omp-conductor 0.19.7 → 0.20.1

package/src/orchestrator-tick.ts

@@ -102,7 +102,6 @@ import {
   type ResolvedGrants,
   type Store,
 } from "./types.ts";
-import { repoSlugFor } from "./gitops.ts";
 import { makeTracker } from "./tracker/github.ts";
 import { formatDecisionDigest } from "./decisions.ts";
 import { installSurfaceMismatch } from "./status-render.ts";
@@ -114,36 +113,39 @@ import {
   parseQuestionnaireRequest,
   performQuestionnaire,
   questionnaireParameterSchema,
-  askAnswerRowWrite,
   askParameterSchema,
-  DEFAULT_ASK_TIMEOUT_SECONDS,
-  MAX_ASK_TIMEOUT_SECONDS,
-  MIN_ASK_TIMEOUT_SECONDS,
-  parseAskAnswerEnvelope,
   parseAskRequest,
   performAsk,
-  renderInteractiveAsk,
-  type AskAnswerEnvelope,
-  type AskInteractiveDelivery,
   type AskResult,
 } from "./ask.ts";
 import { deliverOperatorMessage } from "./reports.ts";
 import { effectiveLabels } from "./routing.ts";
-import { readTelegramToken, resolveProjectTopicId, telegramStateDir } from "./escalate.ts";
 import type { FailureClass, RecoveryAction, RunRecord } from "./types.ts";
 import { dbPath, openStore } from "./store.ts";
 import { digestDue, localDayKey } from "./digest-schedule.ts";
 import {
-  parseToSpecEvidence,
-  parseToSpecFailureEvidence,
-  recordToSpecGrooming,
-  TO_SPEC_MAX_SOURCE_AGE_MS,
-  TO_SPEC_SCHEMA,
-  type ToSpecFailure,
-  type ToSpecResult,
-} from "./to-spec.ts";
+  DEFAULT_GROOM_BELOW,
+  groomingDue,
+  parseReadyGateRejection,
+  TO_SPEC_IN_FLIGHT_REASON,
+  toSpecDurableVerdict,
+  type ToSpecTrackerSeam,
+} from "./groom.ts";
 import { heldNoticeId } from "./notices.ts";
-import { classifyArmReply } from "./arm-challenge.ts";
+import {
+  clearArmTransaction,
+  expiredArmChallenges,
+  FLEET_ARM_KEY,
+  resolveArmReply,
+  type ArmChallengeSighting,
+  type ArmReplyMatch,
+} from "./arm-challenge.ts";
+import {
+  readTelegramChannel,
+  readTelegramToken,
+  resolveProjectTopicId,
+  sendTelegram,
+} from "./escalate.ts";
 
 /** The activation file. Absent means "this is not an orchestrator session". */
 export const TICK_CONFIG_FILE = ".conductor-tick.json";
@@ -151,47 +153,6 @@ export const TICK_CONFIG_FILE = ".conductor-tick.json";
 /** Namespaced so a renderer or a session-log reader can pick ticks out. */
 export const TICK_CUSTOM_TYPE = "omp-conductor.tick";
 
-/**
- * A deterministic machine-readable steer the availability gate sends when an
- * inbound user turn is an active arming proof (conductor #415). It names the
- * turn for what it is so the model acknowledges receipt and hands completion to
- * the host-side `arm` instead of ad-libbing pairing-safety prose at the bare
- * `FLEET-…` token — and it never quotes the code, which has no place outside
- * the protected session transcript.
- */
-export const ARM_PROOF_CUSTOM_TYPE = "omp-conductor.arm-proof";
-
-/**
- * The type carried by an answer to a code that was **not** a proof (#991).
- *
- * Deliberately not {@link ARM_PROOF_CUSTOM_TYPE}: that type means "an arming
- * proof landed", and the availability gate and every reader that filters on it
- * would otherwise see a refusal as a proof. A refusal is the opposite fact.
- */
-export const ARM_REPLY_CUSTOM_TYPE = "omp-conductor.arm-reply";
-
-/**
- * What the operator is told when their code arrived too late (#991).
- *
- * Never the token, and never a hint about any other project: an expired record
- * is the one thing this session can state about a code it could not accept.
- */
-export const ARM_EXPIRED_REPLY_TEXT =
-  "That arming code has expired — nothing was armed. Run `omp-conductor arm` again for a fresh code.";
-
-/** What the operator is told when the code matches nothing here (#991). Worded
- *  so it cannot be read as a statement about another project's ceremony. */
-export const ARM_UNKNOWN_REPLY_TEXT =
-  "No arming is in progress here, so that code was not accepted. Run `omp-conductor arm` to start one.";
-
-/** The model-ready wording for {@link ARM_PROOF_CUSTOM_TYPE}. Kept fixed so the
- *  orchestrator's handling of an arming proof is deterministic, whichever
- *  challenge it was cut for. */
-export const ARM_PROOF_ACK_TEXT =
-  "The message you just received was an active omp conductor arming confirmation. " +
-  "Acknowledge that the arming confirmation was received; the host-side `arm` command " +
-  "owns completion of the arming handshake. No pairing or access change is required.";
-
 /**
  * A tick costs a whole turn of a frontier model, and the orchestrator's loop is
  * about minutes of latency, not seconds. Anything under a minute is a
@@ -245,22 +206,6 @@ export const STALL_TICKS = 2;
 const DEFAULT_TICK_BUDGET_SECONDS = 600;
 /** Grace before a queued operator message preempts the turn's tool calls. */
 const PENDING_MESSAGE_GRACE_MS = 60_000;
-/** Routable candidates below which the queue digest tells the orchestrator to groom (#181). */
-const DEFAULT_GROOM_BELOW = 4;
-
-/**
- * Whether the count-based half of the grooming duty fires for one dispatch
- * row's routable count (#988): below a numeric threshold as always, while
- * `"always"` leaves this gate open on purpose — the selectors then answer
- * "is anything left to groom?" from candidate state (ungroomed, unrefused,
- * unparked), and the launch block or no-batch line renders the truthful
- * finding either way. Never substitute a large number for `"always"`: a big
- * queue must not silence the duty.
- */
-function groomingDue(routed: number, groomBelow: GroomTrigger): boolean {
-  return groomBelow === "always" || routed < groomBelow;
-}
-
 /**
  * Written by herdr-conductor `recover.sh` *before* `agent start`, and by the
  * dispatch daemon when a watched decision condition transitions false→true
@@ -481,15 +426,6 @@ export interface TickConfig {
    * before the next tick).
    */
   budgetSeconds?: number;
-  /**
-   * Seconds one {@link ASK_TOOL} call waits for the operator before its
-   * declared timeout outcome fires (#438). Optional; defaults to
-   * {@link DEFAULT_ASK_TIMEOUT_SECONDS} (5 minutes) and is always capped at the
-   * turn budget, so an ask can never outlive the turn it runs in. The ceiling
-   * is the tool's, not the model's: an ask issued without a `timeoutSeconds`
-   * gets this value all the same.
-   */
-  askTimeoutSeconds?: number;
   /**
    * The herdr agent name this fleet's orchestrator pane is registered under, and
    * the whole of {@link resolveTickOwnership}'s identity test under herdr.
@@ -567,6 +503,10 @@ const AUTONOMOUS_RECOVERY_ACTIONS: Record<RecoveryAction, boolean> = {
   "rerun-checks": true,
   settle: true,
   escalate: false,
+  // An observation row never stamps `recoveredAt` (the recovery IS the later
+  // sweep pass), so it never lands in this digest; `false` is the honest value
+  // if one ever did — it is not "already handled", it is waiting (#1068).
+  observe: false,
   hold: false,
   none: false,
 };
@@ -718,10 +658,10 @@ export interface QueueObservation {
  * line tells claimable candidates apart from a runway that cannot move —
  * instead of inviting Duty 2 to groom work whose last pass held it, which is
  * exactly the re-derivation this store exists to stop. A to-spec launch row
- * (#777) carries the same `blocked` verdict as its durable in-flight marker,
- * so it is told apart from the mechanical holds: it says "a batch is running",
- * not "the lane cannot move", and counts neither as claimable nor as
- * known-blocked.
+ * (#777, written by the daemon's grooming launcher since #1041) carries the
+ * same `blocked` verdict as its durable in-flight marker, so it is told apart
+ * from the mechanical holds: it says "a batch is running", not "the lane
+ * cannot move", and counts neither as claimable nor as known-blocked.
  *
  * `queue` is the tracker observation the caller made THIS tick (#848). When
  * present, the queue verdict reads in the present tense from that inventory,
@@ -737,9 +677,9 @@ export function queueDigestLine(
   grooming: readonly GroomingRecord[] = [],
   queue: QueueObservation | undefined = undefined,
   /** Observation time for the durability of the grooming rows this line
-   *  describes — the same clock the selection is offered against, so the
-   *  inventory and the batch cannot disagree about what is still groomed
-   *  (#887). */
+   *  describes — the same clock the daemon's selection judges them against, so
+   *  the inventory and the next grooming pass cannot disagree about what is
+   *  still groomed (#887). */
   now: number = Date.now(),
 ): string | undefined {
   if (summary === undefined) return undefined;
@@ -823,8 +763,8 @@ function liveQueueDigestLine(
   if (queued === 0) {
     return (
       `Queue: empty — nothing open carries "${queueLabel}" right now (tracker ${observed}). ` +
-      "Groom the backlog (Duty 2): promote or file the next issues, or say in this tick's report " +
-      "why there is nothing to do."
+      "Groom the backlog (Duty 2): the daemon runs the to-spec passes and promotes what its ready gate " +
+      "passes, so file or sharpen the next issues, or say in this tick's report why there is nothing to do."
     );
   }
   // The grooming threshold is claimability — summary.routed — never raw
@@ -884,8 +824,8 @@ function lowQueueTail(
   groomBelow: GroomTrigger,
   grooming: readonly GroomingRecord[],
   lead: string,
-  /** The clock the durability of each verdict is judged against — the same
-   *  one the batch offer uses (#887). */
+  /** The clock the durability of each verdict is judged against — the same one
+   *  the daemon's selection uses (#887). */
   now: number,
 ): string {
   // The durable per-issue verdicts, not this pass's one-shot hold groups: a
@@ -910,20 +850,23 @@ function lowQueueTail(
       `(${groomingGroupCounts(knownBlocked)})${busy} — no grooming moves them; the holds clear by themselves` +
       `${inFlight.length === 0 ? "" : " and the to-spec batch's results land when it settles"}.`;
   } else if (knownBlocked.length > 0 || inFlight.length > 0) {
+    // Who grooms is the daemon's business now (#1041): the tail reports which
+    // candidates the pipeline can actually move, and stops instructing a
+    // session that no longer holds the launch.
     tail =
       groomBelow === "always"
-        ? `${lead}grooming runs every tick ("always") — ${summary.routed} routable candidate(s): ` +
+        ? `${lead}grooming runs every pass ("always") — ${summary.routed} routable candidate(s): ` +
           `${claimable} claimable, ${knownBlocked.length} known-blocked (${groomingGroupCounts(knownBlocked)})` +
-          `${busy} — groom the claimable while any remain ungroomed.`
+          `${busy} — only the claimable are groomable.`
         : `${lead}running low — ${summary.routed} routable candidate(s), below the grooming trigger of ${groomBelow}: ` +
           `${claimable} claimable, ${knownBlocked.length} known-blocked (${groomingGroupCounts(knownBlocked)})` +
-          `${busy} — groom only the claimable.`;
+          `${busy} — only the claimable are groomable.`;
   } else if (groomBelow === "always") {
     // No numeric trigger exists to be "below", so the tail states the actual
     // condition and what remains ungroomed (#988) instead of inventing one.
     tail =
-      `${lead}grooming runs every tick ("always") — ${summary.routed} routable candidate(s); ` +
-      "groom while ungroomed, unrefused, unparked candidates remain.";
+      `${lead}grooming runs every pass ("always") — ${summary.routed} routable candidate(s); ` +
+      "the daemon keeps grooming while ungroomed, unrefused, unparked candidates remain.";
   } else {
     tail = `${lead}running low — ${summary.routed} routable candidate(s), below the grooming trigger of ${groomBelow}.`;
   }
@@ -939,7 +882,7 @@ function lowQueueTail(
       ` Backlog already-considered: ${considered.length} (${groomingVerdictCounts(considered)}) — ` +
       `${durable.length} still durable (never re-groom these), ${regroomable} re-groomable ` +
       "(no readable to-spec source, or observed past the freshness ceiling). " +
-      "Promote the promotable or groom new issues.";
+      "The daemon promotes what its ready gate passes; audit those promotions and sharpen what it rejected.";
   }
   if (summary.admitted === 0 && summary.holds.length > 0) {
     const held = summary.holds
@@ -953,657 +896,115 @@ function lowQueueTail(
   return tail;
 }
 
-// ================================================================ to-spec
-// launch lifecycle (#777). #772 shipped the strict to-spec contract
-// (`TO_SPEC_SCHEMA` + `recordToSpecGrooming`); this section is the launch
-// half: the mechanical candidate selection, the bounded prompt block that
-// authorizes exactly one native `task` batch per low-queue tick, the
-// tool-call gate that stamps the contract and records in-flight rows, and
-// the result capture that routes every item's exact output through
-// `recordToSpecGrooming` independently.
-//
-// Where each fact lives decides who enforces it — and every exclusion is
-// enforced mechanically from authoritative data, never by prose:
-//
-//  - Tracker facts — the open-issue pool, the park label, the parent/epic
-//    probe — are read ONCE, at launch composition time, through the existing
-//    Tracker adapter (`listOpenIssues`/`childrenOf`). The tick turns that
-//    snapshot into the mechanically selected batch: `offerToSpecLaunch`
-//    streams the snapshot through the store-side exclusions and the parent
-//    probe, and the returned block names the selected candidates as the ONLY
-//    batch this tick may launch. If the snapshot cannot be read, no batch is
-//    offered at all — the launch fails closed rather than trusting the model
-//    to self-filter.
-//  - Store facts — durable grooming rows (#735), admission's lane/dependency
-//    holds, active runs, in-flight launches — are enforced mechanically at
-//    composition time (the exclusion lines the block names) and again at
-//    `tool_call` time (the gate refuses an item the store contradicts).
-//  - The live source ref for each item cannot be known synchronously without
-//    a fresh per-repo read, so the model fetches it and declares it in the
-//    item's second contract line; the strict parser's 24h freshness ceiling
-//    re-vets the claim at persistence time, which is the boundary #772 set.
-//  - The gate additionally enforces the allowlist: a marker-bearing `task`
-//    call is refused unless every item's issue number AND routing repo match
-//    the batch this tick's token authorized. A parked or parent/epic
-//    candidate therefore cannot be stamped in-flight even if the model
-//    invents one — it was never on the list, and the list is the only thing
-//    the gate lets through.
+// ============================================================ promotion audit
+// (#1041/#1040). #777 gave the tick a per-tick capability token: a launch block
+// naming the mechanically selected batch, a `task` tool-call gate that redeemed
+// exactly one batch, and promotion as an orchestrator act. That made grooming
+// tick-bound — one batch per low-queue tick, and an operator message that
+// consumed the tick consumed the batch (#1040) — so the whole mechanism is
+// gone. The daemon watches depth, launches its own to-spec sessions, and
+// promotes a PROMOTABLE verdict whose spec passes the pure ready gate.
 //
-// The pure selector (`selectToSpecBatch`) remains the single shared rule set:
-// the offer feeds it the tracker-vetted pool and the gate runs the same
-// exclusion on every item at call time, so a candidate excluded in the prompt
-// is excluded in the gate for the same reason.
-
-/** The `to-spec` agent every batch item runs under (shipped in
- *  `omp/agents/to-spec.md`, discovered through OMP's native task-agent
- *  discovery — never a custom process runtime). */
-export const TO_SPEC_AGENT = "to-spec";
-
-/** The maximum number of candidates one tick's batch may carry (#679's
- *  "small per-tick candidate limit"; the session-scoped task semaphore
- *  bounds concurrency underneath). */
-export const TO_SPEC_BATCH_MAX = 3;
-
-/**
- * The `context` marker that identifies a conductor grooming batch to the
- * `tool_call` gate. The launch block instructs the orchestrator to put
- * `{@link TO_SPEC_BATCH_MARKER}: <token>` as the first line of the batch's
- * shared `context`; the gate matches the marker and the exact token this tick
- * issued, stamps the per-item contract (agent, strict schema), and persists
- * the in-flight rows. A `task` call without this marker is the orchestrator's
- * own and passes untouched.
- */
-export const TO_SPEC_BATCH_MARKER = "conductor-to-spec-batch";
-
-/** The grooming-table verdict row a launched-but-unfinished batch leaves behind
- *  (reason, on a `blocked` verdict): the durable in-flight marker that stops
- *  the next tick — or a restarted session — from re-launching the same item.
- *  `blocked` is deliberate: `recordToSpecGrooming` replaces the row when the
- *  result lands, and refusing-to-parse output must *not* be swallowed by the
- *  kept-prior path that protects prior `promotable`/`considered` verdicts. */
-export const TO_SPEC_IN_FLIGHT_REASON = "in-flight";
-
-/**
- * How long a launch row may sit before it is treated as a dead batch and the
- * candidate becomes eligible again. A batch that dies with the process (a
- * daemon stop between `tool_call` and delivery) must not park a candidate
- * forever; the 24h ceiling matches the source-freshness ceiling, so a
- * relaunched pass always reads new source evidence anyway.
- */
-export const TO_SPEC_IN_FLIGHT_TTL_MS = 24 * 60 * 60 * 1_000;
-
-/**
- * How long a refused pass parks its candidate before another batch may be
- * spent on it. Deliberately the same 24h number as the source-freshness
- * ceiling and the in-flight TTL — one granularity for this whole lifecycle,
- * not a third threshold to keep in sync: within that window neither the
- * authoritative source nor the issue has produced new evidence, so a retry
- * re-runs the identical prompt and refuses the identical way.
- *
- * Without it, a candidate whose delegated pass returns malformed,
- * source-less or stale output is immediately eligible again, so every
- * low-queue tick spends a full delegated batch re-grooming it — measured on
- * this fleet as five permanently-refused rows (#295, #296, #297, #679, #806)
- * re-offered on every pass, and as #807 groomed twice seven minutes apart
- * (#887).
- */
-export const TO_SPEC_REFUSED_RETRY_COOLDOWN_MS = TO_SPEC_MAX_SOURCE_AGE_MS;
-
-/**
- * The one durability rule for a grooming row: the validated to-spec result it
- * carries when that result is still fresh, or `undefined` when the row is not
- * durable grooming at all (no to-spec payload — a hand-edited or pre-#772
- * row — or a source observed past the freshness ceiling).
- *
- * Every reader of "is this issue already groomed?" MUST go through this:
- * {@link toSpecCandidateExclusion} (selection and the `tool_call` gate), the
- * launch block's `already-groomed` list, and the queue digest's
- * already-considered inventory. Two readers with two predicates is exactly
- * the #887 defect — the digest told the orchestrator "never re-groom these"
- * about rows the mechanical selection was simultaneously offering.
- */
-export function toSpecDurableVerdict(row: GroomingRecord, now: number): ToSpecResult | undefined {
-  const result = parseToSpecEvidence(row.evidence);
-  if (result === undefined) return undefined;
-  return now - result.source.freshAt <= TO_SPEC_MAX_SOURCE_AGE_MS ? result : undefined;
-}
-
-/** The refusal a row records when its pass produced nothing usable, while the
- *  cooldown above still holds it out of a new batch; `undefined` for any
- *  other row, including a refusal whose cooldown has expired. */
-export function toSpecRefusalOnCooldown(row: GroomingRecord, now: number): ToSpecFailure | undefined {
-  const failure = parseToSpecFailureEvidence(row.evidence);
-  if (failure === undefined) return undefined;
-  return now - row.recordedAt <= TO_SPEC_REFUSED_RETRY_COOLDOWN_MS ? failure : undefined;
-}
-
-/** The first line of every batch item's `task`, in the shape the gate parses:
- *  `to-spec candidate: <owner/repo>#<issue> — <title>`. */
-export const TO_SPEC_ITEM_PREFIX = "to-spec candidate:";
-
-/** The second line of every batch item's `task`, naming the authoritative
- *  source and the exact ref the item was groomed against:
- *  `to-spec source: <owner/repo>@<ref>`. `ref` is whatever the launch block
- *  told the orchestrator to fetch as the repo's current default-branch head. */
-export const TO_SPEC_ITEM_SOURCE_PREFIX = "to-spec source:";
-
-/** The tool the orchestrator calls to persist one completed item's exact raw
- *  output when the batch ran in the background (#777). Registered by this
- *  extension; subagents never see it — the `to-spec` agent's tool list is
- *  read-only and explicit. */
-export const TO_SPEC_RESULT_TOOL = "conductor_to_spec_result";
-
-/** One backlog candidate the mechanical gate can judge. The tracker facts
- *  (labels, epics) are read from the authoritative open-issue snapshot at
- *  launch composition time; they travel in this view so the selector stays
- *  deterministic and testable. */
-export interface ToSpecCandidateView {
-  issue: number;
-  title: string;
-  /** The routing target — a routed `owner/repo` (from the issue's one
-   *  `routing.labelPrefix<key>` label, resolved through `routing.repos`). */
-  routing: string;
-  /** Operator-parked (`project.stateLabels.backlog`); read from tracker labels. */
-  parked?: boolean;
-  /** A parent/epic with no independently runnable slice; read from the
-   *  tracker's sub-issue probe. */
-  parent?: boolean;
-}
-
-/** One candidate the tick's token authorizes. The gate admits a batch item
- *  only when its issue number AND routing both match an entry here. */
-export interface ToSpecLaunchItem {
-  issue: number;
-  /** The `owner/repo` the item's first contract line must name. */
-  routing: string;
-  /** The candidate title, as it appears in the item's first contract line. */
-  title: string;
-}
-
-/** The machine-readable item contract a batch item must satisfy. */
-export interface ToSpecBatchItem {
-  issue: number;
-  /** The `owner/repo` named by the item's first contract line. */
-  routing: string;
-  /** The `owner/repo@ref` named by the item's second contract line. */
-  sourceRef: string;
-  /** The item's full task text (the rendered brief plus the contract lines). */
-  task: string;
-}
-
-/**
- * Parse the two contract lines a batch item must start with
- * (`to-spec candidate: <repo>#<n> — <title>` / `to-spec source: <name>@<ref>`).
- * Anything else is not a conductor grooming item. Built from the shared
- * {@link TO_SPEC_ITEM_PREFIX}/{@link TO_SPEC_ITEM_SOURCE_PREFIX} constants so
- * the launch block's wording and the gate's parsing cannot drift apart.
- */
-export function parseToSpecItem(task: unknown): ToSpecBatchItem | undefined {
-  if (typeof task !== "string") return undefined;
-  const lines = task.split("\n");
-  const head = new RegExp(`^${TO_SPEC_ITEM_PREFIX}\\s+([\\w.-]+\\/[\\w.-]+)#(\\d+)(?:\\s+—\\s+.*)?$`).exec(
-    lines[0]?.trim() ?? "",
-  );
-  const source = new RegExp(`^${TO_SPEC_ITEM_SOURCE_PREFIX}\\s+([\\w.-]+\\/[\\w.-]+)@(\\S+)$`).exec(
-    lines[1]?.trim() ?? "",
-  );
-  if (head === null || source === null) return undefined;
-  return { issue: Number(head[2]), routing: head[1]!, sourceRef: source[2]!, task };
-}
-
-/**
- * Why one candidate is not eligible for a batch right now, or undefined when
- * it is. The single rule source for the prompt-time exclusion list, the
- * `tool_call` gate, and the selection helper — one rule, three readers, so a
- * candidate excluded in prose is excluded in the gate for the same reason.
- *
- *  - `in-flight`: a launch row recorded within the TTL (a dead batch's row
- *    expires and the candidate becomes eligible again);
- *  - `file-lane` / `depends-on`: admission's durable mechanical holds (#735);
- *  - a fresh valid `to-spec` result in the grooming table: the candidate was
- *    already groomed at an observed source within the freshness ceiling, so
- *    re-running it would recompute a verdict that is still valid. New source
- *    evidence reconsiders it: once the recorded `freshAt` crosses the ceiling
- *    the row no longer reads as groomed, and a fresh pass overrides it;
- *  - a refused pass inside {@link TO_SPEC_REFUSED_RETRY_COOLDOWN_MS}: a full
- *    delegated batch was already spent and produced nothing usable
- *    (malformed, source-less or stale output). Retrying inside the cooldown
- *    re-runs the identical prompt against the same source and refuses the
- *    same way, which is how one broken candidate consumed a batch on every
- *    low-queue tick (#887);
- *  - `active`: a run is in flight on the issue right now.
- */
-export function toSpecCandidateExclusion(
-  candidate: { issue: number },
-  facts: { grooming: GroomingRecord | undefined; active: boolean },
-  now: number,
-): string | undefined {
-  const row = facts.grooming;
-  if (row !== undefined) {
-    if (row.reason === TO_SPEC_IN_FLIGHT_REASON) {
-      if (now - row.recordedAt <= TO_SPEC_IN_FLIGHT_TTL_MS) {
-        return `#${candidate.issue} is already in a to-spec batch (launched ${new Date(row.recordedAt).toISOString()})`;
-      }
-    } else if (row.reason === "file-lane" || row.reason === "depends-on") {
-      return `#${candidate.issue} is mechanically blocked (${row.reason}) — the hold clears by itself`;
-    } else {
-      const durable = toSpecDurableVerdict(row, now);
-      if (durable !== undefined) {
-        return (
-          `#${candidate.issue} was already groomed ${durable.verdict} (source ${durable.source.name}@` +
-          `${durable.source.ref}, observed ${new Date(durable.source.freshAt).toISOString()}) — re-groom only ` +
-          "with new source evidence"
-        );
-      }
-      const refusal = toSpecRefusalOnCooldown(row, now);
-      if (refusal !== undefined) {
-        const retryAt = new Date(row.recordedAt + TO_SPEC_REFUSED_RETRY_COOLDOWN_MS).toISOString();
-        return (
-          `#${candidate.issue} already spent a to-spec batch that was refused as ${refusal.kind} ` +
-          `(${new Date(row.recordedAt).toISOString()}) — eligible again after ${retryAt}, or once the ` +
-          "issue or its source changes"
-        );
-      }
-    }
-  }
-  if (facts.active) return `#${candidate.issue} has a dispatched run in flight`;
-  return undefined;
-}
-
-/**
- * The mechanical half of Duty 2's launch: deterministic, bounded selection of
- * the eligible candidates, smallest issue numbers first, never more than
- * {@link TO_SPEC_BATCH_MAX} per batch, nothing at/above a numeric grooming
- * trigger (`"always"` opens that gate and lets candidate state decide, #988),
- * nothing before the first dispatch summary exists (queue health unknown —
- * the same gate the queue digest uses). Parked and parent views are honored
- * when the caller supplies them.
- *
- * Production reaches this selector through {@link offerToSpecLaunch}, which
- * fills the views from the authoritative tracker snapshot (park label from
- * the open-issue labels, parent/epic from the sub-issue probe) and streams
- * the store-side exclusions before the selector runs — so parked and parent
- * exclusions are enforced on the live path, not only on test inputs.
- */
-export function selectToSpecBatch(input: {
-  candidates: readonly ToSpecCandidateView[];
-  summary: DispatchSummary | undefined;
-  groomBelow: GroomTrigger;
-  grooming: readonly GroomingRecord[];
-  active: readonly { issue: number }[];
-  now: number;
-}): ToSpecCandidateView[] {
-  if (input.summary === undefined) return [];
-  if (!groomingDue(input.summary.routed, input.groomBelow)) return [];
-  const groomingByIssue = new Map(input.grooming.map((row) => [row.issue, row]));
-  const activeIssues = new Set(input.active.map((run) => run.issue));
-  const selected: ToSpecCandidateView[] = [];
-  for (const candidate of [...input.candidates].sort((a, b) => a.issue - b.issue)) {
-    if (candidate.parked) continue;
-    if (candidate.parent) continue;
-    if (
-      toSpecCandidateExclusion(
-        { issue: candidate.issue },
-        { grooming: groomingByIssue.get(candidate.issue), active: activeIssues.has(candidate.issue) },
-        input.now,
-      ) !== undefined
-    ) {
-      continue;
-    }
-    selected.push(candidate);
-    if (selected.length >= TO_SPEC_BATCH_MAX) break;
-  }
-  return selected;
-}
-
-/**
- * One tick's launch authorization: the token, the block text it carries, and
- * the mechanically selected batch the token authorizes. The gate admits a
- * marker-bearing `task` call only when every item matches an entry of
- * {@link ToSpecLaunchBlock.items} — the list is produced from the tracker
- * snapshot, never from model-supplied fields.
- */
-export interface ToSpecLaunchBlock {
-  /** The per-launch token the batch must echo in its `context` first line. */
-  token: string;
-  block: string;
-  /** The mechanically selected candidates — the ONLY batch this token may
-   *  carry (issue number AND routing must both match). */
-  items: ToSpecLaunchItem[];
-}
-
-/** Why candidates sit out, as one compact line each, for the launch block. */
-export interface ToSpecLaunchExclusions {
-  /** Candidates with a fresh, valid to-spec verdict already on the grooming table. */
-  groomed: string[];
-  /** Candidates whose last pass was refused and whose retry cooldown still
-   *  holds ({@link TO_SPEC_REFUSED_RETRY_COOLDOWN_MS}). */
-  refused: string[];
-  /** Candidates with an active to-spec batch. */
-  inFlight: string[];
-  /** Candidates under admission's durable lane/dependency holds. */
-  mechanicallyBlocked: string[];
-  /** Candidates with a dispatched run live right now. */
-  dispatched: string[];
-}
+// What the tick owes Duty 2 instead is review, and review needs exactly two
+// facts the store already holds: what the daemon queued unattended since the
+// last beat, and which specs its gate refused. Neither is derivable from
+// session memory, and both must arrive with the command that acts on them —
+// an audit line an operator cannot act on is a line that gets skipped.
 
-/**
- * The authoritative tracker surface the launch selection is built from
- * (#777): the two reads through the existing Tracker adapter that answer
- * "which open backlog issues are actually eligible right now". Production
- * implements this with `makeTracker(...).listOpenIssues()` /
- * `.childrenOf(...)`; tests inject deterministic fakes. `listOpenIssues` is
- * the one open-issue snapshot with labels (#203) — it answers the park
- * label and the routing label mechanically — and `childrenOf` answers
- * whether a candidate is a parent/epic (its sub-issues exist, so it has no
- * independently runnable slice of its own). Both fail closed: an unreadable
- * snapshot means no batch is offered, while an unreadable parent probe skips
- * that candidate because eligibility was not mechanically established.
- */
-export interface ToSpecTrackerSeam {
-  /** Every open issue in the tracker repo, labels included
-   *  (`Tracker.listOpenIssues`). Throws when the tracker cannot be read. */
-  listOpenIssues(project: ProjectConfig): Promise<ReadyIssue[]>;
-  /** Sub-issues of one issue (`Tracker.childrenOf`). */
-  childrenOf(project: ProjectConfig, issue: number): Promise<{ number: number; state: IssueState }[]>;
-}
+/** How many promotions and gate rejections one audit block names. A tick's
+ *  prompt is a budget, and an unbounded burst of promotions must not push the
+ *  duties off the end of it; the count always states the full total. */
+const PROMOTION_AUDIT_LIMIT = 6;
 
 /**
- * The tracker half of the candidate views: map one open-issue snapshot onto
- * the pool the selector can judge. Issues still carrying the queue label are
- * already queued — not backlog — and leave the pool; issues with zero or
- * several `routing.labelPrefix` labels (or a label mapping to no configured
- * repo) cannot name an authoritative source to read and leave the pool,
- * exactly like admission's unroutable partition. The park label lands on the
- * view for the selector to drop; the parent/epic probe is separate (one
- * tracker read per candidate) and stays with the offer, which runs it only
- * for candidates the store-side exclusions did not already reject.
- */
-function toSpecPoolFromSnapshot(
-  issues: readonly ReadyIssue[],
-  project: ProjectConfig,
-): ToSpecCandidateView[] {
-  const queueLabel = project.queueLabel;
-  const parkLabel = project.stateLabels.backlog;
-  const { labelPrefix, repos } = project.routing;
-  const views: ToSpecCandidateView[] = [];
-  for (const issue of issues) {
-    if (issue.labels.includes(queueLabel)) continue;
-    const matched = [...new Set(issue.labels.filter((l) => l.startsWith(labelPrefix)))];
-    if (matched.length !== 1) continue;
-    const key = matched[0]!.slice(labelPrefix.length);
-    const target = Object.hasOwn(repos, key) ? repos[key]! : undefined;
-    if (target === undefined) continue;
-    views.push({
-      issue: issue.number,
-      title: issue.title,
-      routing: repoSlugFor(target),
-      parked: issue.labels.includes(parkLabel) ? true : undefined,
-    });
-  }
-  views.sort((a, b) => a.issue - b.issue);
-  return views;
-}
-
-/**
- * The production launch offer for one tick: the complete mechanical
- * selection, from the authoritative tracker snapshot through every
- * exclusion, ending in the token + block + allowlist, or `undefined` when no
- * batch may launch. All of the following yield `undefined`:
+ * The Duty-2 promotion audit: what the daemon promoted on its own since the
+ * previous tick, each with the one command that undoes it, and the specs its
+ * ready gate refused, each with what the gate found missing.
  *
- *  - no dispatch row yet, or the routable queue is at/above a numeric
- *    grooming trigger (`"always"` opens that gate; candidate state decides,
- *    #988 — the same gate the queue digest uses);
- *  - no tracker seam (the snapshot is unavailable);
- *  - the snapshot cannot be read — the launch fails closed rather than
- *    trusting the model to self-filter parked/parent/epic candidates;
- *  - nothing survives the exclusions (parked, parent/epic, already groomed,
- *    in-flight, lane/dependency holds, dispatched runs) — there is then no
- *    batch to authorize, and a marker-bearing `task` call stays refused.
+ * `undefined` when there is nothing to say — the common state of a fleet whose
+ * queue is deep enough that no grooming pass ran. A block that reported "0
+ * promotions" every beat would be permanent noise, the same convention
+ * {@link queueDigestLine} and {@link formatPendingIntake} keep.
  *
- * The parent/epic probe runs only for candidates the store-side exclusions
- * have not already rejected, in issue order, and stops as soon as
- * {@link TO_SPEC_BATCH_MAX} candidates are selected — a bounded set of
- * tracker reads per low-queue tick, never one per open issue.
- */
-export async function offerToSpecLaunch(input: {
-  summary: DispatchSummary | undefined;
-  groomBelow: GroomTrigger;
-  grooming: readonly GroomingRecord[];
-  active: readonly { issue: number }[];
-  project: ProjectConfig;
-  trackerSeam: ToSpecTrackerSeam | undefined;
-  /** An open-issue snapshot this tick already read from the tracker. Shared
-   *  with the queue digest so one tick cannot describe two queues (#848);
-   *  absent when that read failed, in which case the launch retries its own
-   *  read and fails closed on the same terms as before. */
-  issues?: readonly ReadyIssue[];
-  now: number;
-}): Promise<ToSpecLaunchBlock | undefined> {
-  if (input.summary === undefined) return undefined;
-  if (!groomingDue(input.summary.routed, input.groomBelow)) return undefined;
-  const seam = input.trackerSeam;
-  if (seam === undefined) return undefined;
-  let issues = input.issues;
-  if (issues === undefined) {
-    try {
-      issues = await seam.listOpenIssues(input.project);
-    } catch {
-      // No authoritative snapshot, no launch: a batch offered without one would
-      // make the model the selector, which is exactly the defect this slice
-      // removes. The queue digest still names the grooming duty; the next tick
-      // retries the read.
-      return undefined;
-    }
-  }
-  const views = toSpecPoolFromSnapshot(issues, input.project);
-  const groomingByIssue = new Map(input.grooming.map((row) => [row.issue, row]));
-  const activeIssues = new Set(input.active.map((run) => run.issue));
-  const pool: ToSpecCandidateView[] = [];
-  for (const view of views) {
-    if (view.parked) continue;
-    if (
-      toSpecCandidateExclusion(
-        { issue: view.issue },
-        { grooming: groomingByIssue.get(view.issue), active: activeIssues.has(view.issue) },
-        input.now,
-      ) !== undefined
-    ) {
-      continue;
-    }
-    let children: { number: number; state: IssueState }[];
-    try {
-      children = await seam.childrenOf(input.project, view.issue);
-    } catch {
-      continue;
-    }
-    if (children.length > 0) continue; // parent/epic with sub-issues: no runnable slice
-    pool.push(view);
-    if (pool.length >= TO_SPEC_BATCH_MAX) break;
-  }
-  // The one shared rule set re-runs on the tracker-vetted pool, so the pure
-  // selector — not a prose instruction — answers what the block authorizes.
-  const selected = selectToSpecBatch({
-    candidates: pool,
-    summary: input.summary,
-    groomBelow: input.groomBelow,
-    grooming: input.grooming,
-    active: input.active,
-    now: input.now,
-  });
-  if (selected.length === 0) return undefined;
-  return toSpecLaunchBlock({
-    summary: input.summary,
-    groomBelow: input.groomBelow,
-    grooming: input.grooming,
-    active: input.active,
-    tracker: input.project.tracker.repo,
-    queueLabel: input.project.queueLabel,
-    labelPrefix: input.project.routing.labelPrefix,
-    parkLabel: input.project.stateLabels.backlog,
-    selected,
-    now: input.now,
-  });
-}
-
-/**
- * The per-tick launch block. Present exactly when a batch may be launched:
- * the grooming duty is due (below a numeric trigger, or `"always"` — #988),
- * a dispatch row exists, and the mechanical selection produced at least one
- * candidate. The block names the selected candidates as the ONLY batch this
- * tick authorizes and lists every store-proven exclusion the selection
- * already applied; the `tool_call` gate refuses any item outside the list.
+ * The demote command is spelled from the real verb surface rather than
+ * invented: `conductor_label` (verbs/protocol.ts) takes the full issue URL,
+ * the label, `action`, and a `reason` from {@link LABEL_REASONS} — `needs-human`
+ * is the member that means "parked: it needs a decision only a human can
+ * make", which is exactly what an overruled auto-promotion is.
  */
-export function toSpecLaunchBlock(input: {
-  summary: DispatchSummary | undefined;
-  groomBelow: GroomTrigger;
+export function formatPromotionAudit(input: {
+  /** Grooming rows promoted since {@link since}, as `Store.promotionsSince`
+   *  returns them (newest or oldest first — the block does not reorder, so the
+   *  store's order is the audit's order). */
+  promotions: readonly GroomingRecord[];
+  /** Every current grooming row, from which the gate rejections are read. The
+   *  full set rather than a window: a spec the gate refused three ticks ago is
+   *  still unqueued work, and dropping it would let a rejected spec go quiet. */
   grooming: readonly GroomingRecord[];
-  active: readonly { issue: number }[];
+  project: string;
   tracker: string;
   queueLabel: string;
-  labelPrefix: string;
-  parkLabel: string;
-  /** The mechanically selected candidates the block renders and authorizes. */
-  selected: readonly ToSpecCandidateView[];
-  now: number;
-}): ToSpecLaunchBlock | undefined {
-  if (input.summary === undefined) return undefined;
-  if (!groomingDue(input.summary.routed, input.groomBelow)) return undefined;
-  if (input.selected.length === 0) return undefined;
-  const exclusions: ToSpecLaunchExclusions = {
-    groomed: [],
-    refused: [],
-    inFlight: [],
-    mechanicallyBlocked: [],
-    dispatched: [],
-  };
-  for (const row of input.grooming) {
-    if (row.reason === TO_SPEC_IN_FLIGHT_REASON) {
-      if (input.now - row.recordedAt <= TO_SPEC_IN_FLIGHT_TTL_MS) exclusions.inFlight.push(`#${row.issue}`);
-    } else if (row.reason === "file-lane" || row.reason === "depends-on") {
-      exclusions.mechanicallyBlocked.push(`#${row.issue} (${row.reason})`);
-    } else {
-      // The same two predicates the selection and the gate apply, so a
-      // candidate this block advertises as excluded is one selection actually
-      // withheld — and one it does not advertise is one selection may offer
-      // (#887).
-      const durable = toSpecDurableVerdict(row, input.now);
-      if (durable !== undefined) {
-        exclusions.groomed.push(
-          `#${row.issue} (${durable.verdict} @ ${durable.source.ref}, observed ${new Date(durable.source.freshAt).toISOString()})`,
-        );
-        continue;
-      }
-      const refusal = toSpecRefusalOnCooldown(row, input.now);
-      if (refusal !== undefined) {
-        exclusions.refused.push(
-          `#${row.issue} (${refusal.kind}, refused ${new Date(row.recordedAt).toISOString()}, retry after ` +
-            `${new Date(row.recordedAt + TO_SPEC_REFUSED_RETRY_COOLDOWN_MS).toISOString()})`,
-        );
-      }
-    }
-  }
-  for (const run of input.active) exclusions.dispatched.push(`#${run.issue}`);
-  const token = randomUUID();
-  const items: ToSpecLaunchItem[] = input.selected.map((candidate) => ({
-    issue: candidate.issue,
-    routing: candidate.routing,
-    title: candidate.title,
-  }));
-  const candidates = items.map((item) => `- #${item.issue} (${item.routing}) — ${item.title}`).join("\n");
-  // The opening sentence names the condition that authorized this batch:
-  // below a numeric trigger as before, or the always-on mode in its own
-  // words (#988) — never a threshold the configuration does not have.
-  const trigger =
-    input.groomBelow === "always"
-      ? `Grooming is configured \`groomBelow: "always"\` — Duty 2 grooms every tick while ungroomed candidates remain ` +
-        `(${input.summary.routed} routable right now). `
-      : `The routable queue is below the grooming trigger of ${input.groomBelow} (${input.summary.routed} routable). `;
-  const lines = [
-    `## Bounded to-spec grooming batch (${TO_SPEC_BATCH_MARKER}, #777)`,
-    "",
-    trigger +
-      "Duty 2's finding is now a strict contract: launch EXACTLY ONE native `task` batch this turn with the " +
-      `\`${TO_SPEC_AGENT}\` agent — never a second batch, never an improvised scout.`,
-    "",
-    "The conductor selected this batch mechanically from the live open-issue snapshot " +
-      `(issues carrying \`${input.queueLabel}\`, the \`${input.parkLabel}\` park label, issues without exactly one ` +
-      `\`${input.labelPrefix}<repo>\` routing label, parent/epic issues with sub-issues, ` +
-      "already-groomed, refused-on-cooldown, in-flight, lane/dependency-blocked and dispatched candidates were excluded):",
-    candidates,
-    "Excluded this tick — " +
-      `already-groomed: ${exclusions.groomed.length === 0 ? "none" : exclusions.groomed.join(", ")}; ` +
-      `refused, cooldown still holding: ${exclusions.refused.length === 0 ? "none" : exclusions.refused.join(", ")}; ` +
-      `in-flight batches — ${exclusions.inFlight.length === 0 ? "none" : exclusions.inFlight.join(", ")}; ` +
-      `mechanically blocked: ${exclusions.mechanicallyBlocked.length === 0 ? "none" : exclusions.mechanicallyBlocked.join(", ")}; ` +
-      `dispatched now: ${exclusions.dispatched.length === 0 ? "none" : exclusions.dispatched.join(", ")}.`,
-    "",
-    "To launch it:",
-    "",
-    `1. For each candidate above, render \`omp/src/briefs/to-spec.md\` with its placeholders — {{TRACKER_REPO}}, ` +
-      "{{ISSUE_NUMBER}}, {{CANDIDATE_TITLE}}, {{ISSUE_BODY}} (read via `gh issue view <number> --repo " +
-      `${input.tracker}\`, never from memory), {{SOURCE}} = the candidate's routed repo, {{SOURCE_REF}} = that repo's \`` +
-      "current default-branch head, fetched now (`gh api repos/<repo>/branches/HEAD` or `git ls-remote`). Your item " +
-      "`task` MUST start with the two contract lines `to-spec candidate: <owner/repo>#<issue> — <title>` and " +
-      "`to-spec source: <owner/repo>@<ref>` — the `owner/repo` must match the routing named above.",
-    `2. Call \`task\` once with \`context\` whose first line is exactly \`${TO_SPEC_BATCH_MARKER}: ${token}\`, one ` +
-      `item per candidate above, in that order — no substitutes, no extra items (\`agent: "${TO_SPEC_AGENT}"\`; this ` +
-      "extension stamps the exact outputSchema/schemaMode on the way in and refuses a second batch this turn).",
-    `3. When each item completes, whether in the tool result or later as an async-result message, persist the agent's ` +
-      `exact raw output through the \`${TO_SPEC_RESULT_TOOL}\` tool — one call per completed item (\`issue\` + \`input\`), ` +
-      "success and failure alike: a malformed, source-less or stale result persists as blocked and must not discard " +
-      "successful siblings. Read the full output from its `agent://<id>` artifact when the inline text is truncated.",
-    `Never add \`${input.queueLabel}\`, never edit an issue or its labels. This batch produces verdicts only; ` +
-      "promotion stays your decision — the tool_call gate and the store own persistence, you own the queue.",
-    "",
-  ];
-  return { token, block: lines.join("\n"), items };
-}
-
-/**
- * The accounting a low-queue tick owes Duty 2 when the mechanical selection
- * produced no batch at all. Without it a fully-excluded backlog is silence,
- * and silence is what gets re-derived by hand: the orchestrator cannot tell
- * "the queue is low and nothing is groomable" from "the launch machinery did
- * not run". Every count comes from the same predicates the selection and the
- * `tool_call` gate apply (#887).
- *
- * `undefined` when no dispatch row exists or the queue is at/above a numeric
- * grooming trigger (`"always"` opens that gate; candidate state decides, #988)
- * — the same gate the offer itself uses, so this line and a launch block are
- * mutually exclusive.
- */
-export function toSpecNoBatchLine(input: {
-  summary: DispatchSummary | undefined;
-  groomBelow: GroomTrigger;
-  grooming: readonly GroomingRecord[];
-  active: readonly { issue: number }[];
-  now: number;
+  /** The lower bound the promotions were read from, named so the orchestrator
+   *  can tell "nothing happened" from "a narrow window". */
+  since: number;
 }): string | undefined {
-  if (input.summary === undefined) return undefined;
-  if (!groomingDue(input.summary.routed, input.groomBelow)) return undefined;
-  let durable = 0;
-  let refused = 0;
-  let inFlight = 0;
-  let held = 0;
-  for (const row of input.grooming) {
-    if (row.reason === TO_SPEC_IN_FLIGHT_REASON) {
-      if (input.now - row.recordedAt <= TO_SPEC_IN_FLIGHT_TTL_MS) inFlight += 1;
-    } else if (row.reason === "file-lane" || row.reason === "depends-on") {
-      held += 1;
-    } else if (toSpecDurableVerdict(row, input.now) !== undefined) {
-      durable += 1;
-    } else if (toSpecRefusalOnCooldown(row, input.now) !== undefined) {
-      refused += 1;
+  const rejected = input.grooming.flatMap((row) => {
+    const rejection = parseReadyGateRejection(row.evidence);
+    return rejection === undefined ? [] : [{ row, rejection }];
+  });
+  if (input.promotions.length === 0 && rejected.length === 0) return undefined;
+  const lines: string[] = [
+    `Promotion audit (Duty 2) — ${input.promotions.length} auto-promotion(s) since ` +
+      `${new Date(input.since).toISOString()}, ${rejected.length} spec(s) the ready gate refused:`,
+  ];
+  for (const row of input.promotions.slice(0, PROMOTION_AUDIT_LIMIT)) {
+    const at = row.promotedAt === undefined ? "unknown time" : new Date(row.promotedAt).toISOString();
+    const by = row.promotedBy ?? "unrecorded";
+    // The gate that passed is named from the provenance the promoter stored,
+    // never guessed: the audit exists to review what the daemon did
+    // unattended, and a guessed attribution would make that review circular.
+    const gate =
+      by === "daemon"
+        ? "ready gate passed"
+        : by === "orchestrator"
+          ? "promoted by an earlier tick"
+          : "promoted by an operator";
+    lines.push(
+      `- #${row.issue} — verdict ${row.verdict} (${row.reason}); ${gate}; queued ${at} by ${by}. ` +
+        `Demote: omp-conductor verb conductor_label --project ${input.project} ` +
+        `--arg issueUrl=https://github.com/${input.tracker}/issues/${row.issue} ` +
+        `--arg label=${input.queueLabel} --arg action=remove --arg reason=needs-human ` +
+        `--arg rationale="<why this spec is not ready>"`,
+    );
+  }
+  if (input.promotions.length > PROMOTION_AUDIT_LIMIT) {
+    lines.push(`- … ${input.promotions.length - PROMOTION_AUDIT_LIMIT} further promotion(s) not shown.`);
+  }
+  if (rejected.length > 0) {
+    lines.push(
+      "Gate-rejected specs — never queued, and the pass that produced them is already spent, so the " +
+        "issue itself is what has to change. These repeat every tick until they are fixed, which is why " +
+        "each carries the date its gate ran:",
+    );
+    // Oldest rejection first: a spec refused days ago and never edited is the
+    // one the audit keeps re-printing, so it leads rather than sinking under
+    // whatever the last pass produced.
+    const ordered = [...rejected].sort((a, b) => a.rejection.checkedAt - b.rejection.checkedAt);
+    for (const { row, rejection } of ordered.slice(0, PROMOTION_AUDIT_LIMIT)) {
+      const checked =
+        rejection.checkedAt === 0 ? "unknown date" : new Date(rejection.checkedAt).toISOString();
+      lines.push(`- #${row.issue} (gate ran ${checked}) missing: ${rejection.missing.join("; ")}`);
+    }
+    if (rejected.length > PROMOTION_AUDIT_LIMIT) {
+      lines.push(`- … ${rejected.length - PROMOTION_AUDIT_LIMIT} further rejected spec(s) not shown.`);
     }
   }
-  return (
-    `No to-spec batch this tick: the mechanical selection found nothing eligible in the open-issue ` +
-    `snapshot — ${durable} durable verdict(s), ${refused} refused inside the retry cooldown, ${inFlight} ` +
-    `in flight, ${held} lane/dependency-blocked, ${input.active.length} dispatched. A \`task\` call carrying ` +
-    `the ${TO_SPEC_BATCH_MARKER} marker is refused this turn; file or promote from what the backlog already ` +
-    "says instead of re-grooming it."
+  lines.push(
+    "Duty 2 is now three things and no launch: propose net-new scope through a decision row, audit the " +
+      "promotions above (demote what you disagree with, using the command on its line), and edit the " +
+      "gate-rejected issues until the missing fields are there — the daemon re-runs the gate by itself.",
   );
+  return lines.join("\n");
 }
 
 export const TICK_SCOPE_CONSTRAINTS: { readonly [K in ReportScopeChoice]: string } = {
@@ -1616,6 +1017,19 @@ export const TICK_SCOPE_CONSTRAINTS: { readonly [K in ReportScopeChoice]: string
     "Interrupt only for: tier2, fleet-stopped, confirmed-failure; everything else waits for the daily digest.",
 };
 
+/**
+ * Collapses one durable row's prose to a single bounded prompt line.
+ *
+ * Shared by every appended block rather than re-declared inside each: they all
+ * render operator- or model-authored text into a prompt where one pathological
+ * row must not push the duties out of the window, and three private copies of
+ * the same four lines is how one of them ends up unbounded.
+ */
+function flattened(text: string, limit: number): string {
+  const flat = text.replace(/\s+/g, " ").trim();
+  return flat.length <= limit ? flat : `${flat.slice(0, limit - 1)}…`;
+}
+
 /** Bounded, durable source material for one due digest. Row ids are part of the
  * handoff contract: the report and exactly the rows it consumed settle in one
  * SQLite transaction, so a crash cannot lose an outcome between those writes. */
@@ -1624,21 +1038,17 @@ export function formatDigestLedger(
   notices: readonly HeldNotice[],
   backlog: DigestBacklog,
 ): string {
-  const oneLine = (text: string, limit: number): string => {
-    const flat = text.replace(/\s+/g, " ").trim();
-    return flat.length <= limit ? flat : `${flat.slice(0, limit - 1)}…`;
-  };
   const lines = [
     `Durable digest ledger — ${backlog.materialCount} material event(s), ${backlog.heldNoticeCount} held notice(s); oldest first:`,
     ...events.map(
       (event) =>
         `  event ${event.id} | ${new Date(event.occurredAt).toISOString()} | ${event.category} | ` +
-        `${oneLine(event.summary, 180)} | evidence: ${oneLine(event.evidence, 240)}`,
+        `${flattened(event.summary, 180)} | evidence: ${flattened(event.evidence, 240)}`,
     ),
     ...notices.map(
       (notice) =>
         `  notice ${notice.id} | ${new Date(notice.createdAt).toISOString()} | ${notice.category} | ` +
-        `${oneLine(notice.summary, 180)} | detail: ${oneLine(notice.detail, 240)}`,
+        `${flattened(notice.summary, 180)} | detail: ${flattened(notice.detail, 240)}`,
     ),
   ];
   if (backlog.materialCount > events.length) {
@@ -1658,6 +1068,113 @@ export function formatDigestLedger(
   return lines.join("\n");
 }
 
+/**
+ * Reserved `material_events` category for a mechanical amendment the
+ * orchestrator applied on its own authority (Phase 4 — the floor's
+ * mechanical-vs-judgment split).
+ *
+ * There is no amendments table, and neither other durable candidate can carry
+ * this audit honestly. `POLICY.md`'s own `## Amendments` section is written by
+ * step 4 of the floor's *judgment* protocol only — a mechanical fix skips
+ * straight to applying and reporting, so it never lands there — and that
+ * section's line shape (date, trigger, one-sentence summary) has nowhere to put
+ * a revert command. `friction_rollups` counts admission holds and report
+ * classifications and knows nothing about policy edits. `material_events` is
+ * the append-only outbox the floor already uses for every outcome that is not
+ * sent as an interrupt, its category is a free lowercase slug (`event record`
+ * validates `^[a-z0-9][a-z0-9-]{0,31}$`), and both its text columns are
+ * mandatory — `--summary` 1-240 characters, `--evidence` 1-500 — which makes
+ * `evidence` exactly the right home for a one-line revert. So the audit is a
+ * category convention over the ledger that already exists, and needs no schema
+ * change. Note where the cap bites: a revert longer than 500 characters is
+ * refused by `event record` at write time rather than truncated by the renderer
+ * below, so an over-long one is a revert to shorten, never a silently clipped
+ * command an operator would paste.
+ *
+ * The consequence to keep in view: this surface holds what the orchestrator
+ * wrote to it and nothing else. An amendment applied without the ledger write
+ * is invisible here, which is why the floor's mechanical bullet and the
+ * friction digest both name the exact command rather than leaving the shape to
+ * be guessed.
+ */
+export const AMENDMENT_EVENT_CATEGORY = "amendment";
+
+/** Amendment rows rendered in one audit. A window with more self-applied policy
+ *  edits than this is a fleet problem the prompt cannot fix by listing them. */
+const AMENDMENT_AUDIT_LIMIT = 5;
+
+/**
+ * How deep into the outbox the audit reads.
+ *
+ * Deliberately far past {@link DIGEST_BACKLOG_LIMIT}, which bounds one digest's
+ * worth of source material: an audit inheriting that bound would hide a
+ * self-applied policy edit behind twenty merge events, and that row is the one
+ * that must never go unseen.
+ */
+export const AMENDMENT_AUDIT_SCAN_LIMIT = 200;
+
+/**
+ * The one sentence in the tick prompt that states the amendment cap.
+ *
+ * A constant, and used in exactly one rendered block, because the cap is the
+ * clause the floor just re-scoped: it counts *judgment* proposals, and a
+ * mechanical drift fix is not a proposal at all. A second copy of this sentence
+ * anywhere in the prompt is how the old undifferentiated wording comes back —
+ * the audit block below therefore states the duty and never restates the cap.
+ */
+export const AMENDMENT_THROTTLE_LINE =
+  "The cap is at most one new orchestrator-originated judgment amendment proposal per autonomous tick, and it " +
+  "counts judgment proposals only — duties, boundaries, release policy, caps, reporting scope. A mechanical " +
+  "drift fix is not a proposal and is not throttled: apply it, report it with its revert, and apply the next one.";
+
+/**
+ * Mechanical amendments the orchestrator applied without asking, read back to
+ * it before they reach its operator (Phase 4).
+ *
+ * The floor's mechanical branch trades an ask for a promise — apply now, then
+ * say in the next report what changed, why, and how to revert it. This block is
+ * what makes that promise auditable by something other than session memory,
+ * which is exactly the memory the whole ledger discipline exists to distrust.
+ *
+ * The window is "recorded and not yet carried into a delivered digest", not
+ * "since the previous tick". That is the honest predicate rather than the
+ * approximate one: the tick has no durable record of its own previous beat, and
+ * an interval-width window silently drops the audit when a turn runs long or a
+ * digest fails — the two occasions where an unreviewed policy edit is most
+ * likely. Undigested is also self-clearing: composing the report retires the
+ * row, so a reported amendment stops appearing without anyone marking it.
+ *
+ * On a due-digest tick this deliberately overlaps {@link formatDigestLedger},
+ * which lists the same row for a different purpose — the ledger hands over row
+ * ids to consume, the audit hands over a policy edit to re-justify or revert.
+ * Suppressing one because the other rendered would mean a self-applied
+ * amendment goes unreviewed precisely on the tick that ships it.
+ */
+export function formatAmendmentAudit(events: readonly MaterialEvent[]): string | undefined {
+  const amendments = events.filter((event) => event.category === AMENDMENT_EVENT_CATEGORY);
+  if (amendments.length === 0) return undefined;
+  const shown = amendments.slice(0, AMENDMENT_AUDIT_LIMIT);
+  const lines = [
+    `Mechanical amendments you applied without asking — ${amendments.length}, not yet carried into a report. ` +
+      "Each one is a POLICY.md edit made on your own authority, so the audit is yours before it is your operator's:",
+    ...shown.map(
+      (event) =>
+        `- ${new Date(event.occurredAt).toISOString()} | ${flattened(event.summary, 180)} | ` +
+        `revert: ${flattened(event.evidence, 240)}`,
+    ),
+  ];
+  if (amendments.length > shown.length) {
+    lines.push(`- … ${amendments.length - shown.length} further amendment(s) not shown.`);
+  }
+  lines.push(
+    "Re-check each against the source that made it mechanical — the file, config key or ledger row that proves " +
+      "the value. Still true: carry the line into your next report exactly as it reads here, revert command " +
+      "included. No longer true, or a source you can no longer state: run the revert now, and propose the change " +
+      "as a judgment amendment if it is still worth making.",
+  );
+  return lines.join("\n");
+}
+
 /**
  * The reporting constraint appended to a default tick prompt (#229, #242).
  *
@@ -1779,7 +1296,11 @@ export { TELEGRAM_APPROVAL_TOOL };
  *
  * The last clause is the actual hazard #114 exposed: a turn that knows
  * it must ask, and cannot, is one inference away from recording an approval
- * nobody gave.
+ * nobody gave. Phase 4 narrows its noun to a *judgment* amendment, and only its
+ * noun: a mechanical drift fix is applied without an ask by design, so an
+ * undifferentiated "never apply an amendment without an answer" here would
+ * contradict the floor on the branch that has no ask to be missing. The hazard
+ * this rule guards — recording an unanswered yes/no as approved — is unchanged.
  *
  * Unlike {@link TICK_DELIVERY_RULE} this is appended to a configured `message`
  * too. An operator's prompt owns the reporting contract and is theirs to get
@@ -1788,29 +1309,35 @@ export { TELEGRAM_APPROVAL_TOOL };
  */
 export const TICK_APPROVAL_UNAVAILABLE_RULE =
   `The ${TELEGRAM_APPROVAL_TOOL} tool is NOT mounted on this tick, so the package floor's yes/no amendment approval cannot be asked here. ` +
-  `If you have an amendment to propose, deliver the question with \`omp-conductor message --category decision-needed --text "<the question>"\` — ` +
+  `If you have a judgment amendment to propose, deliver the question with \`omp-conductor message --category decision-needed --text "<the question>"\` — ` +
   `it resolves this project's own Telegram chat and topic, records the question as an open decision row, and applies the ` +
   `same availability policy as the tick: an unanswered yes/no stays pending — re-surfaced in every tick until answered ` +
   `or the seven-day expiry, never recorded as approved. ` +
   `Wait for the operator's reply on a later turn, then resolve the row with \`omp-conductor decision resolve <id> --answer "..."\`. ` +
   `A returned answer proves an answer, not Telegram delivery. ` +
-  `Never apply an amendment, or record one as approved, without an explicit answer you actually received.`;
+  `Never apply a judgment amendment, or record one as approved, without an explicit answer you actually received.`;
 
 /**
  * Appended to every tick — the shipped prompt or the operator's own — because
- * the bounded-ask surface is the mechanical contract of a local tick (#438).
+ * the durable ask surface is the mechanical contract of a local tick (#438).
  *
- * Even a *mounted* `telegram_ask` is not the ask surface for a locally injected
- * tick: it would wait for the operator for as long as the answer takes, and on
- * 2026-08-16 that was six stopped hours. The gate refuses it, so the tick names
- * the bounded replacement up front instead of letting the model discover the
- * refusal mid-ask.
+ * No ask waits any more. This session is the headless tick brain: operator
+ * turns land in the 24/7 console session, so an answer physically cannot
+ * arrive here, and a duty cycle that waited would stop the fleet for nothing —
+ * on 2026-08-16 that was six stopped hours. So the rule states the whole
+ * contract up front: the question becomes a durable row, the console resolves
+ * it later, and parking the blocked work is part of the same turn rather than
+ * something the model discovers when a wait expires.
  */
 export const TICK_ASK_RULE =
   `On this locally injected tick, questions to your operator go through ${ASK_TOOL}: ` +
-  `call it with "on-timeout": "auto-proceed" or "park" (what to do when nobody answers within the ceiling) ` +
-  `and optionally "timeoutSeconds" — an ask issued without one still gets the default ceiling, capped at the turn budget. ` +
-  `Several judgement calls about ONE issue go as a single ${QUESTIONNAIRE_TOOL} instead: one delivery, one ceiling, ` +
+  `call it with the question, its options and your recommendation. It does NOT wait — nothing here does. ` +
+  `The question is filed as a durable decision row and delivered, and the answer arrives later, when your ` +
+  `operator resolves that row from the console session (\`omp-conductor decision resolve <id> --answer "..."\`). ` +
+  `So in the SAME turn you ask, park the work the question blocks: take it out of the claimable queue, record ` +
+  `its state, and name the row id in your report. Never wait for a reply, never re-ask on the next tick, and ` +
+  `never proceed as though your recommendation had been approved. ` +
+  `Several judgement calls about ONE issue go as a single ${QUESTIONNAIRE_TOOL} instead: one delivery, ` +
   `each item a durable row bound to that issue, resolved independently and in any order. ` +
   `The ${TELEGRAM_APPROVAL_TOOL} tool is refused here: it would wait for your operator for as long as the answer ` +
   `takes, and an unanswered question must never hold the loop.`;
@@ -1824,8 +1351,8 @@ export const TICK_ASK_RULE =
 export const ASK_DIVERSION_REASON =
   `Blocked: on this locally injected tick, ${TELEGRAM_APPROVAL_TOOL} would wait for your operator for as long as ` +
   `the answer takes, and an unanswered question must never stop the loop (#438). Nothing was sent or recorded ` +
-  `by this call. Ask instead with ${ASK_TOOL}, declaring "on-timeout" ("auto-proceed" or "park") — it bounds the ` +
-  `wait, records the question durably, and returns one of those outcomes when nobody answers.`;
+  `by this call. Ask instead with ${ASK_TOOL} — it records the question as a durable decision row, delivers it, ` +
+  `and returns immediately with the row id and the command your operator's console resolves it with.`;
 
 /**
  * Appended to every tick — the shipped prompt or the operator's own — composed
@@ -1866,7 +1393,17 @@ function frictionLabel(kind: FrictionSignal["kind"]): string {
   return "tick reports classified as surprising";
 }
 
-/** Bounded evidence for the existing approval protocol — never an automatic edit. */
+/**
+ * Bounded evidence for the existing approval protocol — never an automatic edit.
+ *
+ * The closing instruction is the one place the tick prompt routes into the
+ * Learning loop, so it is also where the floor's mechanical-vs-judgment split
+ * has to be visible (Phase 4): the gate sentence is unchanged — friction with no
+ * safe POLICY.md remedy still leaves policy alone — and the two branches under
+ * it say which kind of amendment the remedy is, and what a mechanical one owes
+ * the ledger. It carries {@link AMENDMENT_THROTTLE_LINE} and is the only block
+ * that does.
+ */
 export function formatFrictionDigest(signals: readonly FrictionSignal[]): string {
   const shown = signals.slice(0, FRICTION_DIGEST_LIMIT);
   const lines = [
@@ -1884,12 +1421,24 @@ export function formatFrictionDigest(signals: readonly FrictionSignal[]): string
   if (signals.length > shown.length) lines.push(`- ${signals.length - shown.length} more signal(s) deferred`);
   lines.push(
     "After the tick duties, investigate at most one signal. Use the existing Learning loop only if the recurring cause has a safe POLICY.md remedy; otherwise leave policy unchanged and report or file the underlying product/infra issue through the existing rules.",
+    "When there is a remedy, route it by kind. A drift fact you can verify against the repo, the config or " +
+      "this fleet's own ledger — a renamed label, a moved path, a changed schedule, a caps figure the config " +
+      "already carries — is a MECHANICAL amendment: edit POLICY.md now, then record it with " +
+      '`omp-conductor event record --category ' +
+      AMENDMENT_EVENT_CATEGORY +
+      ' --summary "<what changed and why>" --evidence "<the one-line revert>"`, which is what puts it in the ' +
+      "next tick's amendment audit and in your next report. A remedy that is a choice about how the fleet " +
+      "should behave is a JUDGMENT amendment and goes through the proposal protocol unchanged. " +
+      AMENDMENT_THROTTLE_LINE,
   );
   return lines.join("\n");
 }
 
 /** Bounds one pending idea's text in the tick prompt, like the digest ledger. */
 const INTAKE_TEXT_LIMIT = 160;
+/** Bounds a mined item's provenance key beside its text. Shorter than the text
+ *  because a source is an identifier, not prose — a longer one is malformed. */
+const INTAKE_SOURCE_LIMIT = 80;
 
 /**
  * Pending intake items, each waiting to become an issue (#300).
@@ -1903,19 +1452,31 @@ const INTAKE_TEXT_LIMIT = 160;
  * "0 pending" every tick would be permanent noise — the same convention as
  * {@link queueDigestLine}. Project-specific grooming taste (priority scales,
  * template wording) stays in POLICY.md; this block carries only the floor duty.
+ *
+ * Provenance is rendered per item because the two kinds are not the same work
+ * (Phase 4 signal mining). An item with no `source` is an idea a person typed:
+ * it is scope, and grooming it means writing down what they asked for. A mined
+ * item is a machine's inference from settlement flags, failure classes or
+ * friction — evidence to check against the code before anything is filed, and
+ * the one kind that can be honestly dismissed on the orchestrator's own
+ * judgement when the evidence does not hold up. Rendering them
+ * indistinguishably invited exactly one error: filing a mined guess as though
+ * an operator had asked for it.
  */
 export function formatPendingIntake(
   items: readonly IntakeItem[],
   instruction: { tracker: string; queueLabel: string; labelPrefix: string },
 ): string | undefined {
   if (items.length === 0) return undefined;
-  const oneLine = (text: string): string => {
-    const flat = text.replace(/\s+/g, " ").trim();
-    return flat.length <= INTAKE_TEXT_LIMIT ? flat : `${flat.slice(0, INTAKE_TEXT_LIMIT - 1)}…`;
-  };
+  // Bounded like the text: a mined source is a key, and a pathological one must
+  // not push the grooming instruction out of the prompt window.
+  const provenance = (item: IntakeItem): string =>
+    item.source === undefined
+      ? "your operator's own idea"
+      : `mined signal ${flattened(item.source, INTAKE_SOURCE_LIMIT)}`;
   const lines = [
     `Pending intake — ${items.length} idea(s) captured, waiting to be groomed into issues, oldest first:`,
-    ...items.map((item) => `- ${item.id} — ${oneLine(item.text)}`),
+    ...items.map((item) => `- ${item.id} (${provenance(item)}) — ${flattened(item.text, INTAKE_TEXT_LIMIT)}`),
     "",
     `Groom each into exactly one issue on ${instruction.tracker}: a title stating the problem; a body ` +
       `carrying the product rationale and the acceptance criteria as a checklist; the routing ` +
@@ -1927,6 +1488,12 @@ export function formatPendingIntake(
       'intake --summary "groomed intake <id> → #<issue-number>" --evidence <url>` so the digest names ' +
       "the grooming. An item that is malformed or empty is dismissed with `omp-conductor intake dismiss " +
       "<id>` and noted in the digest rather than filed.",
+    "The two provenances are groomed differently. Your operator's own idea is scope: file what they asked " +
+      "for, and never dismiss it on your own judgement — if it looks wrong, that is a question for them. A " +
+      "mined signal is evidence, not scope: open what its source names, confirm from the code that the " +
+      "problem is real, and file the issue against what you actually find — its wording is a machine's " +
+      "inference and yours to correct. A mined signal the evidence does not support is dismissed, with the " +
+      "reason in the digest.",
   ];
   return lines.join("\n");
 }
@@ -2089,6 +1656,20 @@ export function resolveArmState(armedFile: string, projectName?: string): ArmSta
   return shared ? { armed: true } : { armed: true, legacy: "honoured" };
 }
 
+/**
+ * The one armed-marker write both settlement paths share — the CLI's
+ * `arm --reply` half and the orchestrator session's mechanical reply consumer
+ * (#1061): same content, same mode, and the same restamp of the pre-per-project
+ * shared marker the heartbeat still honours (#316). It lives here, beside
+ * {@link resolveArmState}, so the session consumer can write the gate it reads
+ * — the reverse import (into `fleet.ts`) would cycle.
+ */
+export function writeArmedMarker(path: string, owner: string, arm: ArmState): void {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `armed ${new Date().toISOString()} owner=${owner}\n`, { mode: 0o600 });
+  if (arm.legacy === "honoured") rmSync(legacyArmedMarkerPath(), { force: true });
+}
+
 /**
  * Best-effort recompose of `ORCHESTRATOR.md` from the installed package floor +
  * live `POLICY.md`.
@@ -2165,18 +1746,11 @@ export function readTickConfig(cwd: string): TickConfigResult {
       ? budgetRaw
       : undefined;
 
-  // Same tolerance, same reason. The ask ceiling is bounded on both ends by
-  // construction: MIN..MAX here, and the resolved per-ask ceiling is capped at
-  // the turn budget by the ask tool itself, so a config cannot smuggle an
-  // unbounded wait in through this key.
-  const askRaw = raw["askTimeoutSeconds"];
-  const askTimeoutSeconds =
-    typeof askRaw === "number" &&
-    Number.isInteger(askRaw) &&
-    askRaw >= MIN_ASK_TIMEOUT_SECONDS &&
-    askRaw <= MAX_ASK_TIMEOUT_SECONDS
-      ? askRaw
-      : undefined;
+  // No ask ceiling is read from the config any more: the ask does not wait at
+  // all (#438 as re-cut for the console split), so a stale `askTimeoutSeconds`
+  // on a deployed fleet's `.conductor-tick.json` is simply an unknown key —
+  // ignored like every other one, so an old file on disk can never fail a
+  // restart.
 
   // Relative paths resolve against the session cwd, so the files can sit beside
   // the config that names them (`state/armed`) without hard-coding a deploy path.
@@ -2222,7 +1796,6 @@ export function readTickConfig(cwd: string): TickConfigResult {
       intervalSeconds,
       ...(project === undefined ? {} : { project }),
       ...(budgetSeconds === undefined ? {} : { budgetSeconds }),
-      ...(askTimeoutSeconds === undefined ? {} : { askTimeoutSeconds }),
       ...(armedFile === undefined ? {} : { armedFile }),
       ...(accessFile === undefined ? {} : { accessFile }),
       ...(message === undefined ? {} : { message }),
@@ -2856,12 +2429,6 @@ interface PendingLocalTick {
 interface ActiveLocalTick extends PendingLocalTick {
   /** A person who writes during an autonomous run is awake by construction. */
   humanWaiting: boolean;
-  /** The most recent inbound turn was an *active arming proof* (conductor #415):
-   *  a reply matching a persisted pending challenge for this project. Set when
-   *  `humanWaiting` is, without flipping the human-present exemption — the
-   *  operator answered a challenge, so they are awake, and the model must not
-   *  treat the matching token as license to mutate pairing or access. */
-  armingProof?: boolean;
 }
 
 interface TelegramInterrupt {
@@ -3231,29 +2798,6 @@ interface TickSession {
   legacyArmLogged: boolean;
   /** The local tick whose agent loop is currently running, if any. */
   activeLocalTick?: ActiveLocalTick;
-  /**
-   * The to-spec launch token the last low-queue tick authorized (#777). Set
-   * when the tick appended a launch block; the `task` tool_call gate accepts
-   * exactly one batch echoing it and refuses a marker-bearing call without
-   * it (no authorized batch this tick), with a stale token, or after a batch
-   * was already accepted. Cleared at the start of every tick — healthy and
-   * low-queue alike — so a token minted on a low-queue tick can never be
-   * spent on a later healthy-queue tick; the tick that mints the next token
-   * sets it fresh with its own {@link TickSession.launchItems}.
-   */
-  launchToken?: string;
-  /** The project the {launchToken} authorization was minted for — the one
-   *  in-flight rows are recorded against. */
-  launchProject?: string;
-  /** The mechanically selected batch the current token authorizes: the gate
-   *  refuses any item whose issue or routing is not on this list, so parked,
-   *  parent/epic and other excluded candidates cannot be stamped in-flight
-   *  no matter what the model sends. */
-  launchItems?: ToSpecLaunchItem[];
-  /** The one batch this session's gate has let through, so a second attempt
-   *  this tick refuses, and the tool_result capture can match results to
-   *  items by index. */
-  launchedBatch?: { toolCallId: string; items: ToSpecBatchItem[] };
 }
 
 /**
@@ -3342,14 +2886,8 @@ async function tick(
   config: TickConfig,
   session: TickSession,
   toSpecTrackerSeam: ToSpecTrackerSeam | undefined,
+  armSeam: ArmConsumerSeam | undefined,
 ): Promise<void> {
-  // A launch authorization belongs to one emitted tick only. Revoke it before
-  // any gate, config, store or tracker read so a skipped/degraded/healthy next
-  // tick cannot reuse a token minted by an earlier low-queue tick.
-  session.launchedBatch = undefined;
-  session.launchToken = undefined;
-  session.launchProject = undefined;
-  session.launchItems = undefined;
   const live = currentConfig(ctx.cwd, config);
   const arm = live.armedFile === undefined ? undefined : resolveArmState(live.armedFile, live.project);
   if (arm?.legacy === "stranded" && !session.legacyArmLogged) {
@@ -3358,6 +2896,29 @@ async function tick(
       `[omp-conductor] ${legacyArmedMarkerPath()}: ${LEGACY_ARM_MARKER_DETAIL} — this heartbeat stays disarmed`,
     );
   }
+  // An unanswered ceremony that passed its window is a dead ceremony, not a
+  // silent one (#1061): the tick that notices tells the operator why and how
+  // to re-run it, on the surface the challenge was sent to. Deliberately
+  // before the tick gate — a disarmed fleet is exactly the state an
+  // unanswered challenge leaves, and its death notice must not wait for an
+  // arm to be heard. The scan is synchronous so an idle host (no expired
+  // records) costs the tick nothing; only a send is awaited.
+  const armNow = (armSeam?.now ?? Date.now)();
+  for (const expired of expiredArmChallenges(live.project, armNow)) {
+    const surface: ArmNoticeSurface = { accessFile: live.accessFile, project: live.project };
+    const send = armSeam?.notify ?? sendArmNotice;
+    try {
+      await send(armExpiryNotice(expired, live.project), surface);
+    } catch (err) {
+      // Keep the record: the next heartbeat retries, and `doctor` still
+      // reports it.
+      pi.logger.error(
+        `[omp-conductor] arm expiry notice not delivered: ${err instanceof Error ? err.message : String(err)}`,
+      );
+      continue;
+    }
+    clearArmTransaction(expired.key, expired.id);
+  }
   const decision = tickDecision({
     armed: arm === undefined || arm.armed,
     channelOk: live.accessFile === undefined || channelIsUp(live.accessFile),
@@ -3563,6 +3124,17 @@ async function tick(
           now - FRICTION_COOLDOWN_MS,
         );
         if (frictionSignals.length > 0) content = `${content}\n${formatFrictionDigest(frictionSignals)}`;
+        // Policy edits the session made on its own authority, read back before
+        // they reach the operator (Phase 4). Placed directly after the friction
+        // digest and before the decision rows because that is the order of the
+        // Learning loop itself: the evidence that provokes an amendment, then
+        // the mechanical ones already applied and owed a report, then the
+        // judgment ones still waiting on an answer. The scan reaches past one
+        // digest's worth of backlog on purpose — see AMENDMENT_AUDIT_SCAN_LIMIT.
+        const amendments = formatAmendmentAudit(
+          frictionStore.undigestedMaterialEvents(scope.projectName, AMENDMENT_AUDIT_SCAN_LIMIT),
+        );
+        if (amendments !== undefined) content = `${content}\n${amendments}`;
         // What the session still owes its operator, read from the ledger rather
         // than from what it remembers asking (#136). Appended every tick,
         // because the whole failure was a question surviving in context only.
@@ -3609,16 +3181,13 @@ async function tick(
           const grooming = store.groomingVerdicts(projectName);
           // #848: "the queue is empty / running dry" is the tracker's word, not
           // the last dispatch pass's echo. One open-issue snapshot per tick,
-          // read live through the same authoritative tracker surface the
-          // to-spec launch uses, overlaid with the label_ops projection
-          // exactly as the dispatch pass judges eligibility — so a promotion,
-          // unblock or projection write after the last dispatch pass is
-          // visible on the very next tick even while a drain holds claiming.
-          // The digest consumes the overlay as the live inventory; the to-spec
-          // offer shares the same raw snapshot so one tick cannot describe two
-          // queues. If the tracker read fails, the digest falls back to
-          // explicitly dated wording (never a present-tense empty claim),
-          // and the offer retries its own read exactly as it did before.
+          // read live through the authoritative tracker surface, overlaid with
+          // the label_ops projection exactly as the dispatch pass judges
+          // eligibility — so a promotion, unblock or projection write after the
+          // last dispatch pass is visible on the very next tick even while a
+          // drain holds claiming. If the tracker read fails, the digest falls
+          // back to explicitly dated wording, never a present-tense empty
+          // claim.
           //
           // The read is made only for dispatch rows the digest could render:
           // a healthy row (routed at/above a numeric grooming threshold)
@@ -3627,16 +3196,14 @@ async function tick(
           // below the trigger) is exactly where the old wording lied, so every
           // such tick reads the live queue. Under `groomBelow: "always"`
           // (#988) the duty never clears on volume, so every dispatch row
-          // reads the queue and the selectors judge candidate state.
+          // reads the queue.
           const needsQueueRead =
             dispatch !== undefined &&
             (dispatch.ready === 0 || dispatch.routed === 0 || groomingDue(dispatch.routed, groomBelow));
           let queueObservation: QueueObservation | undefined;
-          let openSnapshot: readonly ReadyIssue[] | undefined;
           if (toSpecTrackerSeam !== undefined && needsQueueRead) {
             try {
               const open = await toSpecTrackerSeam.listOpenIssues(project);
-              openSnapshot = open;
               const effective = open.map((issue) => {
                 const pending = store.pendingLabelOpsFor(projectName, issue.number);
                 return pending.length === 0
@@ -3659,57 +3226,29 @@ async function tick(
             groomBelow,
             grooming,
             queueObservation,
-            // One clock for the inventory and the offer below: the digest must
-            // never call a verdict durable that the same tick's selection is
+            // One clock for the inventory and the audit below: the digest must
+            // never call a verdict durable that the daemon's own selection is
             // about to re-groom (#887).
             now,
           );
           if (queue !== undefined) content = `${content}\n${queue}`;
-          // #777: the mechanical to-spec launch boundary. The queue digest is
-          // the trigger — the same below-`groomBelow` signal that already asks
-          // the orchestrator to groom — so the launch offer is composed beside
-          // it, from the same store read, and only when a dispatch row exists
-          // to prove the queue is genuinely low. The token it carries is the
-          // only authorization the `task` tool_call gate accepts this tick;
-          // absent a block (healthy queue, no dispatch, unreadable snapshot,
-          // nothing eligible) a task call with the batch marker is refused.
-          //
-          // Every tick owns its authorization fresh — the clears above ran
-          // before the reads, so the offer below can only mint for THIS tick.
-          const toSpecActive = store.activeRuns(projectName);
-          const launch = await offerToSpecLaunch({
-            summary: dispatch,
-            groomBelow,
+          // The Duty-2 audit that replaced #777's launch block (#1041/#1040).
+          // The daemon promotes unattended, so what the tick owes is review,
+          // and the window is two intervals wide for the same reason the
+          // recovery digest's is: a tick that ran long must not drop the
+          // promotions it was meant to audit. A tick that reports nothing
+          // renders nothing — the store, not this call site, decides whether
+          // there is anything to say.
+          const auditSince = now - 2 * config.intervalSeconds * 1_000;
+          const audit = formatPromotionAudit({
+            promotions: store.promotionsSince(projectName, auditSince),
             grooming,
-            active: toSpecActive,
-            issues: openSnapshot,
-            project,
-            trackerSeam: toSpecTrackerSeam,
-            now,
+            project: project.name,
+            tracker: project.tracker.repo,
+            queueLabel: project.queueLabel,
+            since: auditSince,
           });
-          if (launch !== undefined) {
-            content = `${content}\n${launch.block}`;
-            // A minted token authorizes exactly the batch this tick's block
-            // describes: the project and the allowlist are captured so the
-            // tool_call gate records in-flight rows against the same project
-            // the prompt named and refuses any item off the list.
-            session.launchProject = project.name;
-            session.launchToken = launch.token;
-            session.launchItems = launch.items;
-          } else if (openSnapshot !== undefined) {
-            // A low queue with nothing eligible is a finding, not silence: the
-            // snapshot read succeeded, so the exclusions — and only they — are
-            // why no batch is offered. Rendered only when the read succeeded,
-            // so a tracker failure never masquerades as "nothing eligible".
-            const noBatch = toSpecNoBatchLine({
-              summary: dispatch,
-              groomBelow,
-              grooming,
-              active: toSpecActive,
-              now,
-            });
-            if (noBatch !== undefined) content = `${content}\n${noBatch}`;
-          }
+          if (audit !== undefined) content = `${content}\n${audit}`;
           // Pending intake is the same class of standing block as the friction
           // and decisions read-outs: a store-backed duty the orchestrator must
           // not derive from memory. The store answers, the prompt instructs.
@@ -3720,7 +3259,8 @@ async function tick(
           });
           if (pendingIntake !== undefined) content = `${content}\n${pendingIntake}`;
         } catch {
-          // unreadable config: no queue digest, launch block, or pending-intake block this tick
+          // unreadable config: no queue digest, promotion audit, or
+          // pending-intake block this tick
         }
       } catch (err) {
         frictionStore?.close();
@@ -3887,11 +3427,12 @@ function armTickHeartbeat(
   config: TickConfig,
   session: TickSession,
   toSpecTrackerSeam: ToSpecTrackerSeam | undefined,
+  armSeam: ArmConsumerSeam | undefined,
 ): void {
   writeTickRuntimeStatus(pi, ctx.cwd, config.intervalSeconds);
   const runScheduledTick = async (): Promise<void> => {
     try {
-      await tick(pi, ctx, config, session, toSpecTrackerSeam);
+      await tick(pi, ctx, config, session, toSpecTrackerSeam, armSeam);
     } finally {
       writeTickRuntimeStatus(pi, ctx.cwd, config.intervalSeconds);
     }
@@ -3947,7 +3488,7 @@ function armTickHeartbeat(
   // call runs inside the session_start handler dispatch, which cannot see an
   // async rejection — an escaped one reaches the process-level
   // unhandledRejection handler and takes the session down.
-  void tick(pi, ctx, config, session, toSpecTrackerSeam).catch((err) => {
+  void tick(pi, ctx, config, session, toSpecTrackerSeam, armSeam).catch((err) => {
     pi.logger.error(
       `[omp-conductor] arm-time tick failed: ${err instanceof Error ? err.message : String(err)}`,
     );
@@ -3992,325 +3533,229 @@ function armTickGuard(pi: TickApi, ctx: TickContext, budgetMs: number): void {
 }
 
 /**
- * The harness surface one to-spec batch travels through (#777): the `task`
- * tool call the orchestrator makes (with the launch marker in `context`) and
- * its result. `details` is the task tool's `TaskToolDetails` — declared here
- * rather than imported, exactly like {@link TickApi}, because the harness is
- * a peer dependency. A settled batch's `details.results` carries one entry
- * per item; a background launch returns an empty `results` array and delivers
- * each final result later as an async-result message, which the orchestrator
- * routes through {@link TO_SPEC_RESULT_TOOL}.
+ * Factory-time seams for the extension, used by tests. Production runs
+ * `orchestratorTickExtension(pi)` with no options and gets the module's own
+ * real-time defaults; the `ask` seam hands the registered {@link ASK_TOOL} an
+ * injected clock (`now`) so the filed row's timestamp is deterministic. There
+ * is no wait seam any more: the ask does not wait (#438 as re-cut for the
+ * console split), so there is no timer for a test to control.
  */
-interface ToSpecTaskToolEvent {
-  toolName: string;
-  toolCallId: string;
-  input: Record<string, unknown>;
-  details: unknown;
+export interface OrchestratorTickExtensionOptions {
+  ask?: {
+    now?: () => number;
+  };
+  /**
+   * The authoritative tracker surface the queue digest reads (#848).
+   * Production omits it and the extension builds the real seam over the
+   * existing Tracker adapter for each project; tests inject deterministic
+   * fakes so the digest's live inventory is provable without a network. An
+   * unreadable snapshot leaves the digest dated rather than claiming a
+   * present-tense empty queue.
+   */
+  toSpec?: { tracker?: ToSpecTrackerSeam };
+  /**
+   * The arm ceremony's mechanical consumer seams (#1061). Production omits
+   * them and the extension classifies inbound turns against the pending
+   * challenge records itself, sending confirmations and expiry notices over
+   * the same bridge transport `armTicks` sends the challenge on. Tests inject
+   * a recorder (`notify`) and a fixed clock (`now`) so the settle and the
+   * notices are provable without Telegram or timers.
+   */
+  arm?: {
+    now?: () => number;
+    notify?: ArmNoticeFn;
+  };
 }
 
-/** One settled batch item, as `details.results` carries it. */
-interface ToSpecSettledItem {
-  /** The item's index inside the batch call. */
-  index?: unknown;
-  /** The agent's raw output — the exact text that must reach the parser. */
-  output?: unknown;
-  /** The harness's parsed structured output, when one exists. */
-  structuredOutput?: unknown;
+/** The send surface an arm notice rides: the live tick config's channel and project. */
+export interface ArmNoticeSurface {
+  accessFile?: string;
+  project?: string;
 }
 
 /**
- * The launch gate and result capture for one to-spec batch (#777). Armed at
- * extension-factory time; inert until a low-queue tick mints a launch token.
- *
- * `tool_call` on `task`:
- *  - a call without the {@link TO_SPEC_BATCH_MARKER} in `context` is the
- *    orchestrator's own task use and passes untouched;
- *  - a marker-bearing call is the conductor batch and is gated hard: it needs
- *    this tick's exact token, the batch shape (1..{@link TO_SPEC_BATCH_MAX}
- *    items, each starting with the two contract lines), unique items and
- *    names, every item ON the tick's mechanically selected allowlist (issue
- *    and routing — the parked/parent/epic exclusions are baked into that
- *    list, so a forbidden candidate can never be stamped in-flight), and
- *    store-side eligibility — the same {@link toSpecCandidateExclusion} rule
- *    the prompt block's exclusion lines came from, so an item excluded in
- *    prose is excluded in the gate for the same reason;
- *  - on acceptance it stamps every item's `agent`, `outputSchema` and
- *    `schemaMode` (the model never carries the schema itself), records the
- *    durable in-flight rows through the #735 grooming table, and latches the
- *    session so a second batch this tick refuses.
- *
- * `tool_result` on the accepted call captures a *settled* batch: every item
- * is routed through {@link recordToSpecGrooming} independently, so a
- * malformed or failed item persists `blocked` and its siblings survive. A
- * background launch settles with no results here — its completed items arrive
- * as async-result messages and are persisted through
- * {@link TO_SPEC_RESULT_TOOL}.
+ * One mechanical Telegram send the arm consumer raises: the confirmation when
+ * a reply settles the ceremony, or the expiry notice when a challenge dies
+ * unanswered. The default is {@link sendArmNotice}; tests record instead.
  */
-function armToSpecGate(pi: TickApi, session: TickSession): void {
-  const api = pi as TickApi & {
-    on(
-      event: "tool_call",
-      handler: (
-        event: { toolName: string; toolCallId: string; input: Record<string, unknown> },
-        ctx: unknown,
-      ) => { block: true; reason: string } | { input: Record<string, unknown> } | undefined,
-    ): void;
-    on(event: "tool_result", handler: (event: ToSpecTaskToolEvent, ctx: unknown) => void): void;
-  };
+export type ArmNoticeFn = (text: string, surface: ArmNoticeSurface) => Promise<void> | void;
 
-  api.on("tool_call", (event) => {
-    if (event.toolName !== "task") return undefined;
-    const input = event.input;
-    const context = input["context"];
-    if (typeof context !== "string" || !context.includes(TO_SPEC_BATCH_MARKER)) return undefined;
-    // From here on this is a conductor grooming batch — the hard gate. Each
-    // refusal names the correction, because a blocked batch costs the tick a
-    // retry and the gate is meant to catch model error, not to hide it.
-    if (session.launchToken === undefined) {
-      return {
-        block: true,
-        reason:
-          `task refused: no to-spec batch is authorized this tick (` +
-          `only a low-queue tick's launch block names a ${TO_SPEC_BATCH_MARKER} token). ` +
-          "Run no batch this turn.",
-      };
-    }
-    if (session.launchedBatch !== undefined) {
-      return {
-        block: true,
-        reason: "task refused: this tick already launched its one to-spec batch. Wait for the results.",
-      };
-    }
-    const token = new RegExp(`${TO_SPEC_BATCH_MARKER}:\\s*(\\S+)`).exec(context)?.[1];
-    if (token !== session.launchToken) {
-      return {
-        block: true,
-        reason:
-          "task refused: the context token does not match the batch this tick authorized. " +
-          "Relaunch with the token named in this tick's launch block.",
-      };
-    }
-    const tasks = input["tasks"];
-    if (!Array.isArray(tasks) || tasks.length === 0 || tasks.length > TO_SPEC_BATCH_MAX) {
-      return {
-        block: true,
-        reason:
-          `task refused: a to-spec batch carries 1–${TO_SPEC_BATCH_MAX} items (one \`tasks[]\` call) — ` +
-          `got ${Array.isArray(tasks) ? tasks.length : "none"}.`,
-      };
-    }
-    const items: ToSpecBatchItem[] = [];
-    const names = new Set<string>();
-    for (const raw of tasks) {
-      if (typeof raw !== "object" || raw === null) {
-        return { block: true, reason: "task refused: every batch item must be an object." };
-      }
-      const item = parseToSpecItem((raw as Record<string, unknown>)["task"]);
-      if (item === undefined) {
-        return {
-          block: true,
-          reason:
-            "task refused: every item's `task` must start with the two contract lines " +
-            "`to-spec candidate: <owner/repo>#<issue> — <title>` and `to-spec source: <owner/repo>@<ref>`.",
-        };
-      }
-      const name = (raw as Record<string, unknown>)["name"];
-      if (typeof name === "string" && name.length > 0) {
-        if (names.has(name)) {
-          return { block: true, reason: `task refused: duplicate item name \`${name}\`.` };
-        }
-        names.add(name);
-      }
-      items.push(item);
-    }
-    for (let i = 1; i < items.length; i += 1) {
-      for (let j = 0; j < i; j += 1) {
-        if (items[j]!.issue === items[i]!.issue) {
-          return {
-            block: true,
-            reason: `task refused: #${items[i]!.issue} appears twice in one batch.`,
-          };
-        }
-      }
-    }
-    // The allowlist is the mechanical selection this tick's token authorized:
-    // every item's issue number AND routing must match an entry the launch
-    // offer produced from the authoritative tracker snapshot. Parked,
-    // parent/epic, already-groomed, in-flight, held and dispatched candidates
-    // were never on it, so no item carrying one can be stamped in-flight here
-    // — the model cannot self-select past the conductor's selection (#805).
-    const allowlist = session.launchItems;
-    if (allowlist === undefined) {
-      return {
-        block: true,
-        reason:
-          "task refused: this tick's launch did not carry a mechanically selected batch — " +
-          "re-tick before launching.",
-      };
-    }
-    for (const item of items) {
-      if (!allowlist.some((allowed) => allowed.issue === item.issue && allowed.routing === item.routing)) {
-        const listed = allowlist.map((allowed) => `#${allowed.issue} (${allowed.routing})`).join(", ");
-        return {
-          block: true,
-          reason:
-            `task refused: #${item.issue} is not on this tick's mechanically selected to-spec batch ` +
-            `(${listed}). Launch exactly the selected candidates, no substitutes.`,
-        };
-      }
-    }
-    const projectName = session.launchProject;
-    if (projectName === undefined) {
-      return {
-        block: true,
-        reason: "task refused: the batch was authorized without a project — re-tick before launching.",
-      };
-    }
-    // Store-side eligibility, the same rule the prompt block's exclusion list
-    // came from. Eligible items then become durable in-flight rows, so a
-    // crashed batch still suppresses re-launch until the TTL expires.
-    let store: Store | undefined;
+/** The consumer's injectable clock and transport, carried into the tick's helpers. */
+export interface ArmConsumerSeam {
+  now?: () => number;
+  notify?: ArmNoticeFn;
+}
+
+/**
+ * The plain text of an inbound message, for the arm classifier. Content blocks
+ * join with newlines so a code split across block boundaries still tokenises
+ * whole; non-text blocks contribute nothing. `undefined` for an absent or
+ * empty message, which is ordinary chat either way.
+ */
+function inboundMessageText(content: readonly { type?: string; text?: string }[] | undefined): string | undefined {
+  if (content === undefined || content.length === 0) return undefined;
+  const text = content.map((block) => block.text ?? "").join("\n");
+  return text.length === 0 ? undefined : text;
+}
+
+/**
+ * The ready-to-send expiry notice: the reason — never answered, or answered
+ * but never settled — and the exact command that re-runs the ceremony. The
+ * code is the proof and is never named in a notice; only the window is.
+ */
+function armExpiryNotice(expired: { key: string; sighting: ArmChallengeSighting }, project: string | undefined): string {
+  const reissue =
+    expired.key === FLEET_ARM_KEY || project === undefined || project === ""
+      ? "omp-conductor arm"
+      : `omp-conductor arm --project ${project}`;
+  const sentAt =
+    expired.sighting.sentAt === undefined
+      ? ""
+      : ` sent ${new Date(expired.sighting.sentAt).toISOString()}`;
+  const reason =
+    expired.sighting.acknowledgedAt === undefined
+      ? `The arming challenge${sentAt} expired without being answered — nothing is armed.`
+      : `The arming challenge${sentAt} was answered but never settled before its window closed — nothing is armed.`;
+  return `${reason} Send a fresh one: ${reissue}`;
+}
+
+/**
+ * The default transport for the arm consumer's confirmation and expiry
+ * notices: the same bot token, paired channel and project topic `armTicks`
+ * sends the challenge on, so the notice lands on the surface the operator was
+ * asked in. Deliberately not availability-gated — the ceremony is the
+ * operator's own interaction, exactly like the challenge send itself, and a
+ * notice held for quiet hours would be the silent failure #1061 removes. Any
+ * missing or down fact throws; the caller logs and keeps the challenge record
+ * so the next heartbeat retries and `doctor` still reports it.
+ */
+export async function sendArmNotice(text: string, surface: ArmNoticeSurface): Promise<void> {
+  if (surface.accessFile === undefined) {
+    throw new Error("no accessFile — the arm notice has no channel");
+  }
+  const channel = readTelegramChannel(surface.accessFile);
+  if (channel.kind === "down") {
+    throw new Error(`escalation channel is not up (${surface.accessFile}): ${channel.reason}`);
+  }
+  const token = readTelegramToken();
+  if (token === undefined) {
+    throw new Error("no Telegram bot token readable — the arm notice cannot send");
+  }
+  let topicId: number | undefined;
+  if (surface.project !== undefined) {
     try {
-      store = openStore(dbPath());
-      const byIssue = new Map(
-        store.groomingVerdicts(projectName).map((row) => [row.issue, row] as const),
-      );
-      const active = new Set(store.activeRuns(projectName).map((run) => run.issue));
-      const now = Date.now();
-      for (const item of items) {
-        const reason = toSpecCandidateExclusion(
-          { issue: item.issue },
-          { grooming: byIssue.get(item.issue), active: active.has(item.issue) },
-          now,
-        );
-        if (reason !== undefined) {
-          return {
-            block: true,
-            reason: `task refused: ${reason}. Drop that item (and every other listed exclusion) from this batch and re-call.`,
-          };
-        }
-      }
-      const launchedEvidence = JSON.stringify({
-        kind: "to-spec-in-flight",
-        launchedAt: now,
-        batch: token,
-        agent: TO_SPEC_AGENT,
-      });
-      for (const item of items) {
-        store.upsertGrooming({
-          project: projectName,
-          issue: item.issue,
-          verdict: "blocked",
-          reason: TO_SPEC_IN_FLIGHT_REASON,
-          evidence: launchedEvidence,
-          at: now,
-        });
-      }
-    } catch (err) {
-      pi.logger.error(
-        `[omp-conductor] to-spec launch not recorded: ${err instanceof Error ? err.message : String(err)}`,
-      );
-      return {
-        block: true,
-        reason: `task refused: the launch could not be recorded durably (${
-          err instanceof Error ? err.message : String(err)
-        }); nothing was started.`,
-      };
-    } finally {
-      store?.close();
+      topicId = resolveProjectTopicId(findProject(loadConfig(), surface.project));
+    } catch {
+      /* no project config — flat chat, exactly like armTicks */
     }
-    const stampedTasks = tasks.map((raw) => ({
-      ...(raw as Record<string, unknown>),
-      agent: TO_SPEC_AGENT,
-      outputSchema: TO_SPEC_SCHEMA,
-      schemaMode: "strict",
-    }));
-    session.launchedBatch = { toolCallId: event.toolCallId, items };
-    pi.logger.info(
-      `[omp-conductor] to-spec batch launched: ${items.map((item) => `#${item.issue}`).join(", ")} (${token})`,
+  }
+  await sendTelegram(token, channel.owner, text, { topicId });
+}
+
+/**
+ * The settle half of the mechanical consumer: write the markers the matched
+ * challenge recorded and clear its transaction, then confirm on the
+ * challenge's surface. The recorded targets are the contract — the exact rule
+ * `armReply` applies — so nothing is ever armed that the challenge did not
+ * name. A pre-targets record (one release of overlap) is not settled here:
+ * nothing in-session may guess a marker the challenge never recorded; the CLI
+ * half still settles it, and the operator is told so.
+ */
+function settleInboundArmMatch(
+  pi: TickApi,
+  match: ArmReplyMatch,
+  notify: (text: string) => void,
+): void {
+  if (match.targets === undefined || match.owner === undefined) {
+    pi.logger.error(
+      "[omp-conductor] an inbound arming code matched a pre-targets challenge — nothing armed in-session; " +
+        'run `omp-conductor arm --reply "<the reply>"` to settle it',
     );
-    return { input: { ...input, tasks: stampedTasks } };
-  });
+    return;
+  }
+  for (const target of match.targets) {
+    const state = resolveArmState(target.armedFile, target.project);
+    writeArmedMarker(target.armedFile, match.owner, state);
+  }
+  clearArmTransaction(match.key, match.id);
+  const label =
+    match.targets.length === 1 && match.targets[0]!.project !== undefined
+      ? `project ${match.targets[0]!.project}`
+      : `${match.targets.length} project(s)`;
+  notify(`Arming verified — ${label} armed. The reply was consumed; nothing else to do.`);
+}
 
-  api.on("tool_result", (event) => {
-    if (event.toolName !== "task") return;
-    const batch = session.launchedBatch;
-    if (batch === undefined || event.toolCallId !== batch.toolCallId) return;
-    const projectName = session.launchProject;
-    if (projectName === undefined) return;
-    const details = event.details as { results?: unknown } | undefined;
-    const results = details?.results;
-    if (!Array.isArray(results) || results.length === 0) {
-      // Background launch: the settled items arrive later through
-      // TO_SPEC_RESULT_TOOL; the in-flight rows keep them out of any new batch
-      // until then.
-      return;
-    }
-    let store: Store | undefined;
+/**
+ * The arm ceremony's mechanical consumer (#1061): classify one inbound user
+ * turn against this host's pending challenges and, on a match, settle the
+ * ceremony exactly as `omp-conductor arm --reply` would — markers for the
+ * recorded targets, transaction cleared, a confirmation on the surface the
+ * challenge was sent to. This is the real owner the ceremony needed on a host
+ * with no console session: the challenge goes to the project topic, which is
+ * this pane's own claimed surface, so the reply lands here and the ceremony
+ * completes with no second human command. A code past its window is answered
+ * with the re-run command and the dead record is cleared; a lookalike matching
+ * nothing stays inert (#415's non-disclosure bound is unchanged).
+ *
+ * Never throws: an inbound message must not take the session down. Failures
+ * are logged and the CLI half of the ceremony stays available.
+ */
+function consumeInboundArmReply(
+  pi: TickApi,
+  cwd: string,
+  startupProject: string | undefined,
+  text: string,
+  seam: ArmConsumerSeam | undefined,
+): void {
+  // The state key the send half derived from the same file, read fresh so a
+  // re-stamp between the send and the reply cannot split the ceremony. An
+  // invalid config cannot be trusted to name either the key or a marker —
+  // fail closed exactly like `armReply`, but without throwing at a message.
+  const reread = readTickConfig(cwd);
+  if (reread.kind === "invalid") {
+    pi.logger.error(
+      `[omp-conductor] inbound arm reply not classified — tick config invalid at ${reread.path}: ` +
+        `${reread.problem}; use \`omp-conductor arm --reply\` on the host`,
+    );
+    return;
+  }
+  const project = reread.kind === "ok" ? reread.config.project : startupProject;
+  const surface: ArmNoticeSurface = {
+    ...(reread.kind === "ok" ? { accessFile: reread.config.accessFile } : {}),
+    project,
+  };
+  const now = (seam?.now ?? Date.now)();
+  const resolved = resolveArmReply(project, text, now);
+  const notify = (notice: string): void => {
+    const send = seam?.notify ?? sendArmNotice;
     try {
-      store = openStore(dbPath());
-      for (const entry of results) {
-        const settled = entry as ToSpecSettledItem;
-        const item = batch.items[typeof settled.index === "number" ? settled.index : -1];
-        if (item === undefined) continue;
-        // The raw output is the contract input — exactly as returned, even
-        // when the item failed: the strict parser turns anything unparseable
-        // into a blocked row, and a failed sibling never touches the others.
-        const raw = typeof settled.output === "string" ? settled.output : "";
-        const structured = settled.structuredOutput;
-        const fallback =
-          structured !== null &&
-          typeof structured === "object" &&
-          typeof (structured as { data?: unknown }).data === "object"
-            ? JSON.stringify((structured as { data?: unknown }).data)
-            : "";
-        try {
-          recordToSpecGrooming(store, {
-            project: projectName,
-            issue: item.issue,
-            input: raw.trim().length > 0 ? raw : fallback,
-          });
-        } catch (err) {
-          pi.logger.error(
-            `[omp-conductor] to-spec result not persisted for #${item.issue}: ${
-              err instanceof Error ? err.message : String(err)
-            }`,
-          );
-        }
-      }
+      // The send is async on the production path; message_start handlers are
+      // not, so delivery rides the microtask queue and its failure lands in
+      // the log, never on the session.
+      void Promise.resolve(send(notice, surface)).catch((err: unknown) => {
+        pi.logger.error(
+          `[omp-conductor] arm notice not delivered: ${err instanceof Error ? err.message : String(err)}`,
+        );
+      });
     } catch (err) {
       pi.logger.error(
-        `[omp-conductor] to-spec results not captured: ${err instanceof Error ? err.message : String(err)}`,
+        `[omp-conductor] arm notice not delivered: ${err instanceof Error ? err.message : String(err)}`,
       );
-    } finally {
-      store?.close();
     }
-  });
-}
-
-/**
- * Factory-time seams for the extension, used by tests. Production runs
- * `orchestratorTickExtension(pi)` with no options and gets the module's own
- * real-time defaults; the `ask` seam hands the registered {@link ASK_TOOL} an
- * injected clock (`wait`/`now`) so the two timeout outcomes can be proven
- * through the real tool deterministically, without real timers (#683).
- */
-export interface OrchestratorTickExtensionOptions {
-  ask?: {
-    wait?: (ms: number) => Promise<void>;
-    now?: () => number;
-    /** Injected interactive delivery surface (#722); production builds its own. */
-    interactive?: AskInteractiveDelivery;
   };
-  /**
-   * The authoritative tracker surface the low-queue to-spec launch reads
-   * (#777). Production omits it and the extension builds the real seam over
-   * the existing Tracker adapter for each project; tests inject deterministic
-   * fakes so the mechanical selection is provable without a network. A
-   * low-queue launch without a readable snapshot is refused entirely — the
-   * launch fails closed rather than trusting the model to self-filter.
-   */
-  toSpec?: { tracker?: ToSpecTrackerSeam };
+  if (resolved.verdict === "matched") {
+    settleInboundArmMatch(pi, resolved.match, notify);
+    return;
+  }
+  // A code past its window: the ceremony is dead, so answer the person who is
+  // clearly trying to complete it — and clear the expired record so neither
+  // this path nor the heartbeat ever notifies twice.
+  if (resolved.verdict === "expired") {
+    for (const expired of expiredArmChallenges(project, now)) {
+      notify(armExpiryNotice(expired, project));
+      clearArmTransaction(expired.key, expired.id);
+    }
+  }
 }
 
 export default function orchestratorTickExtension(
@@ -4337,17 +3782,13 @@ export default function orchestratorTickExtension(
   let releaseGateArmed = false;
   let availabilityGateArmed = false;
   let guardArmed = false;
-  // #777: the to-spec launch gate is factory-time like the tick guard. It acts
-  // only when a low-queue tick has minted a launch token, so on any other
-  // session — or any healthy queue — it observes `task` calls without touching
-  // them.
-  armToSpecGate(pi, session);
-  // The authoritative tracker seam for the launch selection. Production runs
-  // without options and builds the real seam lazily over the existing Tracker
-  // adapter (one tracker per project read, per low-queue tick); tests inject a
-  // deterministic fake. The seam is the ONLY tracker surface the launch path
-  // touches — the tick never mutates tracker state and never lets the model
-  // self-select candidates.
+  // The authoritative tracker seam the queue digest reads (#848): production
+  // runs without options and builds the real seam lazily over the existing
+  // Tracker adapter (one tracker read per low-queue tick); tests inject a
+  // deterministic fake. Read-only — the tick never mutates tracker state.
+  // Grooming itself no longer launches from here: the daemon owns the
+  // selection and the launch (#1041), so there is no launch token to mint and
+  // no `task` gate to arm (#1040).
   const toSpecTrackerSeam: ToSpecTrackerSeam | undefined =
     options.toSpec?.tracker ?? {
       listOpenIssues: (project) => makeTracker(project).listOpenIssues(),
@@ -4453,8 +3894,10 @@ export default function orchestratorTickExtension(
 
   /** `configuredProject` carries {@link TickConfig.project} for the same reason
    *  {@link armReleaseGate} takes it: a recovered tick must reconstruct *this*
-   *  fleet's availability policy, not refuse to guess between two projects. */
-  const armAvailabilityGate = (configuredProject?: string): void => {
+   *  fleet's availability policy, not refuse to guess between two projects.
+   *  `cwd` is the fleet directory itself, which the arm consumer re-reads the
+   *  tick config from at reply time (#1061). */
+  const armAvailabilityGate = (configuredProject?: string, cwd?: string): void => {
     if (availabilityGateArmed) return;
     availabilityGateArmed = true;
 
@@ -4486,56 +3929,32 @@ export default function orchestratorTickExtension(
         }
         return;
       }
-      // The reply to an arming challenge lands here as an ordinary user turn.
-      // This adapter — not the model, and not any transcript scan — is the
-      // sole producer of the arming acknowledgement: it classifies the turn
-      // against persisted authenticated challenge state and, on a match,
-      // atomically records the challenge-id-specific acknowledgement the
-      // host-side `arm` waits on (conductor #614), all before normal model
-      // handling. The classification derives from the pending challenge (hash
-      // + expiry, keyed by this project), never from the `FLEET-` prefix, so
-      // an unsolicited lookalike that matches no active challenge stays inert
-      // and model behaviour cannot determine whether the host becomes armed.
-      // The turn itself still reaches the transcript exactly as sent, with the
-      // same trusted machine-readable steer as before (#415).
+      // An inbound user turn on THIS session is an anomaly, not a
+      // conversation: operator DMs belong to the 24/7 console session, so a
+      // turn arriving here is an accidental topic post. Two things happen,
+      // and both are mechanisms — nothing here is left to model behaviour:
+      //
+      // 1. The arm ceremony's reply is classified against the pending
+      //    challenge records (#1061). The pre-#415 tombstone is retired: it
+      //    reasoned the reply lands "where no tick extension runs", but the
+      //    send half delivers the challenge to the project topic — this
+      //    pane's own claimed surface — so the reply lands exactly here, and
+      //    on a host with no console session the CLI's `arm --reply` step had
+      //    no owner at all. A matching code settles the ceremony
+      //    (markers written, transaction cleared) and answers with a
+      //    confirmation; a code past its window is answered with the re-run
+      //    command; a lookalike matching nothing stays inert, exactly as
+      //    #415 required.
+      // 2. {@link tickGuardDecision}'s preemption, unchanged: a person who
+      //    posts into the fleet topic by accident is still a person waiting,
+      //    and the autonomous-interrupt refusal must not fire at them.
       if (message.role === "user" && message.synthetic !== true && message.attribution !== "agent") {
-        const replyText =
-          message.content
-            ?.filter((part) => part.type === "text" && typeof part.text === "string")
-            .map((part) => part.text as string)
-            .join(" ") ?? "";
-        const verdict = classifyArmReply(configuredProject, replyText, Date.now());
-        const proof = verdict === "matched";
+        if (cwd !== undefined) {
+          const text = inboundMessageText(message.content);
+          if (text !== undefined) consumeInboundArmReply(pi, cwd, configuredProject, text, options.arm);
+        }
         if (session.activeLocalTick !== undefined) {
           session.activeLocalTick.humanWaiting = true;
-          if (proof) session.activeLocalTick.armingProof = true;
-        }
-        // Acknowledged whether or not a local tick is running: an inactivity-
-        // window challenge reply still deserves deterministic handling, and the
-        // host-side `arm` owns completion either way.
-        if (proof) {
-          pi.sendMessage(
-            { customType: ARM_PROOF_CUSTOM_TYPE, content: ARM_PROOF_ACK_TEXT, display: true, attribution: "agent" },
-            { triggerTurn: true, deliverAs: "steer" },
-          );
-        } else if (verdict !== "none") {
-          // A code that matched nothing used to be silent: the waiter kept
-          // waiting and the operator had no idea whether they had been heard,
-          // so the fastest way to be sure of the current code was to scroll
-          // (#991). The answer never echoes the token — that would put the
-          // plaintext in the chat and in any log that captures outbound
-          // messages, defeating the hash-only storage on purpose — and it never
-          // says whether some other project has a live challenge, because
-          // `classifyArmReply` reads only this session's own records.
-          pi.sendMessage(
-            {
-              customType: ARM_REPLY_CUSTOM_TYPE,
-              content: verdict === "expired" ? ARM_EXPIRED_REPLY_TEXT : ARM_UNKNOWN_REPLY_TEXT,
-              display: true,
-              attribution: "agent",
-            },
-            { triggerTurn: true, deliverAs: "steer" },
-          );
         }
       }
     });
@@ -4560,7 +3979,7 @@ export default function orchestratorTickExtension(
     );
   };
 
-  // Mount the bounded ask surface (#438) at extension-factory time, not in
+  // Mount the durable ask surface (#438) at extension-factory time, not in
   // `session_start`: OMP 17.2.9 snapshots the extension's active tool set
   // before it emits `session_start`, so a tool registered there mutates the
   // registry but never reaches this session's model-visible set. Registering
@@ -4575,13 +3994,10 @@ export default function orchestratorTickExtension(
   // surface is brought into the live set by {@link tick} — and only for as
   // long as the current tick config resolves a project.
   //
-  // The ceiling comes from the tick config the heartbeat started with — the
-  // same startup-only contract `budgetSeconds` already has — and is capped at
-  // the turn budget by the tool itself, so no combination of config and
-  // arguments produces an unbounded wait. That session state is read lazily
-  // from {@link askSession}, filled by `session_start` only once ownership is
-  // accepted for a session that goes on to compose a tick; a call on any
-  // other session fails closed.
+  // The session state the tools need — the cwd and the startup config that
+  // routes a call to a project — is read lazily from {@link askSession},
+  // filled by `session_start` only once ownership is accepted for a session
+  // that goes on to compose a tick; a call on any other session fails closed.
   //
   // The tool is inert unless the config resolves this fleet's project: it needs
   // the project to file the decision row against and to resolve the delivery
@@ -4598,7 +4014,7 @@ export default function orchestratorTickExtension(
    */
   const resolveOperatorAskContext = (
     tool: string,
-  ): { ok: true; project: ProjectConfig; config: TickConfig } | { ok: false; text: string } => {
+  ): { ok: true; project: ProjectConfig } | { ok: false; text: string } => {
     const session = askSession;
     if (session === undefined) {
       return {
@@ -4615,7 +4031,7 @@ export default function orchestratorTickExtension(
           "nothing was asked or recorded. Repair the config, do not ask through another path.",
       };
     }
-    return { ok: true, project: routed.project, config: session.config };
+    return { ok: true, project: routed.project };
   };
 
   const operatorAskDelivery =
@@ -4657,22 +4073,15 @@ export default function orchestratorTickExtension(
     label: ASK_TOOL,
     defaultInactive: true,
     description:
-      `Ask your operator one question and wait up to a bounded ceiling for the answer. ` +
-      `Records the question durably (decision row + the same delivery path as \`omp-conductor message\`), ` +
-      `delivers it to the operator per the reporting policy, and waits at most the ceiling ` +
-      `(default ${DEFAULT_ASK_TIMEOUT_SECONDS}s, capped at the turn budget; pass "timeoutSeconds" to ` +
-      `shorten or extend within ${MIN_ASK_TIMEOUT_SECONDS}–${MAX_ASK_TIMEOUT_SECONDS}s — an ask issued without ` +
-      `one still gets the default). When the Telegram surface can, the question posts as selectable ` +
-      `buttons and a tap resolves the decision row with the chosen option; when it cannot, the ask ` +
-      `degrades to plain text and the row records the degraded delivery. "recommended" is required ` +
-      `whenever "on-timeout" is "auto-proceed" (the row must record what was auto-applied) and, when ` +
-      `"options" are supplied, must be one of their labels — the label as delivered, never an index. ` +
-      `When nobody answers, the declared "on-timeout" decides: ` +
-      `"auto-proceed" applies your recommended option and resolves the decision row naming the ` +
-      `auto-application ("<option> (auto-applied on ask timeout)"); "park" leaves the row open and ` +
-      `pending — re-surfaced in every tick prompt until answered or the seven-day expiry — and you then ` +
-      `take the blocked work out of the claimable queue and record its state. A timeout is "nobody ` +
-      `answered yet", never a cancellation, an error, or an operator "no".`,
+      `Ask your operator one question. It does NOT wait for the answer: the question is recorded ` +
+      `durably (a decision row + the same delivery path as \`omp-conductor message\`), delivered per the ` +
+      `reporting policy, and the call returns immediately with the row id and the exact command that ` +
+      `resolves it. Your operator answers in their console session — this tick session is headless and no ` +
+      `reply can land here — and an unanswered row stays open and pending, re-surfaced in every tick ` +
+      `prompt, until it is answered, withdrawn, or swept by the seven-day decision expiry. When ` +
+      `"options" are supplied, "recommended" must be one of their labels — the label as delivered, never ` +
+      `an index. Park the work the question blocks in the same turn you ask: out of the claimable queue, ` +
+      `state recorded, row id in your report. Never treat your own recommendation as an approval.`,
     parameters: askParameterSchema(),
     approval: "write",
     execute: async (_toolCallId, params) => {
@@ -4682,29 +4091,22 @@ export default function orchestratorTickExtension(
       }
       // Routing follows the *live* tick config, not the session-start stamp: a
       // restamp (un-stamped → stamped, or project A → B) must make the next
-      // tick's toolbox land on the project the turn actually ticks for. Only the
-      // ceiling stays startup-only — routing is re-read every call.
+      // tick's toolbox land on the project the turn actually ticks for.
       const context = resolveOperatorAskContext(ASK_TOOL);
       if (!context.ok) {
         return { content: [{ type: "text", text: context.text }], isError: true };
       }
       const projectConfig = context.project;
-      const config = context.config;
       const store = openStore(dbPath());
       let result: AskResult;
       try {
         result = await performAsk(parsed.request, {
           store,
           project: projectConfig.name,
-          configuredCeilingSeconds: config.askTimeoutSeconds,
-          turnBudgetSeconds: config.budgetSeconds ?? DEFAULT_TICK_BUDGET_SECONDS,
-          // Test seam (#683): production omits `wait`/`now` and `performAsk`
-          // falls back to the module's real-time defaults; a test that wants
-          // the timeout outcomes deterministically hands both in. The
-          // interactive surface (#722) is production's default; a test may
-          // inject a fake through the same seam.
-          interactive: options.ask?.interactive ?? interactiveAskSurface({ project: projectConfig, store }),
-          ...(options.ask === undefined ? {} : { wait: options.ask.wait, now: options.ask.now }),
+          // Test seam: production omits `now` and `performAsk` falls back to
+          // the module's real clock; a test hands one in so the filed row's
+          // timestamp is deterministic.
+          ...(options.ask?.now === undefined ? {} : { now: options.ask.now }),
           deliver: operatorAskDelivery(ASK_TOOL, projectConfig, store),
         });
       } finally {
@@ -4724,19 +4126,15 @@ export default function orchestratorTickExtension(
     label: QUESTIONNAIRE_TOOL,
     defaultInactive: true,
     description:
-      `Ask your operator several bounded questions about ONE issue as a single message, and wait up ` +
-      `to one ask ceiling for the answers. Every item is recorded as its own durable decision row ` +
-      `before anything is delivered, all bound to the issue you name in "spec-issue" — so the answers ` +
-      `become that issue's provenance and a later reader sees why a slice is shaped the way it is. ` +
-      `Items resolve independently and in any order: an item the operator answers keeps that answer, ` +
-      `and at the ceiling each unanswered item takes its own declared "on-timeout" ("auto-proceed" ` +
-      `applies its recommendation and records that nobody human chose it; "park" leaves the row open ` +
-      `and pending, and you then park the work it blocks). Ask ONLY the judgement calls that genuinely ` +
-      `belong to your operator — anything a repo read can answer is your own work — and at most ` +
-      `${MAX_QUESTIONNAIRE_ITEMS} items. This path is plain text by design (one message, not ` +
-      `${MAX_QUESTIONNAIRE_ITEMS} button posts), so a prose reply does not itself resolve a row: map ` +
-      `it with \`omp-conductor decision resolve <id> --answer "…"\`. Use conductor_ask for a single ` +
-      `question.`,
+      `Ask your operator several questions about ONE issue as a single message. Like conductor_ask it ` +
+      `does NOT wait: every item is recorded as its own durable decision row before anything is ` +
+      `delivered, all bound to the issue you name in "spec-issue" — so the answers become that issue's ` +
+      `provenance and a later reader sees why a slice is shaped the way it is — and the call returns the ` +
+      `group id, every row id, and the command that resolves each one. Your operator answers in their ` +
+      `console session, item by item, in any order. Ask ONLY the judgement calls that genuinely belong ` +
+      `to your operator — anything a repo read can answer is your own work — and at most ` +
+      `${MAX_QUESTIONNAIRE_ITEMS} items. Park the work every item blocks in the same turn you ask, and ` +
+      `name the group id in your report.`,
     parameters: questionnaireParameterSchema(),
     approval: "write",
     execute: async (_toolCallId, params) => {
@@ -4754,9 +4152,7 @@ export default function orchestratorTickExtension(
         const result = await performQuestionnaire(parsed.request, {
           store,
           project: projectConfig.name,
-          configuredCeilingSeconds: context.config.askTimeoutSeconds,
-          turnBudgetSeconds: context.config.budgetSeconds ?? DEFAULT_TICK_BUDGET_SECONDS,
-          ...(options.ask === undefined ? {} : { wait: options.ask.wait, now: options.ask.now }),
+          ...(options.ask?.now === undefined ? {} : { now: options.ask.now }),
           deliver: operatorAskDelivery(QUESTIONNAIRE_TOOL, projectConfig, store),
         });
         return { content: [{ type: "text", text: result.text }] };
@@ -4766,114 +4162,6 @@ export default function orchestratorTickExtension(
     },
   });
 
-  // The async half of the to-spec result capture (#777). Registered at
-  // extension-factory time like {@link ASK_TOOL}, with the same routing
-  // contract: the state it needs (cwd + startup config) is filled by
-  // `session_start` for an accepted fleet session, and the live config is
-  // re-read at execution so a restamp binds the current project. The tool
-  // only ever writes the grooming table — never an issue, a label, or a
-  // dispatch row — so the output of a background batch persists while no
-  // candidate can become claimable from it.
-  pi.registerTool({
-    name: TO_SPEC_RESULT_TOOL,
-    label: TO_SPEC_RESULT_TOOL,
-    description:
-      `Persist the exact raw output of one completed to-spec grooming item (#777). ` +
-      `Call it once per completed batch item after the batch settles — in the tool ` +
-      `result, or when an async-result message delivers the item — passing the issue ` +
-      `number and the agent's EXACT raw output as \`input\` (read agent://<id> when the ` +
-      `inline text is truncated; never paraphrase). The conductor parses the output ` +
-      `against the strict to-spec contract and records the verdict durably: a valid ` +
-      `result persists its verdict, anything malformed, source-less or stale persists ` +
-      `as blocked, and a failing item never discards its siblings. One call per item, ` +
-      `success and failure alike; never edits an issue or a label.`,
-    parameters: {
-      type: "object",
-      properties: {
-        issue: { type: "integer", description: "The tracker issue number the item groomed." },
-        input: {
-          type: "string",
-          description: "The to-spec agent's exact raw output for this item.",
-        },
-      },
-      required: ["issue", "input"],
-      additionalProperties: false,
-    },
-    approval: "write",
-    execute: async (_toolCallId, params) => {
-      const fleet = askSession;
-      if (fleet === undefined) {
-        return {
-          content: [
-            {
-              type: "text",
-              text: `${TO_SPEC_RESULT_TOOL}: not available in this session (no orchestrator tick); nothing was persisted.`,
-            },
-          ],
-          isError: true,
-        };
-      }
-      const issue = params["issue"];
-      const input = params["input"];
-      if (typeof issue !== "number" || !Number.isInteger(issue) || typeof input !== "string" || input.length === 0) {
-        return {
-          content: [
-            { type: "text", text: `${TO_SPEC_RESULT_TOOL}: expected an integer \`issue\` and a non-empty \`input\` string.` },
-          ],
-          isError: true,
-        };
-      }
-      const routed = resolveAskProject(fleet.cwd, fleet.config);
-      if (routed.kind === "error") {
-        return {
-          content: [
-            {
-              type: "text",
-              text:
-                `${TO_SPEC_RESULT_TOOL}: conductor config unreadable (${routed.problem}); nothing was persisted. ` +
-                "Keep the outputs in the transcript and persist after the config is repaired.",
-            },
-          ],
-          isError: true,
-        };
-      }
-      const store = openStore(dbPath());
-      try {
-        const outcome = recordToSpecGrooming(store, {
-          project: routed.project.name,
-          issue,
-          input,
-        });
-        const record = outcome.record;
-        const kept = outcome.kind === "kept-prior" ? " (kept the prior valid verdict)" : "";
-        return {
-          content: [
-            {
-              type: "text",
-              text:
-                `${TO_SPEC_RESULT_TOOL}: #${issue} persisted as ${record.verdict} (${record.reason})${kept}. ` +
-                "The grooming table now decides re-grooming; promotion stays yours.",
-            },
-          ],
-        };
-      } catch (err) {
-        return {
-          content: [
-            {
-              type: "text",
-              text: `${TO_SPEC_RESULT_TOOL}: could not persist #${issue}: ${
-                err instanceof Error ? err.message : String(err)
-              } — keep the output and retry the call.`,
-            },
-          ],
-          isError: true,
-        };
-      } finally {
-        store.close();
-      }
-    },
-  });
-
   pi.on("session_start", (_event, ctx) => {
     if (decided) return;
 
@@ -4905,7 +4193,7 @@ export default function orchestratorTickExtension(
     // invalid config names none — it cannot be trusted to.
     const configuredProject = result.kind === "ok" ? result.config.project : undefined;
     armReleaseGate(configuredProject);
-    armAvailabilityGate(configuredProject);
+    armAvailabilityGate(configuredProject, ctx.cwd);
     // The tool is already registered (extension-factory time); only the session
     // state it acts on is filled, and only once ownership is accepted below.
     // `configuredProject` isn't closed over at all — routing is re-read from
@@ -4995,7 +4283,7 @@ export default function orchestratorTickExtension(
         // not create or deliver decisions). `cwd` is for re-reading the live
         // tick config at execution, `config` for the startup-only ceiling.
         askSession = { cwd: ctx.cwd, config };
-        armTickHeartbeat(pi, ctx, config, session, toSpecTrackerSeam);
+        armTickHeartbeat(pi, ctx, config, session, toSpecTrackerSeam, options.arm);
         if (!guardArmed) {
           guardArmed = true;
           armTickGuard(pi, ctx, (config.budgetSeconds ?? DEFAULT_TICK_BUDGET_SECONDS) * 1000);
@@ -5017,7 +4305,7 @@ export default function orchestratorTickExtension(
     // why): a declined or unresolved session keeps `askSession` undefined and
     // the tool fails closed.
     askSession = { cwd: ctx.cwd, config };
-    armTickHeartbeat(pi, ctx, config, session, toSpecTrackerSeam);
+    armTickHeartbeat(pi, ctx, config, session, toSpecTrackerSeam, options.arm);
     if (!guardArmed) {
       guardArmed = true;
       armTickGuard(pi, ctx, (config.budgetSeconds ?? DEFAULT_TICK_BUDGET_SECONDS) * 1000);
@@ -5035,272 +4323,3 @@ export default function orchestratorTickExtension(
     );
   });
 }
-
-/** One error's message, for a reason string — never a stack. */
-function errText(err: unknown): string {
-  return err instanceof Error ? err.message : String(err);
-}
-
-/**
- * Write one prompt-protocol file the way omp-telegram's `atomicJson` does:
- * temp file in the same directory, then rename. The bridge reads these files
- * on a hot path (every tap), so a half-written request must never be visible.
- */
-function atomicallyWriteJson(path: string, value: unknown): void {
-  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-  const tmp = `${path}.tmp-${process.pid}-${randomUUID().slice(0, 8)}`;
-  writeFileSync(tmp, `${JSON.stringify(value)}\n`, { mode: 0o600 });
-  renameSync(tmp, path);
-}
-
-/** Remove one prompt file; a missing file is not an error. */
-function removeFile(path: string): void {
-  try {
-    rmSync(path, { force: true });
-  } catch {
-    // best effort — a leftover prompt request dies with its owner process
-  }
-}
-
-/**
- * The interactive Telegram surface for one bounded ask (#722).
- *
- * `telegram_ask` posts its options as a Bot API inline keyboard whose taps the
- * running omp-telegram bridge acknowledges and answers through a documented
- * cross-process file protocol (guide.md: "prompts/ — Cross-process
- * selectable-question requests (live while their owning session is) and their
- * answers"): the asking process writes `<state>/prompts/<nonce>.json`, the
- * bridge validates the tap against that request (responder, chat, topic,
- * message id, owner-pid liveness) and writes `<nonce>.answer.json`; the asking
- * process reads the envelope and settles. `interactiveAskSurface` is that
- * asking-process half, nothing more: it posts the question with the same
- * `qa:<nonce>:s:<index>` callbacks `prompts.ts` routes, writes the request file
- * so the bridge recognizes the taps, and translates the envelope the bridge
- * writes into the decision row — the resolution is the chosen option's *label*,
- * never an index and never free text.
- *
- * The decision id doubles as the protocol nonce: it fits `[A-Za-z0-9_-]`, the
- * bridge's callback regex, and makes the pending question and its answer
- * addressable by the row that records them.
- */
-export function interactiveAskSurface(deps: {
-  project: ProjectConfig;
-  store: Store;
-  /** Injected Bot API transport (tests); production posts to api.telegram.org. */
-  call?: (method: string, payload: Record<string, unknown>) => Promise<Record<string, unknown>>;
-  /** Injected state dir (tests); production resolves it like the token. */
-  stateDir?: string;
-  /** Injected bot token (tests); production reads the state dir's .env. */
-  token?: string;
-  now?: () => number;
-}): AskInteractiveDelivery {
-  const surfaceStateDir = deps.stateDir ?? telegramStateDir();
-  const call = deps.call ?? telegramCall(deps.token ?? readTelegramToken() ?? "");
-  const now = deps.now ?? Date.now;
-  // Where each pending question physically sits, so collect/close can settle
-  // the right message without re-reading the request file.
-  const posted = new Map<string, { chatId: string; messageId: number; settled: boolean }>();
-
-  const promptsDir = (): string => join(surfaceStateDir, "prompts");
-  const requestPath = (nonce: string): string => join(promptsDir(), `${nonce}.json`);
-  const answerPath = (nonce: string): string => join(promptsDir(), `${nonce}.answer.json`);
-
-  const ownerId = (): string | undefined => {
-    let raw: string;
-    try {
-      raw = readFileSync(join(surfaceStateDir, "access.json"), "utf8");
-    } catch {
-      return undefined;
-    }
-    let access: { allowFrom?: unknown };
-    try {
-      access = JSON.parse(raw) as { allowFrom?: unknown };
-    } catch {
-      return undefined;
-    }
-    const allowFrom = access.allowFrom;
-    if (!Array.isArray(allowFrom) || allowFrom.length !== 1 || typeof allowFrom[0] !== "string") {
-      return undefined;
-    }
-    return allowFrom[0];
-  };
-
-  const tokenAvailable = (): boolean =>
-    deps.call !== undefined || deps.token !== undefined || readTelegramToken() !== undefined;
-
-  return {
-    unavailableReason(request) {
-      const chat = deps.project.escalation.telegramChatId;
-      if (chat === undefined || chat === "") {
-        return "no escalation.telegramChatId configured for this project";
-      }
-      if (!tokenAvailable()) {
-        return "no Telegram bot token readable (install and configure omp-telegram, or set OMP_TELEGRAM_STATE_DIR)";
-      }
-      if (ownerId() === undefined) {
-        return "no paired Telegram owner (omp-telegram access.json must name exactly one allowed user)";
-      }
-      // The interactive post is still a delivery under the reporting policy: a
-      // question the policy would hold for the digest or the availability
-      // window must not bypass that hold just because it has buttons.
-      const disposition = interruptDisposition(
-        deps.project.reporting,
-        request.category ?? "decision-needed",
-        now(),
-      );
-      if (disposition !== "interrupt") {
-        return `the question defers under the reporting policy (${disposition}) — it must be held, not posted`;
-      }
-      return undefined;
-    },
-
-    async post(request, decisionId) {
-      const chat = deps.project.escalation.telegramChatId;
-      const owner = ownerId();
-      if (chat === undefined || owner === undefined) {
-        return {
-          ok: false,
-          reason: "the interactive surface is not configured (no escalation.telegramChatId or no paired owner)",
-        };
-      }
-      const render = renderInteractiveAsk(request, decisionId);
-      const threadId = resolveProjectTopicId(deps.project);
-      let result: Record<string, unknown>;
-      try {
-        result = await call("sendMessage", {
-          chat_id: chat,
-          ...(threadId === undefined ? {} : { message_thread_id: threadId }),
-          text: render.text,
-          reply_markup: render.markup,
-        });
-      } catch (err) {
-        return { ok: false, reason: `Telegram rejected the interactive question: ${errText(err)}` };
-      }
-      const messageId = result["message_id"];
-      const chatType =
-        typeof result["chat"] === "object" && result["chat"] !== null
-          ? String((result["chat"] as Record<string, unknown>)["type"] ?? "private")
-          : "private";
-      if (typeof messageId !== "number" || !Number.isSafeInteger(messageId)) {
-        // The question went out, but unaddressable — take it back rather than
-        // leaving a button row nothing can settle.
-        await call("deleteMessage", { chat_id: chat, message_id: messageId as number }).catch(
-          () => undefined,
-        );
-        return { ok: false, reason: "Telegram posted no usable message id" };
-      }
-      const recommended =
-        request.recommended === undefined
-          ? undefined
-          : (request.options ?? []).findIndex((option) => option.label === request.recommended);
-      const requestFile = {
-        version: 1,
-        nonce: decisionId,
-        responderId: owner,
-        chatId: chat,
-        chatType,
-        threadId,
-        page: 0,
-        messageId,
-        questions: [
-          {
-            id: "q1",
-            question: request.question,
-            options: request.options ?? [],
-            ...(recommended === undefined || recommended < 0 ? {} : { recommended }),
-          },
-        ],
-        questionIndex: 0,
-        answers: [],
-        selectedIndices: [],
-        awaitingText: (request.options ?? []).length === 0,
-        ownerPid: process.pid,
-      };
-      try {
-        atomicallyWriteJson(requestPath(decisionId), requestFile as unknown);
-      } catch (err) {
-        // The buttons went out but nothing would ever answer them — take the
-        // message back rather than leave a dead keyboard in the chat.
-        await call("deleteMessage", { chat_id: chat, message_id: messageId }).catch(() => undefined);
-        return { ok: false, reason: `could not register the interactive question: ${errText(err)}` };
-      }
-      posted.set(decisionId, { chatId: chat, messageId, settled: false });
-      return { ok: true };
-    },
-
-    collect(decisionId) {
-      const state = posted.get(decisionId);
-      if (state === undefined) return;
-      let raw: string | undefined;
-      try {
-        raw = readFileSync(answerPath(decisionId), "utf8");
-      } catch {
-        return; // no answer yet
-      }
-      let parsed: AskAnswerEnvelope | undefined;
-      try {
-        parsed = parseAskAnswerEnvelope(JSON.parse(raw) as unknown);
-      } catch {
-        parsed = undefined;
-      }
-      if (parsed === undefined) return; // an unreadable envelope is "no answer yet"
-      const write = askAnswerRowWrite(parsed);
-      if (write === undefined) return; // expiry/abort: the bounded wait still owns the row
-      deps.store.resolveDecision(decisionId, write.state, write.resolution, now());
-      removeFile(requestPath(decisionId));
-      removeFile(answerPath(decisionId));
-      state.settled = true;
-      const outcomeText =
-        write.state === "withdrawn"
-          ? write.resolution
-          : `User selected: ${write.resolution}`;
-      // The bridge edits its own prompts' messages; this surface owns the edit
-      // for its own, so an answered ask reads as answered and a stale tap
-      // finds no keyboard.
-      call("editMessageText", {
-        chat_id: state.chatId,
-        message_id: state.messageId,
-        text: outcomeText,
-        reply_markup: { inline_keyboard: [] },
-      }).catch(() => undefined);
-    },
-
-    close(decisionId) {
-      const state = posted.get(decisionId);
-      removeFile(requestPath(decisionId));
-      removeFile(answerPath(decisionId));
-      if (state !== undefined && !state.settled) {
-        call("editMessageReplyMarkup", {
-          chat_id: state.chatId,
-          message_id: state.messageId,
-          reply_markup: { inline_keyboard: [] },
-        }).catch(() => undefined);
-        state.settled = true;
-      }
-    },
-  };
-}
-
-/** The Bot API transport: one JSON POST per call, the `result` back. */
-function telegramCall(
-  token: string,
-): (method: string, payload: Record<string, unknown>) => Promise<Record<string, unknown>> {
-  return async (method, payload) => {
-    if (token === "") throw new Error("no Telegram bot token");
-    const url = `https://api.telegram.org/bot${token}/${method}`;
-    const res = await fetch(url, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify(payload),
-    });
-    const raw = await res.text();
-    if (!res.ok) {
-      throw new Error(`telegram ${method} failed: HTTP ${res.status} ${raw.slice(0, 200)}`);
-    }
-    const parsed = JSON.parse(raw) as { ok?: unknown; result?: unknown };
-    if (parsed.ok !== true) {
-      throw new Error(`telegram ${method} rejected: ${raw.slice(0, 200)}`);
-    }
-    return (parsed.result as Record<string, unknown>) ?? {};
-  };
-}