Features: the context-roll notice now obeys requireOperatorConfirm (fleetd #621)

11-Features.md

@@ -5652,3 +5652,36 @@ report to its terminal and ends the turn with no `fleet_reply`. The role does no
 brief still has to name the right skill.
 
 fleetd #568 (PR #596).
+
+## The context-roll notice now obeys `requireOperatorConfirm`
+
+**What it does.** When an idle lead's own context reads HIGH, the heartbeat loop appends a notice to
+its nudge telling the lead how to hand over. The wording of that notice now follows the daemon's own
+`leadRollover.requireOperatorConfirm` setting. With the default (`true`) it tells the lead to ask the
+operator before confirming. With `false` it drops that instruction and tells the lead to decide for
+itself, naming the gate that actually applies: the handover file must exist, must have been changed
+after the `open()` request, and must not be older than `maxDocAgeSeconds`.
+
+**The knob.** `leadRollover.requireOperatorConfirm` (default `true`). It is **deferred, not hot** —
+read once at boot, so an edit does nothing until the daemon is redeployed.
+
+**Why it exists.** The daemon's own gate, `LeadRollover.confirm(...)`, already honoured this flag at
+`LeadRollover.java:480`. So setting it to `false` did stop the daemon refusing a roll. But the *text*
+the lead reads is built by `LeadHeartbeatLoop.contextNotice(...)`, which took no config at all and
+hardcoded "ask the operator … Only the operator can approve the roll". A lead follows the
+instructions it is given, so it asked the operator anyway. The operator was interrupted for a routine
+context roll exactly as before, and the config looked broken. Our operator asked for this directly:
+*"is it intended or? if yes, fix this behavior"*.
+
+**The gotcha — the knob used to be half a fix, and the failing half was silent.** Nothing warned that
+the message and the policy disagreed. Changing config that the instruction text does not read is
+invisible to the agent reading that text, and no test or log line caught it. If you set this knob and
+the asking continues, check whether the daemon has actually been redeployed since — the config half
+and the code half each need their own restart to take effect.
+
+**The second gotcha — a config value that reaches a *message* needs its own test.** The enforcement
+path and the wording path are two consumers of one setting, and pinning the first proves nothing
+about the second. The two tests added here assert on the returned string for both values of the flag.
+Inverting the branch condition kills three tests, including one written before this change.
+
+fleetd #621 (PR #622).