omp-conductor 0.3.18 → 0.3.19

package/src/brief-upgrade.ts

@@ -10,8 +10,20 @@
  * banner can `retrofit` one at a classified cut before migrating.
  */
 
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { randomUUID } from "node:crypto";
+import {
+  constants,
+  copyFileSync,
+  existsSync,
+  linkSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { basename, dirname, join } from "node:path";
+import { stateDir } from "./config.ts";
 
 /**
  * The line that divides the two halves. Matched on this substring rather than
@@ -355,28 +367,84 @@ export function shippedDiff(before: string, after: string): string {
   return lines.join("\n");
 }
 
+/** Dedicated state-root directory for conductor-managed brief backups. */
+export function briefBackupDir(): string {
+  return join(stateDir(), "backups", "briefs");
+}
+
+function backupTimestamp(): string {
+  return new Date().toISOString().replace(/[:.]/g, "-");
+}
+
+function copyToUniqueBackup(source: string, backupRoot: string, stem: string): string {
+  mkdirSync(backupRoot, { recursive: true });
+  const temporary = join(backupRoot, `.${stem}.${process.pid}.${randomUUID()}.tmp`);
+  copyFileSync(source, temporary, constants.COPYFILE_EXCL);
+  try {
+    for (let suffix = 0; ; suffix += 1) {
+      const destination = join(backupRoot, suffix === 0 ? stem : `${stem}-${suffix}`);
+      try {
+        // Linking a complete temp file publishes the backup atomically without
+        // overwriting a backup created concurrently at the same millisecond.
+        linkSync(temporary, destination);
+        return destination;
+      } catch (err) {
+        if ((err as NodeJS.ErrnoException).code === "EEXIST") continue;
+        throw err;
+      }
+    }
+  } finally {
+    unlinkSync(temporary);
+  }
+}
+
 /**
- * Writes content, leaving the previous file beside it when one existed.
+ * Moves only conductor's timestamp-shaped legacy sidecar backups into state.
+ * Unknown `.bak` files remain operator-owned. Copy-before-unlink also works
+ * when the workspace and state root are on different filesystems.
  */
-export function writeWithBackup(path: string, content: string): string | undefined {
-  mkdirSync(dirname(path), { recursive: true });
-  let backup: string | undefined;
-  if (existsSync(path)) {
-    backup = `${path}.bak-${new Date().toISOString().replace(/[:.]/g, "-")}`;
-    writeFileSync(backup, readFileSync(path));
+export function migrateLegacyBriefBackups(paths: readonly string[], backupRoot = briefBackupDir()): string[] {
+  const migrated: string[] = [];
+  for (const path of paths) {
+    const name = basename(path);
+    const pattern = new RegExp(
+      `^${name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\.bak-\\d{4}-\\d{2}-\\d{2}T\\d{2}-\\d{2}-\\d{2}-\\d{3}Z$`,
+    );
+    if (!existsSync(dirname(path))) continue;
+    for (const entry of readdirSync(dirname(path), { withFileTypes: true })) {
+      if (!entry.isFile() || !pattern.test(entry.name)) continue;
+      const source = join(dirname(path), entry.name);
+      const destination = copyToUniqueBackup(source, backupRoot, entry.name);
+      unlinkSync(source);
+      migrated.push(destination);
+    }
   }
+  return migrated;
+}
+
+/** Writes content and stores any previous file under conductor state. */
+export function writeWithBackup(
+  path: string,
+  content: string,
+  backupRoot = briefBackupDir(),
+): string | undefined {
+  mkdirSync(dirname(path), { recursive: true });
+  migrateLegacyBriefBackups([path], backupRoot);
+  const backup = existsSync(path)
+    ? copyToUniqueBackup(path, backupRoot, `${basename(path)}.bak-${backupTimestamp()}`)
+    : undefined;
   writeFileSync(path, content);
   return backup;
 }
 
 /**
- * Writes the merged brief, leaving the previous one beside it.
+ * Writes the merged brief, storing the previous one under conductor state.
  *
  * @deprecated Prefer {@link migrateToPolicy} / overlay refresh. Kept for
  * pre-overlay `--apply` on bannered single-file briefs.
  */
-export function writeMergedBrief(path: string, merged: string): string {
-  const backup = writeWithBackup(path, merged);
+export function writeMergedBrief(path: string, merged: string, backupRoot?: string): string {
+  const backup = writeWithBackup(path, merged, backupRoot);
   return backup ?? `${path}.bak-missing`;
 }
 
@@ -399,6 +467,8 @@ export function migrateToPolicy(opts: {
   floor: string;
   /** When set, use this owned text instead of splitting the live file. */
   owned?: string;
+  /** Override the conductor backup directory (tests). */
+  backupRoot?: string;
 }): MigrateResult {
   const live = readFileSync(opts.orchestratorPath, "utf8");
   const owned = opts.owned ?? splitBrief(live)?.owned;
@@ -408,9 +478,13 @@ export function migrateToPolicy(opts: {
   // Strip banner footers that an older split may have left in owned — never let
   // package chrome become fleet policy.
   const policyBody = stripLeadingBannerCrumbs(owned).replace(/^\s+/, "");
-  const policyBackup = writeWithBackup(opts.policyPath, policyBody.endsWith("\n") ? policyBody : `${policyBody}\n`);
+  const policyBackup = writeWithBackup(
+    opts.policyPath,
+    policyBody.endsWith("\n") ? policyBody : `${policyBody}\n`,
+    opts.backupRoot,
+  );
   const composed = composeOrchestrator(opts.floor, readFileSync(opts.policyPath, "utf8"));
-  const orchestratorBackup = writeWithBackup(opts.orchestratorPath, composed);
+  const orchestratorBackup = writeWithBackup(opts.orchestratorPath, composed, opts.backupRoot);
   return {
     policyPath: opts.policyPath,
     orchestratorPath: opts.orchestratorPath,
@@ -430,6 +504,8 @@ export function repairPolicyBannerCrumbs(opts: {
   orchestratorPath: string;
   policyPath: string;
   floor: string;
+  /** Override the conductor backup directory (tests). */
+  backupRoot?: string;
 }): MigrateResult | undefined {
   if (!existsSync(opts.policyPath)) return undefined;
   const before = readFileSync(opts.policyPath, "utf8");
@@ -439,9 +515,13 @@ export function repairPolicyBannerCrumbs(opts: {
     writeFileSync(opts.orchestratorPath, composeOrchestrator(opts.floor, before));
     return undefined;
   }
-  const policyBackup = writeWithBackup(opts.policyPath, cleaned.endsWith("\n") ? cleaned : `${cleaned}\n`);
+  const policyBackup = writeWithBackup(
+    opts.policyPath,
+    cleaned.endsWith("\n") ? cleaned : `${cleaned}\n`,
+    opts.backupRoot,
+  );
   const composed = composeOrchestrator(opts.floor, readFileSync(opts.policyPath, "utf8"));
-  const orchestratorBackup = writeWithBackup(opts.orchestratorPath, composed);
+  const orchestratorBackup = writeWithBackup(opts.orchestratorPath, composed, opts.backupRoot);
   return {
     policyPath: opts.policyPath,
     orchestratorPath: opts.orchestratorPath,
@@ -459,7 +539,10 @@ export function refreshComposedBrief(opts: {
   orchestratorPath: string;
   policyPath: string;
   floor: string;
+  /** Override the conductor backup directory (tests). */
+  backupRoot?: string;
 }): boolean {
+  migrateLegacyBriefBackups([opts.policyPath, opts.orchestratorPath], opts.backupRoot);
   if (!existsSync(opts.policyPath)) return false;
   const policy = readFileSync(opts.policyPath, "utf8");
   writeFileSync(opts.orchestratorPath, composeOrchestrator(opts.floor, policy));
@@ -558,9 +641,9 @@ export function proposeRetrofit(live: string): RetrofitResult {
   };
 }
 
-/** Insert the banner into a hand-written brief (with backup). */
-export function applyRetrofit(path: string, proposal: RetrofitProposal): string {
-  const backup = writeWithBackup(path, proposal.retrofitted);
+/** Insert the banner into a hand-written brief (with a state-root backup). */
+export function applyRetrofit(path: string, proposal: RetrofitProposal, backupRoot?: string): string {
+  const backup = writeWithBackup(path, proposal.retrofitted, backupRoot);
   return backup ?? `${path}.bak-missing`;
 }
 

package/src/briefs/orchestrator.md

@@ -91,8 +91,9 @@ checked in this order:
 - **A PR closed without merging.** A human read the work and said no; the row says
   `failed`. Read the rejection before you touch anything — most of the time a
   review comment is a spec change. Fold what it says into the issue, then release
-  the label so the next tick can attempt it again; the attempt counter still bounds
-  it. If the answer was "this should not be built", take it off the queue instead.
+  the label so the next tick can attempt it again; the failed-attempt budget still
+  bounds repeated implementation failures. If the answer was "this should not be
+  built", take it off the queue instead.
 - **An open PR that is green.** That worker finished; it just never got to report.
   This is the "already done" case above — handle it exactly the same way. Never
   release-and-re-claim it — a fresh worker would duplicate a finished run.
@@ -106,10 +107,10 @@ checked in this order:
   pushed work lives on the remote, and unpushed commits live on the run's branch
   in the mirror, which a re-claim deliberately reattaches so the next worker
   starts from them with a **continuation brief** (read the log/diff first; do
-  not recreate existing work). Note what exists and release the label; the
-  attempt counter still bounds a loop of deaths. A turns-cap kill with attempts
-  left is re-queued automatically by the daemon — you should still notice it on
-  drain, but you do not have to invent the continuation prompt.
+  not recreate existing work). Note what exists and release the label. Cap kills,
+  daemon orphans and answered blocks consume the separate bounded continuation
+  budget rather than failed implementation attempts. A turns-cap kill with room
+  left is re-queued automatically; you do not have to invent its prompt.
 - **Genuinely nothing** (clean tree, no commits, no PR). Release the label and let
   the next tick re-claim it clean.
 
@@ -204,7 +205,7 @@ rather than by editing policy prose. The five boundaries above are not.
 
 ## Learning loop
 
-`POLICY.md` is yours to amend, and amending it is part of the job. Two things
+`POLICY.md` is yours to amend, and amending it is part of the job. Three things
 trigger an amendment:
 
 - **Your operator corrects you.** They told you to do something differently. That
@@ -212,16 +213,29 @@ trigger an amendment:
 - **Policy contradicts repo reality.** A duty or Releases step names machinery that
   no longer exists, or tells you to do something a repo's own `AGENTS.md` forbids.
   The repo wins.
+- **Repeated friction points to policy.** A tick can carry a seven-day aggregate
+  of admission holds, recurring escalations, or reports classified as noise or
+  surprising. It is evidence to investigate, not permission to edit. Propose only
+  when the recurring cause has a safe `POLICY.md` remedy; a code, tracker, or
+  infrastructure defect follows the existing issue/escalation rules instead.
+
+The daemon records repairable admission holds itself. You record judgments code
+cannot make when the evidence is clear:
+`omp-conductor friction escalation-digest --detail "<why>"`,
+`omp-conductor friction report-noise --detail "<why>"`, or
+`omp-conductor friction report-surprise --detail "<why>"` (add `--issue N` when
+one issue anchors it). One observation changes nothing; only a repeated aggregate
+can appear in a later tick.
 
 The protocol, in order:
 
 1. **Draft the exact replacement** against `POLICY.md`. Quote the lines as they
    stand, then the lines you propose. A diff, not a description of one. This full
    text is what you *apply* on a yes — it is not what you send.
-2. **Ask, once — a single yes/no question, written for a phone.** It goes over
-   the escalation channel (the `ask` tool — it reaches your operator's Telegram),
-   and Telegram renders none of your markdown: asterisks and backticks arrive as
-   literal characters, and a pasted section becomes an unreadable wall. So:
+2. **Ask, once — a single yes/no question, written for a phone.** Explicitly
+   call `telegram_ask`; never use the generic `ask` UI. Confirm that the tool
+   delivered the question to the configured Telegram chat. Telegram renders
+   none of your markdown, so asterisks and backticks arrive as literal characters:
    - Lead with one plain sentence: what changes, and why, in your own words.
    - Then show only the lines that actually change, compact, under two short
      labels like "now:" and "proposed:". Never paste whole sections around a
@@ -233,11 +247,13 @@ The protocol, in order:
 3. **On yes, apply it** by editing **`POLICY.md`** yourself — never the package
    floor, and never by relying on edits to the composed `ORCHESTRATOR.md` (that
    file is regenerated from the floor + `POLICY.md`). **On explicit no, drop
-   it** forever and do not re-ask that amendment. **On cancel, timeout, or no
-   answer**, park it — that means "not now", not "never": mention it once in the
-   next report as `pending amendment: <one-liner> — say 'apply it' or 'drop it'`,
-   never re-open the yes/no dialog, and drop it if still unanswered after 7 days.
-   A cancelled dialog is not a permanent rejection.
+   it** forever and do not re-ask that amendment. A cancelled or errored
+   `telegram_ask` is a delivery failure, not an operator answer. Re-deliver the
+   question with `telegram_send`, or report the channel as broken. Never infer
+   rejection or “not now” from failed delivery. On an explicit “not now”, park
+   it: mention it once in the next report as
+   `pending amendment: <one-liner> — say 'apply it' or 'drop it'`, never re-open
+   the yes/no dialog, and drop it if still unanswered after 7 days.
 4. **Log it.** Append one line to **Amendments** at the bottom of `POLICY.md`:
    the date, what triggered it, a one-sentence summary.
 5. **Offer general fixes upstream.** Ask one question of the amendment you just

package/src/briefs/worker.md

@@ -112,7 +112,11 @@ or the full test suite on this host. It is shared, and CI owns the heavy gates.
    ```bash
    gh pr checks <pr> --repo {{REPO}} --watch --interval 30
    ```
-5. **Green** → stop and report `pushed-green`.
+5. After the watcher exits, read the exact remote head for the final report:
+   ```bash
+   gh pr view <pr> --repo {{REPO}} --json headRefOid --jq .headRefOid
+   ```
+6. **Green** → stop and report `pushed-green`.
    **Red** → diagnose the real cause and make **one** corrective push. Red a
    second time → stop, do not push again, and report `failed` with the failure
    digest (job name plus the decisive log lines).
@@ -148,11 +152,12 @@ Escalating is a successful outcome. Guessing is not.
 
 ## Your final report
 
-End with exactly these six lines, evidence only — no narration:
+End with exactly these seven lines, evidence only — no narration:
 
 ```
 issue:   {{TRACKER_REPO}}#{{ISSUE_NUMBER}}
 pr:      <url or "none">
+head:    <40-character head SHA or "none">
 state:   pushed-green | blocked | failed
 gates:   <exact commands run and their results>
 changed: <files touched, one line>

package/src/cli.ts

@@ -7,6 +7,7 @@
  */
 import { closeSync, openSync, readFileSync, readSync, statSync } from "node:fs";
 import { dirname, join } from "node:path";
+import { runBoard } from "./board.ts";
 import {
   applyRetrofit,
   checkBrief,
@@ -21,7 +22,7 @@ import {
   writeMergedBrief,
 } from "./brief-upgrade.ts";
 import { findProject, loadConfig, resolveCaps, stateDir } from "./config.ts";
-import { dbPath, runDaemon, setPaused } from "./daemon.ts";
+import { runDaemon, setPaused } from "./daemon.ts";
 import {
   armTicks,
   clearPaneHalt,
@@ -51,10 +52,20 @@ import {
   renderFloorForProject,
   shippedBriefTemplate,
 } from "./setup.ts";
-import { LIVE_STATES, openStore } from "./store.ts";
+import { dbPath, LIVE_STATES, openStore } from "./store.ts";
+import { formatTranscriptLine } from "./transcript.ts";
 import { makeTracker } from "./tracker/github.ts";
 import type { ProjectConfig } from "./types.ts";
 import { formatUnblock, unblockIssue } from "./unblock.ts";
+import { upgradeConductor } from "./upgrade.ts";
+
+const FRICTION_FEEDBACK_KINDS = {
+  "escalation-digest": "feedback:escalation-should-digest",
+  "report-noise": "feedback:report-noise",
+  "report-surprise": "feedback:report-surprise",
+} as const;
+
+type FrictionFeedbackName = keyof typeof FRICTION_FEEDBACK_KINDS;
 
 function packageVersion(): string {
   const parsed = JSON.parse(readFileSync(join(import.meta.dir, "..", "package.json"), "utf8")) as {
@@ -73,6 +84,8 @@ usage:
   omp-conductor --version
   omp-conductor stop
   omp-conductor restart [--port N] [--project NAME]
+  omp-conductor upgrade [--to VERSION] [--project NAME]
+  omp-conductor board [--project NAME]
   omp-conductor status [--project NAME]
   omp-conductor hold [--project NAME]
   omp-conductor halt [--pane] [--project NAME]
@@ -80,14 +93,20 @@ usage:
   omp-conductor disarm [--project NAME]
   omp-conductor release-pane [--project NAME]
   omp-conductor tail <issue> [--project NAME]
+  omp-conductor extend <issue> --turns N [--project NAME]
   omp-conductor unblock <issue> [--project NAME]
   omp-conductor daemon [--once] [--port N] [--project NAME]
   omp-conductor pause
   omp-conductor resume
   omp-conductor graph-setup [--project NAME] [--write]
   omp-conductor brief-upgrade [--migrate|--retrofit] [--apply] [--file PATH] [--project NAME]
+  omp-conductor friction <escalation-digest|report-noise|report-surprise> --detail TEXT [--issue N] [--project NAME]
   omp-conductor help
 
+  upgrade  update the Bun-global CLI, omp plugin, Herdr recovery plugin, and
+           brief as one pinned release. Pauses only new claims, drains live
+           workers, reloads, verifies twice, and restores the prior dispatch
+           state. Run it from a shell outside the target Herdr session.
   start    start the installed herdr-fleet.service when present, then run the
            dispatch loop in the background and wait until it answers GET
            /healthz on :8787 (override with --port). Refuses if one is running.
@@ -102,6 +121,9 @@ usage:
   status   layered fleet report: dispatch (running|paused|stopped), ticks and
            next due time, pane, herdr, Telegram bot/API health, daemon, caps
            and active runs.
+  board    open the live keyboard-driven fleet board. It renders queue holds,
+           every run lifecycle stage, recent merges, spend and health; Enter
+           follows a selected transcript without leaving the board.
   hold     soft stop: pause claiming AND disarm ticks. Daemon and pane stay up.
            This is "stop the conductor overnight" without killing processes.
   halt     hold, then stop the dispatch daemon (systemctl-aware). Pane stays up
@@ -121,11 +143,17 @@ usage:
            the daemon rather than terminals, so this is the only way to watch
            one live. Runs until Ctrl-C, or until the run has finished and its
            transcript has stopped growing.
+  extend   monotonically raise a live run's turn ceiling without restarting its
+           session. Refuses settled runs and values at or below its current cap.
   unblock  clear <issue>'s blocked and failed labels so the next tick can claim
            it again — the supported way back for an escalation you answered,
            and why the brief's "never hand-edit a state label" rule can stay
-           absolute. Attempts already spent are kept: an answered block still
-           cost a worker.
+           absolute. Run history is kept; answered blocks consume the separate
+           operational-continuation budget, not failed implementation attempts.
+  friction record a bounded observation the daemon cannot classify itself:
+           an escalation that belonged in a digest, or a tick report that was
+           noise/surprising. Repeated observations feed the existing Learning
+           loop; recording one never edits policy by itself.
   daemon   run the dispatch loop in the foreground; --once runs a single tick
            and exits. This is what \`start\` launches.
   pause    stop claiming new work only (ticks keep firing if armed). Prefer hold.
@@ -187,6 +215,17 @@ function portFlag(argv: string[]): number | undefined {
   return port;
 }
 
+/** Required positive integer for `extend`; no partial parses such as `180x`. */
+function turnsFlag(argv: string[]): number {
+  const raw = flag(argv, "turns");
+  const turns = raw === undefined ? Number.NaN : Number(raw);
+  if (!Number.isSafeInteger(turns) || turns < 1) {
+    process.stderr.write(`omp-conductor: extend needs --turns with a positive integer, got "${raw ?? ""}"\n`);
+    process.exit(2);
+  }
+  return turns;
+}
+
 function humanDuration(ms: number): string {
   const s = Math.max(0, Math.round(ms / 1000));
   if (s < 60) return `${s}s`;
@@ -258,55 +297,6 @@ function issueArg(verb: string, raw: string | undefined): number {
   return issue;
 }
 
-/** Read one property off an unvalidated transcript entry. */
-function prop(source: unknown, key: string): unknown {
-  if (source === null || typeof source !== "object") return undefined;
-  return Reflect.get(source, key);
-}
-
-/**
- * One transcript line rendered for somebody watching, or `undefined` for the
- * lines not worth a row: thinking blocks, tool results, session metadata, and
- * anything this parser does not recognise.
- *
- * Defensive throughout. The transcript is written by the harness, not by this
- * package, so its shape is a peer dependency's business and can gain entry
- * types without warning. A `tail` that dies on one unfamiliar line is strictly
- * worse than one that skips it — the operator is watching a run they have no
- * other window onto.
- */
-function formatTranscriptLine(line: string): string | undefined {
-  let entry: unknown;
-  try {
-    entry = JSON.parse(line);
-  } catch {
-    return undefined;
-  }
-  if (prop(entry, "type") !== "message") return undefined;
-  const message = prop(entry, "message");
-  if (prop(message, "role") !== "assistant") return undefined;
-
-  const content = prop(message, "content");
-  // The harness writes an array of blocks; a bare string is the degenerate form
-  // some sessions still produce, and dropping it would silently lose the text.
-  if (typeof content === "string") {
-    return content.trim() === "" ? undefined : `assistant: ${content.trim()}`;
-  }
-
-  const blocks: readonly unknown[] = Array.isArray(content) ? content : [];
-  const out: string[] = [];
-  for (const block of blocks) {
-    const type = prop(block, "type");
-    if (type === "text") {
-      const text = prop(block, "text");
-      if (typeof text === "string" && text.trim() !== "") out.push(`assistant: ${text.trim()}`);
-    } else if (type === "toolCall") {
-      const name = prop(block, "name");
-      if (typeof name === "string" && name !== "") out.push(`tool: ${name}`);
-    }
-  }
-  return out.length === 0 ? undefined : out.join("\n");
-}
 
 /**
  * Follow one run's transcript the way `tail -f` follows a log.
@@ -398,6 +388,19 @@ try {
     case "version":
       process.stdout.write(`${packageVersion()}\n`);
       break;
+    case "upgrade": {
+      const result = await upgradeConductor({
+        version: flag(argv, "to"),
+        project: flag(argv, "project"),
+      });
+      process.stdout.write(
+        result.alreadyCurrent
+          ? `conductor ${result.version} already current on all three surfaces\n`
+          : `upgraded conductor ${result.previousVersion} → ${result.version} (${result.gitHead})\n` +
+              `dispatch ${result.dispatch} restored\n`,
+      );
+      break;
+    }
     case "daemon": {
       // Until now only `lifecycle.startDaemon()` — the spawn path — wrote the
       // pidfile, which left a daemon started in the foreground (which is how
@@ -503,6 +506,10 @@ try {
       break;
     }
 
+    case "board":
+      await runBoard(flag(argv, "project"));
+      break;
+
     case "hold": {
       const r = hold(flag(argv, "project"));
       process.stdout.write(
@@ -583,6 +590,44 @@ try {
       break;
     }
 
+    case "extend": {
+      const issue = issueArg("extend", argv[1]);
+      const maxTurns = turnsFlag(argv);
+      const project = findProject(loadConfig(), flag(argv, "project"));
+      const daemon = livingDaemon();
+      if (daemon === undefined) throw new Error("daemon is not running");
+      if (daemon.project !== undefined && daemon.project !== project.name) {
+        throw new Error(
+          `daemon serves project "${daemon.project}", not requested project "${project.name}"`,
+        );
+      }
+      const response = await fetch(
+        `http://127.0.0.1:${daemon.port}/runs/${issue}/turn-limit`,
+        {
+          method: "PUT",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ project: project.name, maxTurns }),
+        },
+      );
+      const payload = (await response.json()) as {
+        error?: unknown;
+        runId?: unknown;
+        maxTurns?: unknown;
+      };
+      if (!response.ok) {
+        throw new Error(
+          typeof payload.error === "string" ? payload.error : `daemon returned HTTP ${response.status}`,
+        );
+      }
+      if (typeof payload.runId !== "string" || typeof payload.maxTurns !== "number") {
+        throw new Error("daemon returned an invalid turn-extension response");
+      }
+      process.stdout.write(
+        `#${issue} turn ceiling extended to ${payload.maxTurns} (run ${payload.runId})\n`,
+      );
+      break;
+    }
+
     case "unblock": {
       const issue = issueArg("unblock", argv[1]);
       const cfg = loadConfig();
@@ -597,6 +642,44 @@ try {
       break;
     }
 
+    case "friction": {
+      const name = argv[1] as FrictionFeedbackName | undefined;
+      if (name === undefined || !Object.hasOwn(FRICTION_FEEDBACK_KINDS, name)) {
+        process.stderr.write(
+          "omp-conductor: friction needs one of: escalation-digest, report-noise, report-surprise\n",
+        );
+        process.exit(2);
+      }
+      const rawDetail = flag(argv, "detail");
+      const detail = rawDetail?.replace(/\s+/g, " ").trim();
+      if (
+        detail === undefined ||
+        detail.length === 0 ||
+        detail.length > 160 ||
+        rawDetail?.startsWith("--") === true
+      ) {
+        process.stderr.write("omp-conductor: friction needs --detail with 1-160 characters\n");
+        process.exit(2);
+      }
+      const issueText = flag(argv, "issue");
+      const issue = issueText === undefined ? undefined : issueArg("friction --issue", issueText);
+      const project = findProject(loadConfig(), flag(argv, "project"));
+      const store = openStore(dbPath());
+      try {
+        store.recordFriction(project.name, {
+          kind: FRICTION_FEEDBACK_KINDS[name],
+          occurrences: 1,
+          ...(issue === undefined ? {} : { issue }),
+          sample: detail,
+          at: Date.now(),
+        });
+      } finally {
+        store.close();
+      }
+      process.stdout.write(`friction recorded for ${project.name}: ${name} — ${detail}\n`);
+      break;
+    }
+
     case "pause":
       setPaused(true);
       process.stdout.write(

package/src/config.ts

@@ -20,14 +20,17 @@ import {
   CONFIG_VERSION,
   DEFAULT_AUTHORITY,
   DEFAULT_CAPS,
+  DEFAULT_RELEASE_POLICY,
   DEFAULT_REPORT_SCOPE,
   ORCHESTRATOR_MODES,
   READABLE_CONFIG_VERSIONS,
+  RELEASE_POLICIES,
   REPORT_SCOPES,
   type Caps,
   type ConductorConfig,
   type ProjectConfig,
   type ReportScope,
+  type ReleasePolicy,
   type RepoTarget,
 } from "./types.ts";
 
@@ -137,24 +140,28 @@ export function saveConfig(c: ConductorConfig): void {
 }
 
 /**
- * Layers a project's overrides on the global defaults, field by field, so a
- * project that pins one cap still inherits the other five. `??` not `||`: a
- * deliberate `dailySpendUsd: 0` is a hard stop, not "unset", and `null` is a
- * deliberate "no spend gate" that must not fall through to the default.
- * Spelled out per field so adding a `Caps` member fails to compile here.
+ * Layers a project's overrides on the global defaults, field by field. `??`
+ * not `||`: a deliberate `dailySpendUsd: 0` is a hard stop, and `null` is a
+ * deliberate "no spend gate". Spelled out so a new cap fails compilation here.
  */
 export function resolveCaps(p: ProjectConfig, defaults: Caps): Caps {
   const o: Partial<Caps> = p.caps ?? {};
   return {
     maxConcurrentWorkers: o.maxConcurrentWorkers ?? defaults.maxConcurrentWorkers,
-    // nullish only — `null` means off; do not coalesce it to the default.
     dailySpendUsd: o.dailySpendUsd !== undefined ? o.dailySpendUsd : defaults.dailySpendUsd,
     workerMaxTurns: o.workerMaxTurns ?? defaults.workerMaxTurns,
     workerWallClockMs: o.workerWallClockMs ?? defaults.workerWallClockMs,
     maxAttemptsPerIssue: o.maxAttemptsPerIssue ?? defaults.maxAttemptsPerIssue,
+    maxContinuationsPerIssue:
+      o.maxContinuationsPerIssue ?? defaults.maxContinuationsPerIssue,
   };
 }
 
+/** Old configs and omitted keys are fail-closed at the enforcement boundary. */
+export function resolveReleasePolicy(p: ProjectConfig): ReleasePolicy {
+  return p.releasePolicy ?? DEFAULT_RELEASE_POLICY;
+}
+
 /**
  * Resolves a project by name, or the only project when the name is omitted.
  * Refuses to guess between several: picking one silently would spend the wrong
@@ -275,6 +282,14 @@ function normalizeProject(
 
   const escalation = normalizeEscalation(raw["escalation"], label, problems);
   const authority = normalizeAuthority(raw["authority"], label, problems);
+  const releasePolicy = pickLiteral(
+    raw["releasePolicy"],
+    RELEASE_POLICIES,
+    DEFAULT_RELEASE_POLICY,
+    `${label}: releasePolicy`,
+    RELEASE_POLICIES.map((value) => JSON.stringify(value)).join(" or "),
+    problems,
+  );
 
   const caps = coerceCaps(raw["caps"], `${label}: caps`, problems, legacyCaps);
   const reporting = normalizeReporting(raw["reporting"], label, problems);
@@ -300,6 +315,7 @@ function normalizeProject(
     ...(workerModel === undefined ? {} : { workerModel }),
     escalation,
     authority,
+    releasePolicy,
     reporting,
     workspaceRoot: expandHome(pickString(raw["workspaceRoot"], join(stateDir(), "worktrees"))),
     mirrorRoot: expandHome(pickString(raw["mirrorRoot"], join(stateDir(), "mirrors"))),