From b16d0e349428208e9f3b7e49f22c671e6371c56c Mon Sep 17 00:00:00 2001
From: danielplant <daniel@plantdynamics.co>
Date: Wed, 5 Aug 2026 19:24:08 -0400
Subject: [PATCH 1/4] fix: restore Conductor AskUserQuestion popups

---
 SKILL.md                                      |   9 +-
 autoplan/SKILL.md                             |  37 ++-
 benchmark-models/SKILL.md                     |   9 +-
 benchmark/SKILL.md                            |   9 +-
 bin/gstack-settings-hook                      |  55 +++--
 browse/SKILL.md                               |   9 +-
 canary/SKILL.md                               |  37 ++-
 codex/SKILL.md                                |  37 ++-
 context-restore/SKILL.md                      |  37 ++-
 context-save/SKILL.md                         |  37 ++-
 cso/SKILL.md                                  |  37 ++-
 design-consultation/SKILL.md                  |  37 ++-
 design-html/SKILL.md                          |  37 ++-
 design-review/SKILL.md                        |  37 ++-
 design-shotgun/SKILL.md                       |  37 ++-
 devex-review/SKILL.md                         |  37 ++-
 diagram/SKILL.md                              |  37 ++-
 document-generate/SKILL.md                    |  37 ++-
 document-release/SKILL.md                     |  37 ++-
 gstack-upgrade/migrations/v1.58.0.0.sh        |  11 +-
 gstack-upgrade/migrations/v1.60.2.0.sh        |  85 +++++++
 health/SKILL.md                               |  37 ++-
 hosts/claude/hooks/auq-error-fallback-hook.ts | 198 ++++++++++++---
 .../claude/hooks/question-preference-hook.ts  |  97 ++++++--
 investigate/SKILL.md                          |  37 ++-
 ios-clean/SKILL.md                            |  37 ++-
 ios-design-review/SKILL.md                    |  37 ++-
 ios-fix/SKILL.md                              |  37 ++-
 ios-qa/SKILL.md                               |  37 ++-
 ios-sync/SKILL.md                             |  37 ++-
 land-and-deploy/SKILL.md                      |  37 ++-
 landing-report/SKILL.md                       |  37 ++-
 learn/SKILL.md                                |  37 ++-
 make-pdf/SKILL.md                             |   9 +-
 office-hours/SKILL.md                         |  37 ++-
 open-gstack-browser/SKILL.md                  |  37 ++-
 pair-agent/SKILL.md                           |  37 ++-
 plan-ceo-review/SKILL.md                      |  37 ++-
 plan-design-review/SKILL.md                   |  37 ++-
 plan-devex-review/SKILL.md                    |  37 ++-
 plan-eng-review/SKILL.md                      |  37 ++-
 plan-tune/SKILL.md                            |  37 ++-
 qa-only/SKILL.md                              |  37 ++-
 qa/SKILL.md                                   |  37 ++-
 retro/SKILL.md                                |  37 ++-
 review/SKILL.md                               |  37 ++-
 scrape/SKILL.md                               |  37 ++-
 .../preamble/generate-ask-user-format.ts      |  28 ++-
 .../preamble/generate-preamble-bash.ts        |   9 +-
 setup                                         |  12 +-
 setup-browser-cookies/SKILL.md                |   9 +-
 setup-deploy/SKILL.md                         |  37 ++-
 setup-gbrain/SKILL.md                         |  37 ++-
 ship/SKILL.md                                 |  37 ++-
 skillify/SKILL.md                             |  37 ++-
 spec/SKILL.md                                 |  74 ++++--
 sync-gbrain/SKILL.md                          |  37 ++-
 test/auq-error-fallback-hook.test.ts          | 228 ++++++++++++++++--
 test/fixtures/golden/claude-ship-SKILL.md     |  37 ++-
 test/fixtures/golden/codex-ship-SKILL.md      |  37 ++-
 test/fixtures/golden/factory-ship-SKILL.md    |  37 ++-
 .../gstack-settings-hook-schema-aware.test.ts |  76 ++++++
 ...gstack-upgrade-migration-v1_60_2_0.test.ts | 130 ++++++++++
 test/helpers/carve-guards.ts                  |  10 +-
 test/helpers/touchfiles.ts                    |   9 +-
 test/memory-cache-injection.test.ts           |   2 +-
 test/question-preference-hook.test.ts         | 142 +++++++++--
 test/resolver-ask-user-format.test.ts         |  44 ++--
 ...kill-e2e-auq-unavailable-fallback.test.ts} |  32 +--
 test/skill-e2e-auto-decide-preserved.test.ts  |   4 +-
 70 files changed, 2145 insertions(+), 820 deletions(-)
 create mode 100755 gstack-upgrade/migrations/v1.60.2.0.sh
 create mode 100644 test/gstack-upgrade-migration-v1_60_2_0.test.ts
 rename test/{skill-e2e-conductor-prose.test.ts => skill-e2e-auq-unavailable-fallback.test.ts} (50%)

diff --git a/SKILL.md b/SKILL.md
index aaa5612dd4..7b124bce62 100644
--- a/SKILL.md
+++ b/SKILL.md
@@ -47,10 +47,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
diff --git a/autoplan/SKILL.md b/autoplan/SKILL.md
index 5346f1d437..b20766bfbb 100644
--- a/autoplan/SKILL.md
+++ b/autoplan/SKILL.md
@@ -57,10 +57,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -342,20 +343,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -366,7 +375,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -454,7 +463,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/benchmark-models/SKILL.md b/benchmark-models/SKILL.md
index 6a9d62616d..bdd6b4587e 100644
--- a/benchmark-models/SKILL.md
+++ b/benchmark-models/SKILL.md
@@ -51,10 +51,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
diff --git a/benchmark/SKILL.md b/benchmark/SKILL.md
index 9451d2d4f9..9f05d9ca97 100644
--- a/benchmark/SKILL.md
+++ b/benchmark/SKILL.md
@@ -51,10 +51,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
diff --git a/bin/gstack-settings-hook b/bin/gstack-settings-hook
index 6d663b23f7..325b840e38 100755
--- a/bin/gstack-settings-hook
+++ b/bin/gstack-settings-hook
@@ -19,8 +19,9 @@
 # before mutating (Codex correction — silent settings.json mutation is wrong).
 #
 # Dedup: legacy `add`/`remove` dedupe by the historical `gstack-session-update`
-# substring. Schema-aware `add-event` dedupes by (event, matcher, _gstack_source) so
-# multiple gstack registrations (plan-tune, ...) don't collide.
+# substring. Schema-aware `add-event` dedupes by event + matcher and either the
+# gstack source tag or the exact command. The command fallback adopts entries when
+# Claude strips `_gstack_source` and collapses duplicate legacy registrations.
 #
 # Writes atomically: .tmp + rename to prevent corruption on crash/disk-full.
 set -euo pipefail
@@ -49,10 +50,16 @@ fi
 
 backup_settings() {
   if [ -f "$SETTINGS_FILE" ]; then
-    local ts
+    local ts backup suffix
     ts=$(date +%Y%m%d-%H%M%S)
-    cp "$SETTINGS_FILE" "$SETTINGS_FILE.bak.$ts"
-    echo "$SETTINGS_FILE.bak.$ts" > "$SETTINGS_FILE.bak-latest"
+    backup="$SETTINGS_FILE.bak.$ts"
+    suffix=0
+    while [ -e "$backup" ]; do
+      suffix=$((suffix + 1))
+      backup="$SETTINGS_FILE.bak.$ts.$suffix"
+    done
+    cp "$SETTINGS_FILE" "$backup"
+    echo "$backup" > "$SETTINGS_FILE.bak-latest"
   fi
 }
 
@@ -169,26 +176,46 @@ case "$ACTION" in
       if (!settings.hooks) settings.hooks = {};
       if (!settings.hooks[event]) settings.hooks[event] = [];
 
+      const hooks = Array.isArray(settings.hooks[event]) ? settings.hooks[event] : [];
+      const sameMatcher = (entry) => (entry.matcher || "") === matcher;
+      const hasExactCommand = (entry) =>
+        Array.isArray(entry.hooks) && entry.hooks.some((hook) => hook?.command === cmd);
       const matchesEntry = (entry) => {
-        const sameMatcher = (entry.matcher || "") === matcher;
         const sameSource = entry._gstack_source === source;
-        return sameMatcher && sameSource;
+        return sameMatcher(entry) && (sameSource || hasExactCommand(entry));
       };
 
-      let existing = settings.hooks[event].find(matchesEntry);
       const hookEntry = { type: "command", command: cmd };
       if (timeoutRaw) {
         const n = Number(timeoutRaw);
         if (Number.isFinite(n) && n > 0) hookEntry.timeout = n;
       }
 
-      if (existing) {
-        existing.hooks = [hookEntry];
-      } else {
-        const newEntry = { _gstack_source: source, hooks: [hookEntry] };
-        if (matcher) newEntry.matcher = matcher;
-        settings.hooks[event].push(newEntry);
+      const canonical = { _gstack_source: source, hooks: [hookEntry] };
+      if (matcher) canonical.matcher = matcher;
+
+      const normalized = [];
+      let inserted = false;
+      for (const entry of hooks) {
+        if (!matchesEntry(entry)) {
+          normalized.push(entry);
+          continue;
+        }
+
+        // An untagged entry may contain the gstack command alongside a user-owned
+        // unrelated command. Preserve those unrelated hooks as their own entry.
+        if (entry._gstack_source !== source && Array.isArray(entry.hooks)) {
+          const unrelated = entry.hooks.filter((hook) => hook?.command !== cmd);
+          if (unrelated.length > 0) normalized.push({ ...entry, hooks: unrelated });
+        }
+
+        if (!inserted) {
+          normalized.push(canonical);
+          inserted = true;
+        }
       }
+      if (!inserted) normalized.push(canonical);
+      settings.hooks[event] = normalized;
 
       const after = JSON.stringify(settings, null, 2);
 
diff --git a/browse/SKILL.md b/browse/SKILL.md
index a8138dbbc3..fe56464337 100644
--- a/browse/SKILL.md
+++ b/browse/SKILL.md
@@ -49,10 +49,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
diff --git a/canary/SKILL.md b/canary/SKILL.md
index 08d4d7369e..b7e7d7d527 100644
--- a/canary/SKILL.md
+++ b/canary/SKILL.md
@@ -49,10 +49,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -334,20 +335,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -358,7 +367,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -446,7 +455,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/codex/SKILL.md b/codex/SKILL.md
index 33228ff9b8..902e9fcc6b 100644
--- a/codex/SKILL.md
+++ b/codex/SKILL.md
@@ -52,10 +52,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -337,20 +338,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -361,7 +370,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -449,7 +458,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/context-restore/SKILL.md b/context-restore/SKILL.md
index 59b40e82c2..bf4f732fd6 100644
--- a/context-restore/SKILL.md
+++ b/context-restore/SKILL.md
@@ -53,10 +53,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -338,20 +339,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -362,7 +371,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -450,7 +459,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/context-save/SKILL.md b/context-save/SKILL.md
index a1eb245950..7bf30bb5c5 100644
--- a/context-save/SKILL.md
+++ b/context-save/SKILL.md
@@ -52,10 +52,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -337,20 +338,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -361,7 +370,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -449,7 +458,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/cso/SKILL.md b/cso/SKILL.md
index a08d7e9fe2..fd120d6396 100644
--- a/cso/SKILL.md
+++ b/cso/SKILL.md
@@ -55,10 +55,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -340,20 +341,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -364,7 +373,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -452,7 +461,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/design-consultation/SKILL.md b/design-consultation/SKILL.md
index 83eed0a2d9..84edbe9632 100644
--- a/design-consultation/SKILL.md
+++ b/design-consultation/SKILL.md
@@ -75,10 +75,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -360,20 +361,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -384,7 +393,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -472,7 +481,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/design-html/SKILL.md b/design-html/SKILL.md
index a480bd62c4..d4709f37b3 100644
--- a/design-html/SKILL.md
+++ b/design-html/SKILL.md
@@ -56,10 +56,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -341,20 +342,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -365,7 +374,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -453,7 +462,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/design-review/SKILL.md b/design-review/SKILL.md
index 6454531625..5b2fac6596 100644
--- a/design-review/SKILL.md
+++ b/design-review/SKILL.md
@@ -53,10 +53,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -338,20 +339,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -362,7 +371,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -450,7 +459,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/design-shotgun/SKILL.md b/design-shotgun/SKILL.md
index 3386d18fa5..9c378f3656 100644
--- a/design-shotgun/SKILL.md
+++ b/design-shotgun/SKILL.md
@@ -70,10 +70,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -355,20 +356,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -379,7 +388,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -467,7 +476,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/devex-review/SKILL.md b/devex-review/SKILL.md
index 7ef324b3ec..6a061f6daf 100644
--- a/devex-review/SKILL.md
+++ b/devex-review/SKILL.md
@@ -55,10 +55,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -340,20 +341,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -364,7 +373,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -452,7 +461,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/diagram/SKILL.md b/diagram/SKILL.md
index 9e5a41066c..6c8098bf7e 100644
--- a/diagram/SKILL.md
+++ b/diagram/SKILL.md
@@ -50,10 +50,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -335,20 +336,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -359,7 +368,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -447,7 +456,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/document-generate/SKILL.md b/document-generate/SKILL.md
index 30846fc4dd..d48b1084db 100644
--- a/document-generate/SKILL.md
+++ b/document-generate/SKILL.md
@@ -55,10 +55,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -340,20 +341,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -364,7 +373,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -452,7 +461,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/document-release/SKILL.md b/document-release/SKILL.md
index b95873625b..fc40095ebe 100644
--- a/document-release/SKILL.md
+++ b/document-release/SKILL.md
@@ -53,10 +53,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -338,20 +339,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -362,7 +371,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -450,7 +459,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/gstack-upgrade/migrations/v1.58.0.0.sh b/gstack-upgrade/migrations/v1.58.0.0.sh
index da2252286c..bd93c923ef 100755
--- a/gstack-upgrade/migrations/v1.58.0.0.sh
+++ b/gstack-upgrade/migrations/v1.58.0.0.sh
@@ -2,9 +2,8 @@
 # Migration: v1.58.0.0 — register the PreToolUse AskUserQuestion hook for
 # existing Conductor installs.
 #
-# Why a migration: v1.58 makes the PreToolUse question-preference-hook also
-# deny the flaky Conductor AskUserQuestion and redirect to a prose decision
-# brief. But setup's hook-install block skips silently in non-interactive
+# Why a migration: v1.58 made the PreToolUse question-preference-hook carry
+# Conductor-specific routing. But setup's hook-install block skips silently in non-interactive
 # (conductor/CI) setups, and existing users who previously declined plan-tune
 # hooks would never pick up the new Conductor backstop. This re-registers the
 # hook for Conductor users so layer 3 actually deploys.
@@ -26,7 +25,7 @@ DONE="${MIGRATION_DIR}/v1.58.0.0.done"
 mkdir -p "${MIGRATION_DIR}" 2>/dev/null || true
 [ -f "${DONE}" ] && exit 0
 
-# Only relevant inside Conductor — the prose-default behavior is Conductor-scoped.
+# Only relevant inside Conductor — this historical migration is host-scoped.
 if [ -z "${CONDUCTOR_WORKSPACE_PATH:-}" ] && [ -z "${CONDUCTOR_PORT:-}" ]; then
   touch "${DONE}"
   exit 0
@@ -42,7 +41,7 @@ _PT=$("${CONFIG_BIN}" get plan_tune_hooks 2>/dev/null || echo "")
 _PT=$(printf '%s' "${_PT}" | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]')
 case "${_PT}" in
   n|no|false|skip|off|0)
-    echo "  [v1.58.0.0] plan_tune_hooks opted out — leaving Conductor on guidance-only prose." >&2
+    echo "  [v1.58.0.0] plan_tune_hooks opted out — leaving Conductor hooks unchanged." >&2
     touch "${DONE}"
     exit 0
     ;;
@@ -55,7 +54,7 @@ if [ -x "${SETTINGS_HOOK}" ] && [ -x "${PREF_HOOK}" ]; then
     --command "${PREF_HOOK}" \
     --source plan-tune-cathedral \
     --timeout 5 2>/dev/null \
-    && echo "  [v1.58.0.0] Conductor AskUserQuestion prose hook registered (PreToolUse)." >&2 \
+    && echo "  [v1.58.0.0] Conductor AskUserQuestion hook registered (PreToolUse)." >&2 \
     || echo "  [v1.58.0.0] WARN: could not register the PreToolUse hook; run ./setup --plan-tune-hooks." >&2
 fi
 
diff --git a/gstack-upgrade/migrations/v1.60.2.0.sh b/gstack-upgrade/migrations/v1.60.2.0.sh
new file mode 100755
index 0000000000..da9006ee67
--- /dev/null
+++ b/gstack-upgrade/migrations/v1.60.2.0.sh
@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+# Migration: v1.60.2.0 — normalize AskUserQuestion hooks after Claude stripped
+# `_gstack_source` from some settings entries. Re-registering through the
+# schema-aware helper adopts exact-command matches and collapses duplicates.
+
+set -u
+
+GSTACK_HOME="${HOME}/.gstack"
+MIGRATION_DIR="${GSTACK_HOME}/.migrations"
+DONE="${MIGRATION_DIR}/v1.60.2.0.done"
+mkdir -p "${MIGRATION_DIR}" 2>/dev/null || true
+[ -f "${DONE}" ] && exit 0
+
+SCRIPT_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
+SETTINGS_HOOK="${SCRIPT_DIR}/bin/gstack-settings-hook"
+CONFIG_BIN="${SCRIPT_DIR}/bin/gstack-config"
+PREF_HOOK="${SCRIPT_DIR}/hosts/claude/hooks/question-preference-hook"
+LOG_HOOK="${SCRIPT_DIR}/hosts/claude/hooks/question-log-hook"
+FALLBACK_HOOK="${SCRIPT_DIR}/hosts/claude/hooks/auq-error-fallback-hook"
+MATCHER='(AskUserQuestion|mcp__.*__AskUserQuestion)'
+
+_PT=$("${CONFIG_BIN}" get plan_tune_hooks 2>/dev/null || echo "")
+_PT=$(printf '%s' "${_PT}" | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]')
+case "${_PT}" in
+  n|no|false|skip|off|0)
+    echo "  [v1.60.2.0] plan_tune_hooks opted out; AskUserQuestion hooks unchanged." >&2
+    touch "${DONE}"
+    exit 0
+    ;;
+esac
+
+# Existing Conductor installs need the popup routing hooks even when their saved
+# config is still the default `prompt`. Outside Conductor, only an explicit opt-in
+# authorizes settings changes during upgrade.
+case "${_PT}" in
+  y|yes|true|install|on|1) _SHOULD_NORMALIZE=1 ;;
+  *)
+    if [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; then
+      _SHOULD_NORMALIZE=1
+    else
+      _SHOULD_NORMALIZE=0
+    fi
+    ;;
+esac
+
+if [ "${_SHOULD_NORMALIZE}" -ne 1 ]; then
+  touch "${DONE}"
+  exit 0
+fi
+
+for executable in "${SETTINGS_HOOK}" "${PREF_HOOK}" "${LOG_HOOK}" "${FALLBACK_HOOK}"; do
+  if [ ! -x "${executable}" ]; then
+    echo "  [v1.60.2.0] WARN: missing executable ${executable}; migration will retry later." >&2
+    exit 0
+  fi
+done
+
+_OK=1
+"${SETTINGS_HOOK}" add-event \
+  --event PreToolUse \
+  --matcher "${MATCHER}" \
+  --command "${PREF_HOOK}" \
+  --source plan-tune-cathedral \
+  --timeout 5 >/dev/null || _OK=0
+"${SETTINGS_HOOK}" add-event \
+  --event PostToolUse \
+  --matcher "${MATCHER}" \
+  --command "${LOG_HOOK}" \
+  --source plan-tune-cathedral \
+  --timeout 5 >/dev/null || _OK=0
+"${SETTINGS_HOOK}" add-event \
+  --event PostToolUse \
+  --matcher "${MATCHER}" \
+  --command "${FALLBACK_HOOK}" \
+  --source auq-error-fallback \
+  --timeout 5 >/dev/null || _OK=0
+
+if [ "${_OK}" -eq 1 ]; then
+  touch "${DONE}"
+  echo "  [v1.60.2.0] AskUserQuestion hooks normalized for clickable host popups." >&2
+else
+  echo "  [v1.60.2.0] WARN: hook normalization was incomplete; migration will retry later." >&2
+fi
+
+exit 0
diff --git a/health/SKILL.md b/health/SKILL.md
index e68199dec5..24891cb529 100644
--- a/health/SKILL.md
+++ b/health/SKILL.md
@@ -51,10 +51,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -336,20 +337,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -360,7 +369,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -448,7 +457,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/hosts/claude/hooks/auq-error-fallback-hook.ts b/hosts/claude/hooks/auq-error-fallback-hook.ts
index 502c9d4866..1b0ff16c26 100755
--- a/hosts/claude/hooks/auq-error-fallback-hook.ts
+++ b/hosts/claude/hooks/auq-error-fallback-hook.ts
@@ -3,13 +3,11 @@
  * PostToolUse hook for AskUserQuestion — runtime reliability layer for the
  * AUQ-failure prose fallback (OV3:B).
  *
- * When an AskUserQuestion call comes back as an ERROR / missing result (the
- * Conductor MCP bug returns `[Tool result missing due to internal error]`), this
- * hook injects `additionalContext` reminding the model of the failure-fallback
- * rule, tailored to the session kind. It does NOT render the prose itself — the
- * model still emits it. The hook only guarantees the reminder fires at the moment
- * of failure, instead of relying on the model noticing the error result and
- * recalling the echoed SESSION_KIND.
+ * When an AskUserQuestion call returns an explicit error, this hook injects
+ * `additionalContext` tailored to the session kind. Conductor returns structured
+ * `CONDUCTOR_ASK_USER_QUESTION_*` errors with a retryable flag; the generic Claude
+ * SDK `[Tool result missing due to internal error]` placeholder is deliberately
+ * ignored because it does not prove that popup delivery failed.
  *
  * DEFENSIVE / INERT-IF-UNSUPPORTED: it is unverified whether Claude Code invokes
  * PostToolUse hooks when an MCP tool returns a transport/missing-result error (we
@@ -31,14 +29,38 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
+import { createHash } from 'crypto';
 import { spawnSync } from 'child_process';
 
 interface HookStdin {
+  session_id?: string;
+  tool_use_id?: string;
   tool_name?: string;
+  tool_input?: unknown;
   tool_response?: unknown;
   cwd?: string;
 }
 
+export type ResponseOutcome =
+  | 'success'
+  | 'cancelled'
+  | 'ambiguous-placeholder'
+  | 'retryable-error'
+  | 'non-retryable-error';
+
+export interface ResponseClassification {
+  outcome: ResponseOutcome;
+  code?: string;
+}
+
+const SDK_MISSING_RESULT_RE = /^\[?tool result missing due to internal error\]?\.?$/i;
+const CONDUCTOR_CODE_RE = /CONDUCTOR_ASK_USER_QUESTION_[A-Z_]+/;
+const RETRYABLE_CONDUCTOR_CODES = new Set([
+  'CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED',
+  'CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS',
+  'CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH',
+]);
+
 function stateRoot(): string {
   return (
     process.env.GSTACK_STATE_ROOT ||
@@ -88,38 +110,111 @@ function inject(additionalContext: string): void {
   process.exit(0);
 }
 
-/**
- * Decide whether the tool_response is an ERROR / missing result rather than a
- * real answer. Conservative: only flag clear failure shapes, so a successful
- * AskUserQuestion (which carries the user's choice) is never misread as failure.
- */
-export function isErrorResponse(response: unknown): boolean {
-  if (response === null || response === undefined) return true;
-  if (typeof response === 'string') {
-    const s = response.trim();
-    if (s === '') return true;
-    // Match ONLY the specific missing-result sentinel phrase, not any string that
-    // merely contains "error" — a real answer like "Investigate the internal error"
-    // must NOT trigger the fallback. (Codex review finding.)
-    return /tool result missing/i.test(s);
+function responseText(response: unknown): string {
+  if (typeof response === 'string') return response.trim();
+  if (!response || typeof response !== 'object') return '';
+  const rec = response as Record<string, unknown>;
+  const parts: string[] = [];
+  if (typeof rec.error === 'string') parts.push(rec.error);
+  if (typeof rec.content === 'string') parts.push(rec.content);
+  if (Array.isArray(rec.content)) {
+    for (const item of rec.content) {
+      if (typeof item === 'string') parts.push(item);
+      else if (item && typeof item === 'object') {
+        const text = (item as Record<string, unknown>).text;
+        if (typeof text === 'string') parts.push(text);
+      }
+    }
   }
-  if (typeof response === 'object') {
+  return parts.join('\n').trim();
+}
+
+/** Classify the result without confusing SDK bookkeeping with a host failure. */
+export function classifyResponse(response: unknown): ResponseClassification {
+  if (response === null || response === undefined) return { outcome: 'non-retryable-error' };
+
+  const text = responseText(response);
+  if (text === '') {
+    if (typeof response === 'string') return { outcome: 'non-retryable-error' };
+  }
+
+  if (SDK_MISSING_RESULT_RE.test(text)) return { outcome: 'ambiguous-placeholder' };
+  if (/^User responses:/i.test(text)) return { outcome: 'success' };
+
+  const code = text.match(CONDUCTOR_CODE_RE)?.[0];
+  if (code === 'CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED') {
+    return { outcome: 'cancelled', code };
+  }
+  if (code) {
+    const retryable = RETRYABLE_CONDUCTOR_CODES.has(code) && /Retryable:\s*yes/i.test(text);
+    return { outcome: retryable ? 'retryable-error' : 'non-retryable-error', code };
+  }
+
+  if (response && typeof response === 'object') {
     const rec = response as Record<string, unknown>;
-    // Structured flag must be the boolean true — not the substring "is_error" inside
-    // a serialized success payload like '{"is_error": false}'.
-    if (rec.is_error === true || rec.isError === true) return true;
-    if (typeof rec.error === 'string' && rec.error.trim() !== '') return true;
-    // Some hosts wrap the payload as { content: "..." } or { content: [{text}] }.
-    const content = rec.content;
-    if (typeof content === 'string') return /tool result missing/i.test(content);
-    if (Array.isArray(content)) {
-      const text = content
-        .map((c) => (typeof c === 'string' ? c : (c as Record<string, unknown>)?.text ?? ''))
-        .join(' ');
-      return /tool result missing/i.test(text);
+    if (rec.is_error === true || rec.isError === true) return { outcome: 'non-retryable-error' };
+    if (typeof rec.error === 'string' && rec.error.trim() !== '') {
+      return { outcome: 'non-retryable-error' };
     }
   }
-  return false;
+
+  return { outcome: 'success' };
+}
+
+export function isErrorResponse(response: unknown): boolean {
+  const outcome = classifyResponse(response).outcome;
+  return outcome === 'retryable-error' || outcome === 'non-retryable-error';
+}
+
+function retryMarker(stdin: HookStdin): string | undefined {
+  if (!stdin.session_id || stdin.tool_input === undefined) return undefined;
+  const digest = createHash('sha256')
+    .update(`${stdin.tool_name || ''}\n${stableJson(stdin.tool_input)}`)
+    .digest('hex')
+    .slice(0, 20);
+  return path.join(stateRoot(), 'sessions', stdin.session_id, `.auq-retry-${digest}`);
+}
+
+/** Canonical JSON keeps a semantically identical retry on the same marker even
+ * when the SDK/model emits object keys in a different order. */
+function stableJson(value: unknown): string {
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(',')}]`;
+  if (value && typeof value === 'object') {
+    const entries = Object.entries(value as Record<string, unknown>)
+      .filter(([, item]) => item !== undefined)
+      .sort(([a], [b]) => a.localeCompare(b));
+    return `{${entries
+      .map(([key, item]) => `${JSON.stringify(key)}:${stableJson(item)}`)
+      .join(',')}}`;
+  }
+  return JSON.stringify(value) ?? 'null';
+}
+
+/** Returns true exactly once for a given session + question payload. */
+function claimRetry(stdin: HookStdin): boolean {
+  const marker = retryMarker(stdin);
+  if (!marker) return false;
+  try {
+    fs.mkdirSync(path.dirname(marker), { recursive: true });
+    const fd = fs.openSync(marker, 'wx');
+    fs.writeFileSync(fd, `${new Date().toISOString()}\n`);
+    fs.closeSync(fd);
+    return true;
+  } catch (e) {
+    const code = (e as { code?: string }).code;
+    if (code !== 'EEXIST') logHookError(`retry marker failed: ${(e as Error).message}`);
+    return false;
+  }
+}
+
+function clearRetry(stdin: HookStdin): void {
+  const marker = retryMarker(stdin);
+  if (!marker) return;
+  try {
+    fs.rmSync(marker, { force: true });
+  } catch (e) {
+    logHookError(`retry marker cleanup failed: ${(e as Error).message}`);
+  }
 }
 
 /** Resolve SESSION_KIND via the shared helper (same classification the preamble
@@ -142,9 +237,14 @@ export function sessionKind(cwd?: string): 'spawned' | 'headless' | 'interactive
 }
 
 /** The directive injected per session kind. Exported for unit testing. */
-export function directiveFor(kind: 'spawned' | 'headless' | 'interactive'): string {
+export function directiveFor(
+  kind: 'spawned' | 'headless' | 'interactive',
+  action: 'retry' | 'fallback' = 'fallback',
+  code?: string,
+): string {
+  const codeNote = code ? ` (${code})` : '';
   const lead =
-    'The AskUserQuestion call did not return a usable answer (error / missing result). ' +
+    `The AskUserQuestion call returned an explicit error${codeNote}. ` +
     'Per the AskUserQuestion failure-fallback rule: ';
   switch (kind) {
     case 'spawned':
@@ -160,12 +260,20 @@ export function directiveFor(kind: 'spawned' | 'headless' | 'interactive'): stri
       );
     case 'interactive':
     default:
+      if (action === 'retry') {
+        return (
+          lead +
+          'SESSION_KIND=interactive — retry the SAME AskUserQuestion exactly once with identical ' +
+          'questions and plain-string options. Do not emit prose yet. If the retry returns `User responses`, ' +
+          'resume the workflow exactly once. If it fails again, follow the prose fallback from the next hook result.'
+        );
+      }
       return (
         lead +
         'SESSION_KIND=interactive — render the decision as a PROSE message now: a clear ELI10 of the issue, ' +
         'then a Recommendation line, then ONE paragraph per choice carrying its `(recommended)` marker, its ' +
         '`Completeness: X/10`, and 2-4 sentences of reasoning. Tell the user to reply with a letter, then STOP. ' +
-        '(Retry the call once first only if no answer could have surfaced.)'
+        'Do not call AskUserQuestion again for this decision.'
       );
   }
 }
@@ -187,9 +295,19 @@ async function main(): Promise<void> {
     return defer();
   }
 
-  if (!isErrorResponse(stdin.tool_response)) return defer();
+  const classification = classifyResponse(stdin.tool_response);
+  if (classification.outcome === 'success' || classification.outcome === 'cancelled') {
+    clearRetry(stdin);
+    return defer();
+  }
+  if (classification.outcome === 'ambiguous-placeholder') return defer();
 
-  inject(directiveFor(sessionKind(stdin.cwd)));
+  const kind = sessionKind(stdin.cwd);
+  const action =
+    classification.outcome === 'retryable-error' && kind === 'interactive' && claimRetry(stdin)
+      ? 'retry'
+      : 'fallback';
+  inject(directiveFor(kind, action, classification.code));
 }
 
 // Only run the stdin→stdout pipeline when executed as a hook, not when imported
diff --git a/hosts/claude/hooks/question-preference-hook.ts b/hosts/claude/hooks/question-preference-hook.ts
index 12cbd5ea28..878baff72e 100644
--- a/hosts/claude/hooks/question-preference-hook.ts
+++ b/hosts/claude/hooks/question-preference-hook.ts
@@ -368,11 +368,9 @@ async function main(): Promise<void> {
     return;
   }
 
-  const questions = stdin.tool_input?.questions || [];
-  if (questions.length === 0) {
-    defer();
-    return;
-  }
+  const questions = Array.isArray(stdin.tool_input?.questions)
+    ? stdin.tool_input.questions
+    : [];
 
   // For multi-question AUQ, enforcement is all-or-nothing per call:
   // we deny only if ALL questions have marker + never-ask + safe door type.
@@ -403,7 +401,7 @@ async function main(): Promise<void> {
 
   // Determine whether EVERY question is eligible for never-ask auto-decide.
   // We deliberately do NOT early-return defer on the first ineligible question:
-  // a Conductor session still needs the [conductor] prose deny as a fallback,
+  // a Conductor session still needs the [conductor] routing branch below,
   // so we compute eligibility, then branch. memoryContext is preserved on every
   // non-enforcing exit. (All-or-nothing per-call semantics are unchanged: any
   // ineligible question makes the whole call not auto-decidable.)
@@ -451,23 +449,78 @@ async function main(): Promise<void> {
     return;
   }
 
-  // Not fully auto-decidable. In Conductor, AskUserQuestion is unreliable
-  // (native is disabled, the mcp__conductor__AskUserQuestion variant is flaky),
-  // so deny the tool and redirect to a prose decision brief. This is TRANSPORT
-  // AVOIDANCE, not preference enforcement: it fires regardless of marker,
-  // preference, or door type — including one-way doors, which must reach the
-  // human via prose rather than the unreliable tool.
+  // Conductor: the clickable-question tool (mcp__conductor__AskUserQuestion) works
+  // and must render. This reverses the v1.58.1 (#2004) prose suppression: the SDK
+  // missing-result placeholder was misattributed to the host. Native AUQ is
+  // disabled by Conductor's launch flags, so redirect
+  // native calls to the MCP variant; let well-formed MCP calls through to render.
   if (isConductor()) {
-    const conductorReason =
-      '[conductor] AskUserQuestion is unreliable in Conductor (native disabled, MCP variant flaky). ' +
-      'Do NOT call AskUserQuestion (native or any mcp__*__AskUserQuestion). Render this decision as a ' +
-      'PROSE decision brief now: a D<N> label, an ELI10 of the issue, a Recommendation line, then one ' +
-      'paragraph per choice carrying its `(recommended)` marker and `Completeness: X/10`; tell the user ' +
-      'to reply with a letter, then STOP. For a one-way/destructive confirmation, require an explicit ' +
-      'typed confirmation and do NOT proceed on a vague reply. Capture the decision with gstack-question-log ' +
-      '(PostToolUse will not fire on a prose path).' +
-      (memoryContext ? `\n${memoryContext}` : '');
-    deny(conductorReason);
+    if (toolName === 'AskUserQuestion') {
+      deny(
+        '[conductor] Native AskUserQuestion is disabled in Conductor (--disallowedTools). ' +
+        'Re-issue the SAME question as mcp__conductor__AskUserQuestion (it is in your tool list). ' +
+        'Keep the full D<N> decision brief in the `question` field; pass `options` as an array of ' +
+        'plain STRINGS (letter + label + `(recommended)` marker + short tradeoff in each string). ' +
+        'Use 1-4 questions and at most 4 options each; do not include an `Other` option because Conductor adds it. ' +
+        'Do NOT fall back to prose — the MCP tool is the clickable path.' +
+        (memoryContext ? `\n${memoryContext}` : ''),
+      );
+      return;
+    }
+    if (toolName !== 'mcp__conductor__AskUserQuestion') {
+      defer(memoryContext);
+      return;
+    }
+    if (questions.length < 1 || questions.length > 4) {
+      deny(
+        '[conductor] mcp__conductor__AskUserQuestion requires 1-4 `questions` per call. ' +
+        'Retry once with the same decision content split into at most 4 questions. ' +
+        'Do NOT fall back to prose.',
+      );
+      return;
+    }
+    const hasTooManyOptions = questions.some(
+      (q) => Array.isArray(q.options) && q.options.length > 4,
+    );
+    if (hasTooManyOptions) {
+      deny(
+        '[conductor] mcp__conductor__AskUserQuestion allows at most 4 `options` per question. ' +
+        'Retry once with the same decision content split into groups of at most 4 options. ' +
+        'Do NOT drop choices and do NOT fall back to prose.',
+      );
+      return;
+    }
+    // mcp__conductor__AskUserQuestion: options MUST be plain strings. Object
+    // options ({label, description}) render as blank/unclickable choices and are
+    // the single cause of the "AUQ broken in Conductor" reports. Reject them
+    // deterministically with a retry hint; otherwise let the question render.
+    const hasObjectOrBlankOption = questions.some((q) =>
+      !Array.isArray(q.options) ||
+      q.options.some((o) => typeof o !== 'string' || o.trim() === ''),
+    );
+    if (hasObjectOrBlankOption) {
+      deny(
+        '[conductor] mcp__conductor__AskUserQuestion `options` must be an array of non-empty ' +
+        'STRINGS, not {label, description} objects (object options render as blank choices). ' +
+        'Retry the SAME call with each option as one string, e.g. ' +
+        '"A) <label> (recommended) — <short tradeoff>". Keep the full brief in `question`. ' +
+        'Do NOT fall back to prose.',
+      );
+      return;
+    }
+    const hasOtherOption = questions.some((q) =>
+      (q.options || []).some((o) => /^(?:[A-D]\)\s*)?Other(?:\s|$)/i.test(o)),
+    );
+    if (hasOtherOption) {
+      deny(
+        '[conductor] Do not include an `Other` option in mcp__conductor__AskUserQuestion; ' +
+        'Conductor adds it automatically. Retry once with the same questions and all explicit choices, ' +
+        'but remove the explicit `Other` option. Do NOT fall back to prose.',
+      );
+      return;
+    }
+    // Well-formed clickable question — let it through to Conductor to render.
+    defer(memoryContext);
     return;
   }
 
diff --git a/investigate/SKILL.md b/investigate/SKILL.md
index 5d54b42567..50b5acde41 100644
--- a/investigate/SKILL.md
+++ b/investigate/SKILL.md
@@ -90,10 +90,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -375,20 +376,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -399,7 +408,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -487,7 +496,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/ios-clean/SKILL.md b/ios-clean/SKILL.md
index 6c466896be..6ebd6a3c98 100644
--- a/ios-clean/SKILL.md
+++ b/ios-clean/SKILL.md
@@ -53,10 +53,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -338,20 +339,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -362,7 +371,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -450,7 +459,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/ios-design-review/SKILL.md b/ios-design-review/SKILL.md
index 904da7589b..ba9b8009ec 100644
--- a/ios-design-review/SKILL.md
+++ b/ios-design-review/SKILL.md
@@ -55,10 +55,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -340,20 +341,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -364,7 +373,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -452,7 +461,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/ios-fix/SKILL.md b/ios-fix/SKILL.md
index 3ddae1ac0c..1793f67bf6 100644
--- a/ios-fix/SKILL.md
+++ b/ios-fix/SKILL.md
@@ -56,10 +56,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -341,20 +342,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -365,7 +374,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -453,7 +462,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/ios-qa/SKILL.md b/ios-qa/SKILL.md
index 24624be5f2..ae978f9b9a 100644
--- a/ios-qa/SKILL.md
+++ b/ios-qa/SKILL.md
@@ -59,10 +59,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -344,20 +345,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -368,7 +377,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -456,7 +465,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/ios-sync/SKILL.md b/ios-sync/SKILL.md
index 95e0bca0a4..8863f3f3da 100644
--- a/ios-sync/SKILL.md
+++ b/ios-sync/SKILL.md
@@ -53,10 +53,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -338,20 +339,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -362,7 +371,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -450,7 +459,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/land-and-deploy/SKILL.md b/land-and-deploy/SKILL.md
index 54ebf52c0f..313a16d95b 100644
--- a/land-and-deploy/SKILL.md
+++ b/land-and-deploy/SKILL.md
@@ -48,10 +48,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -333,20 +334,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -357,7 +366,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -445,7 +454,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/landing-report/SKILL.md b/landing-report/SKILL.md
index 8f7e6e2103..01500712ec 100644
--- a/landing-report/SKILL.md
+++ b/landing-report/SKILL.md
@@ -49,10 +49,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -334,20 +335,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -358,7 +367,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -446,7 +455,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/learn/SKILL.md b/learn/SKILL.md
index a0c6ae053b..f954f79a10 100644
--- a/learn/SKILL.md
+++ b/learn/SKILL.md
@@ -51,10 +51,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -336,20 +337,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -360,7 +369,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -448,7 +457,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/make-pdf/SKILL.md b/make-pdf/SKILL.md
index 600eb47ca4..05c6ef941e 100644
--- a/make-pdf/SKILL.md
+++ b/make-pdf/SKILL.md
@@ -50,10 +50,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
diff --git a/office-hours/SKILL.md b/office-hours/SKILL.md
index 83161b8ca9..5d26d4810c 100644
--- a/office-hours/SKILL.md
+++ b/office-hours/SKILL.md
@@ -86,10 +86,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -371,20 +372,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -395,7 +404,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -483,7 +492,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/open-gstack-browser/SKILL.md b/open-gstack-browser/SKILL.md
index 28fb1ddb27..3447349102 100644
--- a/open-gstack-browser/SKILL.md
+++ b/open-gstack-browser/SKILL.md
@@ -48,10 +48,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -333,20 +334,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -357,7 +366,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -445,7 +454,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/pair-agent/SKILL.md b/pair-agent/SKILL.md
index eed9d171af..64a6bf2b6b 100644
--- a/pair-agent/SKILL.md
+++ b/pair-agent/SKILL.md
@@ -50,10 +50,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -335,20 +336,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -359,7 +368,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -447,7 +456,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/plan-ceo-review/SKILL.md b/plan-ceo-review/SKILL.md
index 3d3208bee6..4d9c7feee5 100644
--- a/plan-ceo-review/SKILL.md
+++ b/plan-ceo-review/SKILL.md
@@ -80,10 +80,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -365,20 +366,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -389,7 +398,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -477,7 +486,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/plan-design-review/SKILL.md b/plan-design-review/SKILL.md
index e81f7f12af..eef6d91a6e 100644
--- a/plan-design-review/SKILL.md
+++ b/plan-design-review/SKILL.md
@@ -52,10 +52,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -337,20 +338,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -361,7 +370,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -449,7 +458,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/plan-devex-review/SKILL.md b/plan-devex-review/SKILL.md
index 20a32da8bb..41447cb20c 100644
--- a/plan-devex-review/SKILL.md
+++ b/plan-devex-review/SKILL.md
@@ -58,10 +58,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -343,20 +344,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -367,7 +376,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -455,7 +464,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/plan-eng-review/SKILL.md b/plan-eng-review/SKILL.md
index 5557a33fa0..f5a6a535f2 100644
--- a/plan-eng-review/SKILL.md
+++ b/plan-eng-review/SKILL.md
@@ -56,10 +56,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -341,20 +342,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -365,7 +374,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -453,7 +462,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/plan-tune/SKILL.md b/plan-tune/SKILL.md
index f49b66fac3..858e93e36f 100644
--- a/plan-tune/SKILL.md
+++ b/plan-tune/SKILL.md
@@ -61,10 +61,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -346,20 +347,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -370,7 +379,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -458,7 +467,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/qa-only/SKILL.md b/qa-only/SKILL.md
index 801a935c06..9667f703ff 100644
--- a/qa-only/SKILL.md
+++ b/qa-only/SKILL.md
@@ -51,10 +51,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -336,20 +337,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -360,7 +369,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -448,7 +457,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/qa/SKILL.md b/qa/SKILL.md
index c1ac10253f..b892fc0b53 100644
--- a/qa/SKILL.md
+++ b/qa/SKILL.md
@@ -57,10 +57,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -342,20 +343,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -366,7 +375,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -454,7 +463,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/retro/SKILL.md b/retro/SKILL.md
index 3fbc447261..956558eca7 100644
--- a/retro/SKILL.md
+++ b/retro/SKILL.md
@@ -68,10 +68,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -353,20 +354,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -377,7 +386,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -465,7 +474,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/review/SKILL.md b/review/SKILL.md
index 5f26e2e426..ba558a62ae 100644
--- a/review/SKILL.md
+++ b/review/SKILL.md
@@ -53,10 +53,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -338,20 +339,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -362,7 +371,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -450,7 +459,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/scrape/SKILL.md b/scrape/SKILL.md
index dc965ec5f7..06b473a407 100644
--- a/scrape/SKILL.md
+++ b/scrape/SKILL.md
@@ -49,10 +49,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -334,20 +335,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -358,7 +367,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -446,7 +455,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/scripts/resolvers/preamble/generate-ask-user-format.ts b/scripts/resolvers/preamble/generate-ask-user-format.ts
index 533c002c02..9b264f73d9 100644
--- a/scripts/resolvers/preamble/generate-ask-user-format.ts
+++ b/scripts/resolvers/preamble/generate-ask-user-format.ts
@@ -7,20 +7,28 @@ export function generateAskUserFormat(_ctx: TemplateContext): string {
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. \`mcp__conductor__AskUserQuestion\` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if \`CONDUCTOR_SESSION: true\` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any \`mcp__*__AskUserQuestion\` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns \`[Tool result missing due to internal error]\`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a \`[plan-tune auto-decide] <id> → <option>\` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with \`bin/gstack-question-log\` (the PostToolUse capture hook never fires on a prose path, so \`/plan-tune\` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any \`mcp__*__AskUserQuestion\` variant is in your tool list, CALL IT. This includes Conductor's \`mcp__conductor__AskUserQuestion\` — it renders clickable questions and works. Hosts disable native AUQ via \`--disallowedTools AskUserQuestion\` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any \`mcp__*__AskUserQuestion\` variant is in your tool list, prefer it. Hosts may disable native AUQ via \`--disallowedTools AskUserQuestion\` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes \`options\` as an array of plain **strings** — put the option letter, label, the \`(recommended)\` marker, and short tradeoff text all inside each string (e.g. \`"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"\`). It does **NOT** accept \`{label, description}\` option objects — those render as blank/unclickable choices. The full \`D<N>\` decision brief (ELI10, Recommendation, etc.) goes in the \`question\` field exactly as in the Format section below; long multi-line \`question\` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with \`label\` + optional \`description\` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 \`questions\`. Each entry is \`{ question: string, options: string[<=4], multiSelect?: boolean }\`. Do not include an \`Other\` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a \`[plan-tune auto-decide] <id> → <option>\` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains \`[plan-tune auto-decide] <id> → <option>\` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns \`[Tool result missing due to internal error]\`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on \`SESSION_KIND\` (echoed by the preamble; empty/absent ⇒ \`interactive\`):
+2. **Success.** A Conductor result beginning \`User responses:\` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** \`CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED\` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is \`CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED\`, \`CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS\`, or \`CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH\` and the result says \`Retryable: yes\`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** \`CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE\`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** \`[Tool result missing due to internal error]\` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on \`SESSION_KIND\` (echoed by the preamble; empty/absent ⇒ \`interactive\`):
      - \`spawned\` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - \`headless\` → \`BLOCKED — AskUserQuestion unavailable\`; stop and wait (no human can answer).
      - \`interactive\` → **prose fallback** (below).
@@ -31,7 +39,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit \`Completeness: X/10\` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a \`Recommendation: <choice> because <reason>\` line plus the \`(recommended)\` marker on that choice.
 
-Layout: a \`D<N>\` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its \`(recommended)\` marker, its \`Completeness: X/10\`, and 2-4 sentences of reasoning — never a bare bullet list; a closing \`Net:\` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a \`D<N>\` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its \`(recommended)\` marker, its \`Completeness: X/10\`, and 2-4 sentences of reasoning — never a bare bullet list; a closing \`Net:\` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (\`D<N>\`, or \`D<N>.k\` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which \`D<N>.k\` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -119,7 +127,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless \`CONDUCTOR_SESSION: true\` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + \`(recommended)\` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → \`{label, description}\` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit \`Other\` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + \`(recommended)\` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \\u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/scripts/resolvers/preamble/generate-preamble-bash.ts b/scripts/resolvers/preamble/generate-preamble-bash.ts
index f0bc57b4bb..9995db7bf8 100644
--- a/scripts/resolvers/preamble/generate-preamble-bash.ts
+++ b/scripts/resolvers/preamble/generate-preamble-bash.ts
@@ -36,10 +36,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(${ctx.paths.binDir}/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "\${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "\${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
diff --git a/setup b/setup
index 275236cd36..c0f98ac9c3 100755
--- a/setup
+++ b/setup
@@ -1380,9 +1380,9 @@ if [ "$NO_TEAM_MODE" -ne 1 ] \
     *)                       PT_DECISION="prompt" ;;
   esac
 
-  # Conductor host reliability: the PreToolUse preference hook also carries the
-  # Conductor-prose enforcement (deny the flaky mcp__conductor__AskUserQuestion,
-  # redirect to a prose decision brief). A Conductor workspace setup otherwise
+  # Conductor host reliability: the PreToolUse preference hook redirects native
+  # AskUserQuestion calls to the clickable mcp__conductor__AskUserQuestion tool
+  # and validates its string-option payload. A Conductor workspace setup otherwise
   # falls through to "prompt" → the non-interactive skip below, leaving Conductor
   # users without that backstop. Treat Conductor as an implicit opt-in — but
   # only on the silent fall-through, never overriding an explicit --no-plan-tune-hooks.
@@ -1405,7 +1405,7 @@ if [ "$NO_TEAM_MODE" -ne 1 ] \
       --source plan-tune-cathedral \
       --timeout 5
     # AskUserQuestion-failure prose-fallback reliability hook (OV3:B). Fires only when
-    # an AskUserQuestion call returns an error/missing result; inert on success and
+    # an AskUserQuestion call returns an explicit error; inert on success and
     # inert if the platform doesn't invoke PostToolUse on tool errors. MUST use its
     # OWN source tag: gstack-settings-hook dedupes by (event, matcher, source) and
     # REPLACES the entry's hooks, so sharing 'plan-tune-cathedral' would overwrite the
@@ -1429,8 +1429,8 @@ if [ "$NO_TEAM_MODE" -ne 1 ] \
     _install_plan_tune_hooks
     log ""
     if [ "${_PT_CONDUCTOR_AUTO:-0}" -eq 1 ]; then
-      log "AskUserQuestion reliability hooks installed (Conductor detected): decisions"
-      log "render as a prose brief instead of the flaky AskUserQuestion tool. Inspect with /plan-tune."
+      log "AskUserQuestion hooks installed (Conductor detected): clickable host popups"
+      log "are enabled, with prose reserved for genuine transport failures. Inspect with /plan-tune."
     else
       log "Plan-tune hooks installed. Run /plan-tune anytime to inspect."
     fi
diff --git a/setup-browser-cookies/SKILL.md b/setup-browser-cookies/SKILL.md
index 77df27da2c..7de7ddf750 100644
--- a/setup-browser-cookies/SKILL.md
+++ b/setup-browser-cookies/SKILL.md
@@ -45,10 +45,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
diff --git a/setup-deploy/SKILL.md b/setup-deploy/SKILL.md
index 3465dc564b..11f96faf88 100644
--- a/setup-deploy/SKILL.md
+++ b/setup-deploy/SKILL.md
@@ -52,10 +52,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -337,20 +338,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -361,7 +370,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -449,7 +458,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/setup-gbrain/SKILL.md b/setup-gbrain/SKILL.md
index a3892f1c90..4ab2cce05f 100644
--- a/setup-gbrain/SKILL.md
+++ b/setup-gbrain/SKILL.md
@@ -51,10 +51,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -336,20 +337,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -360,7 +369,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -448,7 +457,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/ship/SKILL.md b/ship/SKILL.md
index eadffaa8f6..7331c7909e 100644
--- a/ship/SKILL.md
+++ b/ship/SKILL.md
@@ -53,10 +53,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -338,20 +339,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -362,7 +371,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -450,7 +459,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/skillify/SKILL.md b/skillify/SKILL.md
index 7cb434d0ca..b0f3a66fa9 100644
--- a/skillify/SKILL.md
+++ b/skillify/SKILL.md
@@ -49,10 +49,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -334,20 +335,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -358,7 +367,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -446,7 +455,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/spec/SKILL.md b/spec/SKILL.md
index 0894e98d18..50cd4f1ce1 100644
--- a/spec/SKILL.md
+++ b/spec/SKILL.md
@@ -50,10 +50,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -335,20 +336,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -359,7 +368,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -447,7 +456,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
@@ -1120,10 +1131,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -1405,20 +1417,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -1429,7 +1449,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -1517,7 +1537,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/sync-gbrain/SKILL.md b/sync-gbrain/SKILL.md
index 02055bb6f8..aa0e892919 100644
--- a/sync-gbrain/SKILL.md
+++ b/sync-gbrain/SKILL.md
@@ -51,10 +51,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -336,20 +337,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -360,7 +369,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -448,7 +457,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/test/auq-error-fallback-hook.test.ts b/test/auq-error-fallback-hook.test.ts
index ee6d317f58..24d3619205 100644
--- a/test/auq-error-fallback-hook.test.ts
+++ b/test/auq-error-fallback-hook.test.ts
@@ -13,34 +13,69 @@
  * pin the hook's BEHAVIOR given it is invoked; the platform trigger is the
  * documented residual risk. The hook is inert if never invoked.
  */
-import { describe, test, expect } from 'bun:test';
+import { afterEach, describe, test, expect } from 'bun:test';
 import { spawnSync } from 'child_process';
+import * as fs from 'fs';
+import * as os from 'os';
 import * as path from 'path';
-import { isErrorResponse, directiveFor } from '../hosts/claude/hooks/auq-error-fallback-hook.ts';
+import {
+  classifyResponse,
+  isErrorResponse,
+  directiveFor,
+} from '../hosts/claude/hooks/auq-error-fallback-hook.ts';
 
 const HOOK = path.resolve(__dirname, '..', 'hosts', 'claude', 'hooks', 'auq-error-fallback-hook.ts');
 
 describe('isErrorResponse — only clear failures, never a real answer', () => {
-  test('null / undefined / empty string are failures', () => {
+  test('null / undefined / empty string are failures, but not retryable', () => {
     expect(isErrorResponse(null)).toBe(true);
     expect(isErrorResponse(undefined)).toBe(true);
     expect(isErrorResponse('')).toBe(true);
     expect(isErrorResponse('   ')).toBe(true);
+    expect(classifyResponse(null).outcome).toBe('non-retryable-error');
+    expect(classifyResponse('').outcome).toBe('non-retryable-error');
   });
 
-  test('the Conductor missing-result string is a failure', () => {
-    expect(isErrorResponse('[Tool result missing due to internal error]')).toBe(true);
+  test('the SDK missing-result placeholder is ambiguous, not a host failure', () => {
+    expect(isErrorResponse('[Tool result missing due to internal error]')).toBe(false);
+    expect(classifyResponse('[Tool result missing due to internal error]').outcome)
+      .toBe('ambiguous-placeholder');
+    expect(classifyResponse('Tool result missing due to internal error.').outcome)
+      .toBe('ambiguous-placeholder');
   });
 
-  test('is_error: true / error-field / sentinel-in-content are failures', () => {
+  test('is_error: true and error-field are failures', () => {
     expect(isErrorResponse({ is_error: true })).toBe(true);
     expect(isErrorResponse({ isError: true })).toBe(true);
     expect(isErrorResponse({ error: 'boom' })).toBe(true);
-    expect(isErrorResponse({ content: 'Tool result missing due to internal error' })).toBe(true);
+    expect(isErrorResponse({ content: 'Tool result missing due to internal error' })).toBe(false);
+    expect(classifyResponse({ isError: true }).outcome).toBe('non-retryable-error');
+  });
+
+  test('classifies every explicit Conductor result shape', () => {
+    const response = (code: string, retryable: 'yes' | 'no') => ({
+      isError: retryable === 'yes',
+      content: [{ type: 'text', text: `Error asking the user a question\nError code: ${code}\nRetryable: ${retryable}` }],
+    });
+    expect(classifyResponse(response('CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED', 'yes')))
+      .toEqual({ outcome: 'retryable-error', code: 'CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED' });
+    expect(classifyResponse(response('CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS', 'yes')).outcome)
+      .toBe('retryable-error');
+    expect(classifyResponse(response('CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH', 'yes')).outcome)
+      .toBe('retryable-error');
+    expect(classifyResponse(response('CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE', 'no')))
+      .toEqual({ outcome: 'non-retryable-error', code: 'CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE' });
+    expect(classifyResponse(response('CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED', 'no')))
+      .toEqual({ outcome: 'cancelled', code: 'CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED' });
+    expect(classifyResponse(response('CONDUCTOR_ASK_USER_QUESTION_UNKNOWN', 'yes')))
+      .toEqual({ outcome: 'non-retryable-error', code: 'CONDUCTOR_ASK_USER_QUESTION_UNKNOWN' });
+    expect(classifyResponse(response('CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED', 'no')))
+      .toEqual({ outcome: 'non-retryable-error', code: 'CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED' });
   });
 
   test('a real answer is NOT a failure (no false trigger)', () => {
     expect(isErrorResponse({ answers: [{ option_label: 'A' }] })).toBe(false);
+    expect(isErrorResponse({ content: [{ type: 'text', text: 'User responses:\nQuestion 1: A' }] })).toBe(false);
     expect(isErrorResponse('A')).toBe(false);
     // a choice that coincidentally contains "error" must not trip it
     expect(isErrorResponse({ answers: [{ option_label: 'Fix the error' }] })).toBe(false);
@@ -74,35 +109,200 @@ describe('directiveFor — per-session-kind instruction', () => {
   test('spawned directive auto-chooses', () => {
     expect(directiveFor('spawned')).toMatch(/auto-choose/i);
   });
+
+  test('interactive retry directive retries exactly once without prose', () => {
+    const d = directiveFor('interactive', 'retry', 'CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED');
+    expect(d).toMatch(/retry the SAME AskUserQuestion exactly once/);
+    expect(d).toMatch(/Do not emit prose yet/);
+    expect(d).toContain('CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED');
+  });
 });
 
 /** Spawn the hook with synthetic stdin + controlled env; parse its JSON stdout. */
-function runHook(stdin: object, env: Record<string, string>): { additionalContext?: string } {
+const tempRoots: string[] = [];
+
+afterEach(() => {
+  for (const root of tempRoots.splice(0)) fs.rmSync(root, { recursive: true, force: true });
+});
+
+function stateRoot(): string {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-auq-fallback-'));
+  tempRoots.push(root);
+  return root;
+}
+
+function runHook(
+  stdin: object,
+  env: Record<string, string>,
+  root = stateRoot(),
+): { additionalContext?: string } {
   const res = spawnSync('bun', [HOOK], {
     input: JSON.stringify(stdin),
     encoding: 'utf-8',
-    env: { PATH: process.env.PATH ?? '/usr/bin:/bin', ...env },
+    env: { PATH: process.env.PATH ?? '/usr/bin:/bin', GSTACK_STATE_ROOT: root, ...env },
   });
   const parsed = JSON.parse(res.stdout || '{}');
   return parsed.hookSpecificOutput ?? {};
 }
 
 describe('hook integration — invoked as PostToolUse', () => {
-  test('error result + headless env → injects BLOCK directive', () => {
+  const retryableError = {
+    isError: true,
+    content: [{
+      type: 'text',
+      text: 'Error asking the user a question\nError code: CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED\nRetryable: yes',
+    }],
+  };
+  const toolCall = {
+    session_id: 'session-1',
+    tool_use_id: 'tool-1',
+    tool_name: 'mcp__conductor__AskUserQuestion',
+    tool_input: { questions: [{ question: 'Pick?', options: ['A', 'B'] }] },
+  };
+
+  test('retryable error + headless env → injects BLOCK directive', () => {
     const out = runHook(
-      { tool_name: 'mcp__conductor__AskUserQuestion', tool_response: '[Tool result missing due to internal error]' },
+      { ...toolCall, tool_response: retryableError },
       { GSTACK_HEADLESS: '1' },
     );
     expect(out.additionalContext).toMatch(/BLOCKED — AskUserQuestion unavailable/);
   });
 
-  test('error result + interactive env → injects prose-triad directive', () => {
+  test('SDK placeholder stays inert and cannot cause duplicate prose', () => {
+    const out = runHook(
+      { ...toolCall, tool_response: '[Tool result missing due to internal error]' },
+      { CONDUCTOR_PORT: '55010' },
+    );
+    expect(out.additionalContext).toBeUndefined();
+  });
+
+  test('retryable error retries exactly once, then falls back to prose', () => {
+    const root = stateRoot();
+    const first = runHook(
+      { ...toolCall, tool_response: retryableError },
+      { CONDUCTOR_PORT: '55010' },
+      root,
+    );
+    expect(first.additionalContext).toMatch(/retry the SAME AskUserQuestion exactly once/);
+
+    const second = runHook(
+      { ...toolCall, tool_use_id: 'tool-2', tool_response: retryableError },
+      { CONDUCTOR_PORT: '55010' },
+      root,
+    );
+    expect(second.additionalContext).toMatch(/render the decision as a PROSE message/i);
+    expect(second.additionalContext).toMatch(/Completeness: X\/10/);
+    expect(second.additionalContext).toMatch(/Do not call AskUserQuestion again/);
+  });
+
+  test('retry exhaustion survives reordered payload keys and an ambiguous SDK placeholder', () => {
+    const root = stateRoot();
+    const first = runHook(
+      { ...toolCall, tool_response: retryableError },
+      { CONDUCTOR_PORT: '55010' },
+      root,
+    );
+    expect(first.additionalContext).toMatch(/retry the SAME AskUserQuestion exactly once/);
+
+    const reorderedInput = {
+      questions: [{ options: ['A', 'B'], question: 'Pick?' }],
+    };
+    const placeholder = runHook(
+      {
+        ...toolCall,
+        tool_use_id: 'tool-2',
+        tool_input: reorderedInput,
+        tool_response: 'Tool result missing due to internal error.',
+      },
+      { CONDUCTOR_PORT: '55010' },
+      root,
+    );
+    expect(placeholder.additionalContext).toBeUndefined();
+
+    const exhausted = runHook(
+      {
+        ...toolCall,
+        tool_use_id: 'tool-3',
+        tool_input: reorderedInput,
+        tool_response: retryableError,
+      },
+      { CONDUCTOR_PORT: '55010' },
+      root,
+    );
+    expect(exhausted.additionalContext).toMatch(/render the decision as a PROSE message/i);
+    expect(exhausted.additionalContext).not.toMatch(/retry the SAME/);
+  });
+
+  test.each([
+    'CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS',
+    'CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH',
+  ])('%s receives the one allowed retry', (code) => {
+    const out = runHook(
+      {
+        ...toolCall,
+        tool_response: {
+          isError: true,
+          content: [{ type: 'text', text: `Error code: ${code}\nRetryable: yes` }],
+        },
+      },
+      { CONDUCTOR_PORT: '55010' },
+    );
+    expect(out.additionalContext).toMatch(/retry the SAME AskUserQuestion exactly once/);
+    expect(out.additionalContext).toContain(code);
+  });
+
+  test('a generic explicit error falls back without retrying', () => {
+    const out = runHook(
+      { ...toolCall, tool_response: { isError: true, error: 'transport failed' } },
+      { CONDUCTOR_PORT: '55010' },
+    );
+    expect(out.additionalContext).toMatch(/render the decision as a PROSE message/i);
+    expect(out.additionalContext).not.toMatch(/retry the SAME/);
+  });
+
+  test('successful User responses clears retry exhaustion', () => {
+    const root = stateRoot();
+    runHook({ ...toolCall, tool_response: retryableError }, { CONDUCTOR_PORT: '55010' }, root);
+    const success = runHook(
+      { ...toolCall, tool_use_id: 'tool-2', tool_response: { content: [{ type: 'text', text: 'User responses:\nQuestion 1: A' }] } },
+      { CONDUCTOR_PORT: '55010' },
+      root,
+    );
+    expect(success.additionalContext).toBeUndefined();
+    const nextFailure = runHook(
+      { ...toolCall, tool_use_id: 'tool-3', tool_response: retryableError },
+      { CONDUCTOR_PORT: '55010' },
+      root,
+    );
+    expect(nextFailure.additionalContext).toMatch(/retry the SAME AskUserQuestion exactly once/);
+  });
+
+  test('non-retryable session-unavailable error goes straight to prose', () => {
     const out = runHook(
-      { tool_name: 'AskUserQuestion', tool_response: null },
+      {
+        ...toolCall,
+        tool_response: {
+          isError: true,
+          content: [{ type: 'text', text: 'Error code: CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE\nRetryable: no' }],
+        },
+      },
       { CONDUCTOR_PORT: '55010' },
     );
     expect(out.additionalContext).toMatch(/render the decision as a PROSE message/i);
-    expect(out.additionalContext).toMatch(/Completeness: X\/10/);
+    expect(out.additionalContext).not.toMatch(/retry the SAME/);
+  });
+
+  test('user cancellation stays inert and does not retry', () => {
+    const out = runHook(
+      {
+        ...toolCall,
+        tool_response: {
+          content: [{ type: 'text', text: 'User cancelled the question.\nError code: CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED\nRetryable: no' }],
+        },
+      },
+      { CONDUCTOR_PORT: '55010' },
+    );
+    expect(out.additionalContext).toBeUndefined();
   });
 
   test('error result + spawned env → injects auto-choose directive', () => {
diff --git a/test/fixtures/golden/claude-ship-SKILL.md b/test/fixtures/golden/claude-ship-SKILL.md
index eadffaa8f6..7331c7909e 100644
--- a/test/fixtures/golden/claude-ship-SKILL.md
+++ b/test/fixtures/golden/claude-ship-SKILL.md
@@ -53,10 +53,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -338,20 +339,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -362,7 +371,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -450,7 +459,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/test/fixtures/golden/codex-ship-SKILL.md b/test/fixtures/golden/codex-ship-SKILL.md
index d99630c4b3..84684708c7 100644
--- a/test/fixtures/golden/codex-ship-SKILL.md
+++ b/test/fixtures/golden/codex-ship-SKILL.md
@@ -39,10 +39,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$($GSTACK_BIN/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -324,20 +325,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -348,7 +357,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -436,7 +445,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/test/fixtures/golden/factory-ship-SKILL.md b/test/fixtures/golden/factory-ship-SKILL.md
index a2acad24f6..3c302c60e0 100644
--- a/test/fixtures/golden/factory-ship-SKILL.md
+++ b/test/fixtures/golden/factory-ship-SKILL.md
@@ -41,10 +41,11 @@ echo "REPO_MODE: $REPO_MODE"
 _SESSION_KIND=$($GSTACK_BIN/gstack-session-kind 2>/dev/null || echo "interactive")
 case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
-# Conductor host: AskUserQuestion is unreliable here (native disabled, MCP
-# variant flaky), so skills render decisions as prose instead of calling the
-# tool. Gated on !headless so an eval/CI run INSIDE Conductor (GSTACK_HEADLESS)
-# still BLOCKs rather than rendering prose to nobody.
+# Conductor host: native AskUserQuestion is disabled (--disallowedTools), so
+# route clickable questions through mcp__conductor__AskUserQuestion with plain
+# STRING options (see the AskUserQuestion Format section). Signal it here so
+# skills pick the right tool + payload shape. Gated on !headless so an eval/CI
+# run INSIDE Conductor (GSTACK_HEADLESS) still BLOCKs rather than prompting nobody.
 if [ "$_SESSION_KIND" != "headless" ] && { [ -n "${CONDUCTOR_WORKSPACE_PATH:-}" ] || [ -n "${CONDUCTOR_PORT:-}" ]; }; then
   echo "CONDUCTOR_SESSION: true"
 fi
@@ -326,20 +327,28 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 
 "AskUserQuestion" can resolve to two tools at runtime: the **host MCP variant** (e.g. `mcp__conductor__AskUserQuestion` — appears in your tool list when the host registers it) or the **native** Claude Code tool.
 
-**Conductor rule (read before the MCP rule):** if `CONDUCTOR_SESSION: true` was echoed by the preamble, do NOT call AskUserQuestion at all — neither native nor any `mcp__*__AskUserQuestion` variant. Render EVERY decision brief as the **prose form** below and STOP. This is proactive, not a reaction to a failure: Conductor disables native AUQ and its MCP variant is flaky (it returns `[Tool result missing due to internal error]`), so prose is the reliable path. **Auto-decide preferences still apply first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option (no prose). Because in Conductor you go straight to prose without ever calling the tool, this auto-decide-first ordering is enforced HERE, not only by the PreToolUse hook. When you render a Conductor prose brief, also capture it with `bin/gstack-question-log` (the PostToolUse capture hook never fires on a prose path, so `/plan-tune` history/learning depends on this call).
+**Rule — always prefer the MCP variant when present.** If any `mcp__*__AskUserQuestion` variant is in your tool list, CALL IT. This includes Conductor's `mcp__conductor__AskUserQuestion` — it renders clickable questions and works. Hosts disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant, so calling native there silently fails. Do NOT render prose instead — the MCP tool is the clickable path.
 
-**Rule (non-Conductor):** if any `mcp__*__AskUserQuestion` variant is in your tool list, prefer it. Hosts may disable native AUQ via `--disallowedTools AskUserQuestion` (Conductor does, by default) and route through their MCP variant; calling native there silently fails. Same questions/options shape; same decision-brief format applies.
+**Payload shape (this is the one thing that must be right):** the MCP variant takes `options` as an array of plain **strings** — put the option letter, label, the `(recommended)` marker, and short tradeoff text all inside each string (e.g. `"A) Site + app foundation (recommended) — ship the site now and add the DB/app skeleton underneath"`). It does **NOT** accept `{label, description}` option objects — those render as blank/unclickable choices. The full `D<N>` decision brief (ELI10, Recommendation, etc.) goes in the `question` field exactly as in the Format section below; long multi-line `question` text is fine. Native Claude AUQ — only when no MCP variant exists — uses option **objects** with `label` + optional `description` instead.
 
-If AskUserQuestion is unavailable (no variant in your tool list) OR a call to it fails, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
+**Conductor MCP contract:** send 1-4 `questions`. Each entry is `{ question: string, options: string[<=4], multiSelect?: boolean }`. Do not include an `Other` option; Conductor adds it automatically.
+
+**Auto-decide applies first:** if a `[plan-tune auto-decide] <id> → <option>` result has already surfaced for a question, proceed with that option — do not re-call the tool.
+
+If AskUserQuestion is unavailable (no variant in your tool list) OR a call returns an explicit error, do NOT silently auto-decide or write the decision to the plan file as a substitute. Follow the **failure fallback** below.
 
 ### When AskUserQuestion is unavailable or a call fails
 
-Tell three outcomes apart:
+Tell these outcomes apart:
 
 1. **Auto-decide denial (NOT a failure).** The result contains `[plan-tune auto-decide] <id> → <option>` — the preference hook working as designed. Proceed with that option. Do NOT retry, do NOT fall back to prose.
-2. **Genuine failure** — no variant in your tool list, OR the variant is present but the call returns an error / missing result (MCP transport error, empty result, host bug — e.g. Conductor's MCP AskUserQuestion is flaky and returns `[Tool result missing due to internal error]`).
-   - If it was present and **errored** (not absent), retry the SAME call **once** — but only if no answer could have surfaced (a missing-result error can arrive after the user already saw the question; retrying would double-prompt, so if it may have reached them, treat as pending, don't retry).
-   - Then branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
+2. **Success.** A Conductor result beginning `User responses:` is the completed human answer. Apply it and resume the workflow exactly once. Do NOT retry and do NOT emit a prose duplicate.
+3. **Cancellation.** `CONDUCTOR_ASK_USER_QUESTION_USER_CANCELLED` means the human cancelled. Do NOT retry or replace it with prose; remain stopped for new user direction.
+4. **Explicitly retryable Conductor failure.** Retry the SAME call exactly **once** only when its error code is `CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED`, `CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS`, or `CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH` and the result says `Retryable: yes`. Preserve the same questions and plain-string options. If that one retry fails, use the session-kind fallback below.
+5. **Non-retryable failure or unavailable tool.** `CONDUCTOR_ASK_USER_QUESTION_SESSION_UNAVAILABLE`, any other explicit error, or no available AskUserQuestion variant goes directly to the existing session-kind fallback. Do not retry.
+6. **Ambiguous SDK placeholder.** `[Tool result missing due to internal error]` is emitted by the Claude Code SDK, not Conductor, and is not proof that popup delivery failed. Treat the question as pending: do NOT retry and do NOT emit prose from this placeholder alone.
+
+For outcomes 4 (after retry exhaustion) and 5, branch on `SESSION_KIND` (echoed by the preamble; empty/absent ⇒ `interactive`):
      - `spawned` → defer to the **Spawned session** block: auto-choose the recommended option. Never prose, never BLOCKED.
      - `headless` → `BLOCKED — AskUserQuestion unavailable`; stop and wait (no human can answer).
      - `interactive` → **prose fallback** (below).
@@ -350,7 +359,7 @@ Tell three outcomes apart:
 2. **Completeness scores per choice** — explicit `Completeness: X/10` on EACH choice (10 complete, 7 happy-path, 3 shortcut); use the kind-note when options differ in kind not coverage, but never silently drop the score.
 3. **The recommendation and why** — a `Recommendation: <choice> because <reason>` line plus the `(recommended)` marker on that choice.
 
-Layout: a `D<N>` title + a one-line note to reply with a letter (in Conductor this is the normal path; elsewhere it means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
+Layout: a `D<N>` title + a one-line note to reply with a letter (this fallback means AskUserQuestion was unavailable or errored); the issue ELI10; the Recommendation line; then ONE paragraph per choice carrying its `(recommended)` marker, its `Completeness: X/10`, and 2-4 sentences of reasoning — never a bare bullet list; a closing `Net:` line. Split chains / 5+ options: one prose block per per-option call, in sequence. Then STOP and wait — the user's typed answer is the decision. In plan mode this satisfies end-of-turn like a tool call.
 
 **Continuation — mapping a typed reply back to a brief.** Each brief carries a stable label (`D<N>`, or `D<N>.k` in a split chain). The user references it (e.g. "3.2: B"). A bare letter maps to the single most-recent UNANSWERED brief; if more than one is open (a split chain), do NOT guess — ask which `D<N>.k` it answers. Never apply a bare letter ambiguously across a chain.
 
@@ -438,7 +447,9 @@ Before calling AskUserQuestion, verify:
 - [ ] (recommended) label on one option (even for neutral-posture)
 - [ ] Dual-scale effort labels on effort-bearing options (human / CC)
 - [ ] Net line closes the decision
-- [ ] You are calling the tool, not writing prose — unless `CONDUCTOR_SESSION: true` (then prose is the DEFAULT, not the tool) OR the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
+- [ ] Options use the right shape for the tool you're calling: MCP variant (incl. Conductor) → plain **strings**; native Claude → `{label, description}` objects
+- [ ] Conductor MCP call has 1-4 questions, ≤4 options each, and no explicit `Other` option
+- [ ] You are calling the tool, not writing prose — unless the documented failure fallback applies (then: prose with the mandatory triad — issue ELI10, per-choice Completeness, Recommendation + `(recommended)` — and a "reply with a letter" instruction, then STOP)
 - [ ] Non-ASCII characters (CJK / accents) written directly, NOT \u-escaped
 - [ ] If you had 5+ options, you split (or batched into ≤4-groups) — did NOT drop any
 - [ ] If you split, you checked dependencies between options before firing the chain
diff --git a/test/gstack-settings-hook-schema-aware.test.ts b/test/gstack-settings-hook-schema-aware.test.ts
index ada8ec40c1..ddfd929ba0 100644
--- a/test/gstack-settings-hook-schema-aware.test.ts
+++ b/test/gstack-settings-hook-schema-aware.test.ts
@@ -111,6 +111,64 @@ describe('add-event', () => {
     expect(s.hooks.PreToolUse[0].hooks[0].command).toBe('/v2');
   });
 
+  test('adopts an exact-command entry when Claude strips the source tag', () => {
+    fs.writeFileSync(settingsFile, JSON.stringify({
+      hooks: {
+        PreToolUse: [{
+          matcher: 'AskUserQuestion',
+          hooks: [{ type: 'command', command: '/gstack-hook', timeout: 1 }],
+        }],
+      },
+    }));
+    run([
+      'add-event',
+      '--event', 'PreToolUse',
+      '--matcher', 'AskUserQuestion',
+      '--command', '/gstack-hook',
+      '--source', 'plan-tune-cathedral',
+      '--timeout', '5',
+    ]);
+    const entries = settings().hooks.PreToolUse;
+    expect(entries).toHaveLength(1);
+    expect(entries[0]._gstack_source).toBe('plan-tune-cathedral');
+    expect(entries[0].hooks).toEqual([
+      { type: 'command', command: '/gstack-hook', timeout: 5 },
+    ]);
+  });
+
+  test('collapses duplicate stripped registrations and preserves unrelated hooks', () => {
+    fs.writeFileSync(settingsFile, JSON.stringify({
+      hooks: {
+        PreToolUse: [
+          { matcher: 'AskUserQuestion', hooks: [{ type: 'command', command: '/gstack-hook' }] },
+          { matcher: 'AskUserQuestion', hooks: [{ type: 'command', command: '/gstack-hook' }] },
+          { matcher: 'AskUserQuestion', hooks: [
+            { type: 'command', command: '/gstack-hook' },
+            { type: 'command', command: '/user-hook' },
+          ] },
+          { matcher: 'AskUserQuestion', hooks: [{ type: 'command', command: '/other-hook' }] },
+          { matcher: 'Bash', hooks: [{ type: 'command', command: '/bash-hook' }] },
+        ],
+      },
+    }));
+    run([
+      'add-event',
+      '--event', 'PreToolUse',
+      '--matcher', 'AskUserQuestion',
+      '--command', '/gstack-hook',
+      '--source', 'plan-tune-cathedral',
+    ]);
+    const entries = settings().hooks.PreToolUse;
+    const gstackHooks = entries.filter((entry: any) =>
+      entry.hooks.some((hook: any) => hook.command === '/gstack-hook'),
+    );
+    expect(gstackHooks).toHaveLength(1);
+    expect(gstackHooks[0]._gstack_source).toBe('plan-tune-cathedral');
+    expect(entries.some((entry: any) => entry.hooks.some((hook: any) => hook.command === '/user-hook'))).toBe(true);
+    expect(entries.some((entry: any) => entry.hooks.some((hook: any) => hook.command === '/other-hook'))).toBe(true);
+    expect(entries.some((entry: any) => entry.hooks.some((hook: any) => hook.command === '/bash-hook'))).toBe(true);
+  });
+
   test('preserves unrelated existing hooks', () => {
     fs.writeFileSync(
       settingsFile,
@@ -158,6 +216,24 @@ describe('add-event', () => {
     expect(backupContent.hooks).toBeUndefined();
   });
 
+  test('keeps distinct backups for multiple mutations within one second', () => {
+    fs.writeFileSync(settingsFile, JSON.stringify({ original: true }));
+    run([
+      'add-event', '--event', 'PreToolUse', '--matcher', 'AskUserQuestion',
+      '--command', '/pre', '--source', 'plan-tune-cathedral',
+    ]);
+    run([
+      'add-event', '--event', 'PostToolUse', '--matcher', 'AskUserQuestion',
+      '--command', '/post', '--source', 'plan-tune-cathedral',
+    ]);
+    const backups = fs.readdirSync(tmpDir).filter((f) => f.startsWith('settings.json.bak.'));
+    expect(backups).toHaveLength(2);
+    expect(backups.some((file) => {
+      const value = JSON.parse(fs.readFileSync(path.join(tmpDir, file), 'utf-8'));
+      return value.original === true && value.hooks === undefined;
+    })).toBe(true);
+  });
+
   test('rejects invalid --event', () => {
     const r = run([
       'add-event',
diff --git a/test/gstack-upgrade-migration-v1_60_2_0.test.ts b/test/gstack-upgrade-migration-v1_60_2_0.test.ts
new file mode 100644
index 0000000000..774be91d5a
--- /dev/null
+++ b/test/gstack-upgrade-migration-v1_60_2_0.test.ts
@@ -0,0 +1,130 @@
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { spawnSync } from 'child_process';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+
+const ROOT = path.resolve(import.meta.dir, '..');
+const MIGRATION = path.join(ROOT, 'gstack-upgrade', 'migrations', 'v1.60.2.0.sh');
+const MATCHER = '(AskUserQuestion|mcp__.*__AskUserQuestion)';
+const PREF = path.join(ROOT, 'hosts', 'claude', 'hooks', 'question-preference-hook');
+const LOG = path.join(ROOT, 'hosts', 'claude', 'hooks', 'question-log-hook');
+const FALLBACK = path.join(ROOT, 'hosts', 'claude', 'hooks', 'auq-error-fallback-hook');
+
+let home: string;
+let settingsFile: string;
+
+beforeEach(() => {
+  home = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-auq-migration-'));
+  fs.mkdirSync(path.join(home, '.claude'), { recursive: true });
+  settingsFile = path.join(home, '.claude', 'settings.json');
+});
+
+afterEach(() => {
+  fs.rmSync(home, { recursive: true, force: true });
+});
+
+function run(extraEnv: Record<string, string> = {}) {
+  const env: Record<string, string> = {
+    PATH: process.env.PATH || '/usr/bin:/bin',
+    HOME: home,
+    ...extraEnv,
+  };
+  return spawnSync('bash', [MIGRATION], { env, encoding: 'utf-8' });
+}
+
+function writeConfig(value: string): void {
+  fs.mkdirSync(path.join(home, '.gstack'), { recursive: true });
+  fs.writeFileSync(path.join(home, '.gstack', 'config.yaml'), `plan_tune_hooks: ${value}\n`);
+}
+
+function hook(command: string) {
+  return { matcher: MATCHER, hooks: [{ type: 'command', command, timeout: 5 }] };
+}
+
+function settings(): any {
+  return JSON.parse(fs.readFileSync(settingsFile, 'utf-8'));
+}
+
+function commandCount(entries: any[], command: string): number {
+  return entries.filter((entry) =>
+    entry.hooks?.some((registered: any) => registered.command === command),
+  ).length;
+}
+
+describe('v1.60.2.0 AskUserQuestion hook migration', () => {
+  test('collapses three stripped copies of every hook and preserves user hooks', () => {
+    const original = {
+      permissions: { allow: ['Bash(git status)'] },
+      hooks: {
+        PreToolUse: [hook(PREF), hook(PREF), hook(PREF), hook('/user/pre-hook')],
+        PostToolUse: [
+          hook(LOG), hook(LOG), hook(LOG),
+          hook(FALLBACK), hook(FALLBACK), hook(FALLBACK),
+          hook('/user/post-hook'),
+        ],
+      },
+    };
+    fs.writeFileSync(settingsFile, JSON.stringify(original, null, 2));
+
+    const result = run({ CONDUCTOR_PORT: '55070' });
+    expect(result.status).toBe(0);
+    expect(result.stderr).toContain('hooks normalized');
+
+    const updated = settings();
+    expect(commandCount(updated.hooks.PreToolUse, PREF)).toBe(1);
+    expect(commandCount(updated.hooks.PostToolUse, LOG)).toBe(1);
+    expect(commandCount(updated.hooks.PostToolUse, FALLBACK)).toBe(1);
+    expect(commandCount(updated.hooks.PreToolUse, '/user/pre-hook')).toBe(1);
+    expect(commandCount(updated.hooks.PostToolUse, '/user/post-hook')).toBe(1);
+    expect(updated.permissions).toEqual(original.permissions);
+
+    const prefEntry = updated.hooks.PreToolUse.find((entry: any) =>
+      entry.hooks.some((registered: any) => registered.command === PREF));
+    const fallbackEntry = updated.hooks.PostToolUse.find((entry: any) =>
+      entry.hooks.some((registered: any) => registered.command === FALLBACK));
+    expect(prefEntry._gstack_source).toBe('plan-tune-cathedral');
+    expect(fallbackEntry._gstack_source).toBe('auq-error-fallback');
+    expect(fs.existsSync(path.join(home, '.gstack', '.migrations', 'v1.60.2.0.done'))).toBe(true);
+
+    const backups = fs.readdirSync(path.join(home, '.claude'))
+      .filter((file) => file.startsWith('settings.json.bak.'));
+    expect(backups.length).toBeGreaterThanOrEqual(3);
+    expect(backups.some((file) =>
+      JSON.stringify(JSON.parse(fs.readFileSync(path.join(home, '.claude', file), 'utf-8'))) ===
+        JSON.stringify(original),
+    )).toBe(true);
+  });
+
+  test('respects an explicit opt-out even inside Conductor', () => {
+    writeConfig('no');
+    const original = { hooks: { PreToolUse: [hook(PREF), hook(PREF)] } };
+    fs.writeFileSync(settingsFile, JSON.stringify(original));
+    const result = run({ CONDUCTOR_PORT: '55070' });
+    expect(result.status).toBe(0);
+    expect(settings()).toEqual(original);
+    expect(fs.existsSync(path.join(home, '.gstack', '.migrations', 'v1.60.2.0.done'))).toBe(true);
+  });
+
+  test('does not install hooks outside Conductor without an explicit opt-in', () => {
+    const original = { existing: true };
+    fs.writeFileSync(settingsFile, JSON.stringify(original));
+    expect(run().status).toBe(0);
+    expect(settings()).toEqual(original);
+  });
+
+  test('explicit opt-in normalizes outside Conductor and reruns idempotently', () => {
+    writeConfig('yes');
+    fs.writeFileSync(settingsFile, JSON.stringify({ hooks: { PreToolUse: [hook(PREF), hook(PREF)] } }));
+    expect(run().status).toBe(0);
+    const afterFirst = fs.readFileSync(settingsFile, 'utf-8');
+    const backupsAfterFirst = fs.readdirSync(path.join(home, '.claude'))
+      .filter((file) => file.startsWith('settings.json.bak.')).length;
+
+    expect(run().status).toBe(0);
+    expect(fs.readFileSync(settingsFile, 'utf-8')).toBe(afterFirst);
+    const backupsAfterSecond = fs.readdirSync(path.join(home, '.claude'))
+      .filter((file) => file.startsWith('settings.json.bak.')).length;
+    expect(backupsAfterSecond).toBe(backupsAfterFirst);
+  });
+});
diff --git a/test/helpers/carve-guards.ts b/test/helpers/carve-guards.ts
index 5f3e01a1b7..64fe1a098f 100644
--- a/test/helpers/carve-guards.ts
+++ b/test/helpers/carve-guards.ts
@@ -186,7 +186,7 @@ export const CARVE_GUARDS: Record<string, CarveGuard> = {
       gateAfterStop: 'EXIT PLAN MODE GATE',
     },
     behavioral: 'plan',
-    // +Conductor AUQ-default-prose rule + one-way/continuation safety in the
+    // +host-aware AUQ routing + one-way/fallback safety in the
     // always-loaded AskUserQuestion Format section.
     // v1.2.0 activation lift (shared first-run-guidance preamble) + #2077 ask-first scope gate.
     maxSkeletonBytes: 88_000,
@@ -206,7 +206,7 @@ export const CARVE_GUARDS: Record<string, CarveGuard> = {
       gateAfterStop: 'EXIT PLAN MODE GATE',
     },
     behavioral: 'plan',
-    // +Conductor AUQ-default-prose rule + one-way/destructive prose safety +
+    // +host-aware AUQ routing + one-way/destructive fallback safety +
     // continuation protocol in the always-loaded AskUserQuestion Format section.
     // v1.2.0 activation lift: first-run-guidance section in the shared preamble.
     maxSkeletonBytes: 80_000,
@@ -250,7 +250,7 @@ export const CARVE_GUARDS: Record<string, CarveGuard> = {
       gateAfterStop: undefined,
     },
     behavioral: 'prompt',
-    // +Conductor AUQ-default-prose rule + one-way/continuation safety in the
+    // +host-aware AUQ routing + one-way/fallback safety in the
     // always-loaded AskUserQuestion Format section.
     // v1.2.0 activation lift: first-run-guidance section in the shared preamble.
     maxSkeletonBytes: 56_000,
@@ -278,7 +278,7 @@ export const CARVE_GUARDS: Record<string, CarveGuard> = {
       gateAfterStop: undefined,
     },
     behavioral: 'prompt',
-    // +Conductor AUQ-default-prose rule + one-way/continuation safety in the
+    // +host-aware AUQ routing + one-way/fallback safety in the
     // always-loaded AskUserQuestion Format section.
     // v1.2.0 activation lift: first-run-guidance section in the shared preamble.
     maxSkeletonBytes: 69_000,
@@ -317,7 +317,7 @@ export const CARVE_GUARDS: Record<string, CarveGuard> = {
       gateAfterStop: undefined,
     },
     behavioral: 'prompt',
-    // +Conductor AUQ-default-prose rule + one-way/continuation safety in the
+    // +host-aware AUQ routing + one-way/fallback safety in the
     // always-loaded AskUserQuestion Format section.
     // v1.2.0 activation lift: first-run-guidance section in the shared preamble.
     maxSkeletonBytes: 75_000,
diff --git a/test/helpers/touchfiles.ts b/test/helpers/touchfiles.ts
index 33ba9ad973..941bb7ebe1 100644
--- a/test/helpers/touchfiles.ts
+++ b/test/helpers/touchfiles.ts
@@ -122,10 +122,9 @@ export const E2E_TOUCHFILES: Record<string, string[]> = {
   // infrastructure plus the resolvers that own the AUTO_DECIDE preamble.
   'auto-decide-preserved':        ['scripts/resolvers/question-tuning.ts', 'scripts/resolvers/preamble/generate-ask-user-format.ts', 'scripts/resolvers/preamble/generate-preamble-bash.ts', 'scripts/resolvers/preamble/generate-completion-status.ts', 'plan-ceo-review/**', 'bin/gstack-question-preference', 'bin/gstack-config', 'bin/gstack-slug', 'hosts/claude/hooks/question-preference-hook.ts', 'lib/is-conductor.ts', 'test/helpers/claude-pty-runner.ts'],
 
-  // Conductor → prose decision brief (Conductor signal makes prose the default;
-  // the PreToolUse hook denies the flaky tool). Touches the resolver that owns
-  // the Conductor rule, the preamble signal, the hook, and the detection helper.
-  'conductor-prose':              ['scripts/resolvers/preamble/generate-ask-user-format.ts', 'scripts/resolvers/preamble/generate-preamble-bash.ts', 'scripts/resolvers/preamble.ts', 'plan-eng-review/**', 'hosts/claude/hooks/question-preference-hook.ts', 'lib/is-conductor.ts', 'test/helpers/claude-pty-runner.ts', 'test/skill-e2e-conductor-prose.test.ts'],
+  // Genuine unavailable-tool prose fallback. Conductor's registered MCP path is
+  // covered separately by deterministic hook tests.
+  'auq-unavailable-fallback':     ['scripts/resolvers/preamble/generate-ask-user-format.ts', 'scripts/resolvers/preamble.ts', 'plan-eng-review/**', 'test/helpers/claude-pty-runner.ts', 'test/skill-e2e-auq-unavailable-fallback.test.ts'],
 
   // Real-PTY E2E batch (#6 new tests on the harness).
   // Each one tests behavior the SDK harness can't observe (rendered TTY,
@@ -538,7 +537,7 @@ export const E2E_TIERS: Record<string, 'gate' | 'periodic'> = {
   // v1.21+ auto-mode regression tests
   'office-hours-auto-mode': 'gate',
   'auto-decide-preserved': 'periodic',
-  'conductor-prose': 'periodic',
+  'auq-unavailable-fallback': 'periodic',
   'e2e-harness-audit': 'gate',
 
   // Real-PTY E2E batch — tier classification:
diff --git a/test/memory-cache-injection.test.ts b/test/memory-cache-injection.test.ts
index 3ab6a2144a..1b7a92045a 100644
--- a/test/memory-cache-injection.test.ts
+++ b/test/memory-cache-injection.test.ts
@@ -45,7 +45,7 @@ function runHook(stdin: object): { stdout: string; stderr: string; status: numbe
   delete env.GSTACK_HOME;
   // These cases assert the defer-path memoryContext injection. Strip ambient
   // Conductor markers so running inside Conductor (CONDUCTOR_WORKSPACE_PATH/PORT
-  // set) doesn't flip the hook into the [conductor] prose deny instead of defer.
+  // set) doesn't flip the hook into the [conductor] MCP-routing branch.
   delete env.CONDUCTOR_WORKSPACE_PATH;
   delete env.CONDUCTOR_PORT;
   const res = spawnSync(HOOK, [], {
diff --git a/test/question-preference-hook.test.ts b/test/question-preference-hook.test.ts
index 39de02f4e8..36d602a536 100644
--- a/test/question-preference-hook.test.ts
+++ b/test/question-preference-hook.test.ts
@@ -75,7 +75,7 @@ function runHook(stdin: object, cwd?: string, extraEnv?: Record<string, string>)
   // Strip ambient Conductor markers so these cases characterize NON-Conductor
   // behavior deterministically — otherwise running the suite inside Conductor
   // (CONDUCTOR_WORKSPACE_PATH/PORT set) would flip every defer into the
-  // [conductor] prose deny. The Conductor cases below opt back in explicitly
+  // [conductor] MCP routing deny. The Conductor cases below opt back in explicitly
   // via extraEnv.
   delete env.CONDUCTOR_WORKSPACE_PATH;
   delete env.CONDUCTOR_PORT;
@@ -346,16 +346,19 @@ describe('MCP variant', () => {
 });
 
 // ----------------------------------------------------------------------
-// Conductor: deny + prose redirect (transport avoidance, not preference)
+// Conductor: route clickable questions through the MCP variant. Reverses the
+// v1.58.1 (#2004) prose-suppression regression — mcp__conductor__AskUserQuestion
+// renders and works; native AUQ is disabled by launch flags → redirect; object
+// options are rejected (they render blank).
 // ----------------------------------------------------------------------
 
-describe('Conductor prose redirect', () => {
+describe('Conductor clickable-question routing', () => {
   const CONDUCTOR = { CONDUCTOR_PORT: '55070' };
 
-  test('two-way, no preference → deny with [conductor] prose directive', () => {
+  test('MCP + STRING options → defer (question renders)', () => {
     const r = runHook({
       session_id: 'c1',
-      tool_name: 'AskUserQuestion',
+      tool_name: 'mcp__conductor__AskUserQuestion',
       tool_use_id: 'tu-c1',
       tool_input: {
         questions: [
@@ -363,32 +366,131 @@ describe('Conductor prose redirect', () => {
         ],
       },
     }, undefined, CONDUCTOR);
-    expect(r.parsed?.hookSpecificOutput?.permissionDecision).toBe('deny');
-    expect(r.parsed?.hookSpecificOutput?.permissionDecisionReason).toContain('[conductor]');
-    expect(r.parsed?.hookSpecificOutput?.permissionDecisionReason).toMatch(/do not call askuserquestion/i);
-    expect(r.parsed?.hookSpecificOutput?.permissionDecisionReason).toMatch(/reply with a letter/i);
+    expect(r.parsed?.hookSpecificOutput?.permissionDecision).toBe('defer');
+  });
+
+  test('MCP supports multiple questions and multi-select with string options', () => {
+    const r = runHook({
+      session_id: 'c1b',
+      tool_name: 'mcp__conductor__AskUserQuestion',
+      tool_use_id: 'tu-c1b',
+      tool_input: {
+        questions: [
+          { question: 'Pick one?', options: ['A', 'B'] },
+          { question: 'Pick several?', options: ['A', 'B', 'C'], multiSelect: true },
+        ],
+      },
+    }, undefined, CONDUCTOR);
+    expect(r.parsed?.hookSpecificOutput?.permissionDecision).toBe('defer');
   });
 
-  test('UNMARKED question (modal path) → deny with prose directive', () => {
+  test('MCP + OBJECT options → deny with a strings-only retry hint (object options render blank)', () => {
     const r = runHook({
       session_id: 'c2',
-      tool_name: 'AskUserQuestion',
+      tool_name: 'mcp__conductor__AskUserQuestion',
       tool_use_id: 'tu-c2',
       tool_input: {
         questions: [
-          { question: 'No marker — an ad-hoc question', options: ['A) Yes (recommended)', 'B) No'] },
+          { question: '<gstack-qid:test-q> Pick?', options: [{ label: 'A', description: 'x' }, { label: 'B' }] },
         ],
       },
     }, undefined, CONDUCTOR);
     expect(r.parsed?.hookSpecificOutput?.permissionDecision).toBe('deny');
     expect(r.parsed?.hookSpecificOutput?.permissionDecisionReason).toContain('[conductor]');
+    expect(r.parsed?.hookSpecificOutput?.permissionDecisionReason).toMatch(/STRINGS/);
+  });
+
+  test('MCP + blank option → deny with the same strings-only retry hint', () => {
+    const r = runHook({
+      session_id: 'c2b',
+      tool_name: 'mcp__conductor__AskUserQuestion',
+      tool_use_id: 'tu-c2b',
+      tool_input: { questions: [{ question: 'Pick?', options: ['A', '   '] }] },
+    }, undefined, CONDUCTOR);
+    expect(r.parsed?.hookSpecificOutput?.permissionDecision).toBe('deny');
+    expect(r.parsed?.hookSpecificOutput?.permissionDecisionReason).toMatch(/non-empty.*STRINGS/);
+  });
+
+  test('MCP rejects more than four questions with a deterministic retry', () => {
+    const r = runHook({
+      session_id: 'c2c',
+      tool_name: 'mcp__conductor__AskUserQuestion',
+      tool_use_id: 'tu-c2c',
+      tool_input: {
+        questions: Array.from({ length: 5 }, (_, i) => ({ question: `Q${i + 1}?`, options: ['A'] })),
+      },
+    }, undefined, CONDUCTOR);
+    expect(r.parsed?.hookSpecificOutput?.permissionDecision).toBe('deny');
+    expect(r.parsed?.hookSpecificOutput?.permissionDecisionReason).toMatch(/requires 1-4/);
+    expect(r.parsed?.hookSpecificOutput?.permissionDecisionReason).toMatch(/Retry once/);
+  });
+
+  test('MCP rejects an empty questions array', () => {
+    const r = runHook({
+      session_id: 'c2c-empty',
+      tool_name: 'mcp__conductor__AskUserQuestion',
+      tool_use_id: 'tu-c2c-empty',
+      tool_input: { questions: [] },
+    }, undefined, CONDUCTOR);
+    expect(r.parsed?.hookSpecificOutput?.permissionDecision).toBe('deny');
+    expect(r.parsed?.hookSpecificOutput?.permissionDecisionReason).toMatch(/requires 1-4/);
+  });
+
+  test('MCP rejects more than four options without dropping choices', () => {
+    const r = runHook({
+      session_id: 'c2d',
+      tool_name: 'mcp__conductor__AskUserQuestion',
+      tool_use_id: 'tu-c2d',
+      tool_input: { questions: [{ question: 'Pick?', options: ['A', 'B', 'C', 'D', 'E'] }] },
+    }, undefined, CONDUCTOR);
+    expect(r.parsed?.hookSpecificOutput?.permissionDecision).toBe('deny');
+    expect(r.parsed?.hookSpecificOutput?.permissionDecisionReason).toMatch(/at most 4 `options`/);
+    expect(r.parsed?.hookSpecificOutput?.permissionDecisionReason).toMatch(/Do NOT drop choices/);
+  });
+
+  test('MCP rejects an explicit Other option because Conductor supplies it', () => {
+    const r = runHook({
+      session_id: 'c2d-other',
+      tool_name: 'mcp__conductor__AskUserQuestion',
+      tool_use_id: 'tu-c2d-other',
+      tool_input: { questions: [{ question: 'Pick?', options: ['A) First', 'B) Other'] }] },
+    }, undefined, CONDUCTOR);
+    expect(r.parsed?.hookSpecificOutput?.permissionDecision).toBe('deny');
+    expect(r.parsed?.hookSpecificOutput?.permissionDecisionReason).toMatch(/adds it automatically/);
   });
 
-  test('one-way door → deny with prose directive (NOT defer — destructive must reach human via prose)', () => {
+  test('another host MCP variant is not forced into the Conductor payload shape', () => {
+    const r = runHook({
+      session_id: 'c2e',
+      tool_name: 'mcp__another_host__AskUserQuestion',
+      tool_use_id: 'tu-c2e',
+      tool_input: { questions: [{ question: 'Pick?', options: [{ label: 'A' }] }] },
+    }, undefined, CONDUCTOR);
+    expect(r.parsed?.hookSpecificOutput?.permissionDecision).toBe('defer');
+  });
+
+  test('native AskUserQuestion in Conductor → deny + redirect to the MCP variant', () => {
     const r = runHook({
       session_id: 'c3',
       tool_name: 'AskUserQuestion',
       tool_use_id: 'tu-c3',
+      tool_input: {
+        questions: [
+          { question: '<gstack-qid:test-q> Need approval?', options: ['A) Yes (recommended)', 'B) No'] },
+        ],
+      },
+    }, undefined, CONDUCTOR);
+    expect(r.parsed?.hookSpecificOutput?.permissionDecision).toBe('deny');
+    expect(r.parsed?.hookSpecificOutput?.permissionDecisionReason).toContain('[conductor]');
+    expect(r.parsed?.hookSpecificOutput?.permissionDecisionReason).toContain('mcp__conductor__AskUserQuestion');
+    expect(r.parsed?.hookSpecificOutput?.permissionDecisionReason).not.toMatch(/reply with a letter/i);
+  });
+
+  test('native one-way door in Conductor → still redirect to MCP (not prose)', () => {
+    const r = runHook({
+      session_id: 'c3b',
+      tool_name: 'AskUserQuestion',
+      tool_use_id: 'tu-c3b',
       tool_input: {
         questions: [
           {
@@ -399,11 +501,10 @@ describe('Conductor prose redirect', () => {
       },
     }, undefined, CONDUCTOR);
     expect(r.parsed?.hookSpecificOutput?.permissionDecision).toBe('deny');
-    expect(r.parsed?.hookSpecificOutput?.permissionDecisionReason).toContain('[conductor]');
-    expect(r.parsed?.hookSpecificOutput?.permissionDecisionReason).toMatch(/typed confirmation/i);
+    expect(r.parsed?.hookSpecificOutput?.permissionDecisionReason).toContain('mcp__conductor__AskUserQuestion');
   });
 
-  test('CONDUCTOR_WORKSPACE_PATH alone also triggers the redirect', () => {
+  test('CONDUCTOR_WORKSPACE_PATH alone also routes (MCP + strings → defer)', () => {
     const r = runHook({
       session_id: 'c4',
       tool_name: 'mcp__conductor__AskUserQuestion',
@@ -412,11 +513,10 @@ describe('Conductor prose redirect', () => {
         questions: [{ question: '<gstack-qid:test-q> Pick?', options: ['A) X (recommended)', 'B) Y'] }],
       },
     }, undefined, { CONDUCTOR_WORKSPACE_PATH: '/Users/x/conductor/ws' });
-    expect(r.parsed?.hookSpecificOutput?.permissionDecision).toBe('deny');
-    expect(r.parsed?.hookSpecificOutput?.permissionDecisionReason).toContain('[conductor]');
+    expect(r.parsed?.hookSpecificOutput?.permissionDecision).toBe('defer');
   });
 
-  test('PRECEDENCE: full never-ask auto-decide still wins over Conductor prose', () => {
+  test('PRECEDENCE: full never-ask auto-decide still wins over Conductor routing', () => {
     writeProjectPref('ship-pre-landing-review-fix', 'never-ask');
     const r = runHook({
       session_id: 'c5',
@@ -432,12 +532,12 @@ describe('Conductor prose redirect', () => {
       },
     }, undefined, CONDUCTOR);
     expect(r.parsed?.hookSpecificOutput?.permissionDecision).toBe('deny');
-    // auto-decide reason, NOT the conductor prose reason
+    // auto-decide reason, NOT the conductor routing reason
     expect(r.parsed?.hookSpecificOutput?.permissionDecisionReason).toContain('plan-tune auto-decide');
     expect(r.parsed?.hookSpecificOutput?.permissionDecisionReason).not.toContain('[conductor]');
   });
 
-  test('non-AUQ tool in Conductor → still defer (no redirect on unrelated tools)', () => {
+  test('non-AUQ tool in Conductor → still defer (no routing on unrelated tools)', () => {
     const r = runHook(
       { session_id: 'c6', tool_name: 'Bash', tool_use_id: 'tu-c6', tool_input: {} },
       undefined,
diff --git a/test/resolver-ask-user-format.test.ts b/test/resolver-ask-user-format.test.ts
index 0b498af0a0..e26d38ec73 100644
--- a/test/resolver-ask-user-format.test.ts
+++ b/test/resolver-ask-user-format.test.ts
@@ -178,10 +178,18 @@ describe('generateAskUserFormat — runtime-failure prose fallback', () => {
     expect(out).toMatch(/Do NOT[\s\S]{0,40}fall back to prose|never prose/i);
   });
 
-  test('retries the errored call exactly once before degrading', () => {
-    expect(out).toMatch(/retry the SAME call \*\*once\*\*|retry the same call.*once/i);
-    // idempotency guard against double-prompting
-    expect(out).toMatch(/double-prompt|no answer could have surfaced/i);
+  test('retries only the three explicit retryable Conductor errors, exactly once', () => {
+    expect(out).toMatch(/Retry the SAME call exactly \*\*once\*\*/i);
+    expect(out).toContain('CONDUCTOR_ASK_USER_QUESTION_DELIVERY_FAILED');
+    expect(out).toContain('CONDUCTOR_ASK_USER_QUESTION_MALFORMED_ANSWERS');
+    expect(out).toContain('CONDUCTOR_ASK_USER_QUESTION_ANSWER_COUNT_MISMATCH');
+    expect(out).toMatch(/SESSION_UNAVAILABLE[\s\S]{0,160}Do not retry/i);
+  });
+
+  test('success, cancellation, and SDK placeholder never duplicate the question', () => {
+    expect(out).toMatch(/User responses:[\s\S]{0,180}resume the workflow exactly once/i);
+    expect(out).toMatch(/USER_CANCELLED[\s\S]{0,120}Do NOT retry/i);
+    expect(out).toMatch(/Tool result missing due to internal error[\s\S]{0,240}do NOT emit prose/i);
   });
 
   test('branches on SESSION_KIND: spawned / headless / interactive', () => {
@@ -225,22 +233,26 @@ describe('generateAskUserFormat — runtime-failure prose fallback', () => {
     expect(out).toMatch(/must be sent as tool_use, not prose — unless the documented failure fallback/);
   });
 
-  test('OV2: the self-check "not writing prose" line carries the Conductor + fallback qualifiers', () => {
-    // After the Conductor-default-prose change, the exception is two-pronged:
-    // CONDUCTOR_SESSION makes prose the default, OR the documented failure fallback.
-    expect(out).toMatch(/not writing prose — unless `CONDUCTOR_SESSION: true`[\s\S]*OR the documented failure fallback applies/);
+  test('OV2: the self-check "not writing prose" line carries the fallback qualifier', () => {
+    expect(out).toMatch(/not writing prose — unless the documented failure fallback applies/);
   });
 
-  // Conductor-default-prose contract (the proactive path, distinct from the
-  // failure fallback). Guards the Tool-resolution rule + self-check wording.
-  test('Conductor: do-not-call rule present in Tool resolution', () => {
-    expect(out).toMatch(/CONDUCTOR_SESSION: true/);
-    expect(out).toMatch(/do NOT call AskUserQuestion at all/);
-    expect(out).toMatch(/Auto-decide preferences still apply first/);
-    expect(out).toMatch(/gstack-question-log/);
+  // Conductor clickable-question contract (reverses the #2004 prose-suppression):
+  // route to the MCP variant with STRING options; do NOT default to prose.
+  test('Conductor: route to the MCP clickable variant with string options', () => {
+    expect(out).toMatch(/prefer the MCP variant/i);
+    expect(out).toMatch(/mcp__conductor__AskUserQuestion/);
+    expect(out).toMatch(/renders clickable questions and works/);
+    expect(out).toMatch(/array of plain \*\*strings\*\*/);
+    expect(out).toMatch(/does \*\*NOT\*\* accept `\{label, description\}`/);
+    expect(out).toMatch(/Do NOT render prose instead/);
+    expect(out).toMatch(/Auto-decide applies first/);
+    expect(out).toMatch(/send 1-4 `questions`/i);
+    expect(out).toContain('options: string[<=4]');
+    expect(out).toMatch(/Do not include an `Other` option; Conductor adds it automatically/);
   });
 
-  test('Conductor: one-way prose rule + continuation protocol present', () => {
+  test('fallback: one-way prose rule + continuation protocol present', () => {
     expect(out).toMatch(/one-way\b[\s\S]*typed confirmation/i);
     expect(out).toMatch(/never proceed on a vague/i);
     expect(out).toMatch(/Continuation — mapping a typed reply/);
diff --git a/test/skill-e2e-conductor-prose.test.ts b/test/skill-e2e-auq-unavailable-fallback.test.ts
similarity index 50%
rename from test/skill-e2e-conductor-prose.test.ts
rename to test/skill-e2e-auq-unavailable-fallback.test.ts
index a130dcab50..db5ce21e0f 100644
--- a/test/skill-e2e-conductor-prose.test.ts
+++ b/test/skill-e2e-auq-unavailable-fallback.test.ts
@@ -1,21 +1,14 @@
 /**
- * Conductor → prose decision brief (periodic-tier, paid, real-PTY).
+ * AskUserQuestion unavailable → prose decision brief (periodic, paid, real PTY).
  *
- * Proves the end-to-end behavior: when CONDUCTOR_SESSION is signalled, a skill
- * that hits a decision renders a PROSE decision brief and waits, instead of
+ * Proves the end-to-end fallback: when no AskUserQuestion tool can be called, a
+ * skill that reaches a decision renders a prose brief and waits instead of
  * silently skipping the user.
  *
- * SCOPE — read before trusting this as the Conductor guard. This is END-TO-END
- * BEHAVIOR coverage, NOT the discriminating Conductor guarantee:
- *   - The deterministic guard is test/question-preference-hook.test.ts
- *     ("Conductor prose redirect") — it sets process.env.CONDUCTOR_* and asserts
- *     the PreToolUse hook denies + redirects. That test CAN fail on unfixed code.
- *   - The PTY harness here cannot register `mcp__conductor__AskUserQuestion`, so
- *     it tests "native AUQ unavailable + Conductor signal → prose," NOT "the MCP
- *     variant exists and must not be called" (Codex #10). Under --disallowedTools
- *     a present-human interactive session already prose-falls-back, so this test
- *     is a smoke check that the Conductor path still produces a prose brief, not
- *     a proof that the Conductor signal (vs the generic fallback) drove it.
+ * This harness intentionally does not set any Conductor environment variable or
+ * register a host MCP variant. Conductor routing is covered deterministically by
+ * question-preference-hook.test.ts; this test covers only the genuine
+ * unavailable-tool fallback.
  *
  * Periodic tier: model-behavior, non-deterministic.
  */
@@ -37,14 +30,13 @@ Adds a Stripe tier, a React pricing page, a Postgres entitlements table, and a
 Redis cache. The team "feels like" it should be cheaper; no developer was asked.
 `;
 
-describeE2E('Conductor renders decisions as prose (periodic)', () => {
-  test('plan-eng-review in a Conductor session surfaces a PROSE decision brief, not a silent skip', async () => {
+describeE2E('AskUserQuestion unavailable fallback (periodic)', () => {
+  test('plan-eng-review surfaces a prose decision brief instead of silently skipping', async () => {
     const obs = await runPlanSkillObservation({
       skillName: 'plan-eng-review',
       inPlanMode: true,
-      // Mimic Conductor: native AUQ disabled + the Conductor env signal present.
+      // No host MCP is registered in the PTY harness; disable the native tool too.
       extraArgs: ['--disallowedTools', 'AskUserQuestion'],
-      env: { CONDUCTOR_WORKSPACE_PATH: '/tmp/conductor-prose-e2e' },
       initialPlanContent: FLAWED_PLAN,
       timeoutMs: 300_000,
     });
@@ -53,13 +45,13 @@ describeE2E('Conductor renders decisions as prose (periodic)', () => {
     // to the plan without asking) is the precise failure we guard against.
     if (obs.outcome === 'silent_write') {
       throw new Error(
-        `Conductor prose regression: skill wrote findings without surfacing a decision.\n` +
+        `Unavailable-tool fallback regression: skill wrote findings without surfacing a decision.\n` +
           `summary: ${obs.summary}\n--- evidence ---\n${obs.evidence}`,
       );
     }
     if (obs.outcome === 'exited' || obs.outcome === 'timeout') {
       throw new Error(
-        `Conductor prose test inconclusive: outcome=${obs.outcome}\n` +
+        `Unavailable-tool fallback test inconclusive: outcome=${obs.outcome}\n` +
           `summary: ${obs.summary}\n--- evidence ---\n${obs.evidence}`,
       );
     }
diff --git a/test/skill-e2e-auto-decide-preserved.test.ts b/test/skill-e2e-auto-decide-preserved.test.ts
index 7e74d8438d..a52cdeb387 100644
--- a/test/skill-e2e-auto-decide-preserved.test.ts
+++ b/test/skill-e2e-auto-decide-preserved.test.ts
@@ -105,8 +105,8 @@ describeE2E('AUTO_DECIDE opt-in preserved under Conductor flags (periodic)', ()
       //    never sees the never-ask preference, and the test silently exercises
       //    the wrong state root (pre-existing bug, Codex #9 / Issue 13).
       //    CONDUCTOR_WORKSPACE_PATH additionally proves auto-decide still WINS
-      //    over the Conductor prose redirect (precedence: settled preference
-      //    beats transport-avoidance).
+      //    over the Conductor MCP redirect (precedence: settled preference
+      //    beats host routing).
       const obs = await runPlanSkillObservation({
         skillName: 'plan-ceo-review',
         inPlanMode: true,

From 5242b9c3fec7fc610dcffaf3ad3a5a3848ab97c9 Mon Sep 17 00:00:00 2001
From: danielplant <daniel@plantdynamics.co>
Date: Wed, 5 Aug 2026 19:24:15 -0400
Subject: [PATCH 2/4] chore: release v1.60.2.0

---
 CHANGELOG.md | 40 ++++++++++++++++++++++++++++++++++------
 VERSION      |  2 +-
 package.json |  2 +-
 3 files changed, 36 insertions(+), 8 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 351e7cabde..b156caeff7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,34 @@
 # Changelog
 
+## [1.60.2.0] - 2026-08-05
+
+## **Conductor decisions are clickable popups again.**
+
+gstack now routes questions through Conductor's working host tool instead of
+blocking it and replacing the decision with a long reply-by-letter message. A
+successful choice resumes the skill once, cancellation stays cancelled, and
+prose appears only when a genuine transport failure cannot be recovered.
+
+### Fixed
+
+- Conductor sessions prefer `mcp__conductor__AskUserQuestion`, redirect native
+  calls to that host tool, and validate its string-option contract before the
+  popup renders. Auto-decisions still run first, while destructive and one-way
+  decisions still require a person.
+- Retry behavior now distinguishes completed responses, cancellation, the
+  Claude SDK's ambiguous missing-result placeholder, retryable delivery/answer
+  errors, and non-retryable session failures. The same question retries at most
+  once even if JSON key order changes.
+- Upgrades normalize duplicate AskUserQuestion hooks left behind when Claude
+  removed gstack's source tags, preserving unrelated hooks and taking a backup
+  before changing `settings.json`.
+
+### Changed
+
+- Generated skill guidance documents the host-MCP string payload and keeps
+  prose as an unavailable-tool or exhausted-transport fallback. The old
+  Conductor-prose E2E now tests that genuine fallback instead.
+
 ## [1.60.1.0] - 2026-07-09
 
 ## **The /autoplan dual-voice eval is back on the board, catching real regressions.**
@@ -240,12 +269,11 @@ real `~/.claude` in the loop.
   scripts: detached, SIGTERM-proof, `caffeinate`-wrapped eval runs with a machine-wide
   lock, per-run logs under `~/.gstack-dev/eval-runs/`, a watchdog, and an `EXIT=`
   sentinel.
-- **Conductor prose AskUserQuestion**: when a Conductor session is detected, every
-  decision renders as a prose brief (labeled question, recommendation, per-option
-  completeness, reply-with-a-letter), enforced by a PreToolUse hook that denies the
-  tool and redirects. Auto-decide preferences still apply first; destructive
-  confirmations require an explicit typed answer. Installed for Conductor even in
-  non-interactive setup, with an upgrade migration for existing installs.
+- **Historical AskUserQuestion workaround (superseded in v1.60.2.0)**: v1.58
+  temporarily bypassed Conductor's host question tool and rendered decision briefs
+  in chat. Auto-decide preferences still applied first, and destructive confirmations
+  required an explicit typed answer. The later popup restoration replaces this
+  workaround while retaining its safety gates.
 
 #### Changed
 - All five E2E runners (`session-runner`, `claude-pty-runner`, `agent-sdk-runner`,
diff --git a/VERSION b/VERSION
index c4190e0048..762f175545 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.60.1.0
+1.60.2.0
diff --git a/package.json b/package.json
index 846438a603..78b98a86f1 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "gstack",
-  "version": "1.60.1.0",
+  "version": "1.60.2.0",
   "description": "Garry's Stack — Claude Code skills + fast headless browser. One repo, one install, entire AI engineering workflow.",
   "license": "MIT",
   "type": "module",

From d298e586f1983cecf68b3e098a5e3c1e9353359d Mon Sep 17 00:00:00 2001
From: danielplant <daniel@plantdynamics.co>
Date: Wed, 5 Aug 2026 19:39:55 -0400
Subject: [PATCH 3/4] fix: preserve noninteractive and migration retry
 semantics

---
 CHANGELOG.md                                  |  3 +-
 gstack-upgrade/migrations/v1.60.2.0.sh        |  3 +-
 .../claude/hooks/question-preference-hook.ts  | 53 +++++++++++++++++--
 setup                                         | 14 +++--
 ...gstack-upgrade-migration-v1_60_2_0.test.ts | 21 ++++++++
 test/question-preference-hook.test.ts         | 46 +++++++++++++++-
 6 files changed, 129 insertions(+), 11 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b156caeff7..91e8f06b98 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -21,7 +21,8 @@ prose appears only when a genuine transport failure cannot be recovered.
   once even if JSON key order changes.
 - Upgrades normalize duplicate AskUserQuestion hooks left behind when Claude
   removed gstack's source tags, preserving unrelated hooks and taking a backup
-  before changing `settings.json`.
+  before changing `settings.json`. A failed normalization leaves the prior setup
+  version in place so the next setup run retries it.
 
 ### Changed
 
diff --git a/gstack-upgrade/migrations/v1.60.2.0.sh b/gstack-upgrade/migrations/v1.60.2.0.sh
index da9006ee67..8277ccf702 100755
--- a/gstack-upgrade/migrations/v1.60.2.0.sh
+++ b/gstack-upgrade/migrations/v1.60.2.0.sh
@@ -51,7 +51,7 @@ fi
 for executable in "${SETTINGS_HOOK}" "${PREF_HOOK}" "${LOG_HOOK}" "${FALLBACK_HOOK}"; do
   if [ ! -x "${executable}" ]; then
     echo "  [v1.60.2.0] WARN: missing executable ${executable}; migration will retry later." >&2
-    exit 0
+    exit 1
   fi
 done
 
@@ -80,6 +80,7 @@ if [ "${_OK}" -eq 1 ]; then
   echo "  [v1.60.2.0] AskUserQuestion hooks normalized for clickable host popups." >&2
 else
   echo "  [v1.60.2.0] WARN: hook normalization was incomplete; migration will retry later." >&2
+  exit 1
 fi
 
 exit 0
diff --git a/hosts/claude/hooks/question-preference-hook.ts b/hosts/claude/hooks/question-preference-hook.ts
index 878baff72e..bf8c41f4cb 100644
--- a/hosts/claude/hooks/question-preference-hook.ts
+++ b/hosts/claude/hooks/question-preference-hook.ts
@@ -290,6 +290,28 @@ function slugFromCwd(cwd: string | undefined): string {
   return path.basename(cwd);
 }
 
+type SessionKind = 'spawned' | 'headless' | 'interactive';
+
+/** Use the same authoritative classifier emitted by the generated preamble.
+ * Any classifier failure degrades to interactive so a real person is never
+ * incorrectly blocked by a hook-local detection error. */
+function sessionKind(cwd?: string): SessionKind {
+  try {
+    const here = path.dirname(new URL(import.meta.url).pathname);
+    const bin = path.resolve(here, '..', '..', '..', 'bin', 'gstack-session-kind');
+    const res = spawnSync(bin, [], {
+      encoding: 'utf-8',
+      timeout: 3000,
+      cwd: cwd && fs.existsSync(cwd) ? cwd : undefined,
+    });
+    const out = (res.stdout || '').trim();
+    if (out === 'spawned' || out === 'headless' || out === 'interactive') return out;
+  } catch (e) {
+    logHookError(`sessionKind failed: ${(e as Error).message}`);
+  }
+  return 'interactive';
+}
+
 function markAutoDecided(sessionId: string | undefined, toolUseId: string | undefined): void {
   if (!sessionId || !toolUseId) return;
   try {
@@ -455,6 +477,33 @@ async function main(): Promise<void> {
   // disabled by Conductor's launch flags, so redirect
   // native calls to the MCP variant; let well-formed MCP calls through to render.
   if (isConductor()) {
+    // A Conductor environment marker can also be present in SDK evals and
+    // orchestrator-spawned sessions. Those sessions have no person waiting for
+    // a popup, so honor the shared session classifier before routing either the
+    // native tool or Conductor's MCP variant. Other host MCP variants retain
+    // their own contracts and pass through untouched.
+    if (
+      toolName !== 'AskUserQuestion' &&
+      toolName !== 'mcp__conductor__AskUserQuestion'
+    ) {
+      defer(memoryContext);
+      return;
+    }
+    const kind = sessionKind(stdin.cwd);
+    if (kind === 'headless') {
+      deny(
+        '[headless] BLOCKED — AskUserQuestion unavailable. This Conductor session is explicitly ' +
+        'headless, so no human can answer. Stop and wait; do not retry or fall back to prose.',
+      );
+      return;
+    }
+    if (kind === 'spawned') {
+      deny(
+        '[spawned] AskUserQuestion is unavailable in an orchestrator-spawned Conductor session. ' +
+        'Auto-choose the recommended option per the Spawned session block; do not emit prose and do not block.',
+      );
+      return;
+    }
     if (toolName === 'AskUserQuestion') {
       deny(
         '[conductor] Native AskUserQuestion is disabled in Conductor (--disallowedTools). ' +
@@ -467,10 +516,6 @@ async function main(): Promise<void> {
       );
       return;
     }
-    if (toolName !== 'mcp__conductor__AskUserQuestion') {
-      defer(memoryContext);
-      return;
-    }
     if (questions.length < 1 || questions.length > 4) {
       deny(
         '[conductor] mcp__conductor__AskUserQuestion requires 1-4 `questions` per call. ' +
diff --git a/setup b/setup
index c0f98ac9c3..6cf3830d0a 100755
--- a/setup
+++ b/setup
@@ -1206,25 +1206,31 @@ fi
 MIGRATIONS_DIR="$SOURCE_GSTACK_DIR/gstack-upgrade/migrations"
 CURRENT_VERSION=$(cat "$SOURCE_GSTACK_DIR/VERSION" 2>/dev/null || echo "unknown")
 LAST_SETUP_VERSION=$(cat "$HOME/.gstack/.last-setup-version" 2>/dev/null || echo "0.0.0.0")
+MIGRATIONS_OK=1
 if [ -d "$MIGRATIONS_DIR" ] && [ "$CURRENT_VERSION" != "unknown" ] && [ "$LAST_SETUP_VERSION" != "$CURRENT_VERSION" ]; then
   # Fresh install (no marker file) — skip migrations, just write marker
   if [ ! -f "$HOME/.gstack/.last-setup-version" ]; then
     : # fall through to marker write below
   else
-    find "$MIGRATIONS_DIR" -maxdepth 1 -name 'v*.sh' -type f 2>/dev/null | sort -V | while IFS= read -r migration; do
+    while IFS= read -r migration; do
       m_ver="$(basename "$migration" .sh | sed 's/^v//')"
       # Run if migration is newer than last setup version AND not newer than current version
       if [ "$(printf '%s\n%s' "$LAST_SETUP_VERSION" "$m_ver" | sort -V | head -1)" = "$LAST_SETUP_VERSION" ] && [ "$LAST_SETUP_VERSION" != "$m_ver" ] \
          && [ "$(printf '%s\n%s' "$m_ver" "$CURRENT_VERSION" | sort -V | tail -1)" = "$CURRENT_VERSION" ]; then
         echo "  running migration $m_ver..."
-        bash "$migration" || echo "  warning: migration $m_ver had errors (non-fatal)"
+        if ! bash "$migration"; then
+          echo "  warning: migration $m_ver had errors; setup will retry it next time"
+          MIGRATIONS_OK=0
+        fi
       fi
-    done
+    done < <(find "$MIGRATIONS_DIR" -maxdepth 1 -name 'v*.sh' -type f 2>/dev/null | sort -V)
   fi
 fi
 mkdir -p "$HOME/.gstack"
-if [ "$CURRENT_VERSION" != "unknown" ]; then
+if [ "$CURRENT_VERSION" != "unknown" ] && [ "$MIGRATIONS_OK" -eq 1 ]; then
   echo "$CURRENT_VERSION" > "$HOME/.gstack/.last-setup-version"
+elif [ "$MIGRATIONS_OK" -ne 1 ]; then
+  echo "  warning: retaining setup version $LAST_SETUP_VERSION until migrations succeed"
 fi
 
 # 9. First-time welcome + legacy cleanup
diff --git a/test/gstack-upgrade-migration-v1_60_2_0.test.ts b/test/gstack-upgrade-migration-v1_60_2_0.test.ts
index 774be91d5a..97a9f89426 100644
--- a/test/gstack-upgrade-migration-v1_60_2_0.test.ts
+++ b/test/gstack-upgrade-migration-v1_60_2_0.test.ts
@@ -6,6 +6,7 @@ import * as path from 'path';
 
 const ROOT = path.resolve(import.meta.dir, '..');
 const MIGRATION = path.join(ROOT, 'gstack-upgrade', 'migrations', 'v1.60.2.0.sh');
+const SETUP = path.join(ROOT, 'setup');
 const MATCHER = '(AskUserQuestion|mcp__.*__AskUserQuestion)';
 const PREF = path.join(ROOT, 'hosts', 'claude', 'hooks', 'question-preference-hook');
 const LOG = path.join(ROOT, 'hosts', 'claude', 'hooks', 'question-log-hook');
@@ -127,4 +128,24 @@ describe('v1.60.2.0 AskUserQuestion hook migration', () => {
       .filter((file) => file.startsWith('settings.json.bak.')).length;
     expect(backupsAfterSecond).toBe(backupsAfterFirst);
   });
+
+  test('normalization failure exits nonzero and remains retryable', () => {
+    const failed = run({ CONDUCTOR_PORT: '55070', PATH: '/usr/bin:/bin' });
+    expect(failed.status).not.toBe(0);
+    expect(failed.stderr).toContain('migration will retry later');
+    expect(fs.existsSync(path.join(home, '.gstack', '.migrations', 'v1.60.2.0.done'))).toBe(false);
+
+    fs.writeFileSync(settingsFile, JSON.stringify({ hooks: {} }));
+    const retried = run({ CONDUCTOR_PORT: '55070' });
+    expect(retried.status).toBe(0);
+    expect(fs.existsSync(path.join(home, '.gstack', '.migrations', 'v1.60.2.0.done'))).toBe(true);
+  });
+
+  test('setup advances its version marker only after migrations succeed', () => {
+    const source = fs.readFileSync(SETUP, 'utf-8');
+    expect(source).toContain('MIGRATIONS_OK=1');
+    expect(source).toContain('MIGRATIONS_OK=0');
+    expect(source).toContain('[ "$CURRENT_VERSION" != "unknown" ] && [ "$MIGRATIONS_OK" -eq 1 ]');
+    expect(source).toContain('retaining setup version $LAST_SETUP_VERSION until migrations succeed');
+  });
 });
diff --git a/test/question-preference-hook.test.ts b/test/question-preference-hook.test.ts
index 36d602a536..d1fc969ca6 100644
--- a/test/question-preference-hook.test.ts
+++ b/test/question-preference-hook.test.ts
@@ -79,6 +79,8 @@ function runHook(stdin: object, cwd?: string, extraEnv?: Record<string, string>)
   // via extraEnv.
   delete env.CONDUCTOR_WORKSPACE_PATH;
   delete env.CONDUCTOR_PORT;
+  delete env.GSTACK_HEADLESS;
+  delete env.OPENCLAW_SESSION;
   env.GSTACK_QUESTION_LOG_NO_DERIVE = '1';
   if (extraEnv) Object.assign(env, extraEnv);
   const res = spawnSync(HOOK, [], {
@@ -384,6 +386,48 @@ describe('Conductor clickable-question routing', () => {
     expect(r.parsed?.hookSpecificOutput?.permissionDecision).toBe('defer');
   });
 
+  test('explicit headless mode blocks Conductor MCP before popup delivery', () => {
+    const r = runHook({
+      session_id: 'c1-headless-mcp',
+      tool_name: 'mcp__conductor__AskUserQuestion',
+      tool_use_id: 'tu-c1-headless-mcp',
+      tool_input: {
+        questions: [{ question: 'Pick?', options: ['A) Yes (recommended)', 'B) No'] }],
+      },
+    }, undefined, { ...CONDUCTOR, GSTACK_HEADLESS: '1' });
+    expect(r.parsed?.hookSpecificOutput?.permissionDecision).toBe('deny');
+    expect(r.parsed?.hookSpecificOutput?.permissionDecisionReason).toContain('[headless] BLOCKED');
+    expect(r.parsed?.hookSpecificOutput?.permissionDecisionReason).not.toContain('mcp__conductor__AskUserQuestion');
+  });
+
+  test('explicit headless mode blocks native AUQ instead of redirecting it', () => {
+    const r = runHook({
+      session_id: 'c1-headless-native',
+      tool_name: 'AskUserQuestion',
+      tool_use_id: 'tu-c1-headless-native',
+      tool_input: {
+        questions: [{ question: 'Pick?', options: ['A) Yes (recommended)', 'B) No'] }],
+      },
+    }, undefined, { ...CONDUCTOR, GSTACK_HEADLESS: '1' });
+    expect(r.parsed?.hookSpecificOutput?.permissionDecision).toBe('deny');
+    expect(r.parsed?.hookSpecificOutput?.permissionDecisionReason).toContain('[headless] BLOCKED');
+    expect(r.parsed?.hookSpecificOutput?.permissionDecisionReason).not.toContain('mcp__conductor__AskUserQuestion');
+  });
+
+  test('spawned Conductor session follows orchestrator auto-choice policy', () => {
+    const r = runHook({
+      session_id: 'c1-spawned',
+      tool_name: 'mcp__conductor__AskUserQuestion',
+      tool_use_id: 'tu-c1-spawned',
+      tool_input: {
+        questions: [{ question: 'Pick?', options: ['A) Yes (recommended)', 'B) No'] }],
+      },
+    }, undefined, { ...CONDUCTOR, OPENCLAW_SESSION: '1' });
+    expect(r.parsed?.hookSpecificOutput?.permissionDecision).toBe('deny');
+    expect(r.parsed?.hookSpecificOutput?.permissionDecisionReason).toContain('[spawned]');
+    expect(r.parsed?.hookSpecificOutput?.permissionDecisionReason).toMatch(/Auto-choose the recommended option/);
+  });
+
   test('MCP + OBJECT options → deny with a strings-only retry hint (object options render blank)', () => {
     const r = runHook({
       session_id: 'c2',
@@ -530,7 +574,7 @@ describe('Conductor clickable-question routing', () => {
           },
         ],
       },
-    }, undefined, CONDUCTOR);
+    }, undefined, { ...CONDUCTOR, GSTACK_HEADLESS: '1' });
     expect(r.parsed?.hookSpecificOutput?.permissionDecision).toBe('deny');
     // auto-decide reason, NOT the conductor routing reason
     expect(r.parsed?.hookSpecificOutput?.permissionDecisionReason).toContain('plan-tune auto-decide');

From f8760e5e4abaa063f29d5bc430bd6fd66bd6b432 Mon Sep 17 00:00:00 2001
From: danielplant <daniel@plantdynamics.co>
Date: Wed, 5 Aug 2026 19:52:16 -0400
Subject: [PATCH 4/4] fix: parse recommended Conductor option markers

---
 hosts/claude/hooks/question-preference-hook.ts | 12 ++++++++----
 test/question-preference-hook.test.ts          | 12 +++++++++---
 2 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/hosts/claude/hooks/question-preference-hook.ts b/hosts/claude/hooks/question-preference-hook.ts
index bf8c41f4cb..9ca2004d49 100644
--- a/hosts/claude/hooks/question-preference-hook.ts
+++ b/hosts/claude/hooks/question-preference-hook.ts
@@ -28,7 +28,7 @@
  *   swap to allow+updatedInput without changing the contract.
  *
  * Recommended-option extraction (per D2):
- *   - First: (recommended) label suffix on an option.
+ *   - First: (recommended) marker on an option (including before a tradeoff).
  *   - Fall back: "Recommendation: X" prose match against option labels.
  *   - Refuse to auto-decide if ambiguous (multiple labels OR no parseable
  *     recommendation): defer instead of silent-wrong.
@@ -58,7 +58,7 @@ interface HookStdin {
 }
 
 const MARKER_RE = /<gstack-qid:([a-z0-9-]{1,64})>/i;
-const RECOMMENDED_LABEL_RE = /\(recommended\)\s*$/i;
+const RECOMMENDED_MARKER_RE = /\(recommended\)/i;
 
 function stateRoot(): string {
   return (
@@ -264,9 +264,13 @@ function extractRecommended(
   questionText: string,
   opts: string[],
 ): { recommended: string | undefined; ambiguous: boolean } {
-  const labelMatches = opts.filter((o) => RECOMMENDED_LABEL_RE.test(o));
+  const labelMatches = opts.filter((o) => RECOMMENDED_MARKER_RE.test(o));
   if (labelMatches.length === 1) {
-    return { recommended: labelMatches[0].replace(RECOMMENDED_LABEL_RE, '').trim(), ambiguous: false };
+    const recommended = labelMatches[0]
+      .replace(RECOMMENDED_MARKER_RE, '')
+      .replace(/\s{2,}/g, ' ')
+      .trim();
+    return { recommended, ambiguous: false };
   }
   if (labelMatches.length > 1) return { recommended: undefined, ambiguous: true };
 
diff --git a/test/question-preference-hook.test.ts b/test/question-preference-hook.test.ts
index d1fc969ca6..553a249325 100644
--- a/test/question-preference-hook.test.ts
+++ b/test/question-preference-hook.test.ts
@@ -185,7 +185,7 @@ describe('defers (no enforcement)', () => {
 // ----------------------------------------------------------------------
 
 describe('enforces never-ask preferences', () => {
-  test('marker + never-ask + two-way + clean recommendation → deny', () => {
+  test('marker + never-ask + recommendation before tradeoff → deny', () => {
     writeProjectPref('ship-pre-landing-review-fix', 'never-ask');
     const r = runHook({
       session_id: 's5',
@@ -196,7 +196,10 @@ describe('enforces never-ask preferences', () => {
           {
             question:
               '<gstack-qid:ship-pre-landing-review-fix> Pre-landing review flagged issue.',
-            options: ['A) Fix now (recommended)', 'B) Skip'],
+            options: [
+              'A) Fix now (recommended) — applies the complete correction',
+              'B) Skip — leaves the current behavior unchanged',
+            ],
           },
         ],
       },
@@ -570,7 +573,10 @@ describe('Conductor clickable-question routing', () => {
         questions: [
           {
             question: '<gstack-qid:ship-pre-landing-review-fix> Pre-landing review flagged issue.',
-            options: ['A) Fix now (recommended)', 'B) Skip'],
+            options: [
+              'A) Fix now (recommended) — applies the complete correction',
+              'B) Skip — leaves the current behavior unchanged',
+            ],
           },
         ],
       },