omp-conductor 0.3.18 → 0.3.19

package/src/orchestrator-tick.ts

@@ -43,13 +43,20 @@
 import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { isAbsolute, join, resolve } from "node:path";
-import { findProject, loadConfig } from "./config.ts";
+import { findProject, loadConfig, resolveReleasePolicy } from "./config.ts";
 import {
   briefPathForProject,
   policyPathForProject,
   refreshComposedBriefForProject,
 } from "./setup.ts";
-import { DEFAULT_REPORT_SCOPE, type ReportScope } from "./types.ts";
+import {
+  recordReleaseBlock,
+  releaseDecision,
+  releaseDriftDigestLine,
+  type ReleaseDecision,
+} from "./release-policy.ts";
+import { DEFAULT_RELEASE_POLICY, DEFAULT_REPORT_SCOPE, type FrictionSignal, type ReportScope, type Store } from "./types.ts";
+import { dbPath, openStore } from "./store.ts";
 
 /** The activation file. Absent means "this is not an orchestrator session". */
 export const TICK_CONFIG_FILE = ".conductor-tick.json";
@@ -63,6 +70,11 @@ export const TICK_CUSTOM_TYPE = "omp-conductor.tick";
  * misconfiguration worth refusing rather than obeying.
  */
 export const MIN_INTERVAL_SECONDS = 60;
+/** Repetition threshold and windows for Learning-loop friction signals. */
+export const FRICTION_MIN_OBSERVATIONS = 3;
+export const FRICTION_LOOKBACK_MS = 7 * 24 * 60 * 60 * 1_000;
+export const FRICTION_COOLDOWN_MS = 7 * 24 * 60 * 60 * 1_000;
+const FRICTION_DIGEST_LIMIT = 3;
 
 /**
  * How often to re-ask who owns the fleet tick after herdr failed to answer.
@@ -324,6 +336,35 @@ export const TICK_SCOPE_CONSTRAINTS: { readonly [K in ReportScope]: string } = {
 export const TICK_DELIVERY_RULE =
   "This tick was injected locally, not sent from Telegram, so your end-of-turn text does NOT reach your operator. Deliver anything reportable this turn by calling the telegram_send tool and confirming success; never claim a report was sent otherwise.";
 
+function frictionLabel(kind: FrictionSignal["kind"]): string {
+  if (kind.startsWith("admission:")) return `admission hold ${kind.slice("admission:".length)}`;
+  if (kind === "feedback:escalation-should-digest") return "escalations classified as digest material";
+  if (kind === "feedback:report-noise") return "tick reports classified as noise";
+  return "tick reports classified as surprising";
+}
+
+/** Bounded evidence for the existing approval protocol — never an automatic edit. */
+export function formatFrictionDigest(signals: readonly FrictionSignal[]): string {
+  const shown = signals.slice(0, FRICTION_DIGEST_LIMIT);
+  const lines = [
+    "Repeated friction observed over the last 7 days (evidence only; not permission to edit policy):",
+    ...shown.map((signal) => {
+      const issues =
+        signal.issues.length === 0 ? "" : `; issues ${signal.issues.map((issue) => `#${issue}`).join(", ")}`;
+      const samples = signal.samples.length === 0 ? "" : `; examples: ${signal.samples.join(" | ")}`;
+      return (
+        `- ${frictionLabel(signal.kind)} — ${signal.observations} observations, ` +
+        `${signal.occurrences} affected${issues}${samples}`
+      );
+    }),
+  ];
+  if (signals.length > shown.length) lines.push(`- ${signals.length - shown.length} more signal(s) deferred`);
+  lines.push(
+    "After the tick duties, investigate at most one signal. Use the existing Learning loop only if the recurring cause has a safe POLICY.md remedy; otherwise leave policy unchanged and report or file the underlying product/infra issue through the existing rules.",
+  );
+  return lines.join("\n");
+}
+
 /**
  * The scope this tick carries, where the brief actually lives, and — when the
  * config could not answer — why.
@@ -982,23 +1023,66 @@ function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSe
   // expects ORCHESTRATOR.md / AGENTS.md to track the installed package.
   refreshComposedBriefBestEffort();
 
-  // A configured message owns the whole contract, reporting and delivery clauses
-  // included: an operator who wrote their own prompt did not ask for ours
-  // appended to it.
+  const scope = resolveTickScope();
+  // A configured message owns the ordinary reporting and delivery clauses.
+  // Mechanical evidence is different: release-policy drift and repeated
+  // operational friction must not disappear because an operator customized the
+  // ordinary heartbeat wording.
   let content = currentMessage(ctx.cwd, config);
   if (content === undefined) {
-    const scope = resolveTickScope();
     if (scope.fallback !== undefined && !session.scopeFallbackLogged) {
       session.scopeFallbackLogged = true;
       pi.logger.info(`[omp-conductor] tick reporting scope: using ${DEFAULT_REPORT_SCOPE} — ${scope.fallback}`);
     }
     content = `${defaultTickMessage(new Date(), scope.briefPath, scope.policyPath)}\n${TICK_SCOPE_CONSTRAINTS[scope.scope]}\n${TICK_DELIVERY_RULE}`;
   }
+  let frictionStore: Store | undefined;
+  let frictionSignals: FrictionSignal[] = [];
+  const now = Date.now();
+  if (scope.projectName !== undefined) {
+    const drift = releaseDriftDigestLine(scope.projectName);
+    if (drift !== undefined) content = `${content}\n${drift}`;
+    if (existsSync(dbPath())) {
+      try {
+        frictionStore = openStore(dbPath());
+        frictionSignals = frictionStore.pendingFriction(
+          scope.projectName,
+          now - FRICTION_LOOKBACK_MS,
+          FRICTION_MIN_OBSERVATIONS,
+          now - FRICTION_COOLDOWN_MS,
+        );
+        if (frictionSignals.length > 0) content = `${content}\n${formatFrictionDigest(frictionSignals)}`;
+      } catch (err) {
+        frictionStore?.close();
+        frictionStore = undefined;
+        pi.logger.error(
+          `[omp-conductor] friction digest unavailable: ${err instanceof Error ? err.message : String(err)}`,
+        );
+      }
+    }
+  }
 
-  pi.sendMessage(
-    { customType: TICK_CUSTOM_TYPE, content, display: true, attribution: "user" },
-    { triggerTurn: true, deliverAs: "followUp" },
-  );
+  try {
+    pi.sendMessage(
+      { customType: TICK_CUSTOM_TYPE, content, display: true, attribution: "user" },
+      { triggerTurn: true, deliverAs: "followUp" },
+    );
+    if (scope.projectName !== undefined && frictionSignals.length > 0) {
+      try {
+        frictionStore?.markFrictionSurfaced(
+          scope.projectName,
+          frictionSignals.map((signal) => signal.kind),
+          now,
+        );
+      } catch (err) {
+        pi.logger.error(
+          `[omp-conductor] friction digest cooldown could not be recorded: ${err instanceof Error ? err.message : String(err)}`,
+        );
+      }
+    }
+  } finally {
+    frictionStore?.close();
+  }
   pi.logger.info(`[omp-conductor] tick sent: ${decision.reason}`, { reason: decision.reason });
   // An empty queue at send time is the proof the previous tick was consumed, so
   // this is the only place either the counter or the marker is cleared.
@@ -1056,6 +1140,63 @@ export default function orchestratorTickExtension(pi: TickApi): void {
   // counter is about this session's own queue. A second session in the same
   // process starts with both at zero.
   const session: TickSession = { scopeFallbackLogged: false, pendingSkips: 0 };
+  let releaseGateArmed = false;
+  // An activation file makes this a fleet directory before Herdr can prove
+  // which pane owns it. The gate therefore starts closed and only honours an
+  // operator-brief policy after ownership is accepted.
+  let releaseAuthorityAccepted = false;
+  const armReleaseGate = (): void => {
+    if (releaseGateArmed) return;
+    releaseGateArmed = true;
+    (pi as TickApi & {
+      on(
+        event: "tool_call",
+        handler: (
+          event: { toolName: string; input: Record<string, unknown> },
+          ctx: unknown,
+        ) => ReleaseDecision | undefined,
+      ): void;
+    }).on("tool_call", (event) => {
+      // Most tool calls are ordinary tracker/file work. Detect shape first so
+      // they do not re-read config or emit policy diagnostics.
+      const candidate = releaseDecision(DEFAULT_RELEASE_POLICY, event.toolName, event.input);
+      if (candidate === undefined) return undefined;
+      let projectName: string | undefined;
+      let policy = DEFAULT_RELEASE_POLICY;
+      let external = true;
+      try {
+        const project = findProject(loadConfig());
+        projectName = project.name;
+        policy = resolveReleasePolicy(project);
+        external = project.escalation.orchestrator === "external";
+      } catch (err) {
+        // A missing/unreadable config cannot open a release gate. Log only when
+        // a release-shaped call actually reaches this handler.
+        pi.logger.error(
+          `[omp-conductor] release policy unreadable; enforcing ${DEFAULT_RELEASE_POLICY}: ${
+            err instanceof Error ? err.message : String(err)
+          }`,
+        );
+      }
+      if (releaseAuthorityAccepted && policy === "operator-brief") return undefined;
+      // Embedded orchestrators carry the same tripwire inline through
+      // `createSession`; suppress this second copy only after this session has
+      // proved it owns the external heartbeat.
+      if (releaseAuthorityAccepted && !external) return undefined;
+      if (projectName !== undefined) {
+        try {
+          recordReleaseBlock(projectName, "orchestrator", candidate.shape);
+        } catch (err) {
+          pi.logger.error(
+            `[omp-conductor] could not record release-policy block: ${
+              err instanceof Error ? err.message : String(err)
+            }`,
+          );
+        }
+      }
+      return candidate.decision;
+    });
+  };
 
   pi.on("session_start", (_event, ctx) => {
     if (decided) return;
@@ -1081,6 +1222,10 @@ export default function orchestratorTickExtension(pi: TickApi): void {
       return;
     }
 
+    // Present but invalid still identifies a fleet directory. Install the
+    // fail-closed handler before validation or ownership can return early.
+    armReleaseGate();
+
     if (result.kind === "invalid") {
       const detail = `${result.path}: ${result.problem}`;
       pi.logger.error(`[omp-conductor] orchestrator tick disabled — ${detail}`);
@@ -1138,6 +1283,7 @@ export default function orchestratorTickExtension(pi: TickApi): void {
           return;
         }
         if (next.note !== undefined) pi.logger.error(`[omp-conductor] tick ownership: ${next.note}`);
+        releaseAuthorityAccepted = true;
         armTickHeartbeat(pi, ctx, config, session);
         pi.logger.info(`[omp-conductor] orchestrator tick active: ownership resolved on retry`, { agentName });
       }, retryMs);
@@ -1151,6 +1297,7 @@ export default function orchestratorTickExtension(pi: TickApi): void {
       return;
     }
     if (ownership.note !== undefined) pi.logger.error(`[omp-conductor] tick ownership: ${ownership.note}`);
+    releaseAuthorityAccepted = true;
     armTickHeartbeat(pi, ctx, config, session);
     decided = true;
     // Both gates are named at startup: "why is it not ticking?" is answered by

package/src/orchestrator.ts

@@ -33,7 +33,8 @@ import { stateDir } from "./config.ts";
 import { formatEscalation } from "./escalate.ts";
 import { createSession, disposeSession } from "./omp.ts";
 import type { AgentSessionLike } from "./omp.ts";
-import type { Escalation } from "./types.ts";
+import type { ReleaseShape } from "./release-policy.ts";
+import type { Escalation, ReleasePolicy } from "./types.ts";
 
 /**
  * The session factory {@link startOrchestrator} uses. Named so the test seam
@@ -44,6 +45,8 @@ export type CreateSessionFn = (opts: {
   sessionDir?: string;
   model?: string;
   resume?: boolean;
+  releasePolicy?: ReleasePolicy;
+  onReleaseBlocked?: (shape: ReleaseShape) => void;
 }) => Promise<AgentSessionLike>;
 
 /**
@@ -76,6 +79,8 @@ export interface OrchestratorOpts {
   cwd: string;
   sessionDir?: string;
   model?: string;
+  releasePolicy?: ReleasePolicy;
+  onReleaseBlocked?: (shape: ReleaseShape) => void;
   /**
    * Standing orders — which repo, which labels, what the fleet is. Prepended to
    * the *first* injection rather than sent as its own prompt on startup: a
@@ -159,6 +164,8 @@ export async function startOrchestrator(o: OrchestratorOpts): Promise<Orchestrat
     cwd: o.cwd,
     sessionDir,
     ...(o.model === undefined ? {} : { model: o.model }),
+    ...(o.releasePolicy === undefined ? {} : { releasePolicy: o.releasePolicy }),
+    ...(o.onReleaseBlocked === undefined ? {} : { onReleaseBlocked: o.onReleaseBlocked }),
     // The whole point of a persistent orchestrator: a daemon restart must not
     // reset what it knows it has already escalated, or the first tick after a
     // deploy re-litigates every parked issue from scratch.

package/src/plugin.ts

@@ -21,12 +21,12 @@ import {
   repairPolicyBannerCrumbs,
   writeMergedBrief,
 } from "./brief-upgrade.ts";
-import { configPath, expandHome, findProject, loadConfig, saveConfig } from "./config.ts";
+import { configPath, expandHome, findProject, loadConfig, resolveCaps, saveConfig } from "./config.ts";
 import { hostRamBytes, recommendedMaxWorkers } from "./host.ts";
 import {
-  armConductor,
   isPaused,
-  previewQueue,
+  prepareConductor,
+  previewProject,
   setPaused,
   type QueuePreview,
 } from "./daemon.ts";
@@ -40,8 +40,15 @@ import {
   releaseHold,
   renderStatus,
 } from "./fleet.ts";
+import { restartDaemon } from "./lifecycle.ts";
 
 import { defaultGraphRoot } from "./graph.ts";
+import {
+  formatHostRuntimePlan,
+  planHostRuntime,
+  runSetupSmoke,
+  writeHostRuntime,
+} from "./setup-host.ts";
 import {
   AMEND_AREAS,
   ORCHESTRATOR_BRIEF_NAME,
@@ -74,6 +81,7 @@ import {
   type ConductorConfig,
   type OrchestratorMode,
   type ProjectConfig,
+  type ReleasePolicy,
   type ReportScope,
 } from "./types.ts";
 
@@ -341,6 +349,20 @@ async function askAuthority(
   return { merge: merge ? "orchestrator" : "human", release: release ? "orchestrator" : "human" };
 }
 
+async function askReleasePolicy(
+  ctx: CommandContext,
+  prior: ReleasePolicy,
+): Promise<ReleasePolicy> {
+  const open = await ctx.ui.confirm(
+    "Release tool gate",
+    "Allow worker and orchestrator sessions to invoke release/deploy-shaped tools? Only enable this " +
+      "when the operator brief contains the release procedure they must follow. Default: no, block " +
+      "git tags, tag pushes, package publishing, GitHub release creation and deploy commands" +
+      `${prior === "operator-brief" ? " — currently enabled, answer no to close it" : ""}.`,
+  );
+  return open ? "operator-brief" : "none";
+}
+
 /**
  * Where the session that triages escalations lives. Phrased as a fact about the
  * host rather than a preference, because that is what it is: answering yes when
@@ -571,7 +593,8 @@ const askCaps: AreaAsker = async (ctx, a) => {
     `Defaults: ${workersDefault} workers, ` +
       `${spendLabel}, ${DEFAULT_CAPS.workerMaxTurns} turns and ` +
       `${Math.round(DEFAULT_CAPS.workerWallClockMs / 60000)} min per worker, ` +
-      `${DEFAULT_CAPS.maxAttemptsPerIssue} attempts per issue.${smallHostNote} Change them?`,
+      `${DEFAULT_CAPS.maxAttemptsPerIssue} failed attempts and ` +
+      `${DEFAULT_CAPS.maxContinuationsPerIssue} operational continuations per issue.${smallHostNote} Change them?`,
   );
   if (!tuneCaps) {
     if (
@@ -603,9 +626,14 @@ const askCaps: AreaAsker = async (ctx, a) => {
   );
   caps.maxAttemptsPerIssue = await askNumber(
     ctx,
-    "Attempts per issue before it escalates",
+    "Failed implementation attempts per issue before escalation",
     caps.maxAttemptsPerIssue ?? DEFAULT_CAPS.maxAttemptsPerIssue,
   );
+  caps.maxContinuationsPerIssue = await askNumber(
+    ctx,
+    "Operational continuations per issue before escalation",
+    caps.maxContinuationsPerIssue ?? DEFAULT_CAPS.maxContinuationsPerIssue,
+  );
   return { ...a, caps };
 };
 
@@ -621,7 +649,11 @@ const askWorkerModel: AreaAsker = async (ctx, a) => {
 
 /** Both grants, asked together because they are the two questions that decide
  *  what an unattended fleet may do without asking anybody. */
-const askAuthorityArea: AreaAsker = async (ctx, a) => ({ ...a, authority: await askAuthority(ctx, a.authority) });
+const askAuthorityArea: AreaAsker = async (ctx, a) => ({
+  ...a,
+  authority: await askAuthority(ctx, a.authority),
+  releasePolicy: await askReleasePolicy(ctx, a.releasePolicy),
+});
 
 /** How a stuck run reaches a human, and who triages it when it does. */
 const askEscalation: AreaAsker = async (ctx, a) => {
@@ -795,20 +827,6 @@ function formatPreview(p: QueuePreview): string[] {
   return lines;
 }
 
-/**
- * The dry run needs a saved config to read, and before the confirm there may
- * not be one — that is the normal first run, not a failure. So the reason is
- * reported inline and the wizard carries on; the post-write preview is the one
- * that always has something to say.
- */
-async function tryPreview(project: string): Promise<string[]> {
-  try {
-    return formatPreview(await previewQueue(project));
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    return [`  (not available yet: ${message.split("\n")[0] ?? message})`];
-  }
-}
 
 /** What the whole conversation produced: the answers, and which area an amend
  *  narrowed it to. `amend` absent means every question was asked. */
@@ -817,6 +835,17 @@ export interface CollectedSetup {
   amend?: { area: AmendAreaId; before: ProjectConfig };
 }
 
+
+export async function ensureSetupArm(
+  projectName: string,
+  arm: typeof armTicks = armTicks,
+): Promise<string> {
+  const armed = await arm(projectName);
+  return armed.alreadyArmed
+    ? `existing heartbeat arm revalidated for owner ${armed.owner} at ${armed.path}`
+    : `heartbeat armed for owner ${armed.owner} at ${armed.path}`;
+}
+
 /**
  * The whole conversation, from the amend question to the last prompt, and not one
  * byte further: no `gh`, no dry run, nothing written.
@@ -845,11 +874,10 @@ export async function collectSetup(
 /**
  * The onboarding wizard, and — for a project it already knows — the amend.
  *
- * The invariant that makes this safe to run against a live tracker: nothing is
- * written or created before the confirm below returns true. Reading the config,
- * asking questions, `checkTokenScopes`, `planLabels` and `previewQueue` are all
- * reads. The four mutations — `createMissingLabels`, `saveConfig`,
- * `writeOrchestratorBrief`, `armConductor` — all live after it. Keep it that way.
+ * The invariant that makes this safe against a live tracker: no mutation occurs
+ * before the consent below. Config, tracker, and host-runtime planning are
+ * read-only. The paused state, labels, config, brief, runtime files, smoke, and
+ * arm proof all follow the same consent gate.
  *
  * An amend changes which questions are asked and what the summary leads with,
  * and nothing else: the same answers, the same `buildConfig`, the same single
@@ -876,8 +904,46 @@ async function setup(ctx: CommandContext, projectArg: string | undefined): Promi
   const { answers, amend } = collected;
 
   const scopes = await checkTokenScopes();
+  if (!scopes.ok) {
+    ctx.ui.notify(
+      `Setup stopped before writing anything. The gh token needs repo and project scopes. ` +
+        `Run \`gh auth refresh -s repo,project\`, then run setup again.`,
+      "error",
+    );
+    return;
+  }
   const labels = await planLabels(answers.trackerRepo, answers);
   const telegram = detectTelegram();
+  const nextConfig = buildConfig(answers, existing);
+  const project = findProject(nextConfig, answers.projectName);
+  if (
+    project.escalation.orchestrator === "external" &&
+    !answers.writeOrchestratorBrief &&
+    (!existsSync(briefPathForProject(project)) || !existsSync(policyPathForProject(project)))
+  ) {
+    ctx.ui.notify(
+      `Setup stopped before writing anything. External orchestration needs ${ORCHESTRATOR_BRIEF_NAME} and ${POLICY_BRIEF_NAME}. ` +
+        `Run setup again and approve the brief write.`,
+      "error",
+    );
+    return;
+  }
+  const runtime = planHostRuntime(
+    project,
+    resolveCaps(project, nextConfig.defaults),
+    telegram.stateDir,
+  );
+  let queuePreview: string[];
+  try {
+    queuePreview = formatPreview(await previewProject(project));
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    ctx.ui.notify(
+      `Setup stopped before writing anything because the proposed queue could not be read: ${message}`,
+      "error",
+    );
+    return;
+  }
 
   ctx.ui.notify(
     [
@@ -886,10 +952,10 @@ async function setup(ctx: CommandContext, projectArg: string | undefined): Promi
       ...(amend === undefined ? [] : [summariseAmend(amend.area, amend.before, answers)]),
       summarisePlan(answers, scopes, labels, telegram),
       "",
-      existing === undefined
-        ? "Dry run: available once the config is written."
-        : "Dry run against the CURRENTLY SAVED config:",
-      ...(existing === undefined ? [] : await tryPreview(answers.projectName)),
+      formatHostRuntimePlan(runtime),
+      "",
+      "Dry run against the PROPOSED config:",
+      ...queuePreview,
       "",
       "Nothing has been changed yet.",
     ].join("\n"),
@@ -903,14 +969,22 @@ async function setup(ctx: CommandContext, projectArg: string | undefined): Promi
       toCreate.length > 0
         ? `Creates ${toCreate.length} label(s) in ${answers.trackerRepo}: ${toCreate.join(", ")}.`
         : "Creates no labels.",
-      `Writes ${path}, creates the state database and clears the pause flag.`,
-      scopes.missing.length > 0
-        ? `WARNING: the gh token is missing ${scopes.missing.join(", ")} — the daemon will fail to label issues.`
-        : "",
+      `Writes ${path}, prepares a paused state database, then runs a paused daemon smoke.`,
+      runtime.service.action === "keep"
+        ? `Keeps the staged systemd unit at ${runtime.service.path}.`
+        : `${runtime.service.action === "create" ? "Creates" : "Updates"} the staged systemd unit at ${runtime.service.path}.`,
+      runtime.tick === undefined
+        ? ""
+        : runtime.tick.action === "keep"
+          ? `Keeps the external heartbeat config at ${runtime.tick.path}.`
+          : `${runtime.tick.action === "create" ? "Creates" : "Updates"} the external heartbeat config at ${runtime.tick.path}.`,
       answers.writeOrchestratorBrief
         ? `Writes ${orchestratorBriefPath(answers)}, which is then yours to edit.`
         : "",
-      "Issues are only claimed once the daemon runs.",
+      project.escalation.orchestrator === "external"
+        ? "Dispatch stays paused until the existing arm marker or a new inbound Telegram proof makes the heartbeat live."
+        : "Dispatch resumes after the smoke succeeds.",
+      "Issues are only claimed after every setup gate succeeds.",
     ]
       .filter((s) => s.length > 0)
       .join(" "),
@@ -920,25 +994,79 @@ async function setup(ctx: CommandContext, projectArg: string | undefined): Promi
     return;
   }
 
-  // Labels first: a config pointing at labels that do not exist is a daemon
-  // that starts and then fails on its first claim.
+  // Hold first. Any later filesystem, tracker, smoke, or channel error leaves a
+  // partially applied setup unable to claim work.
+  prepareConductor();
   const created = await createMissingLabels(answers.trackerRepo, labels);
-  saveConfig(buildConfig(answers, existing));
+  saveConfig(nextConfig);
   const briefPath = answers.writeOrchestratorBrief ? writeOrchestratorBrief(answers) : undefined;
-  armConductor();
+  const runtimeFiles = writeHostRuntime(runtime);
+  const smoke = await runSetupSmoke(project.name);
+  let smokeLine =
+    `paused daemon --once; temporary /healthz on :${smoke.daemon.port}; ` +
+    `stored status for ${smoke.status.project}`;
+  let restartVia: "systemctl" | "cli" | undefined;
+  if (smoke.mode === "existing") {
+    if (smoke.status.liveWorkers > 0) {
+      ctx.ui.notify(
+        [
+          `Setup files are updated, but ${smoke.status.liveWorkers} live worker(s) still use the old daemon config.`,
+          "Dispatch remains paused. Let those workers finish.",
+          `Then run \`omp-conductor restart --project ${project.name}\`.`,
+          project.escalation.orchestrator === "external"
+            ? `Run \`omp-conductor arm --project ${project.name}\` if ticks are disarmed, then run \`omp-conductor resume\`.`
+            : "Then run `omp-conductor resume`.",
+        ].join("\n"),
+        "warning",
+      );
+      return;
+    }
+    const restarted = await restartDaemon({ project: project.name });
+    restartVia = restarted.via;
+    smokeLine =
+      `existing /healthz and stored status; restarted through ${restarted.via}; ` +
+      `new /healthz on :${restarted.record.port}`;
+  }
+
+  let armLine = "embedded orchestrator — no heartbeat arm marker";
+  if (project.escalation.orchestrator === "external") {
+    ctx.ui.notify("Setup smoke passed. Proving the external heartbeat channel…", "info");
+    try {
+      armLine = await ensureSetupArm(project.name);
+    } catch (err) {
+      ctx.ui.notify(
+        [
+          "Setup files passed the paused daemon smoke, but the fleet remains held.",
+          err instanceof Error ? err.message : String(err),
+          `Start the external orchestrator in ${project.workspaceRoot}, then run \`omp-conductor arm --project ${project.name}\`.`,
+          "After the arm proof succeeds, run `omp-conductor resume`.",
+        ].join("\n"),
+        "warning",
+      );
+      return;
+    }
+  }
+  setPaused(false);
 
   ctx.ui.notify(
     [
-      created.length > 0 ? `Created label(s): ${created.join(", ")}` : "No labels needed creating.",
-      `Wrote ${path} and armed the conductor.`,
+      created.length > 0 ? `Created label(s): ${created.join(", ")}` : "All required labels already existed.",
+      `Wrote ${path}; dispatch is ready.`,
       briefPath === undefined
-        ? "No orchestrator brief written — the conductor stops at green PRs; merges and releases stay human."
-        : `Wrote ${briefPath} + POLICY.md — edit POLICY.md (Releases/Reporting); floor refreshes each tick.`,
+        ? "Kept the existing orchestrator brief."
+        : `Wrote ${briefPath} + POLICY.md. Edit POLICY.md for Releases and Reporting.`,
+      runtimeFiles.length === 0
+        ? "Host runtime files were already current."
+        : `Wrote host runtime file(s): ${runtimeFiles.join(", ")}`,
+      `Smoke passed: ${smokeLine}.`,
+      `Heartbeat: ${armLine}.`,
       "",
-      "Dry run against the config just written:",
-      ...(await tryPreview(answers.projectName)),
+      "On a systemd host, install and start the supervised daemon:",
+      ...(restartVia === "cli" ? ["  omp-conductor stop"] : []),
+      ...runtime.installCommands.map((command) => `  ${command}`),
       "",
-      "Start the loop with `omp-conductor daemon`, or `omp-conductor daemon --once` for a single tick.",
+      "Without systemd, run `omp-conductor start`.",
+      "Use the documented toy-issue drill to prove one complete worker path.",
     ].join("\n"),
     "info",
   );