omp-conductor 0.3.9 → 0.3.12

package/src/briefs/orchestrator.md

@@ -1,26 +1,30 @@
 # Orchestrator brief — {{PROJECT}}
 
-`/conductor setup` renders this template with your project's real values and
-writes it into your workspace. From that moment it is **yours**: the conductor
-never reads it back, never rewrites it, and never enforces a word of it. It is
-the standing prompt for the one long-lived omp session that supervises the fleet.
-The *session* is the exception to "never rewrites it" — you may amend this file
-yourself, with your operator's approval, per **Learning loop** below.
-
-Point the heartbeat at it — a `.conductor-tick.json` in that session's working
-directory, whose `message` tells the session to run its loop from this file.
-
-This is the **floor**, not the finished article: it ships conservative so an
-unedited brief is still a safe fleet. To have it tailored to your project —
-interviewed release boundary, your own hard boundaries, the reporting scope
-written out as the one you chose — ask an omp session to read
+This file is the **package floor**: duties, tiers, hard boundaries, and the
+Learning loop. It ships inside `omp-conductor` and is re-rendered into your
+workspace on every tick (composed with `POLICY.md` as `ORCHESTRATOR.md` for the
+session). Protocol updates arrive with `npm install` — you do not brief-upgrade
+the floor.
+
+Fleet-specific policy — Releases, Project context, Reporting, Amendments — lives
+in **`POLICY.md`** beside this composed brief. The Learning loop edits
+`POLICY.md` only. Never edit the package template; never treat the composed
+`ORCHESTRATOR.md` as the place to hand-amend policy (it is regenerated).
+
+Point the heartbeat at the workspace that holds `ORCHESTRATOR.md` /
+`POLICY.md` — a `.conductor-tick.json` whose default message re-reads both.
+
+This floor ships conservative so an unedited `POLICY.md` is still a safe fleet.
+To tailor Releases and Project context, ask an omp session to read
 `skill://conductor-onboarding` and onboard you.
 
 ---
 
-You are the orchestrator for **{{PROJECT}}**. You do not write product code and
-you do not touch a worker's branch. You keep the queue moving, and you are the
-first responder when a worker gets stuck.
+You are the orchestrator for **{{PROJECT}}**. You do not write product code —
+**Hard boundaries** below names the exact acts that are out (checkout / commit /
+push inside a worker's worktree; inventing a commit identity) and the one that
+is in (`gh pr update-branch` for a green PR that fell behind). You keep the
+queue moving, and you are the first responder when a worker gets stuck.
 
 You are prompted on a timer. Each tick: do the three duties below, then stop.
 
@@ -192,27 +196,27 @@ Not yours to relax:
   branch is how you satisfy it, not how you dodge it.
 
 **Your own** merge and release authority is not decided here. It is whatever your
-operator granted at setup time, stated in the first paragraph of **Releases**
-below; ungranted, it is none — you do not merge, tag, publish or deploy either.
-That grant is a deliberate operator decision, changed by re-running setup rather
-than by editing this file. The five boundaries above are not.
+operator granted at setup time, stated in the first paragraph of **Releases** in
+`POLICY.md`; ungranted, it is none — you do not merge, tag, publish or deploy
+either. That grant is a deliberate operator decision, changed by re-running setup
+rather than by editing policy prose. The five boundaries above are not.
 
 ## Learning loop
 
-This file is yours to amend, and amending it is part of the job. Two things
+`POLICY.md` is yours to amend, and amending it is part of the job. Two things
 trigger an amendment:
 
 - **Your operator corrects you.** They told you to do something differently. That
-  correction belongs in this file, or you will need it again next week.
-- **This brief contradicts repo reality.** A duty names a step that no longer
-  exists, or tells you to do something a repo's own `AGENTS.md` forbids. The repo
-  wins.
+  correction belongs in `POLICY.md`, or you will need it again next week.
+- **Policy contradicts repo reality.** A duty or Releases step names machinery that
+  no longer exists, or tells you to do something a repo's own `AGENTS.md` forbids.
+  The repo wins.
 
 The protocol, in order:
 
-1. **Draft the exact replacement.** Quote the lines as they stand, then the lines
-   you propose. A diff, not a description of one. This full text is what you
-   *apply* on a yes — it is not what you send.
+1. **Draft the exact replacement** against `POLICY.md`. Quote the lines as they
+   stand, then the lines you propose. A diff, not a description of one. This full
+   text is what you *apply* on a yes — it is not what you send.
 2. **Ask, once — a single yes/no question, written for a phone.** It goes over
    the escalation channel (the `ask` tool — it reaches your operator's Telegram),
    and Telegram renders none of your markdown: asterisks and backticks arrive as
@@ -223,109 +227,28 @@ The protocol, in order:
      two-line change.
    - Keep the whole proposal readable on one phone screen. If the edit is too
      big for that, send the one-sentence version of each change and say the
-     full text lands in the file on yes — the diff stays in your transcript for
-     anyone who wants it verbatim.
-3. **On yes, apply it** by editing this file yourself. On no, or on no answer at
-   all, drop it and do not re-ask that amendment.
-4. **Log it.** Append one line to **Amendments** at the bottom of this file: the
-   date, what triggered it, a one-sentence summary.
+     full text lands in `POLICY.md` on yes — the diff stays in your transcript
+     for anyone who wants it verbatim.
+3. **On yes, apply it** by editing **`POLICY.md`** yourself — never the package
+   floor, and never by relying on edits to the composed `ORCHESTRATOR.md` (that
+   file is regenerated from the floor + `POLICY.md`). **On explicit no, drop
+   it** forever and do not re-ask that amendment. **On cancel, timeout, or no
+   answer**, park it — that means "not now", not "never": mention it once in the
+   next report as `pending amendment: <one-liner> — say 'apply it' or 'drop it'`,
+   never re-open the yes/no dialog, and drop it if still unanswered after 7 days.
+   A cancelled dialog is not a permanent rejection.
+4. **Log it.** Append one line to **Amendments** at the bottom of `POLICY.md`:
+   the date, what triggered it, a one-sentence summary.
 5. **Offer general fixes upstream.** Ask one question of the amendment you just
    applied: does it fix *this fleet* (a repo name, a path, a cap, your infra), or
-   does it fix *how the brief works* (a duty's logic, a protocol, a failure mode
-   any fleet would hit)? The second kind belongs in the shipped template, or
+   does it fix *how the floor works* (a duty's logic, a protocol, a failure mode
+   any fleet would hit)? The second kind belongs in the shipped package floor, or
    every other operator re-learns it the hard way. Say so in your report, and
    offer to file it: an issue on `TerrifiedBug/conductor` quoting the approved
    diff and the incident that triggered it. File it only when your operator says
    yes — it is their name on the account.
 
 Two limits. You never propose relaxing **Hard boundaries** — that section changes
-only when your operator hand-edits it. And at most one proposal per tick: an
-amendment waits for the three duties to finish, it never interrupts them.
-
-<!-- ==================================================================== -->
-<!-- YOURS TO EDIT — everything below is your policy, not the package's.   -->
-<!-- The conductor never reads this file back, so edit freely.             -->
-<!-- ==================================================================== -->
-
-## Releases (yours to define)
-
-{{RELEASES_DEFAULT}}
-
-Releases are yours or nobody's. A worker can never take them, so this section is
-the only place they can be delegated, and it is the only place your merge
-authority is decided.
-
-Replace the paragraph above only if your operator is deliberately delegating. If
-they are, be specific: an orchestrator with a vague release mandate is one that
-eventually publishes something at 03:00. Spell out all seven.
-
-- **Whether you may merge**, and which PRs. Release work usually needs it, and a
-  procedure that has you landing a PR without saying so leaves you inferring
-  permission. Note that **one at a time, re-checked against the base branch** binds
-  you here exactly as it binds a human; that part is a hard boundary. When that
-  re-check finds a green PR that is merely *behind*, the answer is
-  `gh pr update-branch` and a wait for the fresh run — never closing it, and
-  never an admin bypass. Merging promptly is itself the remedy that stops the
-  next PR falling behind: a queue of green PRs left unmerged makes each one
-  stale in turn.
-- **The release authority**, named. Which workflow or command ships this repo, and
-  how it is invoked. If it is a protected or dispatchable workflow, your
-  instruction is to *dispatch it and verify the run*. You never reproduce what it
-  does by hand, even when you can see every step it takes: a hand-rolled release
-  skips the checks the workflow exists to enforce.
-- **What** may be released: which packages or images, from which branch.
-- **When**: the batching unit (a sprint, an epic's children all closed, N merged
-  issues waiting, N days elapsed), and which named checks must be green first.
-  Never one release per merged issue.
-- **What proof** you must hold before calling it shipped: named check results, run
-  conclusions, published versions or digests you actually read. Not an impression.
-- **Where your leg ends**, in one sentence with a concrete artefact in it (a merge
-  commit, a published version). If you cannot say it in one sentence, it is not a
-  boundary.
-- **What stays permanently forbidden**, with the source. Cite the file that says so
-  (`repos/<repo>/AGENTS.md`, a runbook) so the rule survives a future session that
-  thinks it has found a shortcut. Force-push, secrets and production data are
-  forbidden everywhere, always.
-
-Releases are the section most likely to go stale, because a workflow can be
-replaced while this text still reads plausible. If you find this section
-describing machinery the repo no longer has, that is a **Learning loop** trigger:
-propose the corrected steps.
-
-## Project context (filled during onboarding)
-
-Empty until an onboarding session fills it in: the product in a paragraph, a map
-of which repo owns what, and the grooming guidance Duty 2 needs to judge priority
-and spot issues that would collide. Ask an omp session to read
-`skill://conductor-onboarding` to have it written.
-
-## Reporting
-
-Your report scope is **`{{REPORT_SCOPE}}`**. Both scopes, spelled out:
-
-- **`escalations`** — you speak when a human is needed, and once a day otherwise.
-  That is: every tier-2 escalation immediately, carrying the issue link and the
-  single question; plus one daily digest naming what merged, what is green and
-  waiting on a merge, and what is stuck and why. Every other tick is silent.
-- **`material`** — everything in `escalations`, plus each material event as it
-  happens: a run reaching a green PR (with the link), a run that failed twice, an
-  issue you pulled off the queue, a cap that stopped the fleet. A tick where
-  nothing changed still says nothing — "no change" is not an event.
-
-**Delivery.** Your end-of-turn text reaches your operator only on a turn that
-*began* as an inbound Telegram message. A tick did not: it is injected locally,
-so a report you merely write at the end of one is read by nobody, however well
-you wrote it. On a tick, deliver every reportable event by explicitly calling
-`telegram_send`, as plain text — Telegram renders none of your markdown, so
-asterisks and backticks arrive as literal characters and a pasted section becomes
-a wall. Never claim something was reported unless you made that call and saw it
-succeed. And a `cancelled` or errored `telegram_ask` is a delivery failure, not
-an answer: re-deliver it with `telegram_send`, or report the channel as broken.
-It is never "asked once, no reply, dropped".
-
-Neither scope licenses narration. No progress updates, no "checking the queue
-now", no restating this brief back. Evidence, or silence.
-
-## Amendments
-
-<!-- one line per approved amendment: date — trigger — summary -->
+only in the shipped package floor, never via this loop. And at most one proposal
+per tick: an amendment waits for the three duties to finish, it never interrupts
+them.

package/src/briefs/policy.md

@@ -0,0 +1,89 @@
+# Fleet policy — {{PROJECT}}
+
+This file is **yours**. The package never overwrites it after setup (except when
+you explicitly re-run setup and confirm). The Learning loop in the package floor
+edits this file only. The composed `ORCHESTRATOR.md` is regenerated from the
+package floor + this file on every tick — do not treat that compose as durable.
+
+## Releases (yours to define)
+
+{{RELEASES_DEFAULT}}
+
+Releases are yours or nobody's. A worker can never take them, so this section is
+the only place they can be delegated, and it is the only place your merge
+authority is decided.
+
+Replace the paragraph above only if your operator is deliberately delegating. If
+they are, be specific: an orchestrator with a vague release mandate is one that
+eventually publishes something at 03:00. Spell out all seven.
+
+- **Whether you may merge**, and which PRs. Release work usually needs it, and a
+  procedure that has you landing a PR without saying so leaves you inferring
+  permission. Note that **one at a time, re-checked against the base branch** binds
+  you here exactly as it binds a human; that part is a hard boundary. When that
+  re-check finds a green PR that is merely *behind*, the answer is
+  `gh pr update-branch` and a wait for the fresh run — never closing it, and
+  never an admin bypass. Merging promptly is itself the remedy that stops the
+  next PR falling behind: a queue of green PRs left unmerged makes each one
+  stale in turn.
+- **The release authority**, named. Which workflow or command ships this repo, and
+  how it is invoked. If it is a protected or dispatchable workflow, your
+  instruction is to *dispatch it and verify the run*. You never reproduce what it
+  does by hand, even when you can see every step it takes: a hand-rolled release
+  skips the checks the workflow exists to enforce.
+- **What** may be released: which packages or images, from which branch.
+- **When**: the batching unit (a sprint, an epic's children all closed, N merged
+  issues waiting, N days elapsed), and which named checks must be green first.
+  Never one release per merged issue.
+- **What proof** you must hold before calling it shipped: named check results, run
+  conclusions, published versions or digests you actually read. Not an impression.
+- **Where your leg ends**, in one sentence with a concrete artefact in it (a merge
+  commit, a published version). If you cannot say it in one sentence, it is not a
+  boundary.
+- **What stays permanently forbidden**, with the source. Cite the file that says so
+  (`repos/<repo>/AGENTS.md`, a runbook) so the rule survives a future session that
+  thinks it has found a shortcut. Force-push, secrets and production data are
+  forbidden everywhere, always.
+
+Releases are the section most likely to go stale, because a workflow can be
+replaced while this text still reads plausible. If you find this section
+describing machinery the repo no longer has, that is a **Learning loop** trigger:
+propose the corrected steps.
+
+## Project context (filled during onboarding)
+
+Empty until an onboarding session fills it in: the product in a paragraph, a map
+of which repo owns what, and the grooming guidance Duty 2 needs to judge priority
+and spot issues that would collide. Ask an omp session to read
+`skill://conductor-onboarding` to have it written.
+
+## Reporting
+
+Your report scope is **`{{REPORT_SCOPE}}`**. Both scopes, spelled out:
+
+- **`escalations`** — you speak when a human is needed, and once a day otherwise.
+  That is: every tier-2 escalation immediately, carrying the issue link and the
+  single question; plus one daily digest naming what merged, what is green and
+  waiting on a merge, and what is stuck and why. Every other tick is silent.
+- **`material`** — everything in `escalations`, plus each material event as it
+  happens: a run reaching a green PR (with the link), a run that failed twice, an
+  issue you pulled off the queue, a cap that stopped the fleet. A tick where
+  nothing changed still says nothing — "no change" is not an event.
+
+**Delivery.** Your end-of-turn text reaches your operator only on a turn that
+*began* as an inbound Telegram message. A tick did not: it is injected locally,
+so a report you merely write at the end of one is read by nobody, however well
+you wrote it. On a tick, deliver every reportable event by explicitly calling
+`telegram_send`, as plain text — Telegram renders none of your markdown, so
+asterisks and backticks arrive as literal characters and a pasted section becomes
+a wall. Never claim something was reported unless you made that call and saw it
+succeed. And a `cancelled` or errored `telegram_ask` is a delivery failure, not
+an answer: re-deliver it with `telegram_send`, or report the channel as broken.
+It is never "asked once, no reply, dropped".
+
+Neither scope licenses narration. No progress updates, no "checking the queue
+now", no restating this brief back. Evidence, or silence.
+
+## Amendments
+
+<!-- one line per approved amendment: date — trigger — summary -->

package/src/cli.ts

@@ -6,8 +6,19 @@
  * cannot drift apart.
  */
 import { closeSync, openSync, readFileSync, readSync, statSync } from "node:fs";
-import { join } from "node:path";
-import { checkBrief, formatBriefStatus, writeMergedBrief } from "./brief-upgrade.ts";
+import { dirname, join } from "node:path";
+import {
+  applyRetrofit,
+  checkBrief,
+  formatBriefStatus,
+  formatMigrateResult,
+  formatRetrofitProposal,
+  formatRetrofitRefusal,
+  inspectBriefLayout,
+  migrateToPolicy,
+  proposeRetrofit,
+  writeMergedBrief,
+} from "./brief-upgrade.ts";
 import { findProject, loadConfig, resolveCaps, stateDir } from "./config.ts";
 import { dbPath, formatStatus, runDaemon, setPaused, statusSnapshot } from "./daemon.ts";
 import { formatGraphSetup, graphRepos, writeGraphSetup, type GraphSetupWrite } from "./graph.ts";
@@ -22,7 +33,13 @@ import {
   writeRecord,
 } from "./lifecycle.ts";
 import { STALL_MARKER_FILE } from "./orchestrator-tick.ts";
-import { briefPathForProject, renderBriefForProject, shippedBriefTemplate } from "./setup.ts";
+import {
+  briefPathForProject,
+  policyPathForProject,
+  renderBriefForProject,
+  renderFloorForProject,
+  shippedBriefTemplate,
+} from "./setup.ts";
 import { LIVE_STATES, openStore } from "./store.ts";
 import { makeTracker } from "./tracker/github.ts";
 import type { ProjectConfig } from "./types.ts";
@@ -41,7 +58,7 @@ usage:
   omp-conductor pause
   omp-conductor resume
   omp-conductor graph-setup [--project NAME] [--write]
-  omp-conductor brief-upgrade [--apply] [--file PATH] [--project NAME]
+  omp-conductor brief-upgrade [--migrate|--retrofit] [--apply] [--file PATH] [--project NAME]
   omp-conductor help
 
   start    run the dispatch loop in the background and wait until it answers
@@ -79,13 +96,13 @@ usage:
            prints the systemctl line to run — it never runs systemctl itself.
            Exits 1 when no repo in the project has graphProject configured.
   brief-upgrade
-           compare a project's ORCHESTRATOR.md against the brief this version of
-           the package ships. Reports by default; --apply replaces the half above
-           the YOURS TO EDIT banner and keeps everything below it, backing the old
-           file up first. --file checks a brief that is not where the wizard would
-           have put it, on a host that may have no config at all. Nothing is
-           written for a brief with no banner, or when no config resolved and the
-           template still carries its {{PLACEHOLDER}} coordinates.
+           inspect the brief overlay (package floor + POLICY.md). Reports by
+           default. --migrate lifts a bannered ORCHESTRATOR.md owned half into
+           POLICY.md and recomposes. --retrofit proposes inserting the YOURS TO
+           EDIT banner before the first Releases/Project context/Reporting/
+           Amendments heading (#20); --retrofit --apply writes it. Legacy
+           --apply still merges a bannered single-file brief. --file checks a
+           brief that is not where the wizard would have put it.
   help     print this text (also --help, -h).
 
 Pause is a flag file under the state directory, so it applies to every project
@@ -526,10 +543,6 @@ try {
     }
 
     case "brief-upgrade": {
-      // `--file` exists because a real fleet's brief is often not where the wizard
-      // would have put it: the supervising session runs from its own directory, and
-      // that host may never have configured a dispatch daemon at all. Without this
-      // the command cannot check the one file it was written for.
       const override = flag(argv, "file");
       let project: ProjectConfig | undefined;
       let path: string;
@@ -541,13 +554,88 @@ try {
         try {
           project = findProject(loadConfig(), flag(argv, "project"));
         } catch {
-          // No config here, or several projects and no name given. With an explicit
-          // file we need neither, and refusing would make the command unusable on a
-          // fleet host that runs only the supervising session.
           project = undefined;
         }
       }
 
+      const workspaceRoot = project?.workspaceRoot ?? dirname(path);
+      const rendered =
+        project === undefined ? shippedBriefTemplate() : renderBriefForProject(project);
+      const floor = project === undefined ? shippedBriefTemplate() : renderFloorForProject(project);
+      const layout = inspectBriefLayout(workspaceRoot, rendered);
+
+      if (argv.includes("--retrofit")) {
+        let live: string;
+        try {
+          live = readFileSync(path, "utf8");
+        } catch {
+          process.stderr.write(`omp-conductor: no brief at ${path}.\n`);
+          process.exit(1);
+        }
+        const result = proposeRetrofit(live);
+        if (result.kind === "no-cut") {
+          process.stdout.write(
+            `brief ${path}\n\nNo Releases / Project context / Reporting / Amendments heading found — cannot classify a cut.\n`,
+          );
+          process.exit(1);
+        }
+        if (result.kind === "interleaved") {
+          process.stdout.write(`${formatRetrofitRefusal(path, result)}\n`);
+          process.exit(1);
+        }
+        process.stdout.write(`${formatRetrofitProposal(path, result.proposal)}\n`);
+        if (argv.includes("--apply")) {
+          const backup = applyRetrofit(path, result.proposal);
+          process.stdout.write(`\napplied retrofit — previous brief kept at ${backup}\n`);
+        }
+        break;
+      }
+
+      if (argv.includes("--migrate")) {
+        if (layout.kind === "overlay") {
+          process.stdout.write(`${formatBriefStatus(path, layout)}\n`);
+          break;
+        }
+        if (layout.kind === "missing") {
+          process.stderr.write(`omp-conductor: no brief at ${path} to migrate.\n`);
+          process.exit(1);
+        }
+        if (layout.kind === "legacy-handwritten") {
+          process.stdout.write(
+            `${formatBriefStatus(path, { kind: "unsplittable", missing: layout.missing })}\n`,
+          );
+          process.exit(1);
+        }
+        if (project === undefined && /\{\{[A-Za-z0-9_]+\}\}/.test(floor)) {
+          process.stderr.write(
+            "omp-conductor: --migrate needs --project (or a config) so the floor renders without {{PLACEHOLDER}}s.\n",
+          );
+          process.exit(1);
+        }
+        if (!argv.includes("--apply")) {
+          process.stdout.write(
+            [
+              `migrate ${layout.orchestratorPath}`,
+              "",
+              "Would write POLICY.md from the owned half below YOURS TO EDIT,",
+              "then recompose ORCHESTRATOR.md from the package floor + that policy.",
+              "",
+              "Apply:  omp-conductor brief-upgrade --migrate --apply",
+            ].join("\n") + "\n",
+          );
+          break;
+        }
+        const policyPath = project ? policyPathForProject(project) : join(workspaceRoot, "POLICY.md");
+        const result = migrateToPolicy({
+          orchestratorPath: layout.orchestratorPath,
+          policyPath,
+          floor: project ? renderFloorForProject(project) : floor,
+          owned: layout.owned,
+        });
+        process.stdout.write(`${formatMigrateResult(result)}\n`);
+        break;
+      }
+
       let live: string;
       try {
         live = readFileSync(path, "utf8");
@@ -559,12 +647,14 @@ try {
         process.exit(1);
       }
 
-      // With no config there are no coordinates to substitute, so the template is
-      // compared raw. Headings carry no placeholders, so the section-level report is
-      // unaffected; the note below keeps the printed text honest.
-      const status = checkBrief(live, project === undefined ? shippedBriefTemplate() : renderBriefForProject(project));
-      // Report first, always: --apply on a brief with no banner must not be the
-      // command that silently discards an operator's hand-written policy.
+      if (layout.kind === "overlay") {
+        process.stdout.write(
+          `${formatBriefStatus(path, { kind: "overlay", policyPath: layout.policyPath, orchestratorPath: layout.orchestratorPath })}\n`,
+        );
+        break;
+      }
+
+      const status = checkBrief(live, rendered);
       process.stdout.write(`${formatBriefStatus(path, status)}\n`);
       if (project === undefined) {
         process.stdout.write(

package/src/daemon.ts

@@ -11,7 +11,7 @@ import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join, relative } from "node:path";
 import { configPath, findProject, loadConfig, resolveCaps, stateDir } from "./config.ts";
-import { createEscalator } from "./escalate.ts";
+import { createEscalator, escalationIssueRef } from "./escalate.ts";
 import { graphHint } from "./graph.ts";
 import { livingDaemon } from "./lifecycle.ts";
 import { STALL_MARKER_FILE } from "./orchestrator-tick.ts";
@@ -369,7 +369,7 @@ async function safeEscalate(d: Pick<Deps, "escalate">, e: Escalation): Promise<b
     await d.escalate(e);
     return true;
   } catch (err) {
-    log(`escalation for #${e.issue} could not be delivered: ${errText(err)}`);
+    log(`escalation for ${escalationIssueRef(e.issue)} could not be delivered: ${errText(err)}`);
     return false;
   }
 }
@@ -393,13 +393,22 @@ export function salvageLines(outcome: SalvageOutcome, worktree: string): string[
     ];
   }
 
-  return [
+  const where =
     `WIP committed to ${outcome.branch} @ ${outcome.sha}` +
-      (outcome.pushed
-        ? " and pushed — the work outlives this worktree"
-        : ` but NOT pushed (${outcome.pushError ?? "no reason given"}) — it lives only in this host's mirror`),
-    kept,
-  ];
+    (outcome.pushed
+      ? " and pushed — the work outlives this worktree"
+      : ` but NOT pushed (${outcome.pushError ?? "no reason given"}) — it lives only in this host's mirror`);
+  // Manifest belongs in the escalation too: opening the commit is how the
+  // orchestrator talked itself into scrubbing a worker tree (#38).
+  const n = outcome.files.length;
+  const count = `${n} file${n === 1 ? "" : "s"}`;
+  const manifest =
+    outcome.newPaths.length === 0
+      ? `${count} (all modifications to tracked paths)`
+      : `${count}; new: ${outcome.newPaths.slice(0, 12).join(", ")}${
+          outcome.newPaths.length > 12 ? `, … +${outcome.newPaths.length - 12} more` : ""
+        }`;
+  return [where, manifest, kept];
 }
 
 /**
@@ -1255,7 +1264,7 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
     // is holding the merge button. The daemon still merges nothing itself.
     project.authority.merge === "orchestrator"
       ? "You never edit product code or push a branch — a worker session does that. Merging is yours: one PR at " +
-        "a time, freshness-checked against the base branch, per the Releases section of your ORCHESTRATOR.md."
+        "a time, freshness-checked against the base branch, per the Releases section of your POLICY.md."
       : "You never edit product code, push a branch, or merge a PR — a worker session edits and pushes, and a " +
         "human merges.",
     "Handle each escalation below before the next one.",

package/src/escalate.ts

@@ -45,11 +45,21 @@ export interface Escalator {
  * send, turning a cosmetic problem into a lost escalation. Plain text is also
  * valid Markdown, so the same string renders fine as an issue comment.
  */
+/**
+ * Fleet-scoped pages (integrity tripwire, spend-cap halt, stall) use issue `0`
+ * as a sentinel — there is no tracker issue. Rendering that as `#0` made
+ * Telegram pages and daemon logs look like a bug (#52). Keep the sentinel in
+ * the typed field; only the human-facing label changes here.
+ */
+export function escalationIssueRef(issue: number): string {
+  return issue === 0 ? "fleet" : `#${issue}`;
+}
+
 export function formatEscalation(e: Escalation, project: string): string {
   const lines = [
     `omp-conductor · tier ${e.tier} escalation`,
     `project: ${project}`,
-    `issue: #${e.issue}`,
+    `issue: ${escalationIssueRef(e.issue)}`,
     `summary: ${e.summary}`,
   ];
   if (e.detail) lines.push(`detail: ${e.detail}`);
@@ -99,18 +109,21 @@ export function createEscalator(
           const onTurnFailed = async (cause: unknown): Promise<void> => {
             if (!p.escalation.fallbackToIssueComment) {
               warn(
-                `tier 1 escalation on issue #${e.issue} was accepted by the orchestrator but its ` +
+                `tier 1 escalation on ${escalationIssueRef(e.issue)} was accepted by the orchestrator but its ` +
                   `turn failed (${errText(cause)}), and no fallback is configured — left unmarked ` +
                   `so the next tick retries`,
               );
               return;
             }
             try {
+              if (e.issue === 0) {
+                throw new Error("fleet-scoped escalation has no issue to comment on");
+              }
               await tracker.comment(e.issue, text);
               store.markNotified(key);
             } catch (err) {
               warn(
-                `tier 1 escalation on issue #${e.issue} failed after acceptance ` +
+                `tier 1 escalation on ${escalationIssueRef(e.issue)} failed after acceptance ` +
                   `(${errText(cause)}) and its issue-comment fallback failed too ` +
                   `(${errText(err)}) — left unmarked so the next tick retries`,
               );
@@ -154,10 +167,19 @@ export function createEscalator(
       if (!p.escalation.fallbackToIssueComment) {
         throw new Error(
           `no escalation transport configured for project "${p.name}": tier ${e.tier} ` +
-            `escalation on issue #${e.issue} (${e.summary}) could not be delivered — ` +
+            `escalation on ${escalationIssueRef(e.issue)} (${e.summary}) could not be delivered — ` +
             `set escalation.telegramChatId or escalation.fallbackToIssueComment`,
         );
       }
+      // Fleet pages (issue 0) have nowhere to comment. Falling through here used
+      // to call `issues/0/comments` and surface as a confusing "#0" delivery
+      // failure after Telegram had already been tried (#52).
+      if (e.issue === 0) {
+        throw new Error(
+          `fleet-scoped tier ${e.tier} escalation (${e.summary}) has no issue to comment on — ` +
+            `configure escalation.telegramChatId so integrity/spend/stall pages can reach an operator`,
+        );
+      }
       await tracker.comment(e.issue, text);
       store.markNotified(key);
     },