omp-conductor 0.5.6 → 0.7.0

package/src/cli.ts

@@ -23,7 +23,7 @@ import {
 } from "./brief-upgrade.ts";
 import { findProject, loadConfig, resolveCaps, stateDir } from "./config.ts";
 import { CONDITION_FORMS, parseCondition } from "./decisions.ts";
-import { runDaemon, setPaused } from "./daemon.ts";
+import { isPaused, pausedAt, runDaemon, setPaused } from "./daemon.ts";
 import {
   armTicks,
   clearPaneHalt,
@@ -58,7 +58,9 @@ import { dbPath, LIVE_STATES, openStore } from "./store.ts";
 import { formatTranscriptLine } from "./transcript.ts";
 import { formatVerbLedgerEntry } from "./verbs/ledger.ts";
 import { makeTracker } from "./tracker/github.ts";
-import { REPORT_KINDS } from "./types.ts";
+import { githubVerbActions } from "./verbs/actions.ts";
+import { handleVerbCall, type VerbChannel } from "./verbs/server.ts";
+import { REPORT_KINDS, VERB_NAMES } from "./types.ts";
 import type { ProjectConfig, ReportKind } from "./types.ts";
 import { formatUnblock, unblockIssue } from "./unblock.ts";
 import { upgradeConductor } from "./upgrade.ts";
@@ -100,6 +102,7 @@ usage:
   omp-conductor tail <issue> [--project NAME]
   omp-conductor extend <issue> --turns N [--project NAME]
   omp-conductor unblock <issue> [--force] [--project NAME]
+  omp-conductor verb <conductor_*> [--project NAME] [--arg k=v ...]
   omp-conductor daemon [--once] [--port N] [--project NAME]
   omp-conductor pause
   omp-conductor resume
@@ -168,6 +171,13 @@ usage:
            Refuses when the newest attempt's work could not be committed and
            its worktree is the only copy: re-claiming removes that tree. Use
            --force once you have recovered it or accepted the loss.
+  verb     run one conductor_* verb as the orchestrator, from the CLI: the same
+           checks and the same ledger rows a session's call would get. This is
+           how an external orchestrator merges, labels, releases or reads PR
+           state without a raw gh call that skips every gate. Arguments are
+           strings, one per --arg (e.g. --arg prUrl=https://x --arg headSha=y).
+           A refusal exits 3. See conductor_pr_merge/conductor_label/
+           conductor_release/conductor_pr_update_branch in the brief.
   report   hand a rendered report to the daemon's durable outbox. The report is
            persisted before anything is sent, delivered by the daemon with
            bounded retries, and shown by status until it lands. Delivery is
@@ -732,6 +742,89 @@ try {
       break;
     }
 
+    /**
+     * The external-orchestrator half of the verbs (#167): run any
+     * `conductor_*` verb from the CLI, through the daemon's own checks and
+     * ledger. An orchestrator that merges, labels or releases through this
+     * gets exactly the same refusals a session would and writes the same
+     * ledger rows — the raw `gh pr merge` a session reaches for instead is
+     * invisible to both.
+     *
+     * Worker-only verbs (conductor_push, conductor_pr_create) refuse with
+     * `role-not-allowed` — correct, and deliberately not special-cased here.
+     *
+     * Accepted limitation: the daemon's in-process one-merge-per-project slot
+     * does not span the daemon and a concurrent CLI merge. The execution-time
+     * head re-read (`--match-head-commit` in prMergeVerb) is the cross-process
+     * guard, so a CLI merge races a daemon merge exactly as two daemon merges
+     * would.
+     */
+    case "verb": {
+      const name = argv[1];
+      if (name === undefined || !VERB_NAMES.some((n) => n === name)) {
+        process.stderr.write(
+          `omp-conductor: unknown verb "${name ?? ""}". Known verbs: ${VERB_NAMES.join(", ")}\n`,
+        );
+        process.exit(2);
+      }
+      const cfg = loadConfig();
+      const project = findProject(cfg, flag(argv, "project"));
+      const args: Record<string, string> = {};
+      for (let i = 2; i < argv.length; i++) {
+        const token = argv[i];
+        if (token === "--arg") {
+          const pair = argv[i + 1];
+          if (pair === undefined || !pair.includes("=")) {
+            process.stderr.write(`omp-conductor: verb --arg needs k=v, got "${pair ?? ""}"\n`);
+            process.exit(2);
+          }
+          const eq = pair.indexOf("=");
+          args[pair.slice(0, eq)] = pair.slice(eq + 1);
+          i++;
+        } else if (token === "--project" || token?.startsWith("--project=") === true) {
+          // Consumed by `flag(argv, "project")` above; both spellings skip here.
+          if (token === "--project") i++;
+        } else {
+          process.stderr.write(
+            `omp-conductor: verb: unexpected argument "${token ?? ""}" (pass verb arguments as --arg k=v)\n`,
+          );
+          process.exit(2);
+        }
+      }
+      const store = openStore(dbPath());
+      try {
+        const channel: VerbChannel = {
+          kind: "orchestrator",
+          path: "cli",
+          project: project.name,
+          role: "orchestrator",
+        };
+        const reply = await handleVerbCall(
+          {
+            project: () => findProject(loadConfig(), project.name),
+            store,
+            tracker: makeTracker(project),
+            actions: githubVerbActions(project),
+            fleetStop: () =>
+              isPaused()
+                ? "claiming is paused for this fleet (omp-conductor pause, hold or halt)"
+                : undefined,
+            pausedAt,
+            log: (m) => process.stderr.write(`${m}\n`),
+            now: () => Date.now(),
+          },
+          channel,
+          { verb: name, args },
+        );
+        process.stdout.write(`${reply.text}\n`);
+        // A refusal must not read as success to a script calling this.
+        if (!reply.ok) process.exitCode = 3;
+      } finally {
+        store.close();
+      }
+      break;
+    }
+
     /**
      * The handover point. Authorship stays with the model; from here the daemon
      * owns delivery, so "I sent the report" stops being a claim the model makes

package/src/daemon.ts

@@ -102,6 +102,11 @@ const GRAPH_HEALTH_INTERVAL_MS = 60_000;
  *  report an operator is waiting on must not sit in the outbox for the length of
  *  a poll interval, and delivery is owed even while claiming is paused (#123). */
 const REPORT_DELIVERY_INTERVAL_MS = 30_000;
+/** A dispatch-infra run (turn-0 git failure) is requeued so the next tick
+ *  retries — but only a bounded number of times. Three strikes for one issue
+ *  means the mirror itself is broken, not unlucky, and the sweep escalates
+ *  instead of burning a turn-0 run per tick forever (#168, #177). */
+const DISPATCH_INFRA_MAX_STRIKES = 3;
 const DEFAULT_PORT = 8787;
 const BRIEF_TEMPLATE_PATH = join(import.meta.dir, "briefs", "worker.md");
 
@@ -121,8 +126,13 @@ export interface DaemonOpts {
   project?: string;
 }
 
-/** Everything one tick touches, resolved once at startup so a tick never
- *  re-reads config mid-flight and changes its own limits underneath itself. */
+/** Everything one tick touches. `project` and `caps` are re-resolved at each
+ *  tick boundary so an operator's config edit applies on the next tick rather
+ *  than the next daemon restart (#170); a tick and the runs it admits see one
+ *  consistent snapshot, and a mid-run edit never changes a live run's labels,
+ *  model or caps — `handleIssue` destructures them at dispatch time. The rest
+ *  are resolved once at startup so a tick never re-reads config mid-flight and
+ *  changes its own limits underneath itself. */
 interface Deps {
   project: ProjectConfig;
   caps: Caps;
@@ -176,6 +186,7 @@ export function verbDeps(d: Pick<Deps, "project" | "store" | "tracker" | "verbAc
       isPaused()
         ? "claiming is paused for this fleet (omp-conductor pause, hold or halt)"
         : undefined,
+    pausedAt,
     log,
     now: () => Date.now(),
   };
@@ -288,6 +299,30 @@ export function isPaused(): boolean {
   return existsSync(join(stateDir(), "paused"));
 }
 
+/**
+ * The epoch-ms timestamp at which the current pause began, read from the same
+ * sentinel file {@link setPaused} writes (`<stateDir()>/paused`). Returns
+ * `undefined` when the fleet is not paused, or when the file's first line does
+ * not parse as a date — a legacy/blank sentinel keeps today's refuse-everything
+ * behavior, because a run admitted before an *unknown* pause cannot be proven
+ * innocent. {@link isPaused} is the authority on *whether*; this answers
+ * *since when*.
+ */
+export function pausedAt(): number | undefined {
+  const f = join(stateDir(), "paused");
+  if (!existsSync(f)) return undefined;
+  try {
+    const first = readFileSync(f, "utf8").split("\n")[0]?.trim();
+    if (first === undefined || first === "") return undefined;
+    const t = Date.parse(first);
+    return Number.isNaN(t) ? undefined : t;
+  } catch {
+    // Unreadable sentinel (permissions, corruption): fail closed like an
+    // unparseable line — refuse mutations while the pause is unprovable.
+    return undefined;
+  }
+}
+
 export function setPaused(v: boolean): void {
   const f = join(stateDir(), "paused");
   if (v) {
@@ -1709,8 +1744,19 @@ export async function admitCandidates(
   slots: number,
 ): Promise<AdmissionPass> {
   const { project, caps, tracker, store } = d;
-  const busyIssues = store.activeRuns(project.name).map((r) => r.issue);
+  const activeRuns = store.activeRuns(project.name);
+  const busyIssues = activeRuns.map((r) => r.issue);
   const busy = new Set(busyIssues);
+  // issue -> its active run rows, for the pushed-green admission bypass (#175):
+  // only a worker-free pushed-green row may be bypassed, and only when *every*
+  // active run for the issue is worker-free. A live (claimed/running) row still
+  // holds unconditionally.
+  const activeByIssue = new Map<number, RunRecord[]>();
+  for (const run of activeRuns) {
+    const list = activeByIssue.get(run.issue);
+    if (list === undefined) activeByIssue.set(run.issue, [run]);
+    else list.push(run);
+  }
   const holds: AdmissionHold[] = [];
   const hold = (issue: number, reason: AdmissionHoldReason): void => {
     holds.push({ issue, reason });
@@ -1769,8 +1815,17 @@ export async function admitCandidates(
       continue;
     }
     if (busy.has(issue)) {
-      hold(issue, "issue-active");
-      continue;
+      // A pushed-green row is worker-free by definition (it is not in
+      // LIVE_STATES): its PR is live but no process is writing to its branch.
+      // So an issue whose active runs are ALL pushed-green is not actually
+      // occupied — the corrective attempt the operator unblocked may be
+      // admitted as a continuation of that PR, and the open-PR gate below
+      // decides the identity. Any live row still holds (#175).
+      const allWorkerFree = (activeByIssue.get(issue) ?? []).every((r) => r.state === "pushed-green");
+      if (!allWorkerFree) {
+        hold(issue, "issue-active");
+        continue;
+      }
     }
 
     const priorRuns = store.attemptsFor(project.name, issue);
@@ -1888,7 +1943,8 @@ export async function admitCandidates(
         latest?.state === "blocked" ||
         latest?.state === "failed" ||
         latest?.state === "killed" ||
-        latest?.state === "orphaned"
+        latest?.state === "orphaned" ||
+        latest?.state === "pushed-green"
           ? latest
           : undefined;
       // The second half asks "is this open PR our retained work", and accepts
@@ -1966,6 +2022,24 @@ export async function dispatchAdmissions(
 // ----------------------------------------------------------------------- a tick
 
 export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
+  // A config edit takes effect on the next tick, not the next daemon restart
+  // (#170). Re-resolve the project and its caps at the tick boundary so a tick
+  // and every run it admits see one consistent snapshot; a failed read keeps
+  // the boot values rather than wedging the tick, and the next tick tries
+  // again.
+  try {
+    const cfg = loadConfig();
+    const fresh = findProject(cfg, d.project.name);
+    const freshCaps = resolveCaps(fresh, cfg.defaults);
+    if (JSON.stringify(fresh) !== JSON.stringify(d.project) || JSON.stringify(freshCaps) !== JSON.stringify(d.caps)) {
+      log(`config reloaded: project ${d.project.name} changed on disk — applying from this tick`);
+    }
+    d.project = fresh;
+    d.caps = freshCaps;
+  } catch (err) {
+    log(`config reload failed (${errText(err)}) — continuing with the values loaded at boot`);
+  }
+
   // Before the pause check, deliberately. This one is not about dispatch: the
   // orchestrator is a different process, and it can be wedged while this fleet
   // is paused — which is exactly the state the reference fleet was in when the
@@ -2643,6 +2717,14 @@ export async function classifyAndRecover(d: Deps): Promise<void> {
         }
         if (run.state === "failed" && facts.pr === "open") {
           facts.checks = await tracker.checkConclusions(run.prUrl);
+          // When a check failed with a reachable log, pull its tail so the
+          // table can tell an infra outage (#177) from a real test failure by
+          // the log's own words. First failure wins; a log that cannot be
+          // fetched is left undefined and classification stays conservative.
+          const firstFailure = facts.checks.find((c) => c.state === "failure" && c.link !== undefined);
+          if (firstFailure?.link !== undefined) {
+            facts.failingLog = await tracker.checkLog(firstFailure.link);
+          }
         }
       }
     } catch (err) {
@@ -2730,6 +2812,26 @@ async function recoverRun(
   }
 
   if (recovery === "requeue") {
+    // A dispatch-infra requeue that keeps landing on the same issue means the
+    // mirror for its repo is persistently broken — a ref-lock that retry already
+    // exhausted, a dead remote. Requeueing forever spends a turn-0 run per tick
+    // with no chance of success, so after a bounded number of strikes this
+    // escalates to a human instead (#168, #177).
+    if (cls === "dispatch-infra" && store.classCountFor(project.name, run.issue, "dispatch-infra") >= DISPATCH_INFRA_MAX_STRIKES) {
+      await safeEscalate(d, {
+        tier: 1,
+        project: project.name,
+        issue: run.issue,
+        summary: `[dispatch-infra] #${run.issue}: the mirror for ${run.repo} is failing persistently — ${evidence}`,
+        detail: [
+          `The dispatcher could not provision a worktree for #${run.issue} ${DISPATCH_INFRA_MAX_STRIKES} times in a row, all before the worker's first turn.`,
+          "The mirror on this host needs attention (check disk, SSH/HTTPS credentials, and the mirror root).",
+        ].join("\n"),
+      });
+      store.updateRun(run.id, { recoveredAt: Date.now() });
+      log(`#${run.issue} escalated from persistent ${cls}: ${evidence}`);
+      return;
+    }
     // Only when the tracker still shows this issue as ours to hand back. An
     // issue that is closed, or has no state label, was resolved by another route
     // and requeueing it would dispatch work nobody asked for.
@@ -2772,7 +2874,15 @@ async function recoverRun(
       );
     }
     if (run.lastError !== undefined && cls !== "question") detail.push(run.lastError);
-    detail.push(`Session: ${run.sessionFile ?? "(no transcript)"}`);
+    // #172: an unwritten transcript is "the run died before it flushed", not a
+    // link to a file the operator will open and find missing.
+    detail.push(
+      run.sessionFile === undefined
+        ? "Session: (no transcript)"
+        : existsSync(run.sessionFile)
+          ? `Session: ${run.sessionFile}`
+          : `Session: ${run.sessionFile} (file was never written — the run died before its transcript was flushed)`,
+    );
     // The class and the run are in the summary, which is what the notifications
     // ledger dedupes on — so one class escalates once per run rather than every
     // five minutes.

package/src/failure-class.ts

@@ -22,6 +22,10 @@ export interface ClassifyFacts {
   pr?: "open" | "merged" | "closed";
   mergeable?: "conflicting" | "clean" | "unknown";
   checks?: { name: string; state: string; link?: string }[];
+  /** Tail (ANSI-stripped) of the first failed check's log, when one was
+   *  reachable. Lets the table tell an infrastructure outage (#177) from a
+   *  deterministic test failure by the log's own words. */
+  failingLog?: string;
 }
 
 export interface Classification {
@@ -50,6 +54,24 @@ const INFRA_CHECK_STATES: Record<string, true> = {
 /** States that mean "this check has a verdict and it is good". */
 const SUCCESS_CHECK_STATES: Record<string, true> = { success: true, neutral: true };
 
+/**
+ * Substrings in a failed check's log that prove the failure was infrastructure,
+ * not the diff (#177). Each is a registry/docker/runner fault a worker cannot
+ * have introduced: a rate limit, an image-manifest resolution failure, a runner
+ * being torn down under the job, or a DNS failure. Matched lowercased against
+ * the log tail.
+ *
+ * Deliberately *not* matching bare `failed to solve:` — a docker build failure
+ * often prints it with a real resolution error, so the closing words carry the
+ * signal, not the phrase.
+ */
+const INFRA_LOG_SIGNATURES = [
+  "429 too many requests",
+  "failed to resolve source metadata for",
+  "the runner has received a shutdown signal",
+  "could not resolve host",
+];
+
 function normalise(state: string): string {
   return state.trim().toLowerCase();
 }
@@ -161,6 +183,28 @@ export function classifyRun(run: RunRecord, facts: ClassifyFacts): Classificatio
     }
   }
 
+  // Dispatch infra: the conductor's own git path failed before the worker's
+  // first turn — a mirror ref-lock (#168), a dead mirror, a transiently
+  // unreachable host. The worker never touched the issue, so this should not
+  // charge an implementation attempt. `lastError` here is written only by the
+  // dispatch catch (`errText(err)` = the stack, which prefixes the thrown
+  // "git … exited N: …" message with "Error: ") and by state messages — never
+  // by a worker — so that shape is proof of the daemon's own git, not a
+  // worker's failed push.
+  if (
+    run.state === "failed" &&
+    run.turns === 0 &&
+    !hasArtifacts &&
+    run.lastError !== undefined &&
+    /^(?:Error: )?git .+ exited \d+/s.test(run.lastError)
+  ) {
+    return {
+      cls: "dispatch-infra",
+      recovery: "requeue",
+      evidence: `dispatch failed in the conductor's own git path before turn 1: ${run.lastError.split("\n")[0]}`,
+    };
+  }
+
   if (run.state === "blocked") {
     return {
       cls: "question",
@@ -215,6 +259,24 @@ export function classifyRun(run: RunRecord, facts: ClassifyFacts): Classificatio
     const checks = facts.checks ?? [];
     const unresolved = checks.filter((c) => !SUCCESS_CHECK_STATES[normalise(c.state)] === true);
     if (checks.length > 0 && unresolved.length > 0) {
+      // A failed check whose *log* smells like infrastructure — a registry 429,
+      // a runner shutdown, a DNS failure (#177). The check has a verdict, so
+      // the check-state table above cannot call it infra; only the log can. It
+      // beats ci-deterministic because charging an implementation attempt for a
+      // rate limit is exactly the waste that class exists to prevent.
+      if (facts.failingLog !== undefined) {
+        const lower = facts.failingLog.toLowerCase();
+        for (const signature of INFRA_LOG_SIGNATURES) {
+          if (lower.includes(signature)) {
+            const check = checks.find((c) => normalise(c.state) === "failure");
+            return {
+              cls: "ci-infra",
+              recovery: "rerun-checks",
+              evidence: `infrastructure signature in ${check?.name === undefined ? "failed check" : check.name} log: "${signature}"`,
+            };
+          }
+        }
+      }
       const failing = unresolved.filter((c) => normalise(c.state) === "failure");
       if (failing.length > 0) {
         return {

package/src/fleet.ts

@@ -29,7 +29,7 @@ import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { findProject, loadConfig, stateDir } from "./config.ts";
 import { planUsageLine, readPlanUsage, sharedUsageSource } from "./usage.ts";
-import { readApprovalSurface } from "./approval-surface.ts";
+import { readApprovalSurface, readDaemonProfile } from "./approval-surface.ts";
 import { inspectBriefLayout } from "./brief-upgrade.ts";
 import { dbPath, openStore } from "./store.ts";
 import { renderBriefForProject } from "./setup.ts";
@@ -1303,6 +1303,24 @@ export async function probeTelegramHealth(
   if (approval.kind === "missing") {
     return { kind: "degraded", detail: `${username}; inbound configured; ${approval.reason}` };
   }
+  // Last, and only once the surface is answerable: whether it is *quiet*.
+  //
+  // The order is the order an operator should fix things in, and one row carries
+  // one remedy. A missing token means nothing outbound works, so the approval
+  // surface is not worth discussing; a missing approval surface means an
+  // amendment cannot be asked, which outranks noise; an interactive profile is
+  // real but strictly the least severe — the fleet works, it is just loud. And
+  // the two lower checks are not independent of each other: setting `notifyMode`
+  // to fix the approval surface is what *arms* the `agent_end` notify post this
+  // one warns about, so a fleet that fixes them in the other order would see the
+  // noise appear as the reward for fixing the silence.
+  const profile = readDaemonProfile(accessPath);
+  if (profile.kind === "interactive") {
+    return {
+      kind: "degraded",
+      detail: `${username}; inbound configured; interactive profile relays assistant text — /telegram set profile daemon`,
+    };
+  }
   return { kind: "ok", detail: `${username}; inbound configured; telegram_ask available` };
 }
 

package/src/orchestrator-tick.ts

@@ -52,6 +52,7 @@ import {
   bridgeTokenBound,
   hasBotToken,
   readApprovalSurface,
+  readDaemonProfile,
   TELEGRAM_APPROVAL_TOOL,
 } from "./approval-surface.ts";
 import {
@@ -363,12 +364,27 @@ export const TICK_SCOPE_CONSTRAINTS: { readonly [K in ReportScope]: string } = {
 /**
  * The delivery clause, appended to every default tick prompt.
  *
- * End-of-turn text streams to the operator's Telegram only on a turn that
- * *began* as an inbound Telegram message. A heartbeat tick is injected locally,
- * so it is never such a turn, and a session that believes otherwise reports
- * into a void: on 2026-08-06 the fleet this extension runs produced a release
- * report and two tier-2 escalations as end-of-turn text, and not one of the
- * three reached anybody.
+ * A tick's end-of-turn text does not reach the operator as a *report*, and the
+ * rule's job is to stop a session believing otherwise: on 2026-08-06 the fleet
+ * this extension runs produced a release report and two tier-2 escalations as
+ * end-of-turn text, and not one of the three reached anybody.
+ *
+ * This comment used to explain that by saying end-of-turn text streams to
+ * Telegram only on a turn that *began* as an inbound Telegram message. That
+ * premise is false, and the correction matters because it flips the reason:
+ * omp-telegram's `agent_end` handler posts `finalText` to the notify chat on
+ * every run that did *not* come from Telegram, whenever `notifyMode` is set —
+ * and the fleet must set it, because {@link readApprovalSurface} needs it for
+ * the approval surface. So a tick's closing prose *was* reaching the operator
+ * all along: not as a delivered report, as an unlogged, unretried, untracked
+ * ping in the middle of whatever else was in that chat. Both the void and the
+ * ping are the same fault seen from two sides — text is not a delivery channel.
+ *
+ * omp-telegram 0.11.0's `profile: "daemon"` removes it in the other direction:
+ * explicit-only outbound, and the idle/final notify post suppressed outright, so
+ * a tick's visible text goes nowhere at all. That is the configuration the fleet
+ * runs (see {@link TICK_NARRATION_RULE}, which warns when it is absent), and it
+ * makes this rule's demand literal rather than merely prudent.
  *
  * The clause used to name `telegram_send`, and that held — but it was still an
  * instruction where a mechanism was needed: the same miss recurs whenever the
@@ -384,6 +400,16 @@ export const TICK_SCOPE_CONSTRAINTS: { readonly [K in ReportScope]: string } = {
 export const TICK_DELIVERY_RULE =
   "This tick was injected locally, not sent from Telegram, so your end-of-turn text does NOT reach your operator. Hand anything reportable this turn to the durable outbox by running `omp-conductor report --text \"<the whole report>\"` (add `--kind digest` for the daily digest) and confirming it printed a report id; the daemon then owns delivery and retries until it lands. Never claim a report was sent otherwise, and never use telegram_send for a report -- that path leaves no record that it went out.";
 
+/** The {@link TICK_DELIVERY_RULE} variant for a fleet whose bridge actually
+ *  delivers the tick's ending text (#169). That is a narrower class than the
+ *  approval surface being ready: `notifyMode: "always"` has to be set, and the
+ *  profile has to be `interactive` — a `daemon` profile suppresses the
+ *  `agent_end` notify post, so its end-of-turn text reaches nobody and the
+ *  durable-outbox rule above is the honest one there. Everything here keeps the
+ *  outbox as the message; only the opening claim about delivery differs. */
+export const TICK_DELIVERY_RULE_BRIDGED =
+  "Your end-of-turn text IS delivered to the operator by the Telegram bridge (notifyMode: always). Still hand anything reportable to the durable outbox with omp-conductor report — and then close with at most one short line. The report is the message; never restate it in your closing text.";
+
 /** Re-exported so the tick's own contract stays readable from one file: the
  *  constant itself lives beside the check that decides whether it is callable. */
 export { TELEGRAM_APPROVAL_TOOL };
@@ -418,6 +444,38 @@ export const TICK_APPROVAL_UNAVAILABLE_RULE =
   `If you have an amendment to propose, deliver the question with telegram_send and wait for your operator's reply on a later turn; ` +
   `never apply an amendment, or record one as approved, without an explicit answer you actually received.`;
 
+/**
+ * Appended to every tick — the shipped prompt or the operator's own — composed
+ * on a bridge that is not in omp-telegram's `profile: "daemon"`.
+ *
+ * The running commentary an operator sees is *mechanical*, not disobedience, and
+ * that is why a prompt line is the wrong permanent fix and the right interim one.
+ * Two verified paths carry visible text out without anyone calling a tool:
+ * `outbound.ts` `onTurnEnd()` finalizes one real Telegram message per assistant
+ * turn for as long as the chat is marked active — so a multi-step answer arrives
+ * as several messages, and a message that lands mid-tick keeps the chat active
+ * for the rest of that run, relaying every subsequent tick-internal turn — and
+ * the `agent_end` handler posts the closing text of every *local* run to the
+ * notify chat whenever `notifyMode` is set. The fleet has to set `notifyMode`
+ * (see {@link TICK_APPROVAL_UNAVAILABLE_RULE}), so the correctly-askable fleet is
+ * exactly the narrating one. `profile: "daemon"` closes both at the transport:
+ * explicit-only outbound, notify post suppressed.
+ *
+ * So this rule is a stopgap with an expiry date, and it says so: it names the
+ * one command that removes it. Until then the only defence is discipline the
+ * turn can actually exercise — no visible text between tool calls, and one
+ * `telegram_send` for a human answer rather than prose that leaks a turn at a
+ * time. It fires *because* the mechanism is absent, so a fleet that has run
+ * `/telegram set profile daemon` never sees it.
+ *
+ * Appended to a configured `message` too, for {@link TICK_APPROVAL_UNAVAILABLE_RULE}'s
+ * reason exactly: an operator's prompt owns the reporting contract, but it cannot
+ * consent on the orchestrator's behalf to what the transport does with its text.
+ * Transport truth is not the operator's prompt to waive.
+ */
+export const TICK_NARRATION_RULE =
+  "This session's Telegram bridge is NOT in daemon profile, so visible assistant text can auto-relay to your operator's chat (per-turn messages while a Telegram conversation is active, and end-of-run notify posts on local runs). Until the operator runs `/telegram set profile daemon`: produce no visible text between tool calls, and answer any human message with a single telegram_send call only.";
+
 function frictionLabel(kind: FrictionSignal["kind"]): string {
   if (kind.startsWith("admission:")) return `admission hold ${kind.slice("admission:".length)}`;
   if (kind === "feedback:escalation-should-digest") return "escalations classified as digest material";
@@ -1147,6 +1205,29 @@ function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSe
   refreshComposedBriefBestEffort();
 
   const scope = resolveTickScope();
+  // The transport contract, read once from the same file at the same moment so
+  // the approval line, the delivery rule and the narration line cannot disagree
+  // (#169, #179). No access file means no fleet channel to judge; a session
+  // with no bound bridge token means omp-telegram posts nothing, so both halves
+  // fail toward "not delivered" — the durable outbox instruction — rather than
+  // asserting a delivery the bridge cannot make.
+  const approval =
+    config.accessFile === undefined
+      ? undefined
+      : session.bridgeTokenAtStart
+        ? readApprovalSurface(config.accessFile)
+        : ({
+            kind: "missing",
+            reason:
+              `${TELEGRAM_APPROVAL_TOOL} unavailable on local ticks: omp-telegram had no bot token when this ` +
+              "session started, so it bound none and its tools stay dead however complete the access file looks " +
+              "now — run `/telegram on` in this session, or restart it, to rebind the bridge",
+          } as const);
+  const profile =
+    config.accessFile === undefined || !session.bridgeTokenAtStart
+      ? undefined
+      : readDaemonProfile(config.accessFile);
+
   // A configured message owns the ordinary reporting and delivery clauses.
   // Mechanical evidence is different: release-policy drift and repeated
   // operational friction must not disappear because an operator customized the
@@ -1157,7 +1238,8 @@ function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSe
       session.scopeFallbackLogged = true;
       pi.logger.info(`[omp-conductor] tick reporting scope: using ${DEFAULT_REPORT_SCOPE} — ${scope.fallback}`);
     }
-    content = `${defaultTickMessage(new Date(), scope.briefPath, scope.policyPath)}\n${TICK_SCOPE_CONSTRAINTS[scope.scope]}\n${TICK_DELIVERY_RULE}`;
+    const bridged = approval?.kind === "ready" && approval.notifyMode === "always" && profile?.kind === "interactive";
+    content = `${defaultTickMessage(new Date(), scope.briefPath, scope.policyPath)}\n${TICK_SCOPE_CONSTRAINTS[scope.scope]}\n${bridged ? TICK_DELIVERY_RULE_BRIDGED : TICK_DELIVERY_RULE}`;
   }
   let frictionStore: Store | undefined;
   let frictionSignals: FrictionSignal[] = [];
@@ -1227,18 +1309,6 @@ function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSe
   // `telegram_ask` and `telegram_send` dead until `/telegram on`. Trusting the
   // file alone there puts the tick straight back to mandating a call its surface
   // cannot make, which is #114 exactly.
-  const approval =
-    config.accessFile === undefined
-      ? undefined
-      : session.bridgeTokenAtStart
-        ? readApprovalSurface(config.accessFile)
-        : ({
-            kind: "missing",
-            reason:
-              `${TELEGRAM_APPROVAL_TOOL} unavailable on local ticks: omp-telegram had no bot token when this ` +
-              "session started, so it bound none and its tools stay dead however complete the access file looks " +
-              "now — run `/telegram on` in this session, or restart it, to rebind the bridge",
-          } as const);
   if (approval?.kind === "missing") {
     content = `${content}\n${TICK_APPROVAL_UNAVAILABLE_RULE}`;
     if (!session.approvalToolMissingLogged) {
@@ -1254,6 +1324,24 @@ function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSe
     }
   }
 
+  // The other half of transport truth, read from the same file at the same
+  // moment: whether visible text stays out of the operator's chat. Appended
+  // after the approval line because it is the weaker instruction of the two —
+  // the approval rule stops an invented approval, this one asks the turn to keep
+  // quiet — and a prompt should end on the sentence that must not be missed.
+  //
+  // Gated on `bridgeTokenAtStart` for the same reason the approval read is, and
+  // the reasoning is the mirror image of it: with no token bound, omp-telegram
+  // sends *nothing*, so the two relay paths this rule warns about cannot fire
+  // either. A narration warning on a dead bridge would describe a hazard that
+  // does not exist, on top of an approval warning that already names the one
+  // command worth running (`/telegram on`) — two remedies on one prompt, and the
+  // operator acts on neither. So the rule fires only where the leak is real: a
+  // live bridge whose profile is not `daemon`.
+  //
+  // No `accessFile` means no fleet bridge to judge, exactly as above.
+  if (profile?.kind === "interactive") content = `${content}\n${TICK_NARRATION_RULE}`;
+
   try {
     pi.sendMessage(
       { customType: TICK_CUSTOM_TYPE, content, display: true, attribution: "user" },