omp-conductor 0.18.2 → 0.19.0

package/src/orchestrator-tick.ts

@@ -98,8 +98,15 @@ import {
 import { repoSlugFor } from "./gitops.ts";
 import { makeTracker } from "./tracker/github.ts";
 import { formatDecisionDigest } from "./decisions.ts";
+import { installSurfaceMismatch } from "./status-render.ts";
 import {
   ASK_TOOL,
+  type AskDeliveryResult,
+  MAX_QUESTIONNAIRE_ITEMS,
+  QUESTIONNAIRE_TOOL,
+  parseQuestionnaireRequest,
+  performQuestionnaire,
+  questionnaireParameterSchema,
   askAnswerRowWrite,
   askParameterSchema,
   DEFAULT_ASK_TIMEOUT_SECONDS,
@@ -121,9 +128,12 @@ import { dbPath, openStore } from "./store.ts";
 import { digestDue, localDayKey } from "./digest-schedule.ts";
 import {
   parseToSpecEvidence,
+  parseToSpecFailureEvidence,
   recordToSpecGrooming,
   TO_SPEC_MAX_SOURCE_AGE_MS,
   TO_SPEC_SCHEMA,
+  type ToSpecFailure,
+  type ToSpecResult,
 } from "./to-spec.ts";
 import { heldNoticeId } from "./notices.ts";
 import { acknowledgeArmReply } from "./arm-challenge.ts";
@@ -681,12 +691,17 @@ export function queueDigestLine(
   groomBelow: number,
   grooming: readonly GroomingRecord[] = [],
   queue: QueueObservation | undefined = undefined,
+  /** Observation time for the durability of the grooming rows this line
+   *  describes — the same clock the selection is offered against, so the
+   *  inventory and the batch cannot disagree about what is still groomed
+   *  (#887). */
+  now: number = Date.now(),
 ): string | undefined {
   if (summary === undefined) return undefined;
   if (queue !== undefined) {
-    return liveQueueDigestLine(summary, queue, queueLabel, labelPrefix, groomBelow, grooming);
+    return liveQueueDigestLine(summary, queue, queueLabel, labelPrefix, groomBelow, grooming, now);
   }
-  return datedQueueDigestLine(summary, queueLabel, labelPrefix, groomBelow, grooming);
+  return datedQueueDigestLine(summary, queueLabel, labelPrefix, groomBelow, grooming, now);
 }
 
 /** The dated rendering: the last dispatch row is the only evidence, so every
@@ -697,6 +712,7 @@ function datedQueueDigestLine(
   labelPrefix: string,
   groomBelow: number,
   grooming: readonly GroomingRecord[],
+  now: number,
 ): string | undefined {
   const dated = new Date(summary.completedAt).toISOString();
   if (summary.ready === 0) {
@@ -735,7 +751,7 @@ function datedQueueDigestLine(
     return line;
   }
   if (summary.routed >= groomBelow) return undefined;
-  return lowQueueTail(summary, groomBelow, grooming, `As of the last dispatch (${dated}): Queue: `);
+  return lowQueueTail(summary, groomBelow, grooming, `As of the last dispatch (${dated}): Queue: `, now);
 }
 
 /** The live rendering: the tracker observation is the queue label inventory,
@@ -752,6 +768,7 @@ function liveQueueDigestLine(
   labelPrefix: string,
   groomBelow: number,
   grooming: readonly GroomingRecord[],
+  now: number,
 ): string | undefined {
   const queued = queue.queued;
   const observed = new Date(queue.observedAt).toISOString();
@@ -808,7 +825,7 @@ function liveQueueDigestLine(
   // low-queue diagnostics the dated path ships — the claimable/known-blocked
   // split, in-flight to-spec batches, the considered backlog and this pass's
   // holds (#735, #777, #679) — so a tracker read never hides them.
-  return inventory + lowQueueTail(summary, groomBelow, grooming, "");
+  return inventory + lowQueueTail(summary, groomBelow, grooming, "", now);
 }
 
 /** The shared low-queue diagnostic tail (#735/#777/#679): the routable-count →
@@ -822,6 +839,9 @@ function lowQueueTail(
   groomBelow: number,
   grooming: readonly GroomingRecord[],
   lead: string,
+  /** The clock the durability of each verdict is judged against — the same
+   *  one the batch offer uses (#887). */
+  now: number,
 ): string {
   // The durable per-issue verdicts, not this pass's one-shot hold groups: a
   // lane-blocked runway must read as "cannot move" even after a restart, and
@@ -853,9 +873,18 @@ function lowQueueTail(
     tail = `${lead}running low — ${summary.routed} routable candidate(s), below the grooming trigger of ${groomBelow}.`;
   }
   if (considered.length > 0) {
+    // "Already considered" is not "will not be re-groomed": selection only
+    // withholds a candidate whose verdict is still durable, so the inventory
+    // says which of the two each row is. Claiming "never re-groom these" over
+    // rows the mechanical selection was simultaneously offering is the #887
+    // defect — the same predicate now answers both.
+    const durable = considered.filter((g) => toSpecDurableVerdict(g, now) !== undefined);
+    const regroomable = considered.length - durable.length;
     tail +=
       ` Backlog already-considered: ${considered.length} (${groomingVerdictCounts(considered)}) — ` +
-      `promote the promotable or groom new issues, never re-groom these.`;
+      `${durable.length} still durable (never re-groom these), ${regroomable} re-groomable ` +
+      "(no readable to-spec source, or observed past the freshness ceiling). " +
+      "Promote the promotable or groom new issues.";
   }
   if (summary.admitted === 0 && summary.holds.length > 0) {
     const held = summary.holds
@@ -948,6 +977,51 @@ export const TO_SPEC_IN_FLIGHT_REASON = "in-flight";
  */
 export const TO_SPEC_IN_FLIGHT_TTL_MS = 24 * 60 * 60 * 1_000;
 
+/**
+ * How long a refused pass parks its candidate before another batch may be
+ * spent on it. Deliberately the same 24h number as the source-freshness
+ * ceiling and the in-flight TTL — one granularity for this whole lifecycle,
+ * not a third threshold to keep in sync: within that window neither the
+ * authoritative source nor the issue has produced new evidence, so a retry
+ * re-runs the identical prompt and refuses the identical way.
+ *
+ * Without it, a candidate whose delegated pass returns malformed,
+ * source-less or stale output is immediately eligible again, so every
+ * low-queue tick spends a full delegated batch re-grooming it — measured on
+ * this fleet as five permanently-refused rows (#295, #296, #297, #679, #806)
+ * re-offered on every pass, and as #807 groomed twice seven minutes apart
+ * (#887).
+ */
+export const TO_SPEC_REFUSED_RETRY_COOLDOWN_MS = TO_SPEC_MAX_SOURCE_AGE_MS;
+
+/**
+ * The one durability rule for a grooming row: the validated to-spec result it
+ * carries when that result is still fresh, or `undefined` when the row is not
+ * durable grooming at all (no to-spec payload — a hand-edited or pre-#772
+ * row — or a source observed past the freshness ceiling).
+ *
+ * Every reader of "is this issue already groomed?" MUST go through this:
+ * {@link toSpecCandidateExclusion} (selection and the `tool_call` gate), the
+ * launch block's `already-groomed` list, and the queue digest's
+ * already-considered inventory. Two readers with two predicates is exactly
+ * the #887 defect — the digest told the orchestrator "never re-groom these"
+ * about rows the mechanical selection was simultaneously offering.
+ */
+export function toSpecDurableVerdict(row: GroomingRecord, now: number): ToSpecResult | undefined {
+  const result = parseToSpecEvidence(row.evidence);
+  if (result === undefined) return undefined;
+  return now - result.source.freshAt <= TO_SPEC_MAX_SOURCE_AGE_MS ? result : undefined;
+}
+
+/** The refusal a row records when its pass produced nothing usable, while the
+ *  cooldown above still holds it out of a new batch; `undefined` for any
+ *  other row, including a refusal whose cooldown has expired. */
+export function toSpecRefusalOnCooldown(row: GroomingRecord, now: number): ToSpecFailure | undefined {
+  const failure = parseToSpecFailureEvidence(row.evidence);
+  if (failure === undefined) return undefined;
+  return now - row.recordedAt <= TO_SPEC_REFUSED_RETRY_COOLDOWN_MS ? failure : undefined;
+}
+
 /** The first line of every batch item's `task`, in the shape the gate parses:
  *  `to-spec candidate: <owner/repo>#<issue> — <title>`. */
 export const TO_SPEC_ITEM_PREFIX = "to-spec candidate:";
@@ -1036,6 +1110,12 @@ export function parseToSpecItem(task: unknown): ToSpecBatchItem | undefined {
  *    re-running it would recompute a verdict that is still valid. New source
  *    evidence reconsiders it: once the recorded `freshAt` crosses the ceiling
  *    the row no longer reads as groomed, and a fresh pass overrides it;
+ *  - a refused pass inside {@link TO_SPEC_REFUSED_RETRY_COOLDOWN_MS}: a full
+ *    delegated batch was already spent and produced nothing usable
+ *    (malformed, source-less or stale output). Retrying inside the cooldown
+ *    re-runs the identical prompt against the same source and refuses the
+ *    same way, which is how one broken candidate consumed a batch on every
+ *    low-queue tick (#887);
  *  - `active`: a run is in flight on the issue right now.
  */
 export function toSpecCandidateExclusion(
@@ -1052,14 +1132,23 @@ export function toSpecCandidateExclusion(
     } else if (row.reason === "file-lane" || row.reason === "depends-on") {
       return `#${candidate.issue} is mechanically blocked (${row.reason}) — the hold clears by itself`;
     } else {
-      const result = parseToSpecEvidence(row.evidence);
-      if (result !== undefined && now - result.source.freshAt <= TO_SPEC_MAX_SOURCE_AGE_MS) {
+      const durable = toSpecDurableVerdict(row, now);
+      if (durable !== undefined) {
         return (
-          `#${candidate.issue} was already groomed ${result.verdict} (source ${result.source.name}@` +
-          `${result.source.ref}, observed ${new Date(result.source.freshAt).toISOString()}) — re-groom only ` +
+          `#${candidate.issue} was already groomed ${durable.verdict} (source ${durable.source.name}@` +
+          `${durable.source.ref}, observed ${new Date(durable.source.freshAt).toISOString()}) — re-groom only ` +
           "with new source evidence"
         );
       }
+      const refusal = toSpecRefusalOnCooldown(row, now);
+      if (refusal !== undefined) {
+        const retryAt = new Date(row.recordedAt + TO_SPEC_REFUSED_RETRY_COOLDOWN_MS).toISOString();
+        return (
+          `#${candidate.issue} already spent a to-spec batch that was refused as ${refusal.kind} ` +
+          `(${new Date(row.recordedAt).toISOString()}) — eligible again after ${retryAt}, or once the ` +
+          "issue or its source changes"
+        );
+      }
     }
   }
   if (facts.active) return `#${candidate.issue} has a dispatched run in flight`;
@@ -1131,6 +1220,9 @@ export interface ToSpecLaunchBlock {
 export interface ToSpecLaunchExclusions {
   /** Candidates with a fresh, valid to-spec verdict already on the grooming table. */
   groomed: string[];
+  /** Candidates whose last pass was refused and whose retry cooldown still
+   *  holds ({@link TO_SPEC_REFUSED_RETRY_COOLDOWN_MS}). */
+  refused: string[];
   /** Candidates with an active to-spec batch. */
   inFlight: string[];
   /** Candidates under admission's durable lane/dependency holds. */
@@ -1321,17 +1413,35 @@ export function toSpecLaunchBlock(input: {
   if (input.summary === undefined) return undefined;
   if (input.summary.routed >= input.groomBelow) return undefined;
   if (input.selected.length === 0) return undefined;
-  const exclusions: ToSpecLaunchExclusions = { groomed: [], inFlight: [], mechanicallyBlocked: [], dispatched: [] };
+  const exclusions: ToSpecLaunchExclusions = {
+    groomed: [],
+    refused: [],
+    inFlight: [],
+    mechanicallyBlocked: [],
+    dispatched: [],
+  };
   for (const row of input.grooming) {
     if (row.reason === TO_SPEC_IN_FLIGHT_REASON) {
       if (input.now - row.recordedAt <= TO_SPEC_IN_FLIGHT_TTL_MS) exclusions.inFlight.push(`#${row.issue}`);
     } else if (row.reason === "file-lane" || row.reason === "depends-on") {
       exclusions.mechanicallyBlocked.push(`#${row.issue} (${row.reason})`);
     } else {
-      const result = parseToSpecEvidence(row.evidence);
-      if (result !== undefined && input.now - result.source.freshAt <= TO_SPEC_MAX_SOURCE_AGE_MS) {
+      // The same two predicates the selection and the gate apply, so a
+      // candidate this block advertises as excluded is one selection actually
+      // withheld — and one it does not advertise is one selection may offer
+      // (#887).
+      const durable = toSpecDurableVerdict(row, input.now);
+      if (durable !== undefined) {
         exclusions.groomed.push(
-          `#${row.issue} (${result.verdict} @ ${result.source.ref}, observed ${new Date(result.source.freshAt).toISOString()})`,
+          `#${row.issue} (${durable.verdict} @ ${durable.source.ref}, observed ${new Date(durable.source.freshAt).toISOString()})`,
+        );
+        continue;
+      }
+      const refusal = toSpecRefusalOnCooldown(row, input.now);
+      if (refusal !== undefined) {
+        exclusions.refused.push(
+          `#${row.issue} (${refusal.kind}, refused ${new Date(row.recordedAt).toISOString()}, retry after ` +
+            `${new Date(row.recordedAt + TO_SPEC_REFUSED_RETRY_COOLDOWN_MS).toISOString()})`,
         );
       }
     }
@@ -1354,10 +1464,11 @@ export function toSpecLaunchBlock(input: {
     "The conductor selected this batch mechanically from the live open-issue snapshot " +
       `(issues carrying \`${input.queueLabel}\`, the \`${input.parkLabel}\` park label, issues without exactly one ` +
       `\`${input.labelPrefix}<repo>\` routing label, parent/epic issues with sub-issues, ` +
-      "already-groomed, in-flight, lane/dependency-blocked and dispatched candidates were excluded):",
+      "already-groomed, refused-on-cooldown, in-flight, lane/dependency-blocked and dispatched candidates were excluded):",
     candidates,
     "Excluded this tick — " +
       `already-groomed: ${exclusions.groomed.length === 0 ? "none" : exclusions.groomed.join(", ")}; ` +
+      `refused, cooldown still holding: ${exclusions.refused.length === 0 ? "none" : exclusions.refused.join(", ")}; ` +
       `in-flight batches — ${exclusions.inFlight.length === 0 ? "none" : exclusions.inFlight.join(", ")}; ` +
       `mechanically blocked: ${exclusions.mechanicallyBlocked.length === 0 ? "none" : exclusions.mechanicallyBlocked.join(", ")}; ` +
       `dispatched now: ${exclusions.dispatched.length === 0 ? "none" : exclusions.dispatched.join(", ")}.`,
@@ -1384,6 +1495,51 @@ export function toSpecLaunchBlock(input: {
   return { token, block: lines.join("\n"), items };
 }
 
+/**
+ * The accounting a low-queue tick owes Duty 2 when the mechanical selection
+ * produced no batch at all. Without it a fully-excluded backlog is silence,
+ * and silence is what gets re-derived by hand: the orchestrator cannot tell
+ * "the queue is low and nothing is groomable" from "the launch machinery did
+ * not run". Every count comes from the same predicates the selection and the
+ * `tool_call` gate apply (#887).
+ *
+ * `undefined` when no dispatch row exists or the queue is at/above the
+ * grooming trigger — the same gate the offer itself uses, so this line and a
+ * launch block are mutually exclusive.
+ */
+export function toSpecNoBatchLine(input: {
+  summary: DispatchSummary | undefined;
+  groomBelow: number;
+  grooming: readonly GroomingRecord[];
+  active: readonly { issue: number }[];
+  now: number;
+}): string | undefined {
+  if (input.summary === undefined) return undefined;
+  if (input.summary.routed >= input.groomBelow) return undefined;
+  let durable = 0;
+  let refused = 0;
+  let inFlight = 0;
+  let held = 0;
+  for (const row of input.grooming) {
+    if (row.reason === TO_SPEC_IN_FLIGHT_REASON) {
+      if (input.now - row.recordedAt <= TO_SPEC_IN_FLIGHT_TTL_MS) inFlight += 1;
+    } else if (row.reason === "file-lane" || row.reason === "depends-on") {
+      held += 1;
+    } else if (toSpecDurableVerdict(row, input.now) !== undefined) {
+      durable += 1;
+    } else if (toSpecRefusalOnCooldown(row, input.now) !== undefined) {
+      refused += 1;
+    }
+  }
+  return (
+    `No to-spec batch this tick: the mechanical selection found nothing eligible in the open-issue ` +
+    `snapshot — ${durable} durable verdict(s), ${refused} refused inside the retry cooldown, ${inFlight} ` +
+    `in flight, ${held} lane/dependency-blocked, ${input.active.length} dispatched. A \`task\` call carrying ` +
+    `the ${TO_SPEC_BATCH_MARKER} marker is refused this turn; file or promote from what the backlog already ` +
+    "says instead of re-grooming it."
+  );
+}
+
 export const TICK_SCOPE_CONSTRAINTS: { readonly [K in ReportScopeChoice]: string } = {
   material: "Report material events per your brief.",
   escalations:
@@ -1588,6 +1744,8 @@ export const TICK_ASK_RULE =
   `On this locally injected tick, questions to your operator go through ${ASK_TOOL}: ` +
   `call it with "on-timeout": "auto-proceed" or "park" (what to do when nobody answers within the ceiling) ` +
   `and optionally "timeoutSeconds" — an ask issued without one still gets the default ceiling, capped at the turn budget. ` +
+  `Several judgement calls about ONE issue go as a single ${QUESTIONNAIRE_TOOL} instead: one delivery, one ceiling, ` +
+  `each item a durable row bound to that issue, resolved independently and in any order. ` +
   `The ${TELEGRAM_APPROVAL_TOOL} tool is refused here: it would wait for your operator for as long as the answer ` +
   `takes, and an unanswered question must never hold the loop.`;
 
@@ -3078,24 +3236,33 @@ function resolveAskProject(
  * prior state, and executing it still fails closed when it cannot route.
  */
 async function ensureAskSurface(pi: TickApi, resolvable: boolean): Promise<boolean> {
+  // Both operator-question surfaces flip together (#947): they route through the
+  // same resolution and fail closed the same way, so a beat that can carry one
+  // can carry the other, and a degraded beat must hide both — an ask surface that
+  // is half-present is a model choosing between a working tool and a broken one.
+  const tools = [ASK_TOOL, QUESTIONNAIRE_TOOL];
   const current = pi.getActiveTools();
-  const present = current.includes(ASK_TOOL);
-  if (resolvable === present) return true;
+  const present = tools.every((tool) => current.includes(tool));
+  const absent = tools.every((tool) => !current.includes(tool));
+  if (resolvable ? present : absent) return true;
   try {
     await pi.setActiveTools(
-      resolvable ? [...current, ASK_TOOL] : current.filter((name) => name !== ASK_TOOL),
+      resolvable
+        ? [...current.filter((name) => !tools.includes(name)), ...tools]
+        : current.filter((name) => !tools.includes(name)),
     );
   } catch (err) {
     pi.logger.error(
-      `[omp-conductor] could not ${resolvable ? "activate" : "deactivate"} ${ASK_TOOL}: ${
+      `[omp-conductor] could not ${resolvable ? "activate" : "deactivate"} ${tools.join(" / ")}: ${
         err instanceof Error ? err.message : String(err)
       }`,
     );
     return false;
   }
   // An awaited call is not yet confirmation: the live membership read after the
-  // reconciliation is what proves the tool is really model-visible.
-  return pi.getActiveTools().includes(ASK_TOOL) === resolvable;
+  // reconciliation is what proves the tools are really model-visible.
+  const after = pi.getActiveTools();
+  return tools.every((tool) => after.includes(tool) === resolvable);
 }
 
 /**
@@ -3335,6 +3502,16 @@ async function tick(
         // because the whole failure was a question surviving in context only.
         const decisions = formatDecisionDigest(frictionStore.openDecisions(scope.projectName), now);
         if (decisions.length > 0) content = `${content}\n${decisions}`;
+        // A host running two different releases at once, from the row the
+        // dispatch pass recorded (#919). Read only — probing the three surfaces
+        // here spawns three children per tick and took this file's own suite
+        // from 8.4s to 83.4s, which is why the observation is recorded. Only a
+        // proven mismatch appears: an absent surface, a `local:` herdr link and
+        // an unverifiable pin are steady states someone chose, and a warning
+        // repeated every fifteen minutes trains an operator to ignore the line
+        // that matters. `doctor` keeps that nuance.
+        const surfaces = installSurfaceMismatch(frictionStore.installSurfaces());
+        if (surfaces !== undefined) content = `${content}\n${surfaces}`;
         // What the daemon already fixed, so the session stops re-deriving that
         // paragraph on every tick (#132). Two intervals wide rather than one: a
         // tick that ran long must not drop the window it was meant to report.
@@ -3414,6 +3591,10 @@ async function tick(
             groomBelow,
             grooming,
             queueObservation,
+            // One clock for the inventory and the offer below: the digest must
+            // never call a verdict durable that the same tick's selection is
+            // about to re-groom (#887).
+            now,
           );
           if (queue !== undefined) content = `${content}\n${queue}`;
           // #777: the mechanical to-spec launch boundary. The queue digest is
@@ -3427,11 +3608,12 @@ async function tick(
           //
           // Every tick owns its authorization fresh — the clears above ran
           // before the reads, so the offer below can only mint for THIS tick.
+          const toSpecActive = store.activeRuns(projectName);
           const launch = await offerToSpecLaunch({
             summary: dispatch,
             groomBelow,
             grooming,
-            active: store.activeRuns(projectName),
+            active: toSpecActive,
             issues: openSnapshot,
             project,
             trackerSeam: toSpecTrackerSeam,
@@ -3446,6 +3628,19 @@ async function tick(
             session.launchProject = project.name;
             session.launchToken = launch.token;
             session.launchItems = launch.items;
+          } else if (openSnapshot !== undefined) {
+            // A low queue with nothing eligible is a finding, not silence: the
+            // snapshot read succeeded, so the exclusions — and only they — are
+            // why no batch is offered. Rendered only when the read succeeded,
+            // so a tracker failure never masquerades as "nothing eligible".
+            const noBatch = toSpecNoBatchLine({
+              summary: dispatch,
+              groomBelow,
+              grooming,
+              active: toSpecActive,
+              now,
+            });
+            if (noBatch !== undefined) content = `${content}\n${noBatch}`;
           }
           // Pending intake is the same class of standing block as the friction
           // and decisions read-outs: a store-backed duty the orchestrator must
@@ -4300,6 +4495,71 @@ export default function orchestratorTickExtension(
   // the project to file the decision row against and to resolve the delivery
   // target. An unreadable/ambiguous config makes the tool say so and record
   // nothing, which is the same fail-closed posture the autonomous gate takes.
+  /**
+   * The plumbing both operator-question tools share (#947): which project this
+   * call records against, and the one sanctioned delivery path.
+   *
+   * Extracted rather than copied, because the questionnaire needs exactly the
+   * live-config routing, the fail-closed refusals and the held-notice fallback
+   * the single ask already got right — and a second copy of the fallback is how
+   * one surface quietly starts dropping questions the other one holds.
+   */
+  const resolveOperatorAskContext = (
+    tool: string,
+  ): { ok: true; project: ProjectConfig; config: TickConfig } | { ok: false; text: string } => {
+    const session = askSession;
+    if (session === undefined) {
+      return {
+        ok: false,
+        text: `${tool}: not available in this session (no orchestrator tick); nothing was asked or recorded.`,
+      };
+    }
+    const routed = resolveAskProject(session.cwd, session.config);
+    if (routed.kind === "error") {
+      return {
+        ok: false,
+        text:
+          `${tool}: conductor config unreadable (${routed.problem}); ` +
+          "nothing was asked or recorded. Repair the config, do not ask through another path.",
+      };
+    }
+    return { ok: true, project: routed.project, config: session.config };
+  };
+
+  const operatorAskDelivery =
+    (tool: string, projectConfig: ProjectConfig, store: Store) =>
+    async (text: string, category: InterruptCategory): Promise<AskDeliveryResult> => {
+      const at = Date.now();
+      const noticeId = randomUUID();
+      try {
+        const delivered = await deliverOperatorMessage(projectConfig, text, {
+          store,
+          at,
+          noticeId,
+          category,
+        });
+        return delivered.kind === "sent"
+          ? { kind: "sent", category: delivered.category }
+          : { kind: "held", category: delivered.category, noticeId: delivered.noticeId };
+      } catch (err) {
+        // A failed immediate send must not drop the question: fall back to the
+        // durable hold exactly like the gate's own hold path, and let the daemon
+        // retry with the digest.
+        store.addHeldNotice({
+          id: noticeId,
+          project: projectConfig.name,
+          category,
+          summary: text.split("\n", 1)[0]!.slice(0, 240),
+          detail: text,
+          createdAt: at,
+        });
+        pi.logger.error(
+          `[omp-conductor] ${tool} could not deliver the ask directly (${err instanceof Error ? err.message : String(err)}); held durably`,
+        );
+        return { kind: "held", category, noticeId };
+      }
+    };
+
   pi.registerTool({
     name: ASK_TOOL,
     label: ASK_TOOL,
@@ -4328,43 +4588,16 @@ export default function orchestratorTickExtension(
       if (!parsed.ok) {
         return { content: [{ type: "text", text: parsed.problem }], isError: true };
       }
-      const session = askSession;
-      if (session === undefined) {
-        // Not a conductor tick session (subagent, or a session that never
-        // composed a tick). Same fail-closed posture as an unresolvable config:
-        // say so, record nothing, and never route the question elsewhere.
-        return {
-          content: [
-            {
-              type: "text",
-              text: `${ASK_TOOL}: not available in this session (no orchestrator tick); nothing was asked or recorded.`,
-            },
-          ],
-          isError: true,
-        };
+      // Routing follows the *live* tick config, not the session-start stamp: a
+      // restamp (un-stamped → stamped, or project A → B) must make the next
+      // tick's toolbox land on the project the turn actually ticks for. Only the
+      // ceiling stays startup-only — routing is re-read every call.
+      const context = resolveOperatorAskContext(ASK_TOOL);
+      if (!context.ok) {
+        return { content: [{ type: "text", text: context.text }], isError: true };
       }
-      // Routing follows the *live* tick config, not the session-start stamp:
-      // a restamp (un-stamped → stamped, or project A → B) must make the next
-      // tick's toolbox land on the project the turn actually ticks for, and an
-      // abandoned stamp must not keep recording against a project that is no
-      // longer this fleet's. Only the ceiling stays startup-only (from
-      // `config` below) — routing is re-read every call.
-      const { cwd, config } = session;
-      const routed = resolveAskProject(cwd, config);
-      if (routed.kind === "error") {
-        return {
-          content: [
-            {
-              type: "text",
-              text:
-                `${ASK_TOOL}: conductor config unreadable (${routed.problem}); ` +
-                "nothing was asked or recorded. Repair the config, do not ask through another path.",
-            },
-          ],
-          isError: true,
-        };
-      }
-      const projectConfig = routed.project;
+      const projectConfig = context.project;
+      const config = context.config;
       const store = openStore(dbPath());
       let result: AskResult;
       try {
@@ -4380,37 +4613,7 @@ export default function orchestratorTickExtension(
           // inject a fake through the same seam.
           interactive: options.ask?.interactive ?? interactiveAskSurface({ project: projectConfig, store }),
           ...(options.ask === undefined ? {} : { wait: options.ask.wait, now: options.ask.now }),
-          deliver: async (text, category) => {
-            const at = Date.now();
-            const noticeId = randomUUID();
-            try {
-              const delivered = await deliverOperatorMessage(projectConfig, text, {
-                store,
-                at,
-                noticeId,
-                category,
-              });
-              return delivered.kind === "sent"
-                ? { kind: "sent", category: delivered.category }
-                : { kind: "held", category: delivered.category, noticeId: delivered.noticeId };
-            } catch (err) {
-              // A failed immediate send must not drop the question: fall back
-              // to the durable hold exactly like the gate's own hold path, and
-              // let the daemon retry with the digest.
-              store.addHeldNotice({
-                id: noticeId,
-                project: projectConfig.name,
-                category,
-                summary: text.split("\n", 1)[0]!.slice(0, 240),
-                detail: text,
-                createdAt: at,
-              });
-              pi.logger.error(
-                `[omp-conductor] ${ASK_TOOL} could not deliver the ask directly (${err instanceof Error ? err.message : String(err)}); held durably`,
-              );
-              return { kind: "held", category, noticeId };
-            }
-          },
+          deliver: operatorAskDelivery(ASK_TOOL, projectConfig, store),
         });
       } finally {
         store.close();
@@ -4419,6 +4622,58 @@ export default function orchestratorTickExtension(
     },
   });
 
+  // The batched spec-out questionnaire (#947): the same durable contract as the
+  // single ask, asked once for several judgement calls about one issue. Mounted
+  // and routed through exactly the shared helpers above, so the two surfaces
+  // cannot come to disagree about which project a question belongs to or what
+  // happens when delivery fails.
+  pi.registerTool({
+    name: QUESTIONNAIRE_TOOL,
+    label: QUESTIONNAIRE_TOOL,
+    defaultInactive: true,
+    description:
+      `Ask your operator several bounded questions about ONE issue as a single message, and wait up ` +
+      `to one ask ceiling for the answers. Every item is recorded as its own durable decision row ` +
+      `before anything is delivered, all bound to the issue you name in "spec-issue" — so the answers ` +
+      `become that issue's provenance and a later reader sees why a slice is shaped the way it is. ` +
+      `Items resolve independently and in any order: an item the operator answers keeps that answer, ` +
+      `and at the ceiling each unanswered item takes its own declared "on-timeout" ("auto-proceed" ` +
+      `applies its recommendation and records that nobody human chose it; "park" leaves the row open ` +
+      `and pending, and you then park the work it blocks). Ask ONLY the judgement calls that genuinely ` +
+      `belong to your operator — anything a repo read can answer is your own work — and at most ` +
+      `${MAX_QUESTIONNAIRE_ITEMS} items. This path is plain text by design (one message, not ` +
+      `${MAX_QUESTIONNAIRE_ITEMS} button posts), so a prose reply does not itself resolve a row: map ` +
+      `it with \`omp-conductor decision resolve <id> --answer "…"\`. Use conductor_ask for a single ` +
+      `question.`,
+    parameters: questionnaireParameterSchema(),
+    approval: "write",
+    execute: async (_toolCallId, params) => {
+      const parsed = parseQuestionnaireRequest(params);
+      if (!parsed.ok) {
+        return { content: [{ type: "text", text: parsed.problem }], isError: true };
+      }
+      const context = resolveOperatorAskContext(QUESTIONNAIRE_TOOL);
+      if (!context.ok) {
+        return { content: [{ type: "text", text: context.text }], isError: true };
+      }
+      const projectConfig = context.project;
+      const store = openStore(dbPath());
+      try {
+        const result = await performQuestionnaire(parsed.request, {
+          store,
+          project: projectConfig.name,
+          configuredCeilingSeconds: context.config.askTimeoutSeconds,
+          turnBudgetSeconds: context.config.budgetSeconds ?? DEFAULT_TICK_BUDGET_SECONDS,
+          ...(options.ask === undefined ? {} : { wait: options.ask.wait, now: options.ask.now }),
+          deliver: operatorAskDelivery(QUESTIONNAIRE_TOOL, projectConfig, store),
+        });
+        return { content: [{ type: "text", text: result.text }] };
+      } finally {
+        store.close();
+      }
+    },
+  });
+
   // The async half of the to-spec result capture (#777). Registered at
   // extension-factory time like {@link ASK_TOOL}, with the same routing
   // contract: the state it needs (cwd + startup config) is filled by