./routing.ts";
 import { readTelegramToken, resolveProjectTopicId, telegramStateDir } from "./escalate.ts";
 import type { FailureClass, RecoveryAction, RunRecord } from "./types.ts";
 import { dbPath, openStore } from "./store.ts";
 import { digestDue, localDayKey } from "./digest-schedule.ts";
 import {
   parseToSpecEvidence,
+  parseToSpecFailureEvidence,
   recordToSpecGrooming,
   TO_SPEC_MAX_SOURCE_AGE_MS,
   TO_SPEC_SCHEMA,
+  type ToSpecFailure,
+  type ToSpecResult,
 } from "./to-spec.ts";
 import { heldNoticeId } from "./notices.ts";
-import { isActiveArmProof } from "./arm-challenge.ts";
+import { acknowledgeArmReply } from "./arm-challenge.ts";
 
 /** The activation file. Absent means "this is not an orchestrator session". */
 export const TICK_CONFIG_FILE = ".conductor-tick.json";
@@ -639,6 +650,21 @@ function groomingVerdictCounts(records: readonly GroomingRecord[]): string {
   return [...counts.entries()].map(([verdict, count]) => `${verdict} ${count}`).join(", ");
 }
 
+/**
+ * The queue-label inventory read fresh from the tracker on one tick, with the
+ * pending label ops applied exactly as the dispatch pass judges eligibility
+ * (#848). Queue verdicts in the present tense ("empty", "running low") are
+ * only ever drawn from this observation; a dispatch summary alone is dated
+ * history and must never be rendered as the live queue.
+ */
+export interface QueueObservation {
+  /** Open issues carrying the queue label under the *effective* label set —
+   *  the count dispatch would route against on its next pass. */
+  queued: number;
+  /** The instant the tracker observation was made, epoch ms. */
+  observedAt: number;
+}
+
 /**
  * One line telling the orchestrator the routable queue is running dry (#181),
  * or `undefined` when healthy — no dispatch recorded yet, or the routable count
@@ -651,6 +677,12 @@ function groomingVerdictCounts(records: readonly GroomingRecord[]): string {
  * so it is told apart from the mechanical holds: it says "a batch is running",
  * not "the lane cannot move", and counts neither as claimable nor as
  * known-blocked.
+ *
+ * `queue` is the tracker observation the caller made THIS tick (#848). When
+ * present, the queue verdict reads in the present tense from that inventory,
+ * and dispatch-derived counts are only ever dated context. When absent the
+ * tracker could not be read, and this never asserts that the queue is empty:
+ * the dispatch row is rendered explicitly as-of instead.
  */
 export function queueDigestLine(
   summary: DispatchSummary | undefined,
@@ -658,10 +690,36 @@ export function queueDigestLine(
   labelPrefix: string,
   groomBelow: number,
   grooming: readonly GroomingRecord[] = [],
+  queue: QueueObservation | undefined = undefined,
+  /** Observation time for the durability of the grooming rows this line
+   *  describes — the same clock the selection is offered against, so the
+   *  inventory and the batch cannot disagree about what is still groomed
+   *  (#887). */
+  now: number = Date.now(),
 ): string | undefined {
   if (summary === undefined) return undefined;
+  if (queue !== undefined) {
+    return liveQueueDigestLine(summary, queue, queueLabel, labelPrefix, groomBelow, grooming, now);
+  }
+  return datedQueueDigestLine(summary, queueLabel, labelPrefix, groomBelow, grooming, now);
+}
+
+/** The dated rendering: the last dispatch row is the only evidence, so every
+ *  count carries its snapshot date and nothing is asserted as current. */
+function datedQueueDigestLine(
+  summary: DispatchSummary,
+  queueLabel: string,
+  labelPrefix: string,
+  groomBelow: number,
+  grooming: readonly GroomingRecord[],
+  now: number,
+): string | undefined {
+  const dated = new Date(summary.completedAt).toISOString();
   if (summary.ready === 0) {
-    return `Queue: empty — nothing carries "${queueLabel}". Groom the backlog (Duty 2): promote or file the next issues, or say in this tick's report why there is nothing to do.`;
+    if (summary.paused === true) {
+      return `Queue: unchecked — the last pass (${dated}) was a hold that counted no queue and admitted nothing; the tracker could not be re-read this tick, so the live queue is NOT claimed empty. Groom only after a fresh read.`;
+    }
+    return `Queue: empty (as of the last dispatch, ${dated}) — nobody carried "${queueLabel}" on that count, and the live tracker was not re-read this tick, so this is a snapshot, not a present-tense claim. Groom the backlog (Duty 2) once a fresh read confirms it.`;
   }
   if (summary.routed === 0) {
     // `ready` counts claimed (in-flight) issues too; route() drops those with a
@@ -678,7 +736,7 @@ export function queueDigestLine(
     const staleLifecycle = summary.holds
       .filter((h) => h.reason === "stale-lifecycle")
       .reduce((n, h) => n + h.count, 0);
-    let line = `Queue: ${summary.ready} ready, 0 spare — ${claimed} in flight`;
+    let line = `As of the last dispatch (${dated}): Queue: ${summary.ready} ready, 0 spare — ${claimed} in flight`;
     if (unroutable > 0) {
       line += `, ${unroutable} unroutable (each unroutable issue needs exactly one "${labelPrefix}<repo>" label)`;
     }
@@ -693,6 +751,98 @@ export function queueDigestLine(
     return line;
   }
   if (summary.routed >= groomBelow) return undefined;
+  return lowQueueTail(summary, groomBelow, grooming, `As of the last dispatch (${dated}): Queue: `, now);
+}
+
+/** The live rendering: the tracker observation is the queue label inventory,
+ *  the dispatch summary supplies the claimability reading, and the shared
+ *  low-queue diagnostics are composed underneath (#848 review 2). The raw
+ *  carrier count appears only as a present-tense inventory fact — never as
+ *  the grooming threshold, which must be claimability (`summary.routed`, the
+ *  same count the to-spec offer gates on), or parked/in-flight/state-labelled
+ *  carriers would silence a queue that dispatch cannot move. */
+function liveQueueDigestLine(
+  summary: DispatchSummary,
+  queue: QueueObservation,
+  queueLabel: string,
+  labelPrefix: string,
+  groomBelow: number,
+  grooming: readonly GroomingRecord[],
+  now: number,
+): string | undefined {
+  const queued = queue.queued;
+  const observed = new Date(queue.observedAt).toISOString();
+  // The present-tense empty verdict is the tracker's own word: nothing open
+  // carries the queue label right now. No dispatch snapshot may produce a
+  // live "empty" claim — that is the whole defect (#848).
+  if (queued === 0) {
+    return (
+      `Queue: empty — nothing open carries "${queueLabel}" right now (tracker ${observed}). ` +
+      "Groom the backlog (Duty 2): promote or file the next issues, or say in this tick's report " +
+      "why there is nothing to do."
+    );
+  }
+  // The grooming threshold is claimability — summary.routed — never raw
+  // carrier volume. Four in-flight/parked/unroutable carriers must not
+  // suppress the low-claimable signal, because the to-spec offer gates on
+  // the very same routed count and the two would split.
+  if (summary.routed >= groomBelow) return undefined;
+  const dated = new Date(summary.completedAt).toISOString();
+  const inventory = `Queue: ${queued} open issue${queued === 1 ? "" : "s"} carry "${queueLabel}" right now (tracker ${observed}); `;
+  if (summary.routed === 0) {
+    // Dispatch's own claimability read: `ready` counts claimed (in-flight)
+    // issues too, so "0 routable" must not blanket-blame missing `repo:`
+    // labels (#228), and a residual lifecycle label is Duty 1 reconciliation
+    // work, not spare depth (#611).
+    if (summary.paused === true) {
+      return (
+        inventory +
+        `the last dispatch (${dated}) was a hold that admitted nothing — the queued issues above are the work that resumes when claiming reopens.`
+      );
+    }
+    const claimed = summary.claimed ?? 0;
+    let line = inventory + `at the last dispatch (${dated}) ${summary.ready} ready, 0 spare — ${claimed} in flight`;
+    const unroutable = summary.holds
+      .filter((h) => h.reason.startsWith("unroutable:"))
+      .reduce((n, h) => n + h.count, 0);
+    const staleLifecycle = summary.holds
+      .filter((h) => h.reason === "stale-lifecycle")
+      .reduce((n, h) => n + h.count, 0);
+    if (unroutable > 0) {
+      line += `, ${unroutable} unroutable (each unroutable issue needs exactly one "${labelPrefix}<repo>" label)`;
+    }
+    if (staleLifecycle > 0) {
+      line += `, ${staleLifecycle} with a residual lifecycle label (Duty 1: newest run terminal — reconcile the stale agent:in-progress/blocked/failed state)`;
+    }
+    if (unroutable === 0 && staleLifecycle === 0) {
+      line += `. Spare depth is what dispatch can actually claim: groom the backlog (Duty 2) before the live runs settle.`;
+    } else {
+      line += ".";
+    }
+    return line;
+  }
+  // routed > 0 below the trigger: the live inventory leads, then the same
+  // low-queue diagnostics the dated path ships — the claimable/known-blocked
+  // split, in-flight to-spec batches, the considered backlog and this pass's
+  // holds (#735, #777, #679) — so a tracker read never hides them.
+  return inventory + lowQueueTail(summary, groomBelow, grooming, "", now);
+}
+
+/** The shared low-queue diagnostic tail (#735/#777/#679): the routable-count →
+ *  claimable/known-blocked split, in-flight to-spec batches, the considered
+ *  backlog and this pass's holds. `lead` is the sentence opener the caller
+ *  chooses — the dated path opens with the dispatch timestamp and "Queue:",
+ *  the live path with its tracker inventory (#848 review 2). Sharing one tail
+ *  means a tracker read can never hide these distinctions. */
+function lowQueueTail(
+  summary: DispatchSummary,
+  groomBelow: number,
+  grooming: readonly GroomingRecord[],
+  lead: string,
+  /** The clock the durability of each verdict is judged against — the same
+   *  one the batch offer uses (#887). */
+  now: number,
+): string {
   // The durable per-issue verdicts, not this pass's one-shot hold groups: a
   // lane-blocked runway must read as "cannot move" even after a restart, and
   // the orchestrator's own prior verdicts (#679) must not be re-derived.
@@ -708,24 +858,33 @@ export function queueDigestLine(
   const claimable = Math.max(0, summary.routed - knownBlocked.length);
   const inFlightNames = inFlight.map((r) => `#${r.issue}`).join(", ");
   const busy = inFlight.length === 0 ? "" : `, ${inFlight.length} in a to-spec batch (${inFlightNames})`;
-  let line: string;
+  let tail: string;
   if (knownBlocked.length > 0 && claimable === 0) {
-    line =
-      `Queue: running low — ${summary.routed} routable candidate(s), all known-blocked ` +
+    tail =
+      `${lead}running low — ${summary.routed} routable candidate(s), all known-blocked ` +
       `(${groomingGroupCounts(knownBlocked)})${busy} — no grooming moves them; the holds clear by themselves` +
       `${inFlight.length === 0 ? "" : " and the to-spec batch's results land when it settles"}.`;
   } else if (knownBlocked.length > 0 || inFlight.length > 0) {
-    line =
-      `Queue: running low — ${summary.routed} routable candidate(s), below the grooming trigger of ${groomBelow}: ` +
+    tail =
+      `${lead}running low — ${summary.routed} routable candidate(s), below the grooming trigger of ${groomBelow}: ` +
       `${claimable} claimable, ${knownBlocked.length} known-blocked (${groomingGroupCounts(knownBlocked)})` +
       `${busy} — groom only the claimable.`;
   } else {
-    line = `Queue: running low — ${summary.routed} routable candidate(s), below the grooming trigger of ${groomBelow}.`;
+    tail = `${lead}running low — ${summary.routed} routable candidate(s), below the grooming trigger of ${groomBelow}.`;
   }
   if (considered.length > 0) {
-    line +=
+    // "Already considered" is not "will not be re-groomed": selection only
+    // withholds a candidate whose verdict is still durable, so the inventory
+    // says which of the two each row is. Claiming "never re-groom these" over
+    // rows the mechanical selection was simultaneously offering is the #887
+    // defect — the same predicate now answers both.
+    const durable = considered.filter((g) => toSpecDurableVerdict(g, now) !== undefined);
+    const regroomable = considered.length - durable.length;
+    tail +=
       ` Backlog already-considered: ${considered.length} (${groomingVerdictCounts(considered)}) — ` +
-      `promote the promotable or groom new issues, never re-groom these.`;
+      `${durable.length} still durable (never re-groom these), ${regroomable} re-groomable ` +
+      "(no readable to-spec source, or observed past the freshness ceiling). " +
+      "Promote the promotable or groom new issues.";
   }
   if (summary.admitted === 0 && summary.holds.length > 0) {
     const held = summary.holds
@@ -734,9 +893,9 @@ export function queueDigestLine(
         return `${h.reason} ${h.count}${first === undefined ? "" : ` (${first})`}`;
       })
       .join(", ");
-    line += ` All held: ${held}.`;
+    tail += ` All held: ${held}.`;
   }
-  return line;
+  return tail;
 }
 
 // ================================================================ to-spec
@@ -818,6 +977,51 @@ export const TO_SPEC_IN_FLIGHT_REASON = "in-flight";
  */
 export const TO_SPEC_IN_FLIGHT_TTL_MS = 24 * 60 * 60 * 1_000;
 
+/**
+ * How long a refused pass parks its candidate before another batch may be
+ * spent on it. Deliberately the same 24h number as the source-freshness
+ * ceiling and the in-flight TTL — one granularity for this whole lifecycle,
+ * not a third threshold to keep in sync: within that window neither the
+ * authoritative source nor the issue has produced new evidence, so a retry
+ * re-runs the identical prompt and refuses the identical way.
+ *
+ * Without it, a candidate whose delegated pass returns malformed,
+ * source-less or stale output is immediately eligible again, so every
+ * low-queue tick spends a full delegated batch re-grooming it — measured on
+ * this fleet as five permanently-refused rows (#295, #296, #297, #679, #806)
+ * re-offered on every pass, and as #807 groomed twice seven minutes apart
+ * (#887).
+ */
+export const TO_SPEC_REFUSED_RETRY_COOLDOWN_MS = TO_SPEC_MAX_SOURCE_AGE_MS;
+
+/**
+ * The one durability rule for a grooming row: the validated to-spec result it
+ * carries when that result is still fresh, or `undefined` when the row is not
+ * durable grooming at all (no to-spec payload — a hand-edited or pre-#772
+ * row — or a source observed past the freshness ceiling).
+ *
+ * Every reader of "is this issue already groomed?" MUST go through this:
+ * {@link toSpecCandidateExclusion} (selection and the `tool_call` gate), the
+ * launch block's `already-groomed` list, and the queue digest's
+ * already-considered inventory. Two readers with two predicates is exactly
+ * the #887 defect — the digest told the orchestrator "never re-groom these"
+ * about rows the mechanical selection was simultaneously offering.
+ */
+export function toSpecDurableVerdict(row: GroomingRecord, now: number): ToSpecResult | undefined {
+  const result = parseToSpecEvidence(row.evidence);
+  if (result === undefined) return undefined;
+  return now - result.source.freshAt <= TO_SPEC_MAX_SOURCE_AGE_MS ? result : undefined;
+}
+
+/** The refusal a row records when its pass produced nothing usable, while the
+ *  cooldown above still holds it out of a new batch; `undefined` for any
+ *  other row, including a refusal whose cooldown has expired. */
+export function toSpecRefusalOnCooldown(row: GroomingRecord, now: number): ToSpecFailure | undefined {
+  const failure = parseToSpecFailureEvidence(row.evidence);
+  if (failure === undefined) return undefined;
+  return now - row.recordedAt <= TO_SPEC_REFUSED_RETRY_COOLDOWN_MS ? failure : undefined;
+}
+
 /** The first line of every batch item's `task`, in the shape the gate parses:
  *  `to-spec candidate: <owner/repo>#<issue> — <title>`. */
 export const TO_SPEC_ITEM_PREFIX = "to-spec candidate:";
@@ -906,6 +1110,12 @@ export function parseToSpecItem(task: unknown): ToSpecBatchItem | undefined {
  *    re-running it would recompute a verdict that is still valid. New source
  *    evidence reconsiders it: once the recorded `freshAt` crosses the ceiling
  *    the row no longer reads as groomed, and a fresh pass overrides it;
+ *  - a refused pass inside {@link TO_SPEC_REFUSED_RETRY_COOLDOWN_MS}: a full
+ *    delegated batch was already spent and produced nothing usable
+ *    (malformed, source-less or stale output). Retrying inside the cooldown
+ *    re-runs the identical prompt against the same source and refuses the
+ *    same way, which is how one broken candidate consumed a batch on every
+ *    low-queue tick (#887);
  *  - `active`: a run is in flight on the issue right now.
  */
 export function toSpecCandidateExclusion(
@@ -922,14 +1132,23 @@ export function toSpecCandidateExclusion(
     } else if (row.reason === "file-lane" || row.reason === "depends-on") {
       return `#${candidate.issue} is mechanically blocked (${row.reason}) — the hold clears by itself`;
     } else {
-      const result = parseToSpecEvidence(row.evidence);
-      if (result !== undefined && now - result.source.freshAt <= TO_SPEC_MAX_SOURCE_AGE_MS) {
+      const durable = toSpecDurableVerdict(row, now);
+      if (durable !== undefined) {
         return (
-          `#${candidate.issue} was already groomed ${result.verdict} (source ${result.source.name}@` +
-          `${result.source.ref}, observed ${new Date(result.source.freshAt).toISOString()}) — re-groom only ` +
+          `#${candidate.issue} was already groomed ${durable.verdict} (source ${durable.source.name}@` +
+          `${durable.source.ref}, observed ${new Date(durable.source.freshAt).toISOString()}) — re-groom only ` +
           "with new source evidence"
         );
       }
+      const refusal = toSpecRefusalOnCooldown(row, now);
+      if (refusal !== undefined) {
+        const retryAt = new Date(row.recordedAt + TO_SPEC_REFUSED_RETRY_COOLDOWN_MS).toISOString();
+        return (
+          `#${candidate.issue} already spent a to-spec batch that was refused as ${refusal.kind} ` +
+          `(${new Date(row.recordedAt).toISOString()}) — eligible again after ${retryAt}, or once the ` +
+          "issue or its source changes"
+        );
+      }
     }
   }
   if (facts.active) return `#${candidate.issue} has a dispatched run in flight`;
@@ -1001,6 +1220,9 @@ export interface ToSpecLaunchBlock {
 export interface ToSpecLaunchExclusions {
   /** Candidates with a fresh, valid to-spec verdict already on the grooming table. */
   groomed: string[];
+  /** Candidates whose last pass was refused and whose retry cooldown still
+   *  holds ({@link TO_SPEC_REFUSED_RETRY_COOLDOWN_MS}). */
+  refused: string[];
   /** Candidates with an active to-spec batch. */
   inFlight: string[];
   /** Candidates under admission's durable lane/dependency holds. */
@@ -1094,21 +1316,28 @@ export async function offerToSpecLaunch(input: {
   active: readonly { issue: number }[];
   project: ProjectConfig;
   trackerSeam: ToSpecTrackerSeam | undefined;
+  /** An open-issue snapshot this tick already read from the tracker. Shared
+   *  with the queue digest so one tick cannot describe two queues (#848);
+   *  absent when that read failed, in which case the launch retries its own
+   *  read and fails closed on the same terms as before. */
+  issues?: readonly ReadyIssue[];
   now: number;
 }): Promise<ToSpecLaunchBlock | undefined> {
   if (input.summary === undefined) return undefined;
   if (input.summary.routed >= input.groomBelow) return undefined;
   const seam = input.trackerSeam;
   if (seam === undefined) return undefined;
-  let issues: ReadyIssue[];
-  try {
-    issues = await seam.listOpenIssues(input.project);
-  } catch {
-    // No authoritative snapshot, no launch: a batch offered without one would
-    // make the model the selector, which is exactly the defect this slice
-    // removes. The queue digest still names the grooming duty; the next tick
-    // retries the read.
-    return undefined;
+  let issues = input.issues;
+  if (issues === undefined) {
+    try {
+      issues = await seam.listOpenIssues(input.project);
+    } catch {
+      // No authoritative snapshot, no launch: a batch offered without one would
+      // make the model the selector, which is exactly the defect this slice
+      // removes. The queue digest still names the grooming duty; the next tick
+      // retries the read.
+      return undefined;
+    }
   }
   const views = toSpecPoolFromSnapshot(issues, input.project);
   const groomingByIssue = new Map(input.grooming.map((row) => [row.issue, row]));
@@ -1184,17 +1413,35 @@ export function toSpecLaunchBlock(input: {
   if (input.summary === undefined) return undefined;
   if (input.summary.routed >= input.groomBelow) return undefined;
   if (input.selected.length === 0) return undefined;
-  const exclusions: ToSpecLaunchExclusions = { groomed: [], inFlight: [], mechanicallyBlocked: [], dispatched: [] };
+  const exclusions: ToSpecLaunchExclusions = {
+    groomed: [],
+    refused: [],
+    inFlight: [],
+    mechanicallyBlocked: [],
+    dispatched: [],
+  };
   for (const row of input.grooming) {
     if (row.reason === TO_SPEC_IN_FLIGHT_REASON) {
       if (input.now - row.recordedAt <= TO_SPEC_IN_FLIGHT_TTL_MS) exclusions.inFlight.push(`#${row.issue}`);
     } else if (row.reason === "file-lane" || row.reason === "depends-on") {
       exclusions.mechanicallyBlocked.push(`#${row.issue} (${row.reason})`);
     } else {
-      const result = parseToSpecEvidence(row.evidence);
-      if (result !== undefined && input.now - result.source.freshAt <= TO_SPEC_MAX_SOURCE_AGE_MS) {
+      // The same two predicates the selection and the gate apply, so a
+      // candidate this block advertises as excluded is one selection actually
+      // withheld — and one it does not advertise is one selection may offer
+      // (#887).
+      const durable = toSpecDurableVerdict(row, input.now);
+      if (durable !== undefined) {
         exclusions.groomed.push(
-          `#${row.issue} (${result.verdict} @ ${result.source.ref}, observed ${new Date(result.source.freshAt).toISOString()})`,
+          `#${row.issue} (${durable.verdict} @ ${durable.source.ref}, observed ${new Date(durable.source.freshAt).toISOString()})`,
+        );
+        continue;
+      }
+      const refusal = toSpecRefusalOnCooldown(row, input.now);
+      if (refusal !== undefined) {
+        exclusions.refused.push(
+          `#${row.issue} (${refusal.kind}, refused ${new Date(row.recordedAt).toISOString()}, retry after ` +
+            `${new Date(row.recordedAt + TO_SPEC_REFUSED_RETRY_COOLDOWN_MS).toISOString()})`,
         );
       }
     }
@@ -1217,10 +1464,11 @@ export function toSpecLaunchBlock(input: {
     "The conductor selected this batch mechanically from the live open-issue snapshot " +
       `(issues carrying \`${input.queueLabel}\`, the \`${input.parkLabel}\` park label, issues without exactly one ` +
       `\`${input.labelPrefix}<repo>\` routing label, parent/epic issues with sub-issues, ` +
-      "already-groomed, in-flight, lane/dependency-blocked and dispatched candidates were excluded):",
+      "already-groomed, refused-on-cooldown, in-flight, lane/dependency-blocked and dispatched candidates were excluded):",
     candidates,
     "Excluded this tick — " +
       `already-groomed: ${exclusions.groomed.length === 0 ? "none" : exclusions.groomed.join(", ")}; ` +
+      `refused, cooldown still holding: ${exclusions.refused.length === 0 ? "none" : exclusions.refused.join(", ")}; ` +
       `in-flight batches — ${exclusions.inFlight.length === 0 ? "none" : exclusions.inFlight.join(", ")}; ` +
       `mechanically blocked: ${exclusions.mechanicallyBlocked.length === 0 ? "none" : exclusions.mechanicallyBlocked.join(", ")}; ` +
       `dispatched now: ${exclusions.dispatched.length === 0 ? "none" : exclusions.dispatched.join(", ")}.`,
@@ -1247,6 +1495,51 @@ export function toSpecLaunchBlock(input: {
   return { token, block: lines.join("\n"), items };
 }
 
+/**
+ * The accounting a low-queue tick owes Duty 2 when the mechanical selection
+ * produced no batch at all. Without it a fully-excluded backlog is silence,
+ * and silence is what gets re-derived by hand: the orchestrator cannot tell
+ * "the queue is low and nothing is groomable" from "the launch machinery did
+ * not run". Every count comes from the same predicates the selection and the
+ * `tool_call` gate apply (#887).
+ *
+ * `undefined` when no dispatch row exists or the queue is at/above the
+ * grooming trigger — the same gate the offer itself uses, so this line and a
+ * launch block are mutually exclusive.
+ */
+export function toSpecNoBatchLine(input: {
+  summary: DispatchSummary | undefined;
+  groomBelow: number;
+  grooming: readonly GroomingRecord[];
+  active: readonly { issue: number }[];
+  now: number;
+}): string | undefined {
+  if (input.summary === undefined) return undefined;
+  if (input.summary.routed >= input.groomBelow) return undefined;
+  let durable = 0;
+  let refused = 0;
+  let inFlight = 0;
+  let held = 0;
+  for (const row of input.grooming) {
+    if (row.reason === TO_SPEC_IN_FLIGHT_REASON) {
+      if (input.now - row.recordedAt <= TO_SPEC_IN_FLIGHT_TTL_MS) inFlight += 1;
+    } else if (row.reason === "file-lane" || row.reason === "depends-on") {
+      held += 1;
+    } else if (toSpecDurableVerdict(row, input.now) !== undefined) {
+      durable += 1;
+    } else if (toSpecRefusalOnCooldown(row, input.now) !== undefined) {
+      refused += 1;
+    }
+  }
+  return (
+    `No to-spec batch this tick: the mechanical selection found nothing eligible in the open-issue ` +
+    `snapshot — ${durable} durable verdict(s), ${refused} refused inside the retry cooldown, ${inFlight} ` +
+    `in flight, ${held} lane/dependency-blocked, ${input.active.length} dispatched. A \`task\` call carrying ` +
+    `the ${TO_SPEC_BATCH_MARKER} marker is refused this turn; file or promote from what the backlog already ` +
+    "says instead of re-grooming it."
+  );
+}
+
 export const TICK_SCOPE_CONSTRAINTS: { readonly [K in ReportScopeChoice]: string } = {
   material: "Report material events per your brief.",
   escalations:
@@ -1451,6 +1744,8 @@ export const TICK_ASK_RULE =
   `On this locally injected tick, questions to your operator go through ${ASK_TOOL}: ` +
   `call it with "on-timeout": "auto-proceed" or "park" (what to do when nobody answers within the ceiling) ` +
   `and optionally "timeoutSeconds" — an ask issued without one still gets the default ceiling, capped at the turn budget. ` +
+  `Several judgement calls about ONE issue go as a single ${QUESTIONNAIRE_TOOL} instead: one delivery, one ceiling, ` +
+  `each item a durable row bound to that issue, resolved independently and in any order. ` +
   `The ${TELEGRAM_APPROVAL_TOOL} tool is refused here: it would wait for your operator for as long as the answer ` +
   `takes, and an unanswered question must never hold the loop.`;
 
@@ -2941,24 +3236,33 @@ function resolveAskProject(
  * prior state, and executing it still fails closed when it cannot route.
  */
 async function ensureAskSurface(pi: TickApi, resolvable: boolean): Promise<boolean> {
+  // Both operator-question surfaces flip together (#947): they route through the
+  // same resolution and fail closed the same way, so a beat that can carry one
+  // can carry the other, and a degraded beat must hide both — an ask surface that
+  // is half-present is a model choosing between a working tool and a broken one.
+  const tools = [ASK_TOOL, QUESTIONNAIRE_TOOL];
   const current = pi.getActiveTools();
-  const present = current.includes(ASK_TOOL);
-  if (resolvable === present) return true;
+  const present = tools.every((tool) => current.includes(tool));
+  const absent = tools.every((tool) => !current.includes(tool));
+  if (resolvable ? present : absent) return true;
   try {
     await pi.setActiveTools(
-      resolvable ? [...current, ASK_TOOL] : current.filter((name) => name !== ASK_TOOL),
+      resolvable
+        ? [...current.filter((name) => !tools.includes(name)), ...tools]
+        : current.filter((name) => !tools.includes(name)),
     );
   } catch (err) {
     pi.logger.error(
-      `[omp-conductor] could not ${resolvable ? "activate" : "deactivate"} ${ASK_TOOL}: ${
+      `[omp-conductor] could not ${resolvable ? "activate" : "deactivate"} ${tools.join(" / ")}: ${
         err instanceof Error ? err.message : String(err)
       }`,
     );
     return false;
   }
   // An awaited call is not yet confirmation: the live membership read after the
-  // reconciliation is what proves the tool is really model-visible.
-  return pi.getActiveTools().includes(ASK_TOOL) === resolvable;
+  // reconciliation is what proves the tools are really model-visible.
+  const after = pi.getActiveTools();
+  return tools.every((tool) => after.includes(tool) === resolvable);
 }
 
 /**
@@ -3198,6 +3502,16 @@ async function tick(
         // because the whole failure was a question surviving in context only.
         const decisions = formatDecisionDigest(frictionStore.openDecisions(scope.projectName), now);
         if (decisions.length > 0) content = `${content}\n${decisions}`;
+        // A host running two different releases at once, from the row the
+        // dispatch pass recorded (#919). Read only — probing the three surfaces
+        // here spawns three children per tick and took this file's own suite
+        // from 8.4s to 83.4s, which is why the observation is recorded. Only a
+        // proven mismatch appears: an absent surface, a `local:` herdr link and
+        // an unverifiable pin are steady states someone chose, and a warning
+        // repeated every fifteen minutes trains an operator to ignore the line
+        // that matters. `doctor` keeps that nuance.
+        const surfaces = installSurfaceMismatch(frictionStore.installSurfaces());
+        if (surfaces !== undefined) content = `${content}\n${surfaces}`;
         // What the daemon already fixed, so the session stops re-deriving that
         // paragraph on every tick (#132). Two intervals wide rather than one: a
         // tick that ran long must not drop the window it was meant to report.
@@ -3224,12 +3538,63 @@ async function tick(
           // so the resolved name is in hand and an un-named lookup would refuse
           // to guess on a host with a second project.
           const project = findProject(loadConfig(), scope.projectName);
+          const groomBelow = project.groomBelow ?? DEFAULT_GROOM_BELOW;
+          const dispatch = frictionStore.latestDispatch(scope.projectName);
+          const grooming = store.groomingVerdicts(projectName);
+          // #848: "the queue is empty / running dry" is the tracker's word, not
+          // the last dispatch pass's echo. One open-issue snapshot per tick,
+          // read live through the same authoritative tracker surface the
+          // to-spec launch uses, overlaid with the label_ops projection
+          // exactly as the dispatch pass judges eligibility — so a promotion,
+          // unblock or projection write after the last dispatch pass is
+          // visible on the very next tick even while a drain holds claiming.
+          // The digest consumes the overlay as the live inventory; the to-spec
+          // offer shares the same raw snapshot so one tick cannot describe two
+          // queues. If the tracker read fails, the digest falls back to
+          // explicitly dated wording (never a present-tense empty claim),
+          // and the offer retries its own read exactly as it did before.
+          //
+          // The read is made only for dispatch rows the digest could render:
+          // a healthy row (routed at/above the grooming threshold) emits no
+          // queue line at all, so no freshness check is spent on it and no
+          // stale claim can leak from it. A zero-ready row (or any row below
+          // the trigger) is exactly where the old wording lied, so every such
+          // tick reads the live queue.
+          const needsQueueRead =
+            dispatch !== undefined &&
+            (dispatch.ready === 0 || dispatch.routed === 0 || dispatch.routed < groomBelow);
+          let queueObservation: QueueObservation | undefined;
+          let openSnapshot: readonly ReadyIssue[] | undefined;
+          if (toSpecTrackerSeam !== undefined && needsQueueRead) {
+            try {
+              const open = await toSpecTrackerSeam.listOpenIssues(project);
+              openSnapshot = open;
+              const effective = open.map((issue) => {
+                const pending = store.pendingLabelOpsFor(projectName, issue.number);
+                return pending.length === 0
+                  ? issue
+                  : { ...issue, labels: effectiveLabels(issue.labels, pending) };
+              });
+              queueObservation = {
+                queued: effective.filter((issue) => issue.labels.includes(project.queueLabel)).length,
+                observedAt: now,
+              };
+            } catch {
+              // No current-queue evidence this tick: the digest below renders
+              // the dispatch row as dated history instead of claiming empty.
+            }
+          }
           const queue = queueDigestLine(
-            frictionStore.latestDispatch(scope.projectName),
+            dispatch,
             project.queueLabel,
             project.routing.labelPrefix,
-            project.groomBelow ?? DEFAULT_GROOM_BELOW,
-            store.groomingVerdicts(projectName),
+            groomBelow,
+            grooming,
+            queueObservation,
+            // One clock for the inventory and the offer below: the digest must
+            // never call a verdict durable that the same tick's selection is
+            // about to re-groom (#887).
+            now,
           );
           if (queue !== undefined) content = `${content}\n${queue}`;
           // #777: the mechanical to-spec launch boundary. The queue digest is
@@ -3243,11 +3608,13 @@ async function tick(
           //
           // Every tick owns its authorization fresh — the clears above ran
           // before the reads, so the offer below can only mint for THIS tick.
+          const toSpecActive = store.activeRuns(projectName);
           const launch = await offerToSpecLaunch({
-            summary: frictionStore.latestDispatch(scope.projectName),
-            groomBelow: project.groomBelow ?? DEFAULT_GROOM_BELOW,
-            grooming: store.groomingVerdicts(projectName),
-            active: store.activeRuns(projectName),
+            summary: dispatch,
+            groomBelow,
+            grooming,
+            active: toSpecActive,
+            issues: openSnapshot,
             project,
             trackerSeam: toSpecTrackerSeam,
             now,
@@ -3261,6 +3628,19 @@ async function tick(
             session.launchProject = project.name;
             session.launchToken = launch.token;
             session.launchItems = launch.items;
+          } else if (openSnapshot !== undefined) {
+            // A low queue with nothing eligible is a finding, not silence: the
+            // snapshot read succeeded, so the exclusions — and only they — are
+            // why no batch is offered. Rendered only when the read succeeded,
+            // so a tracker failure never masquerades as "nothing eligible".
+            const noBatch = toSpecNoBatchLine({
+              summary: dispatch,
+              groomBelow,
+              grooming,
+              active: toSpecActive,
+              now,
+            });
+            if (noBatch !== undefined) content = `${content}\n${noBatch}`;
           }
           // Pending intake is the same class of standing block as the friction
           // and decisions read-outs: a store-backed duty the orchestrator must
@@ -4033,22 +4413,25 @@ export default function orchestratorTickExtension(
         }
         return;
       }
-      // The reply to an arming challenge lands here as an ordinary user turn. It
-      // must reach the transcript exactly as sent — the host's transcript scan
-      // (`armTicks`) is the backend proof, so it is left untouched — while the
-      // model gets a trusted, machine-readable steer about it, so it stops
-      // ad-libbing pairing-safety prose at a bare `FLEET-…` token (conductor
-      // #415). The classification derives from persisted authenticated
-      // pending-challenge state (hash + expiry, keyed by this project), never
-      // from the `FLEET-` prefix, so an unsolicited lookalike that matches no
-      // active challenge stays inert.
+      // The reply to an arming challenge lands here as an ordinary user turn.
+      // This adapter — not the model, and not any transcript scan — is the
+      // sole producer of the arming acknowledgement: it classifies the turn
+      // against persisted authenticated challenge state and, on a match,
+      // atomically records the challenge-id-specific acknowledgement the
+      // host-side `arm` waits on (conductor #614), all before normal model
+      // handling. The classification derives from the pending challenge (hash
+      // + expiry, keyed by this project), never from the `FLEET-` prefix, so
+      // an unsolicited lookalike that matches no active challenge stays inert
+      // and model behaviour cannot determine whether the host becomes armed.
+      // The turn itself still reaches the transcript exactly as sent, with the
+      // same trusted machine-readable steer as before (#415).
       if (message.role === "user" && message.synthetic !== true && message.attribution !== "agent") {
         const replyText =
           message.content
             ?.filter((part) => part.type === "text" && typeof part.text === "string")
             .map((part) => part.text as string)
             .join(" ") ?? "";
-        const proof = isActiveArmProof(configuredProject, replyText, Date.now());
+        const proof = acknowledgeArmReply(configuredProject, replyText, Date.now());
         if (session.activeLocalTick !== undefined) {
           session.activeLocalTick.humanWaiting = true;
           if (proof) session.activeLocalTick.armingProof = true;
@@ -4112,6 +4495,71 @@ export default function orchestratorTickExtension(
   // the project to file the decision row against and to resolve the delivery
   // target. An unreadable/ambiguous config makes the tool say so and record
   // nothing, which is the same fail-closed posture the autonomous gate takes.
+  /**
+   * The plumbing both operator-question tools share (#947): which project this
+   * call records against, and the one sanctioned delivery path.
+   *
+   * Extracted rather than copied, because the questionnaire needs exactly the
+   * live-config routing, the fail-closed refusals and the held-notice fallback
+   * the single ask already got right — and a second copy of the fallback is how
+   * one surface quietly starts dropping questions the other one holds.
+   */
+  const resolveOperatorAskContext = (
+    tool: string,
+  ): { ok: true; project: ProjectConfig; config: TickConfig } | { ok: false; text: string } => {
+    const session = askSession;
+    if (session === undefined) {
+      return {
+        ok: false,
+        text: `${tool}: not available in this session (no orchestrator tick); nothing was asked or recorded.`,
+      };
+    }
+    const routed = resolveAskProject(session.cwd, session.config);
+    if (routed.kind === "error") {
+      return {
+        ok: false,
+        text:
+          `${tool}: conductor config unreadable (${routed.problem}); ` +
+          "nothing was asked or recorded. Repair the config, do not ask through another path.",
+      };
+    }
+    return { ok: true, project: routed.project, config: session.config };
+  };
+
+  const operatorAskDelivery =
+    (tool: string, projectConfig: ProjectConfig, store: Store) =>
+    async (text: string, category: InterruptCategory): Promise<AskDeliveryResult> => {
+      const at = Date.now();
+      const noticeId = randomUUID();
+      try {
+        const delivered = await deliverOperatorMessage(projectConfig, text, {
+          store,
+          at,
+          noticeId,
+          category,
+        });
+        return delivered.kind === "sent"
+          ? { kind: "sent", category: delivered.category }
+          : { kind: "held", category: delivered.category, noticeId: delivered.noticeId };
+      } catch (err) {
+        // A failed immediate send must not drop the question: fall back to the
+        // durable hold exactly like the gate's own hold path, and let the daemon
+        // retry with the digest.
+        store.addHeldNotice({
+          id: noticeId,
+          project: projectConfig.name,
+          category,
+          summary: text.split("\n", 1)[0]!.slice(0, 240),
+          detail: text,
+          createdAt: at,
+        });
+        pi.logger.error(
+          `[omp-conductor] ${tool} could not deliver the ask directly (${err instanceof Error ? err.message : String(err)}); held durably`,
+        );
+        return { kind: "held", category, noticeId };
+      }
+    };
+
   pi.registerTool({
     name: ASK_TOOL,
     label: ASK_TOOL,
@@ -4140,43 +4588,16 @@ export default function orchestratorTickExtension(
       if (!parsed.ok) {
         return { content: [{ type: "text", text: parsed.problem }], isError: true };
       }
-      const session = askSession;
-      if (session === undefined) {
-        // Not a conductor tick session (subagent, or a session that never
-        // composed a tick). Same fail-closed posture as an unresolvable config:
-        // say so, record nothing, and never route the question elsewhere.
-        return {
-          content: [
-            {
-              type: "text",
-              text: `${ASK_TOOL}: not available in this session (no orchestrator tick); nothing was asked or recorded.`,
-            },
-          ],
-          isError: true,
-        };
-      }
-      // Routing follows the *live* tick config, not the session-start stamp:
-      // a restamp (un-stamped → stamped, or project A → B) must make the next
-      // tick's toolbox land on the project the turn actually ticks for, and an
-      // abandoned stamp must not keep recording against a project that is no
-      // longer this fleet's. Only the ceiling stays startup-only (from
-      // `config` below) — routing is re-read every call.
-      const { cwd, config } = session;
-      const routed = resolveAskProject(cwd, config);
-      if (routed.kind === "error") {
-        return {
-          content: [
-            {
-              type: "text",
-              text:
-                `${ASK_TOOL}: conductor config unreadable (${routed.problem}); ` +
-                "nothing was asked or recorded. Repair the config, do not ask through another path.",
-            },
-          ],
-          isError: true,
-        };
+      // Routing follows the *live* tick config, not the session-start stamp: a
+      // restamp (un-stamped → stamped, or project A → B) must make the next
+      // tick's toolbox land on the project the turn actually ticks for. Only the
+      // ceiling stays startup-only — routing is re-read every call.
+      const context = resolveOperatorAskContext(ASK_TOOL);
+      if (!context.ok) {
+        return { content: [{ type: "text", text: context.text }], isError: true };
       }
-      const projectConfig = routed.project;
+      const projectConfig = context.project;
+      const config = context.config;
       const store = openStore(dbPath());
       let result: AskResult;
       try {
@@ -4192,37 +4613,7 @@ export default function orchestratorTickExtension(
           // inject a fake through the same seam.
           interactive: options.ask?.interactive ?? interactiveAskSurface({ project: projectConfig, store }),
           ...(options.ask === undefined ? {} : { wait: options.ask.wait, now: options.ask.now }),
-          deliver: async (text, category) => {
-            const at = Date.now();
-            const noticeId = randomUUID();
-            try {
-              const delivered = await deliverOperatorMessage(projectConfig, text, {
-                store,
-                at,
-                noticeId,
-                category,
-              });
-              return delivered.kind === "sent"
-                ? { kind: "sent", category: delivered.category }
-                : { kind: "held", category: delivered.category, noticeId: delivered.noticeId };
-            } catch (err) {
-              // A failed immediate send must not drop the question: fall back
-              // to the durable hold exactly like the gate's own hold path, and
-              // let the daemon retry with the digest.
-              store.addHeldNotice({
-                id: noticeId,
-                project: projectConfig.name,
-                category,
-                summary: text.split("\n", 1)[0]!.slice(0, 240),
-                detail: text,
-                createdAt: at,
-              });
-              pi.logger.error(
-                `[omp-conductor] ${ASK_TOOL} could not deliver the ask directly (${err instanceof Error ? err.message : String(err)}); held durably`,
-              );
-              return { kind: "held", category, noticeId };
-            }
-          },
+          deliver: operatorAskDelivery(ASK_TOOL, projectConfig, store),
         });
       } finally {
         store.close();
@@ -4231,6 +4622,58 @@ export default function orchestratorTickExtension(
     },
   });
 
+  // The batched spec-out questionnaire (#947): the same durable contract as the
+  // single ask, asked once for several judgement calls about one issue. Mounted
+  // and routed through exactly the shared helpers above, so the two surfaces
+  // cannot come to disagree about which project a question belongs to or what
+  // happens when delivery fails.
+  pi.registerTool({
+    name: QUESTIONNAIRE_TOOL,
+    label: QUESTIONNAIRE_TOOL,
+    defaultInactive: true,
+    description:
+      `Ask your operator several bounded questions about ONE issue as a single message, and wait up ` +
+      `to one ask ceiling for the answers. Every item is recorded as its own durable decision row ` +
+      `before anything is delivered, all bound to the issue you name in "spec-issue" — so the answers ` +
+      `become that issue's provenance and a later reader sees why a slice is shaped the way it is. ` +
+      `Items resolve independently and in any order: an item the operator answers keeps that answer, ` +
+      `and at the ceiling each unanswered item takes its own declared "on-timeout" ("auto-proceed" ` +
+      `applies its recommendation and records that nobody human chose it; "park" leaves the row open ` +
+      `and pending, and you then park the work it blocks). Ask ONLY the judgement calls that genuinely ` +
+      `belong to your operator — anything a repo read can answer is your own work — and at most ` +
+      `${MAX_QUESTIONNAIRE_ITEMS} items. This path is plain text by design (one message, not ` +
+      `${MAX_QUESTIONNAIRE_ITEMS} button posts), so a prose reply does not itself resolve a row: map ` +
+      `it with \`omp-conductor decision resolve <id> --answer "…"\`. Use conductor_ask for a single ` +
+      `question.`,
+    parameters: questionnaireParameterSchema(),
+    approval: "write",
+    execute: async (_toolCallId, params) => {
+      const parsed = parseQuestionnaireRequest(params);
+      if (!parsed.ok) {
+        return { content: [{ type: "text", text: parsed.problem }], isError: true };
+      }
+      const context = resolveOperatorAskContext(QUESTIONNAIRE_TOOL);
+      if (!context.ok) {
+        return { content: [{ type: "text", text: context.text }], isError: true };
+      }
+      const projectConfig = context.project;
+      const store = openStore(dbPath());
+      try {
+        const result = await performQuestionnaire(parsed.request, {
+          store,
+          project: projectConfig.name,
+          configuredCeilingSeconds: context.config.askTimeoutSeconds,
+          turnBudgetSeconds: context.config.budgetSeconds ?? DEFAULT_TICK_BUDGET_SECONDS,
+          ...(options.ask === undefined ? {} : { wait: options.ask.wait, now: options.ask.now }),
+          deliver: operatorAskDelivery(QUESTIONNAIRE_TOOL, projectConfig, store),
+        });
+        return { content: [{ type: "text", text: result.text }] };
+      } finally {
+        store.close();
+      }
+    },
+  });
+
   // The async half of the to-spec result capture (#777). Registered at
   // extension-factory time like {@link ASK_TOOL}, with the same routing
   // contract: the state it needs (cwd + startup config) is filled by