omp-conductor 0.19.6 → 0.20.0

package/src/ask.ts

@@ -1,51 +1,41 @@
 /**
- * The bounded ask surface for an orchestrator tick (#438).
+ * The durable, parking ask surface for an orchestrator tick (#438).
  *
  * On 2026-08-16 the orchestrator called `telegram_ask` for a genuine tier-2
  * contract decision (PR #432 / issue #368) and the operator was asleep. The
  * tool does not time out: it blocked the turn for just over six hours, and a
  * tick prompt timestamped 01:14Z did not execute until after the answer at
  * 07:04Z. Every duty behind the ask — draining, merging, grooming — stopped
- * with it. `telegram_ask` is omp-telegram's tool and this package cannot tell
- * it how long it may wait, so an autonomous tick gets a different ask surface:
- * {@link ASK_TOOL}. It records the question durably (a decision row, plus the
- * same delivery path the `message` command uses), waits at most a configured
- * ceiling — minutes by default, never hours — and then resolves the declared
- * non-answer outcome itself:
+ * with it. The first fix bounded the wait to minutes. This surface removes the
+ * wait entirely, because the session split made waiting pointless as well as
+ * dangerous:
  *
- * - `auto-proceed`: the recommended option is applied and the decision row is
- *   resolved with `"<option> (auto-applied on ask timeout)"`, so the record can
- *   never be read back as a human choice;
- * - `park`: the row stays open and pending — re-surfaced in every tick prompt —
- *   and the caller is told to take the blocked item out of the claimable queue
- *   with its state recorded.
+ * - the tick brain is **headless** — it never receives operator turns, so an
+ *   answer could not land in the asking session even if the operator were
+ *   awake, and a duty cycle must never block on a human;
+ * - operator conversation lives in a separate 24/7 **console** session, which
+ *   answers by resolving the decision row (`omp-conductor decision resolve
+ *   <id> --answer "…"`) — the same store write the dashboard and the CLI use,
+ *   and 409-safe by `resolveDecision`'s open-only guard.
  *
- * A timeout is "nobody answered yet". It is never a cancelled ask, an errored
- * ask, or an operator "no": the only writes it makes are the auto-apply
- * resolution (which names itself as auto-applied) or none at all. The existing
- * seven-day decision expiry bounds a parked row exactly like any other open
- * decision — nothing here reopens that clock.
+ * So the ask does exactly three things: it records the question durably (a
+ * decision row, verbatim), delivers it once through the sanctioned path, and
+ * returns immediately with the row id, the resolve command, and the
+ * instruction to park the blocked work in the same turn. It never resolves a
+ * row itself: there is no timeout to auto-apply, so nothing here can ever be
+ * read back as a human choice that never happened.
+ *
+ * A parked row is bounded without any new machinery: `expireDueDecisions`
+ * (daemon.ts) sweeps unanswered decisions after seven days, exactly as it does
+ * for every other open question.
  */
 
-import type { DecisionRecord, DecisionState, InterruptCategory, Store } from "./types.ts";
+import type { InterruptCategory, Store } from "./types.ts";
 import { INTERRUPT_CATEGORIES } from "./types.ts";
 
-/** The bounded ask tool this package registers on an orchestrator session. */
+/** The durable ask tool this package registers on an orchestrator session. */
 export const ASK_TOOL = "conductor_ask";
 
-/** The two legal non-answer outcomes, declared by the ask, never inferred. */
-export const ASK_TIMEOUT_OUTCOMES = ["auto-proceed", "park"] as const;
-export type AskTimeoutOutcome = (typeof ASK_TIMEOUT_OUTCOMES)[number];
-
-/**
- * The ceiling bounds. Minutes by default, never hours; an ask that is issued
- * without a `timeoutSeconds` gets {@link DEFAULT_ASK_TIMEOUT_SECONDS}, and one
- * that names a ceiling outside the bounds is refused rather than obeyed.
- */
-export const MIN_ASK_TIMEOUT_SECONDS = 60;
-export const MAX_ASK_TIMEOUT_SECONDS = 3_600;
-export const DEFAULT_ASK_TIMEOUT_SECONDS = 300;
-
 /**
  * The shape ceilings for a decision row's question (#593). A question is the
  * bare ask an operator reads on a phone — one sentence, the recommendation, the
@@ -66,36 +56,6 @@ export type QuestionShape =
   | { ok: true }
   | { ok: false; problem: string };
 
-/**
- * The suffix a decision row carries when nobody human chose the answer. Fixed
- * wording on purpose — the same reason `types.ts` gives for closed vocabularies
- * everywhere else: a marker a tick or an operator has to match by reading it
- * must be one no two spellings disagree on.
- */
-export const AUTO_APPLIED_SUFFIX = "(auto-applied on ask timeout)";
-
-/**
- * The fixed sentence a decision row carries when the question could not be
- * posted through a selectable surface and went out as plain text instead
- * (#722). The row is the record a later reader judges "did the operator answer
- * this?" from, so it must say plainly that a prose reply is not a selection:
- * nothing in this pipeline ever maps free text back to an option, and the
- * marker is what stops a reader from treating a chat reply as the row's
- * answer. It rides the row's `blocks` free-text slot — the one place a row
- * carry durable per-row prose that renders in every digest — without
- * rewriting the archived question (which must stay verbatim, #741).
- */
-export const DEGRADED_DELIVERY_MARKER =
-  "question delivered as plain text (no selectable surface); a reply does not resolve it — resolve or withdraw the row by hand";
-
-/** The `blocks` text for a degraded ask: the block list plus the marker. */
-export function degradedAskBlocks(blocks: string | undefined): string | undefined {
-  return blocks === undefined ? DEGRADED_DELIVERY_MARKER : `${blocks}; ${DEGRADED_DELIVERY_MARKER}`;
-}
-
-/** How often the bounded wait re-reads the decision row while waiting. */
-export const ASK_POLL_MS = 1_000;
-
 /** One option the operator may pick, as rendered in the delivered question. */
 export interface AskOption {
   label: string;
@@ -106,16 +66,12 @@ export interface AskOption {
 export interface AskRequest {
   /** The question verbatim, as it is archived on the decision row. */
   question: string;
-  /** What the ask does when nobody answers within the ceiling. */
-  onTimeout: AskTimeoutOutcome;
-  /** Optional ceiling in whole seconds; defaults to the configured ceiling. */
-  timeoutSeconds?: number;
   /** What is waiting on the answer, for the decision row and the digest. */
   blocks?: string;
   /**
-   * The option applied by `auto-proceed`; required exactly for that outcome.
-   * When {@link AskRequest.options} are supplied it must name one of their
-   * labels — the label as delivered, never an index.
+   * The option you recommend, rendered in the delivered question. When
+   * {@link AskRequest.options} are supplied it must name one of their labels —
+   * the label as delivered, never an index.
    */
   recommended?: string;
   /** The choices shown to the operator, with {@link AskRequest.recommended} named. */
@@ -132,6 +88,16 @@ function isInterruptCategory(value: unknown): value is InterruptCategory {
   return typeof value === "string" && (INTERRUPT_CATEGORIES as readonly string[]).includes(value);
 }
 
+/**
+ * The command that answers one row. One spelling for every result text and
+ * prompt line, for the reason `types.ts` gives for closed vocabularies
+ * everywhere else: a command an operator or a console session copies verbatim
+ * must not exist in two shapes, one of which the CLI refuses.
+ */
+export function decisionResolveCommand(id: string): string {
+  return `omp-conductor decision resolve ${id} --answer "<their answer>"`;
+}
+
 /**
  * Refuse a question that outgrew the phone-sized decision row. Counts the
  * trimmed question — the exact text archived on the row — against
@@ -165,9 +131,7 @@ export function validateQuestionShape(question: string): QuestionShape {
 /**
  * Validate one raw tool call. Strict like the verb arguments: an unknown shape
  * is refused with the reason, never coerced into a default that could hide what
- * the asker actually sent. The one tolerant field is the omitted `timeoutSeconds`
- * — the issue's whole point is that the ceiling holds even when the model does
- * not name one.
+ * the asker actually sent.
  */
 export function parseAskRequest(raw: unknown): AskParse {
   if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
@@ -190,46 +154,11 @@ export function parseAskRequest(raw: unknown): AskParse {
     };
   }
 
-  const onTimeoutRaw = input["on-timeout"];
-  if (
-    typeof onTimeoutRaw !== "string" ||
-    !(ASK_TIMEOUT_OUTCOMES as readonly string[]).includes(onTimeoutRaw)
-  ) {
-    return {
-      ok: false,
-      problem: `conductor_ask needs "on-timeout": one of ${ASK_TIMEOUT_OUTCOMES.join(" or ")} — what happens when nobody answers within the ceiling`,
-    };
-  }
-  const onTimeout = onTimeoutRaw as AskTimeoutOutcome;
-
   const recommendedRaw = input["recommended"];
   const recommended =
     typeof recommendedRaw === "string" && recommendedRaw.trim().length > 0
       ? recommendedRaw.trim()
       : undefined;
-  if (onTimeout === "auto-proceed" && recommended === undefined) {
-    return {
-      ok: false,
-      problem:
-        'conductor_ask with "on-timeout": "auto-proceed" needs "recommended": the option to apply when nobody answers, ' +
-        "because the decision row must record what was auto-applied",
-    };
-  }
-
-  const timeoutRaw = input["timeoutSeconds"];
-  let timeoutSeconds: number | undefined;
-  if (timeoutRaw !== undefined) {
-    if (typeof timeoutRaw !== "number" || !Number.isInteger(timeoutRaw)) {
-      return { ok: false, problem: "conductor_ask timeoutSeconds must be a whole number of seconds when present" };
-    }
-    if (timeoutRaw < MIN_ASK_TIMEOUT_SECONDS || timeoutRaw > MAX_ASK_TIMEOUT_SECONDS) {
-      return {
-        ok: false,
-        problem: `conductor_ask timeoutSeconds must be between ${MIN_ASK_TIMEOUT_SECONDS} and ${MAX_ASK_TIMEOUT_SECONDS}`,
-      };
-    }
-    timeoutSeconds = timeoutRaw;
-  }
 
   const blocksRaw = input["blocks"];
   const blocks = typeof blocksRaw === "string" && blocksRaw.trim().length > 0 ? blocksRaw.trim() : undefined;
@@ -265,9 +194,8 @@ export function parseAskRequest(raw: unknown): AskParse {
   // label exactly as the operator reads it — never an index (that is
   // telegram_ask's convention, not this tool's) and never free text when a
   // menu exists. Refused at parse time so the incoherent ask leaves no trace:
-  // on `auto-proceed` its text becomes the recorded auto-applied answer, and a
-  // value that named no option would resolve a decision row to something that
-  // was never a choice (#740).
+  // the recommendation is delivered as one of the choices, and a value naming
+  // none of them is a question nobody can answer by picking (#740).
   if (options !== undefined && recommended !== undefined) {
     const labels = options.map((option) => option.label);
     if (!labels.includes(recommended)) {
@@ -292,8 +220,6 @@ export function parseAskRequest(raw: unknown): AskParse {
     ok: true,
     request: {
       question: question.trim(),
-      onTimeout,
-      ...(timeoutSeconds === undefined ? {} : { timeoutSeconds }),
       ...(blocks === undefined ? {} : { blocks }),
       ...(recommended === undefined ? {} : { recommended }),
       ...(options === undefined ? {} : { options }),
@@ -306,6 +232,10 @@ export function parseAskRequest(raw: unknown): AskParse {
  * The JSON Schema the harness advertises for {@link ASK_TOOL}, shaped like the
  * verb parameter schemas: plain JSON Schema, `additionalProperties: false`,
  * required lists spelled out.
+ *
+ * No timeout property of any kind, and deliberately no conditional
+ * requirement: the ask has exactly one behaviour — file, deliver, park — so
+ * the model has nothing to declare about what happens when nobody answers.
  */
 export function askParameterSchema(): Record<string, unknown> {
   return {
@@ -316,20 +246,10 @@ export function askParameterSchema(): Record<string, unknown> {
         description:
           "The question, written for a phone: one plain sentence, your recommendation, and the options with their consequences.",
       },
-      "on-timeout": {
-        type: "string",
-        enum: [...ASK_TIMEOUT_OUTCOMES],
-        description:
-          "What happens when nobody answers within the ceiling: auto-proceed applies the recommended option and resolves the decision row naming the auto-application; park leaves the row open and pending, re-surfaced every tick.",
-      },
-      timeoutSeconds: {
-        type: "number",
-        description: `Ceiling before the ask times out. Optional — an ask issued without one still gets the default ceiling (${DEFAULT_ASK_TIMEOUT_SECONDS}s, capped at the turn budget). Range ${MIN_ASK_TIMEOUT_SECONDS}–${MAX_ASK_TIMEOUT_SECONDS}.`,
-      },
       recommended: {
         type: "string",
         description:
-          "The option applied on auto-proceed; required when on-timeout is auto-proceed because the row must record what was auto-applied. When options are supplied this must be one of their labels — the label as delivered to the operator, not an index.",
+          "The option you recommend, rendered in the delivered question. When options are supplied this must be one of their labels — the label as delivered to the operator, not an index.",
       },
       blocks: {
         type: "string",
@@ -354,22 +274,8 @@ export function askParameterSchema(): Record<string, unknown> {
         description: "Escalation category for the delivered question. Optional; defaults to decision-needed.",
       },
     },
-    required: ["question", "on-timeout"],
+    required: ["question"],
     additionalProperties: false,
-    // The one conditional requirement the tool has (#722): an ask that
-    // declares auto-proceed must name the option it would auto-apply, because
-    // the decision row must record what was applied and who applied it. Stated
-    // in the schema (not only at call time) so the model sees it next to the
-    // "on-timeout" property it conditions on.
-    allOf: [
-      {
-        if: {
-          properties: { "on-timeout": { const: "auto-proceed" } },
-          required: ["on-timeout"],
-        },
-        then: { required: ["recommended"] },
-      },
-    ],
   };
 }
 
@@ -401,26 +307,6 @@ export function questionnaireParameterSchema(): Record<string, unknown> {
   };
 }
 
-/**
- * The ceiling for one ask, in whole seconds. The model may name one, but the
- * enforcement never depends on it: an ask without a `timeoutSeconds` gets the
- * configured ceiling, and both are capped at the turn budget so the ask can
- * never outlive the turn it runs in.
- */
-export function resolveAskCeilingSeconds(
-  requestedSeconds: number | undefined,
-  configuredSeconds: number | undefined,
-  turnBudgetSeconds: number,
-): number {
-  const base = requestedSeconds ?? configuredSeconds ?? DEFAULT_ASK_TIMEOUT_SECONDS;
-  return Math.min(base, Math.max(MIN_ASK_TIMEOUT_SECONDS, turnBudgetSeconds));
-}
-
-/** The row resolution for an auto-applied outcome — exactly the acceptance text. */
-export function autoApplyResolution(recommended: string): string {
-  return `${recommended} ${AUTO_APPLIED_SUFFIX}`;
-}
-
 /** The question exactly as it is delivered, durable prefix and all. */
 export function askMessageFor(request: AskRequest): string {
   const lines = [`QUESTION: ${request.question}`];
@@ -443,8 +329,7 @@ export function askMessageFor(request: AskRequest): string {
 export const QUESTIONNAIRE_TOOL = "conductor_questionnaire";
 
 /** How many items one delivery may carry. A questionnaire longer than this is
- *  not a questionnaire, it is an interview the operator will abandon halfway —
- *  and the ceiling that bounds the whole group is one ask's, not one per item. */
+ *  not a questionnaire, it is an interview the operator will abandon halfway. */
 export const MAX_QUESTIONNAIRE_ITEMS = 6;
 
 /**
@@ -453,16 +338,15 @@ export const MAX_QUESTIONNAIRE_ITEMS = 6;
  *
  * It is deliberately N {@link AskRequest}s plus a spec binding rather than a
  * new question shape. Every per-item semantic a spec-out needs — options, a
- * recommendation, `auto-proceed` versus `park`, the shape ceiling, the
- * auto-applied marker — already exists and is already tested here; what did not
- * exist is asking six of them once. Re-deriving those semantics for a
- * "questionnaire item" would be the same contract in two places, and the second
- * copy is the one that drifts.
+ * recommendation, the shape ceiling, the durable row — already exists and is
+ * already tested here; what did not exist is asking six of them once.
+ * Re-deriving those semantics for a "questionnaire item" would be the same
+ * contract in two places, and the second copy is the one that drifts.
  */
 export interface QuestionnaireRequest {
   /** The issue these questions spec out; their answers are its provenance. */
   specIssue: number;
-  /** The items, in delivery order. Each is an ordinary bounded ask. */
+  /** The items, in delivery order. Each is an ordinary durable ask. */
   items: AskRequest[];
 }
 
@@ -537,266 +421,11 @@ export function questionnaireMessageFor(request: QuestionnaireRequest): string {
       );
     }
     if (item.recommended !== undefined) parts.push(`   rec: ${item.recommended}`);
-    // Silence is a real outcome, so it is stated per item rather than once for
-    // the group: a questionnaire may legitimately mix "proceed on my
-    // recommendation" with "this one waits for you".
-    parts.push(
-      `   on silence: ${
-        item.onTimeout === "auto-proceed" ? `applies ${item.recommended ?? "the recommendation"}` : "stays open"
-      }`,
-    );
     lines.push(parts.join("\n"));
   }
   return lines.join("\n");
 }
 
-/** What the ceiling did to one still-open item. */
-export type QuestionnaireItemTimeout =
-  | { kind: "auto-applied"; id: string; resolution: string }
-  | { kind: "parked"; id: string };
-
-/**
- * Apply the ceiling to a questionnaire, per item (#947).
- *
- * Pure, and per item on purpose. The group is one delivery but N decisions: an
- * item the operator answered keeps that answer, an `auto-proceed` item resolves
- * with the existing auto-applied marker so the record never reads as a human
- * choice, and a `park` item stays open. Resolving the group atomically — all or
- * nothing — would discard the answers the operator did give, which is the
- * second silent fake this feature has to avoid.
- */
-export function resolveQuestionnaireTimeouts(
-  items: readonly { id: string; request: AskRequest; answered: boolean }[],
-): QuestionnaireItemTimeout[] {
-  const outcomes: QuestionnaireItemTimeout[] = [];
-  for (const item of items) {
-    if (item.answered) continue;
-    if (item.request.onTimeout === "auto-proceed" && item.request.recommended !== undefined) {
-      outcomes.push({ kind: "auto-applied", id: item.id, resolution: autoApplyResolution(item.request.recommended) });
-      continue;
-    }
-    // `park` — and the impossible-by-parse `auto-proceed` with no
-    // recommendation, which parks rather than inventing one.
-    outcomes.push({ kind: "parked", id: item.id });
-  }
-  return outcomes;
-}
-
-/**
- * The interactive surface a bounded ask posts through when one is available
- * (#722): the same Bot API `reply_markup` `telegram_ask` posts, whose taps are
- * routed by the running omp-telegram bridge. The bridge acknowledges the tap
- * and writes an answer envelope into the shared prompts directory; this handle
- * exists only to post the question, translate inbound envelopes into a decision
- * row resolution, and clean up. It is optional by design — a caller without
- * one degrades exactly as before, to the durable plain-text path with the
- * degraded marker on the row.
- */
-export interface AskInteractiveDelivery {
-  /**
-   * Why no interactive surface is available for this ask, or undefined when it
-   * can post. Pure: no files, no network, no side effects — the caller decides
-   * the row note before it creates the row.
-   */
-  unavailableReason(request: AskRequest): string | undefined;
-  /**
-   * Post the selectable question to the operator. Never throws: every failure
-   * comes back as `{ ok: false, reason }` so the caller can fall back to the
-   * durable text path. `decisionId` is the row id and the protocol nonce, so
-   * the pending request and its answer are addressable by the row.
-   */
-  post(request: AskRequest, decisionId: string): Promise<{ ok: true } | { ok: false; reason: string }>;
-  /**
-   * Translate an inbound answer (a button tap, or a reply to a free-text ask)
-   * into the decision row. Called on every poll while the ask waits; no-op
-   * until an answer exists, idempotent afterwards (the row's double-resolve
-   * guard makes the second write a no-op anyway).
-   */
-  collect(decisionId: string): void;
-  /**
-   * Best-effort cleanup once the wait ends, any outcome: remove the prompt
-   * request and its answer from the shared dir, and strip the keyboard off the
-   * posted message so a stale tap reads as expired rather than live.
-   */
-  close(decisionId: string): void;
-}
-
-/** One inline-keyboard button, as the Bot API renders it. */
-export interface AskKeyboardButton {
-  text: string;
-  callback_data: string;
-}
-
-/** The `reply_markup` of one interactive ask, one option per row plus Cancel. */
-export type AskKeyboardMarkup = { inline_keyboard: AskKeyboardButton[][] };
-
-/** The rendered interactive ask: the message text and its keyboard. */
-export interface AskInteractiveRender {
-  text: string;
-  markup: AskKeyboardMarkup;
-}
-
-/** Shorten a button label to Telegram's inline-button limit, like omp-telegram. */
-function clipButton(text: string, max: number): string {
-  const clean = text.replace(/[\r\n]+/g, " ").trim();
-  return clean.length <= max ? clean : `${clean.slice(0, max - 1)}…`;
-}
-
-/**
- * The interactive render of one bounded ask: the question as a normal ask
- * message (numbered options with their consequences when descriptions exist,
- * the same shape `telegram_ask` posts), and a keyboard whose callbacks speak
- * the shared `qa:<nonce>:<action>[:<index>]` protocol (`prompts.ts` in
- * omp-telegram), so the bridge answers the ask with the *label* of the tapped
- * option — never an index and never the model's numbering. Cancel closes the
- * ask as withdrawn, exactly like a `decision withdraw`.
- */
-export function renderInteractiveAsk(request: AskRequest, nonce: string): AskInteractiveRender {
-  const options = request.options ?? [];
-  const lines = [request.question.trim()];
-  if (options.length === 0) {
-    lines.push("", "Reply with your answer as the next message, or /cancel.");
-  } else if (options.some((option) => option.description !== undefined)) {
-    lines.push("");
-    options.forEach((option, index) => {
-      const recommended = option.label === request.recommended ? " (recommended)" : "";
-      const description = option.description === undefined ? "" : ` — ${option.description}`;
-      lines.push(`${index + 1}. ${option.label}${recommended}${description}`);
-    });
-  }
-  const rows = options.map((option, index) => [
-    { text: clipButton(option.label, 60), callback_data: `qa:${nonce}:s:${index}` },
-  ]);
-  rows.push([{ text: "Cancel", callback_data: `qa:${nonce}:x` }]);
-  return { text: lines.join("\n"), markup: { inline_keyboard: rows } };
-}
-
-/** One answer within an answered envelope — the bridge's prompt answer shape. */
-export interface AskAnswer {
-  id: string;
-  question: string;
-  /** The chosen option labels — the tap resolves the row with these, verbatim. */
-  selectedOptions: string[];
-  /** The reply to a free-text ask, when the question had no options. */
-  customInput?: string;
-}
-
-/** One answer envelope from the shared prompts dir (`<nonce>.answer.json`). */
-export interface AskAnswerEnvelope {
-  outcome:
-    | { status: "answered"; answers: AskAnswer[] }
-    | { status: "cancelled" | "expired" | "aborted" };
-}
-
-/**
- * Parse one prompt answer envelope. Malformed or unreadable input is
- * undefined — "no answer yet" is never a crash.
- */
-export function parseAskAnswerEnvelope(raw: unknown): AskAnswerEnvelope | undefined {
-  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return undefined;
-  const outcome = (raw as Record<string, unknown>)["outcome"];
-  if (outcome === null || typeof outcome !== "object" || Array.isArray(outcome)) return undefined;
-  const record = outcome as Record<string, unknown>;
-  const status = record["status"];
-  if (status === "answered") {
-    const answers = record["answers"];
-    if (!Array.isArray(answers)) return undefined;
-    const parsed: AskAnswer[] = [];
-    for (const answer of answers) {
-      if (answer === null || typeof answer !== "object" || Array.isArray(answer)) return undefined;
-      const a = answer as Record<string, unknown>;
-      if (typeof a["id"] !== "string" || typeof a["question"] !== "string") return undefined;
-      const selected = a["selectedOptions"];
-      if (!Array.isArray(selected) || selected.some((label) => typeof label !== "string")) {
-        return undefined;
-      }
-      const customInput = a["customInput"];
-      if (customInput !== undefined && typeof customInput !== "string") return undefined;
-      parsed.push({
-        id: a["id"],
-        question: a["question"],
-        selectedOptions: selected as string[],
-        ...(customInput === undefined ? {} : { customInput }),
-      });
-    }
-    return { outcome: { status: "answered", answers: parsed } };
-  }
-  if (status === "cancelled" || status === "expired" || status === "aborted") {
-    return { outcome: { status } as AskAnswerEnvelope["outcome"] };
-  }
-  return undefined;
-}
-
-/**
- * The decision-row write one envelope calls for, or none. An answer becomes a
- * row resolution carrying the option *label* (or the free-text reply to a
- * free-text ask) — the identity the operator actually chose; cancel becomes a
- * withdrawal, so a deliberate close is never an answer; expiry/abort mean
- * "nobody answered yet" and leave the row open for the bounded wait to decide.
- */
-export function askAnswerRowWrite(
-  envelope: AskAnswerEnvelope,
-): { state: "answered" | "withdrawn"; resolution: string } | undefined {
-  if (envelope.outcome.status === "cancelled") {
-    return { state: "withdrawn", resolution: "Question cancelled by the operator" };
-  }
-  if (envelope.outcome.status !== "answered") return undefined;
-  const first = envelope.outcome.answers[0];
-  if (first === undefined) return undefined;
-  const resolution =
-    first.customInput !== undefined && first.customInput.trim() !== ""
-      ? first.customInput.trim()
-      : first.selectedOptions.join(", ");
-  if (resolution.trim() === "") return undefined;
-  return { state: "answered", resolution };
-}
-
-/** One read of the decision row; `undefined` means the id is unknown. */
-export type DecisionReader = (id: string) => DecisionRecord | undefined;
-
-export interface BoundedAskDeps {
-  decisionId: string;
-  ceilingMs: number;
-  read: DecisionReader;
-  /** Advance one poll; injected so tests stay deterministic. */
-  wait: (ms: number) => Promise<void>;
-  now: () => number;
-  /**
-   * Called once per poll, before the row read: the seam through which an
-   * interactive delivery surface (a Telegram button tap, #722) translates an
-   * inbound answer into a decision-row write the read then sees. Optional and
-   * synchronous on purpose — the wait must never depend on anything slower
-   * than the row itself.
-   */
-  settle?: () => void;
-}
-
-export type BoundedAskOutcome =
-  | { kind: "answered"; answer: string }
-  | { kind: "withdrawn" }
-  | { kind: "timed-out" };
-
-/**
- * The wait itself: read the row, leave when someone closed it, time out at the
- * deadline. Pure by construction — every clock and sleep is injected — so the
- * whole "does the ask come back bounded" contract is a deterministic test, not
- * a timer gamble.
- */
-export async function runBoundedAsk(deps: BoundedAskDeps): Promise<BoundedAskOutcome> {
-  const deadline = deps.now() + deps.ceilingMs;
-  for (;;) {
-    deps.settle?.();
-    const row = deps.read(deps.decisionId);
-    if (row !== undefined && row.state !== "open") {
-      return row.state === "answered"
-        ? { kind: "answered", answer: row.resolution ?? "" }
-        : { kind: "withdrawn" };
-    }
-    if (deps.now() >= deadline) return { kind: "timed-out" };
-    await deps.wait(ASK_POLL_MS);
-  }
-}
-
 /** What delivering the question to the operator returned, for the result text. */
 export interface AskDeliveryResult {
   kind: "sent" | "held";
@@ -806,7 +435,6 @@ export interface AskDeliveryResult {
 
 /** What one {@link ASK_TOOL} call produced, and the exact text the model reads. */
 export interface AskResult {
-  outcome: BoundedAskOutcome;
   decisionId: string;
   text: string;
 }
@@ -814,173 +442,105 @@ export interface AskResult {
 export interface AskDeps {
   store: Store;
   project: string;
-  /** The tick config's `askTimeoutSeconds`, already validated. */
-  configuredCeilingSeconds?: number;
-  /** The tick config's `budgetSeconds`, already validated. */
-  turnBudgetSeconds?: number;
   /** Delivers the question through the sanctioned durable path. */
   deliver(questionText: string, category: InterruptCategory): Promise<AskDeliveryResult>;
-  /**
-   * The selectable delivery surface (#722): the same Bot API buttons
-   * `telegram_ask` uses, whose taps resolve the decision row with the chosen
-   * option label. Absent or unavailable → the ask degrades to the durable
-   * text path, and the row records the degraded delivery.
-   */
-  interactive?: AskInteractiveDelivery;
-  wait?: (ms: number) => Promise<void>;
   now?: () => number;
 }
 
-/** Real-time default for the injected wait; tests hand their own. */
-const sleep = (ms: number): Promise<void> => {
-  const { promise, resolve } = Promise.withResolvers<void>();
-  setTimeout(resolve, ms);
-  return promise;
-};
+/**
+ * One sentence naming what became of the delivery attempt. A throw is its own
+ * case rather than an escape: the row is already filed, so the honest report is
+ * "recorded, not sent" — and swallowing the throw is what lets the caller learn
+ * the row id at all, which is exactly what it needs in order to park the work.
+ */
+function deliveryLine(delivery: AskDeliveryResult | undefined, failure: string | undefined): string {
+  if (delivery === undefined) {
+    return (
+      `Delivery FAILED (${failure ?? "unknown error"}): nothing was sent, and the question is held only as ` +
+      `the row itself. Say so in your report, and deliver it by hand with \`omp-conductor message\` if it ` +
+      `cannot wait for the next digest.`
+    );
+  }
+  return delivery.kind === "sent"
+    ? `It went to the operator as a ${delivery.category} message.`
+    : `It is durably held (notice ${delivery.noticeId ?? "?"}, ${delivery.category}); the daemon releases it ` +
+      `with the next digest or working-hours catch-up.`;
+}
+
+/** Deliver once, never throwing: the row outlives any transport failure. */
+async function deliverOnce(
+  deps: AskDeps,
+  text: string,
+  category: InterruptCategory,
+): Promise<{ delivery?: AskDeliveryResult; failure?: string }> {
+  try {
+    return { delivery: await deps.deliver(text, category) };
+  } catch (err) {
+    return { failure: err instanceof Error ? err.message : String(err) };
+  }
+}
 
 /**
- * One bounded ask, end to end: durable row first, then delivery, then the wait,
- * then the declared timeout outcome. The row exists before the delivery
- * attempt, so a crash at any point leaves a recorded question — never one that
- * lived only in the model's context.
+ * One ask, end to end: durable row, one delivery, park.
+ *
+ * The row exists before the delivery attempt, so a crash at any point leaves a
+ * recorded question — never one that lived only in the model's context. Then
+ * the call returns. Nothing polls, nothing waits, and this function never
+ * resolves the row: the console session does that when the operator answers.
  */
 export async function performAsk(request: AskRequest, deps: AskDeps): Promise<AskResult> {
   const now = deps.now ?? Date.now;
-  const wait = deps.wait ?? sleep;
-
-  // The delivery mode is decided before the row exists: the degraded marker
-  // must ride the row's `blocks` from birth, and the row must exist before any
-  // delivery attempt (a crash at any point leaves a recorded question). The
-  // interactive preview is pure — no files, no network — so it can run here
-  // without violating that ordering.
-  const degradedReason =
-    deps.interactive === undefined
-      ? "no interactive delivery surface is mounted for this session"
-      : deps.interactive.unavailableReason(request);
-  const degraded = degradedReason !== undefined;
 
   const row = deps.store.createDecision({
     project: deps.project,
     question: request.question,
-    ...(request.blocks === undefined && !degraded
-      ? {}
-      : { blocks: degraded ? degradedAskBlocks(request.blocks) : request.blocks }),
+    ...(request.blocks === undefined ? {} : { blocks: request.blocks }),
     at: now(),
   });
 
-  // Interactive first: posting selectable options is the whole fix (#722).
-  // A preview that passed but a post that failed falls back to the durable
-  // text path below, and the result names the failure — the row keeps its
-  // clean blocks in that rare race, because the note is decided at birth and
-  // the row has no update surface by design.
-  let interactivePosted = false;
-  let postFailure: string | undefined;
-  if (!degraded) {
-    const posted = await deps.interactive!.post(request, row.id);
-    interactivePosted = posted.ok;
-    if (!posted.ok) postFailure = posted.reason;
-  }
-
-  let delivery: AskDeliveryResult | undefined;
-  if (!interactivePosted) {
-    delivery = await deps.deliver(askMessageFor(request), request.category ?? "decision-needed");
-  }
-
-  const ceilingSeconds = resolveAskCeilingSeconds(
-    request.timeoutSeconds,
-    deps.configuredCeilingSeconds,
-    deps.turnBudgetSeconds ?? DEFAULT_ASK_TIMEOUT_SECONDS,
+  const { delivery, failure } = await deliverOnce(
+    deps,
+    askMessageFor(request),
+    request.category ?? "decision-needed",
   );
-  const outcome = await runBoundedAsk({
-    decisionId: row.id,
-    ceilingMs: ceilingSeconds * 1_000,
-    read: (id) => deps.store.decision(id),
-    wait,
-    now,
-    settle: interactivePosted ? () => deps.interactive!.collect(row.id) : undefined,
-  });
-  if (interactivePosted) deps.interactive!.close(row.id);
 
-  let text: string;
-  if (outcome.kind === "answered") {
-    text =
-      `conductor_ask ${row.id}: the operator answered — ${outcome.answer}. ` +
-      `The decision row is resolved with that answer. Proceed to apply it.`;
-  } else if (outcome.kind === "withdrawn") {
-    text =
-      `conductor_ask ${row.id}: the decision was withdrawn by whoever holds the row before the ` +
-      `ceiling elapsed. No answer was given and nothing was auto-applied. Treat it as "the question is ` +
-      `closed", not as an answer.`;
-  } else if (request.onTimeout === "auto-proceed") {
-    const resolution = autoApplyResolution(request.recommended!);
-    deps.store.resolveDecision(row.id, "answered", resolution, now());
-    text =
-      `conductor_ask ${row.id}: no answer within ${ceilingSeconds}s — auto-proceeding as declared. ` +
-      `The recommended option "${request.recommended}" is applied, and the decision row was resolved ` +
-      `with the answer "${resolution}" so the record shows nobody human chose it. Proceed to apply ` +
-      `that recommendation to the blocked work now.`;
-  } else {
-    text =
-      `conductor_ask ${row.id}: no answer within ${ceilingSeconds}s — parking as declared. ` +
-      `The decision row stays open and pending, re-surfaced in every tick prompt until answered or the ` +
-      `seven-day expiry. Park the blocked work now: take it out of the claimable queue and record its ` +
-      `state (e.g. unlabel it or move it to a parked state), then note it in your report.`;
-  }
-
-  const deliveryLine =
-    delivery === undefined
-      ? ""
-      : delivery.kind === "sent"
-        ? ` The question went to the operator as a ${delivery.category} message.`
-        : ` The question is durably held (notice ${delivery.noticeId ?? "?"}, ${delivery.category}); the ` +
-          "daemon releases it with the next digest or working-hours catch-up.";
-  const delivered = interactivePosted
-    ? "The question went to the operator as selectable options (button taps); a tap resolves " +
-      "the decision row with the chosen option, and a free-text ask is answered by replying."
-    : degraded
-      ? `The interactive surface is unavailable for this call (${degradedReason}), so the decision row ` +
-        `records the degraded delivery: the operator's prose reply is NOT an answer to this row and ` +
-        `does not resolve it — if they answer in prose, resolve or withdraw the row by hand ` +
-        `(omp-conductor decision resolve|withdraw ${row.id}).${deliveryLine}`
-      : `The interactive question could not be posted (${postFailure}) and the ask fell back to the ` +
-        `durable text path.${deliveryLine}`;
-
-  return { outcome, decisionId: row.id, text: `${delivered}\n${text}` };
+  return {
+    decisionId: row.id,
+    text:
+      `conductor_ask ${row.id}: the question is filed as open decision row ${row.id}. ` +
+      `${deliveryLine(delivery, failure)}\n` +
+      `Nothing waits for the answer here: this tick is headless, and the operator answers in the console ` +
+      `session, which resolves the row with \`${decisionResolveCommand(row.id)}\`. Until then the row stays ` +
+      `open and pending — re-surfaced in every tick prompt — until it is answered, withdrawn, or swept by ` +
+      `the seven-day decision expiry.\n` +
+      `Park the blocked work NOW, in this turn: take it out of the claimable queue and record its state ` +
+      `(e.g. unlabel it or move it to a parked state), then note the parked work and row ${row.id} in your ` +
+      `report. Do not wait, do not re-ask, and do not act as though the recommendation were approved.`,
+  };
 }
 
-/** What one {@link QUESTIONNAIRE_TOOL} call produced, per item and as text. */
+/** What one {@link QUESTIONNAIRE_TOOL} call produced, and its text. */
 export interface QuestionnaireResult {
-  /** The minted group id — the handle for `omp-conductor decision` on any item. */
+  /** The minted group id — the handle for `omp-conductor decision` on the set. */
   groupId: string;
-  items: { id: string; question: string; state: DecisionState; resolution?: string }[];
+  items: { id: string; question: string }[];
   text: string;
 }
 
 /**
- * Ask one bounded spec-out questionnaire (#947).
- *
- * The shape mirrors {@link performAsk} deliberately — rows before delivery, one
- * bounded wait, per-item timeout policy applied at the ceiling — with two
- * differences that are the whole feature:
- *
- * 1. **One delivery.** The items go out as a single numbered message, so a
- *    questionnaire costs one interrupt rather than N.
- * 2. **N independent resolutions.** The wait ends when every item is closed or
- *    the ceiling elapses, and the ceiling then applies each item's own policy.
- *    An item the operator answered keeps that answer.
+ * Ask one spec-out questionnaire (#947).
  *
- * It uses the durable text path rather than posting N interactive keyboards,
- * because N posts is exactly the thing it exists not to do. That means a prose
- * reply is not itself a row resolution — the same contract a degraded single ask
- * already has — so the result text names the ids and the command that resolves
- * them.
+ * The shape mirrors {@link performAsk} deliberately — rows before delivery,
+ * then park — with the one difference that is the whole feature: the items go
+ * out as a **single** numbered message, so a questionnaire costs one interrupt
+ * rather than N. Each item is still its own row, resolved independently and in
+ * any order by the console.
  */
 export async function performQuestionnaire(
   request: QuestionnaireRequest,
   deps: AskDeps,
 ): Promise<QuestionnaireResult> {
   const now = deps.now ?? Date.now;
-  const wait = deps.wait ?? sleep;
 
   // Every row durable, in one transaction, BEFORE the delivery: an operator must
   // never be shown a question that no row is waiting on.
@@ -995,71 +555,26 @@ export async function performQuestionnaire(
   );
   const groupId = rows[0]!.groupId!;
 
-  const category = request.items[0]!.category ?? "decision-needed";
-  const delivery = await deps.deliver(questionnaireMessageFor(request), category);
-
-  const ceilingSeconds = resolveAskCeilingSeconds(
-    // One ceiling for the group, taken from the shortest item that named one:
-    // the whole point is that a questionnaire cannot wait longer than an ask.
-    request.items.reduce<number | undefined>(
-      (shortest, item) =>
-        item.timeoutSeconds === undefined ? shortest : Math.min(shortest ?? item.timeoutSeconds, item.timeoutSeconds),
-      undefined,
-    ),
-    deps.configuredCeilingSeconds,
-    deps.turnBudgetSeconds ?? DEFAULT_ASK_TIMEOUT_SECONDS,
+  const { delivery, failure } = await deliverOnce(
+    deps,
+    questionnaireMessageFor(request),
+    request.items[0]!.category ?? "decision-needed",
   );
-  const deadline = now() + ceilingSeconds * 1_000;
-  for (;;) {
-    const live = deps.store.decisionGroup(groupId);
-    if (live.every((row) => row.state !== "open")) break;
-    if (now() >= deadline) break;
-    await wait(ASK_POLL_MS);
-  }
-
-  // The ceiling, per item. `resolveDecision` refuses a second resolution, so an
-  // answer that landed in the same instant as the deadline is never overwritten.
-  const atCeiling = deps.store.decisionGroup(groupId);
-  for (const outcome of resolveQuestionnaireTimeouts(
-    atCeiling.map((row, index) => ({
-      id: row.id,
-      request: request.items[index]!,
-      answered: row.state !== "open",
-    })),
-  )) {
-    if (outcome.kind === "auto-applied") {
-      deps.store.resolveDecision(outcome.id, "answered", outcome.resolution, now());
-    }
-  }
 
-  const final = deps.store.decisionGroup(groupId);
-  const items = final.map((row) => ({
-    id: row.id,
-    question: row.question,
-    state: row.state,
-    ...(row.resolution === undefined ? {} : { resolution: row.resolution }),
-  }));
-  const open = items.filter((item) => item.state === "open");
-  const deliveryLine =
-    delivery.kind === "sent"
-      ? `The questionnaire went to the operator as one ${delivery.category} message.`
-      : `The questionnaire is durably held (notice ${delivery.noticeId ?? "?"}, ${delivery.category}); the ` +
-        "daemon releases it with the next digest or working-hours catch-up.";
+  const items = rows.map((row) => ({ id: row.id, question: row.question }));
   const perItem = items
-    .map(
-      (item, index) =>
-        `${index + 1}. ${item.state}${item.resolution === undefined ? "" : ` — ${item.resolution}`} (${item.id})`,
-    )
+    .map((item, index) => `${index + 1}. ${item.id} — ${decisionResolveCommand(item.id)}`)
     .join("\n");
-  const closing =
-    open.length === 0
-      ? "Every item is resolved. Apply the answers to the spec now."
-      : `${open.length} item(s) stayed open as declared: park the work each one blocks, and note them in your ` +
-        "report. A prose reply does NOT resolve these rows — map it yourself with " +
-        "`omp-conductor decision resolve <id> --answer \"…\"`.";
   return {
     groupId,
     items,
-    text: `${deliveryLine} Ceiling ${ceilingSeconds}s; #${request.specIssue}.\n${perItem}\n${closing}`,
+    text:
+      `conductor_questionnaire ${groupId}: ${items.length} questions about #${request.specIssue}, each filed ` +
+      `as its own open decision row, delivered as one message. ${deliveryLine(delivery, failure)}\n` +
+      `${perItem}\n` +
+      `Nothing waits for the answers here: the console session resolves each row as the operator answers ` +
+      `it, in any order, and an unanswered row is swept by the seven-day decision expiry. Park the work ` +
+      `every item blocks NOW, in this turn — out of the claimable queue, state recorded — and note group ` +
+      `${groupId} in your report.`,
   };
 }