@manyoars/oars 0.5.4 → 0.5.5

package/dist/sessions/pool-command.js

@@ -5,22 +5,24 @@ import { mkdir, readdir, readFile, rm, writeFile } from 'node:fs/promises';
 import { dirname, join, resolve } from 'node:path';
 import { createInterface } from 'node:readline';
 import { emitOf } from '../telemetry/emit.js';
+import { JOIN_STEPS } from '../telemetry/words.js';
 import { CliError, exitCodeForProblem, ExitCode, unreachableError } from '../errors.js';
 import { compileAllow } from './allow.js';
 import { makeCoverage, readCoverageSetting, writeCoverageSetting } from './coverage.js';
 import { checkSession, exclusionPaths, lastWritten, loadTerms, transcriptFilesOf } from './exclusion.js';
 import { localNames, makeRedactor, REDACTION_VERSION, redactTranscript } from './redact.js';
 import { recordSend, recordWire, newTally, tallyBatch } from '../telemetry/wire.js';
-import { discardStale, FIELD_ROWS, fieldsOf, heldAcross, lockedAcross, rescanPulled, machineKeys, markShown, noteMachineKey, outboxFolder, partsOf, pulledAt, readPulled, readRemoved, removeBatchesExcept, removeBatchOf, staleBatches, unchangedBytes, writeBatch, writePulled, writeRemoved } from './pool-outbox.js';
+import { discardStale, FIELD_ROWS, fieldsOf, heldAcross, lockedAcross, namesHeldAcross, shownHashes, wasShown, rescanPulled, machineKeys, markShown, noteMachineKey, outboxFolder, partsOf, pulledAt, readPulled, readRemoved, removeBatchesExcept, removeBatchOf, staleBatches, unchangedBytes, writeBatch, writePulled, writeRemoved } from './pool-outbox.js';
 import { deriveConsequences } from './recall-consequence.js';
 import { readRecalls } from './recall-object.js';
 import { HARNESSES, hasEnded, ORG_SIZES, REPO_VISIBILITIES, SESSION_IDLE_HOURS, isBundleVersion, isHarness, parseSkeleton, recommendationsOf, sessionsOf, skeletonOf, unpinnedKid, VOCAB_VERSION, verifyBundle } from './pool-wire.js';
-import { carriedDeltas, heldDeltas, keptDeltas, markDeltasSent, placedOf, sentDeltas } from './pool-delta.js';
+import { keepCrewNumber } from './crew-mark.js';
+import { carriedDeltasByWindow, heldDeltas, keptDeltas, markDeltasSent, placedOf, sentDeltas } from './pool-delta.js';
 import { Masker, printed, TRANSPORT_HEADERS, waitWords } from './pool-print.js';
 import { rawAllowed, rawStale, sendsOf } from './pool-choices.js';
 import { heldRaw, rawParts, removeRawExcept, writeRaw } from './pool-raw.js';
 import { SendInterrupted, SendLockBusy, watchInterrupt, withSendLock } from './pool-send-lock.js';
-import { markSent, retirePulled, sentLog } from './pool-sent.js';
+import { markSent, retirePulled, sentHashes, sentLog } from './pool-sent.js';
 import { shellReader } from './projection.js';
 import { isVocabularyExpired, REGISTRY_MAX_AGE_DAYS, VOCAB_SNAPSHOT_DATE } from './public-vocabulary.js';
 import { contentHash, FIRST_ORDER_FAMILIES } from './read.js';
@@ -29,7 +31,7 @@ import { CAPTURE_VERSION, harnessOf as sessionHarness } from './schema.js';
 import { machineIdOf } from './machine-ids.js';
 import { machineOf } from './machine.js';
 import { scanCache } from './machine-scan-cache.js';
-import { loadStore, localSalt, readRedactDomains, readSkeletons, readState, updatePoolChoices } from './store.js';
+import { loadStore, paths, scanLog, localSalt, readRedactDomains, readSkeletons, readState, updatePoolChoices } from './store.js';
 import { runGit } from './survival.js';
 import { vocabulary } from './vocab-load.js';
 import { mkdirOwnerOnly, writeOwnerOnly } from './owner-only.js';
@@ -125,6 +127,8 @@ const TRY_AGAIN = 'Run the same command to try again.';
 const RETRY = `${NOT_MARKED} ${TRY_AGAIN}`;
 /** Said after a stop or a stall once the request carrying the batch had gone out: the pool may hold it even though nothing here saw the answer. */
 const MAY_HAVE_RECEIVED = 'The pool may already have received it.';
+/** How many sessions a build reads and writes at once: the most whose prompts and tools are in memory together. */
+const BUILD_CHUNK = 100;
 /** What `deposit` says after it writes the outbox: the covenant (the person's consent, docs/covenant 2.1) already lets the background sender send what is queued, with or without this command. A machine's batches are never sent by it. */
 const SENT_LATER = 'Nothing was sent yet. Once the covenant is accepted, oars sends what is queued automatically, in the background.';
 /**
@@ -227,15 +231,42 @@ const closedProof = (reply) => {
 ${proofLines(account, provedAt)}`;
     return new CliError(refused.message, refused.exitCode, LOGIN, { ...refused.problem, detail }, { account, provedAt });
 };
+/** A promise that rejects with the signal's reason once it aborts, so a wait can be raced against it, and the `dispose` that removes its listener once the wait has settled. */
+const abortion = (signal) => {
+    let dispose = () => undefined;
+    const promise = new Promise((_resolve, reject) => {
+        const why = () => (signal.reason instanceof Error ? signal.reason : new Error('aborted'));
+        const onAbort = () => { reject(why()); };
+        if (signal.aborted)
+            reject(why());
+        else {
+            signal.addEventListener('abort', onAbort, { once: true });
+            dispose = () => { signal.removeEventListener('abort', onAbort); };
+        }
+    });
+    return { promise, dispose };
+};
 /** Polls the pool until the person approves, and returns the pool's answer with the credential. Time is counted in the waits asked for, so a machine that slept through the code still gets one poll that says it expired. */
-const awaitCredential = async (deps, server, started, show) => {
+const awaitCredential = async (deps, server, started, show, signal) => {
     let { intervalMs } = started;
     let failures = 0;
     let lastFailure;
     for (let waited = 0; waited < started.expiresMs;) {
         // A failed poll (a network error or a 5xx) is the provider or the network having a bad minute, not the person's answer: wait longer each time, up to the cap, and ask again until the code's own expiry.
         const wait = Math.min(intervalMs * 2 ** failures, Math.max(intervalMs, MAX_BACKOFF_MS));
-        await deps.sleep(wait);
+        if (signal === undefined)
+            await deps.sleep(wait);
+        else {
+            const aborted = abortion(signal);
+            try {
+                await Promise.race([deps.sleep(wait), aborted.promise]);
+            }
+            finally {
+                aborted.dispose();
+            }
+        }
+        // A sleep that finished first still ends the poll once the signal has fired.
+        signal?.throwIfAborted();
         waited += wait;
         // `ask` rejects only with the unreachable failure of `send`.
         const [settled] = await Promise.allSettled([ask(deps, LOGIN, server, '/v1/login/poll', { body: { handle: started.handle }, show })]);
@@ -299,7 +330,7 @@ export const poolLogin = async (deps, options) => {
     await deps.openBrowser(started.verificationUrl).catch(() => {
         deps.io.stderr('Could not open a browser; open the link above yourself.\n');
     });
-    const reply = await awaitCredential(deps, server, started, show);
+    const reply = await awaitCredential(deps, server, started, show, options.signal);
     const signIn = signInOf(isObject(reply.body) ? { ...reply.body, server } : undefined);
     if (signIn === undefined)
         throw new CliError('The pool answered a sign-in with no account, token, or signing key.', ExitCode.UNEXPECTED, LOGIN);
@@ -378,8 +409,23 @@ export const OFFER_BEFORE = [
     'The covenant is the whole deal. Its full text is linked below. Read it before you type.',
 ];
 export const OFFER_AFTER = ['Accepted. Sending your batch now.', 'Run oars pool fetch --help for your first pool download.'];
+const readerOf = (deps, signal) => {
+    const lines = createInterface({ input: runtimeOf(deps).stdin, terminal: false, ...(signal === undefined ? {} : { signal }) });
+    const iterator = lines[Symbol.asyncIterator]();
+    return {
+        next: async () => {
+            const next = await iterator.next();
+            if (signal?.aborted === true)
+                throw signal.reason;
+            return next.done === true ? undefined : next.value;
+        },
+        close: () => {
+            lines.close();
+        },
+    };
+};
 /** A send stops here when the server is closed or wants a covenant accepted, before the batch is read for the last time. */
-const openCovenant = async (deps, server, token, accept, region, via, signal) => {
+const openCovenant = async (deps, server, token, accept, region, via, signal, offTerminal = () => Promise.resolve('run this command from one'), refuseAtTerminal = false, shared) => {
     const reply = await ask(deps, DEPOSIT, server, '/v1/covenant', { token }, via);
     if (reply.status !== 200 || !isObject(reply.body))
         throw refusal(DEPOSIT, reply);
@@ -394,47 +440,48 @@ const openCovenant = async (deps, server, token, accept, region, via, signal) =>
     if (accept !== undefined && accept !== version)
         throw usage(`--accept-covenant names covenant ${accept}, but the covenant of this pool is ${version}. Nothing was accepted.`, DEPOSIT);
     if (Reflect.get(reply.body, 'accepted') === true)
-        return;
+        return false;
     const notAccepted = (title) => new CliError(title, ExitCode.AUTH, DEPOSIT, { code: 'covenant_not_accepted', title, status: 403 });
     const screen = screenIn(reply.body);
     if (screen === undefined)
         throw notAccepted(`The pool has no text for covenant ${version} yet, so there is nothing to show and nothing can be accepted. Nothing was accepted.`);
     // Assent is a person typing the phrase the screen states. A flag or a script on stdin is not one, so off a terminal nothing is asked and nothing is accepted.
-    if (!isTerminal(deps)) {
-        throw notAccepted(`Covenant ${version} is not accepted for this account. Accepting it takes a person at a terminal who reads it and types its phrase: run this command from one. Nothing was accepted.`);
+    // A bulk send never shows the screen: a person reads and accepts through the one-batch command, so a terminal is refused the same way.
+    if (refuseAtTerminal || !isTerminal(deps)) {
+        throw notAccepted(`Covenant ${version} is not accepted for this account. Accepting it takes a person at a terminal who reads it and types its phrase: ${await offTerminal()}. Nothing was accepted.`);
     }
     deps.io.stderr(`${OFFER_BEFORE.join('\n')}\n`);
     deps.io.stderr(`\n${screen.text}\n\n> `);
     emitOf(deps)('covenant-shown', { version });
-    // One reader for both lines: a second one opened after the first closed would lose a line the first had already taken from a pipe.
-    // A stop signal (Ctrl-C, a closed terminal) closes the reader, so a read that is waiting for the person ends with the signal's reason instead of holding the process open.
-    const lines = createInterface({ input: runtimeOf(deps).stdin, terminal: false, ...(signal === undefined ? {} : { signal }) });
-    const iterator = lines[Symbol.asyncIterator]();
-    const nextLine = async () => {
-        const next = await iterator.next();
-        if (signal?.aborted === true)
-            throw signal.reason;
-        return next.done === true ? undefined : next.value;
-    };
+    // One reader for both lines: a second one opened after the first closed would lose a line the first had already taken from a pipe. A join passes its own, which also served the questions before this one.
+    const lines = shared ?? readerOf(deps, signal);
     let answered = region;
     try {
-        const typed = await nextLine();
+        const typed = await lines.next();
         if (typed?.trim() !== screen.phrase)
             throw notAccepted(`${typed === undefined ? 'No phrase was typed' : 'That was not the phrase'}. To accept covenant ${version}, type exactly: ${screen.phrase}. Nothing was accepted.`);
         if (region === undefined) {
             deps.io.stderr(`${REGION_QUESTION} > `);
-            answered = regionOf(await nextLine());
+            answered = regionOf(await lines.next());
         }
     }
     finally {
-        lines.close();
+        if (shared === undefined)
+            lines.close();
     }
     if (answered === undefined)
         throw notAccepted('Answer yes or no: are you in the EU, the EEA, or the UK? Nothing was accepted.');
     const body = { version, textSha256: createHash('sha256').update(screen.text).digest('hex'), input: 'typed', client: `oars/${deps.version}`, euEeaUk: answered };
     const accepted = await ask(deps, DEPOSIT, server, '/v1/covenant/accept', { token, body }, via);
-    if (accepted.status !== 200)
-        throw refusal(DEPOSIT, accepted);
+    if (accepted.status !== 200) {
+        const refused = refusal(DEPOSIT, accepted);
+        // A join keeps the answer to the region question for its reruns, so a mistyped yes would be refused again every time: name the way to correct it.
+        if (shared === undefined || refused.problem.code !== 'region_closed')
+            throw refused;
+        // A no that was refused on the request's origin is not a mistake to correct.
+        const title = answered === 'yes' ? `${refused.message} If you answered yes by mistake, run oars pool join --in-eu-eea-uk no to correct it.` : refused.message;
+        throw new CliError(title, refused.exitCode, DEPOSIT, { code: 'region_closed', title, status: 403 });
+    }
     deps.io.stderr(`${OFFER_AFTER.join('\n')}\n`);
     // A yes to the raw prompt belongs to the covenant it was given under, and a covenant can change what that prompt covers: accepting another version asks the raw question again.
     const reset = { done: false };
@@ -447,6 +494,7 @@ const openCovenant = async (deps, server, token, accept, region, via, signal) =>
     });
     if (reset.done)
         deps.io.stderr('Your earlier yes to the raw prompt was given under another covenant, so it no longer applies. Run oars pool raw to read the prompt and answer again.\n');
+    return true;
 };
 const screenIn = (body) => {
     const screen = Reflect.get(body, 'screen');
@@ -586,6 +634,137 @@ const sendBatch = async (deps, options) => {
         interrupt.stop();
     }
 };
+const reasonOf = (signal) => (signal?.reason instanceof Error ? signal.reason : new Error('Interrupted.'));
+export const sleeps = (ms, signal) => new Promise((resolve, reject) => {
+    // Ctrl-C during a wait ends it with the interrupt, instead of being ignored until the wait is over.
+    if (signal?.aborted === true) {
+        reject(reasonOf(signal));
+        return;
+    }
+    const abort = () => {
+        clearTimeout(timer);
+        reject(reasonOf(signal));
+    };
+    const timer = setTimeout(() => {
+        signal?.removeEventListener('abort', abort);
+        resolve();
+    }, ms);
+    signal?.addEventListener('abort', abort, { once: true });
+});
+const retrying = (via, pause, signal) => async (request) => {
+    for (let attempt = 1;; attempt += 1) {
+        const reply = await via(request);
+        if ((reply.status !== 429 && reply.status < 500) || attempt >= SEND_ATTEMPTS)
+            return reply;
+        const named = Number(reply.headers.get('retry-after'));
+        await pause(Number.isFinite(named) && named > 0 ? Math.min(named, 30) * 1000 : 1000 * 2 ** (attempt - 1), signal);
+    }
+};
+/** Batches between two progress lines of `--send-all`. */
+const PROGRESS_EVERY = 100;
+/**
+ * `deposit --send-all`: the lock and the covenant of `--send`, once, then every batch of the outbox in name order, one file read at a time. A batch whose hash `sent.log` holds is not sent again, which is what makes a rerun send only what is left (the log is
+ * written after each batch, so a run that stops loses at most the one in flight, and the pool reads a batch sent again as the same deposit). A batch that `oars pool outbox` never printed, that changed on disk, or that a pulled-batch rule holds back is skipped and counted.
+ * The first batch that fails ends the run: the counts print, and the error goes up with its own exit code. Only counts and hashes print, never a session's content.
+ */
+const sendAll = async (deps, options) => {
+    const { outbox, server, token } = options;
+    const refuse = (code, title) => new CliError(title, ExitCode.CONFLICT, DEPOSIT, { code, title, status: 409 });
+    const interrupt = watchInterrupt();
+    const net = options.via ?? networkSender(deps, DEPOSIT, { stallMs: SEND_STALL_MS, signal: interrupt.signal });
+    const via = retrying(net, options.pause ?? sleeps, interrupt.signal);
+    try {
+        return await withSendLock(outbox, async () => {
+            const scan = await rescanPulled(outbox, await currentTerms(deps));
+            const done = await sentHashes(outbox);
+            const shown = await shownHashes(outbox);
+            // The one-batch command that shows the screen: the first batch that was shown and is not sent.
+            const oneBatch = async () => {
+                for await (const named of namesHeldAcross(outbox)) {
+                    if (shown.has(named.hash) && !done.has(named.hash) && !(named.pulled && !scan.open) && (await unchangedBytes(named.file, named.hash)) !== undefined)
+                        return `run oars pool deposit --send ${named.hash} at a terminal to read it and accept`;
+                }
+                return 'run oars pool deposit --send <hash> at a terminal to read it and accept';
+            };
+            await openCovenant(deps, server, token, options.acceptCovenant, options.region, via, interrupt.signal, oneBatch, true);
+            const tally = { sent: 0, skipped: 0, alreadySent: 0, failed: 0, left: 0 };
+            const handled = new Set();
+            const line = () => `${String(tally.sent)} sent, ${String(tally.skipped)} skipped, ${String(tally.alreadySent)} already sent, ${String(tally.failed)} failed, ${String(tally.left)} left`;
+            let ended;
+            try {
+                for await (const named of namesHeldAcross(outbox)) {
+                    handled.add(named.hash);
+                    if (done.has(named.hash)) {
+                        tally.alreadySent += 1;
+                    }
+                    else {
+                        // Read now, hashed again, and sent: the one batch in memory. A file that no longer hashes to its name is the "changed" case.
+                        const bytes = shown.has(named.hash) && !(named.pulled && !scan.open) ? await unchangedBytes(named.file, named.hash) : undefined;
+                        if (bytes === undefined) {
+                            tally.skipped += 1;
+                        }
+                        else {
+                            try {
+                                await postBatch(deps, { server, token, bytes, hash: named.hash, via });
+                            }
+                            catch (error) {
+                                tally.failed = 1;
+                                throw error;
+                            }
+                            await markSent(outbox, named.hash, deps.now());
+                            tally.sent += 1;
+                        }
+                    }
+                    const count = tally.sent + tally.skipped + tally.alreadySent;
+                    if (count % PROGRESS_EVERY === 0)
+                        deps.io.stderr(`${String(count)} batches handled: ${line()}.
+`);
+                }
+            }
+            catch (error) {
+                ended = { error };
+            }
+            // A pulled batch whose hash is in `sent.log` is done, however the run ended; an error of the loop wins over one of the retiring.
+            try {
+                await retirePulled(outbox, DEPOSIT);
+            }
+            catch (error) {
+                if (ended === undefined)
+                    throw error;
+            }
+            if (ended !== undefined) {
+                // Shown, not sent, not reached: counted by name alone, without reading a file. A batch a rerun would skip (never shown) is not left.
+                for await (const named of namesHeldAcross(outbox)) {
+                    if (!handled.has(named.hash) && !done.has(named.hash) && shown.has(named.hash) && !(named.pulled && !scan.open))
+                        tally.left += 1;
+                }
+                deps.io.stderr(`Stopped: ${line()}. Run the same command again to send what is left.
+`);
+                // The counts reach the --json failure document too, not only stderr.
+                if (ended.error instanceof CliError)
+                    throw new CliError(ended.error.message, ended.error.exitCode, ended.error.step, ended.error.problem, { ...ended.error.details, tally });
+                throw ended.error;
+            }
+            return { document: { ok: true, server, ...tally }, text: `Done: ${line()}.` };
+        }, options.lock?.times, options.lock?.fs, {
+            onWait: (waiting) => {
+                deps.io.stderr(`${waitingLine(waiting)}
+`);
+            },
+            signal: interrupt.signal,
+        });
+    }
+    catch (error) {
+        if (error instanceof SendLockBusy)
+            throw refuse('send_locked', busyLine(error.detail));
+        if (error instanceof SendInterrupted)
+            throw stopped(DEPOSIT, error, false);
+        throw error;
+    }
+    finally {
+        interrupt.stop();
+    }
+};
 /**
  * How long the pool gets to answer one request of a send (an interactive `--send` and the background sender) before the send ends. It is a deadline for the whole request, the upload and the answer together,
  * not an idle timeout: a batch is one session's skeleton, whose largest fixture is 887 KB (docs/pool.md), which a link of 240 kbit/s or better uploads inside 30 seconds. A slower link fails each try with the stall
@@ -698,14 +877,21 @@ export const poolDeposit = async (deps, options) => {
     const server = poolServer(deps.env, DEPOSIT, options.server);
     // A machine (`OARS_HOST_CLASS`, see machine.ts) builds at every Stop and sends nothing from here, so it signs nobody in: the account part of its batch key is its own name, and the holding route's `id` replaces it.
     const machine = machineOf(deps.env);
-    if (machine !== undefined && options.send !== undefined)
-        throw usage('A machine builds batches into its outbox and sends none: --send is for a signed-in person.', DEPOSIT);
+    if (options.send !== undefined && options.sendAll === true)
+        throw usage('--send and --send-all together: --send sends the one batch whose hash you name, and --send-all sends every batch that oars pool outbox printed. Use one. Nothing was sent.', DEPOSIT);
+    if (machine !== undefined && (options.send !== undefined || options.sendAll === true))
+        throw usage('A machine builds batches into its outbox and sends none: --send and --send-all are for a signed-in person.', DEPOSIT);
     const { account, token } = machine === undefined ? await signedIn(deps, runtime.storeDir, server, DEPOSIT) : { account: machineAccount(machine), token: '' };
     // A client past `registry_max_age` builds no batch (spec Section 1.3): its sessions wait in `A` and nothing is lost. This comes before anything is written or sent.
     const expired = vocabularyExpired(deps);
     if (expired !== undefined)
         throw expired;
     // Accepting the covenant is a step of sending a batch: alone it would exit 0 as though something had been sent under it.
+    const accepting = 'accept with oars pool deposit --send <hash>, which shows the covenant screen';
+    if (options.sendAll === true && options.acceptCovenant !== undefined)
+        throw usage(`--accept-covenant belongs to --send: --send-all never accepts a covenant, so ${accepting}. Nothing was accepted.`, DEPOSIT);
+    if (options.sendAll === true && options.inEuEeaUk !== undefined)
+        throw usage(`${REGION_FLAG} belongs to --send: --send-all never accepts a covenant, so ${accepting}. Nothing was accepted.`, DEPOSIT);
     if (options.send === undefined && options.acceptCovenant !== undefined)
         throw usage('--accept-covenant belongs to --send: it names the covenant version expected when a person accepts before a send. Nothing was accepted.', DEPOSIT);
     if (options.send === undefined && options.inEuEeaUk !== undefined)
@@ -715,6 +901,8 @@ export const poolDeposit = async (deps, options) => {
         throw usage(`${REGION_FLAG} takes yes or no, not "${options.inEuEeaUk}". Nothing was accepted.`, DEPOSIT);
     const outbox = outboxFolder(runtime.storeDir, server);
     await mkdirOwnerOnly(outbox);
+    if (options.sendAll === true)
+        return sendAll(deps, { outbox, server, token, acceptCovenant: options.acceptCovenant, region, via: options.via, lock: options.lock, pause: options.pause });
     if (options.send !== undefined)
         return sendBatch(deps, { outbox, server, token, hash: options.send, acceptCovenant: options.acceptCovenant, region, via: options.via, lock: options.lock });
     const { terms } = exclusionPaths(runtime.projectsRoot, deps.env);
@@ -740,6 +928,7 @@ export const poolDeposit = async (deps, options) => {
     const refusedFields = new Set();
     const roots = new Map((await readSkeletons(runtime.storeDir, undefined, true)).skeletons.map(({ session, merkleRoot, leaves }) => [session, { merkleRoot, leaves }]));
     // The sessions that pass both gates and have ended, in the order the store holds them: the windows of a delta are counted over these alone, and the batch of each is built after, once its deltas are known.
+    // Only the session records are held for the gates; a session's prompts and tools are read again when its window or its batch needs them (BUILD_CHUNK at a time), so the history is never in memory at once.
     const ready = [];
     // A session that fails a gate loses its earlier batch at once, so a later throw in this pass cannot leave one in the outbox.
     const withdraw = async (key) => {
@@ -748,7 +937,22 @@ export const poolDeposit = async (deps, options) => {
     };
     // The sessions a Stop does not name that still pass the read-only gates: they only fill the windows of a delta, and are never counted, withdrawn, or built.
     const history = [];
-    const localStore = await loadStore(runtime.storeDir);
+    // One scan of the log for the whole build: the head read and every chunk read take its revs, so a deposit reads the log's revs once, not once per chunk.
+    const { latest, spans, identity } = await scanLog(paths(runtime.storeDir).observations, undefined, true);
+    await runtime.afterScan?.();
+    const localStore = await loadStore(runtime.storeDir, undefined, { sessionsOnly: true, latest });
+    const childrenOf = new Map();
+    for (const agent of localStore.subagents) {
+        const parent = agent.parent ?? '';
+        const list = childrenOf.get(parent) ?? [];
+        list.push(agent.session);
+        childrenOf.set(parent, list);
+    }
+    // The full records of some sessions (and their subagents), read from the log with nothing else.
+    const readRecords = async (ids) => {
+        const store = await loadStore(runtime.storeDir, undefined, { latest, spans, identity, only: new Set([...ids].flatMap((id) => [id, ...(childrenOf.get(id) ?? [])])) });
+        return { store, records: new Map(sessionsOf(store, roots).map((records) => [records.main.session, records])) };
+    };
     // A damaged list stops the pass before anything is built: it must never read as "nothing was removed".
     const removedList = await readRemoved(outbox, DEPOSIT);
     const removedKeys = new Set(Object.keys(removedList));
@@ -810,50 +1014,56 @@ export const poolDeposit = async (deps, options) => {
     // A delta is built from the sessions that passed, carried by the batch of the session that filled its after window, and marked sent only once that batch is written: a deposit that stops first builds it again.
     // A cloud machine has no history of its own to compare a window against (every VM starts clean), so it carries none.
     const placed = machine?.hostClass === 'cloud' ? [] : [...ready.map(({ records }) => records), ...history].flatMap((records) => placedOf(records) ?? []);
-    const carried = carriedDeltas(account, placed, await sentDeltas(outbox));
+    const carried = await carriedDeltasByWindow(account, placed, await sentDeltas(outbox), async (ids) => (await readRecords(ids)).records, new Set(ready.map(({ records }) => records.main.session)));
     // The coverage bands (t871): the operator's two settings, read here, and the team band counted from the local git log. Nothing is looked up, and anything unread goes as unknown.
     const coverageOf = makeCoverage(runtime, await readCoverageSetting(runtime.storeDir), options.git ?? runGit);
     // The recommendations each session was shown or held back from, read from the local rows with their windows, so a shown row stays shown at the pool and a session with none sends none (the pool reads that as unknown).
-    const recalls = deriveConsequences(localStore, await readRecalls(runtime.storeDir));
-    for (const { records, key } of ready) {
-        const delta = carried.get(records.main.session);
-        // A machine builds the open session at every Stop and SessionEnd, so the one it names keeps what its own earlier batch carried and takes only what is new; any other deposit builds a session once.
-        const entries = machine !== undefined && options.session !== undefined ? keptDeltas(await heldDeltas(outbox, key), delta?.entries ?? []) : delta?.entries;
-        const skeleton = skeletonOf(records, key, shellReader(vocabulary()), contentHash, entries, gate, await coverageOf(records.main), recommendationsOf(recalls, records.main.session));
-        if (skeleton === null) {
-            counts.uncaptured += 1;
-            await withdraw(key);
-            continue;
-        }
-        const parsed = parseSkeleton(skeleton);
-        // The server reads a value outside its lists as `other` and keeps a field it does not know, so the parser no longer refuses either: the emitter is the privacy control, and a batch this client built holds neither.
-        const refusedAt = parsed.ok ? parsed.extensions[0]?.at : parsed.field;
-        if (!parsed.ok || refusedAt !== undefined) {
-            counts.refused += 1;
-            refusedFields.add(refusedAt ?? '');
-            await withdraw(key);
-            continue;
-        }
-        // Noted before the batch is written: a person's sweep that runs between the two lines would delete a batch it cannot yet tell is a machine's.
-        if (machine !== undefined)
-            await noteMachineKey(outbox, key);
-        builtBytes += (await writeBatch(outbox, key, parsed.skeleton)).bytes;
-        // The raw copy comes only after both gates and only with a yes to the raw prompt and a folder not at skeleton only: each transcript of the session, redacted here, before it is queued.
-        if (rawAllowed(saved.pool, records.main.project, covenant)) {
-            let place = 0;
-            for (const file of await transcriptFilesOf(runtime, records.main.project, records.main.session)) {
-                const redacted = redactTranscript(await readFile(file.path, 'utf8'), saved.redactDomains, names, injectedKey);
-                counts.raw.bytes += (await writeRaw(outbox, key, place, redacted.text)).bytes;
-                counts.raw.copies += 1;
-                counts.raw.masked += redacted.masked;
-                place += 1;
+    const recorded = await readRecalls(runtime.storeDir);
+    for (let from = 0; from < ready.length; from += BUILD_CHUNK) {
+        const chunk = ready.slice(from, from + BUILD_CHUNK);
+        const { store: chunkStore, records: full } = await readRecords(new Set(chunk.map(({ records }) => records.main.session)));
+        const recalls = deriveConsequences(chunkStore, recorded);
+        for (const { records: head, key } of chunk) {
+            const records = full.get(head.main.session);
+            const delta = carried.get(head.main.session);
+            // A machine builds the open session at every Stop and SessionEnd, so the one it names keeps what its own earlier batch carried and takes only what is new; any other deposit builds a session once.
+            const entries = machine !== undefined && options.session !== undefined ? keptDeltas(await heldDeltas(outbox, key), delta?.entries ?? []) : delta?.entries;
+            const skeleton = records === undefined ? null : skeletonOf(records, key, shellReader(vocabulary()), contentHash, entries, gate, await coverageOf(head.main), recommendationsOf(recalls, head.main.session));
+            if (skeleton === null) {
+                counts.uncaptured += 1;
+                await withdraw(key);
+                continue;
             }
-            rawKept.add(key);
+            const parsed = parseSkeleton(skeleton);
+            // The server reads a value outside its lists as `other` and keeps a field it does not know, so the parser no longer refuses either: the emitter is the privacy control, and a batch this client built holds neither.
+            const refusedAt = parsed.ok ? parsed.extensions[0]?.at : parsed.field;
+            if (!parsed.ok || refusedAt !== undefined) {
+                counts.refused += 1;
+                refusedFields.add(refusedAt ?? '');
+                await withdraw(key);
+                continue;
+            }
+            // Noted before the batch is written: a person's sweep that runs between the two lines would delete a batch it cannot yet tell is a machine's.
+            if (machine !== undefined)
+                await noteMachineKey(outbox, key);
+            builtBytes += (await writeBatch(outbox, key, parsed.skeleton)).bytes;
+            // The raw copy comes only after both gates and only with a yes to the raw prompt and a folder not at skeleton only: each transcript of the session, redacted here, before it is queued.
+            if (rawAllowed(saved.pool, head.main.project, covenant)) {
+                let place = 0;
+                for (const file of await transcriptFilesOf(runtime, head.main.project, head.main.session)) {
+                    const redacted = redactTranscript(await readFile(file.path, 'utf8'), saved.redactDomains, names, injectedKey);
+                    counts.raw.bytes += (await writeRaw(outbox, key, place, redacted.text)).bytes;
+                    counts.raw.copies += 1;
+                    counts.raw.masked += redacted.masked;
+                    place += 1;
+                }
+                rawKept.add(key);
+            }
+            tallyBatch(wireTally, parsed.skeleton);
+            await markDeltasSent(outbox, delta?.marks ?? []);
+            built.add(key);
+            counts.batched += 1;
         }
-        tallyBatch(wireTally, parsed.skeleton);
-        await markDeltasSent(outbox, delta?.marks ?? []);
-        built.add(key);
-        counts.batched += 1;
     }
     // The batch of a session or account this store no longer holds goes too. A machine builds one session at a time and nothing here has the others in hand, so it sweeps nothing: nothing is withdrawn but what a gate refused.
     if (machine === undefined) {
@@ -904,7 +1114,6 @@ export const poolOutbox = async (deps, options) => {
     const server = poolServer(deps.env, OUTBOX, options.server);
     const { token } = await signedIn(deps, runtime.storeDir, server, OUTBOX);
     const outbox = outboxFolder(runtime.storeDir, server);
-    const { batches, edited } = await heldAcross(outbox);
     const masker = new Masker();
     masker.add(token);
     const sent = await sentLog(outbox);
@@ -916,7 +1125,15 @@ export const poolOutbox = async (deps, options) => {
         print?.(`${state.wrote ? '\n\n' : ''}${block}`);
         state.wrote = true;
     };
-    for (const batch of batches) {
+    // One batch is read at a time: the outbox of a 6,500-session history is gigabytes, far past what one array of them holds.
+    let edited = 0;
+    for await (const named of namesHeldAcross(outbox)) {
+        const bytes = await unchangedBytes(named.file, named.hash);
+        if (bytes === undefined) {
+            edited += 1;
+            continue;
+        }
+        const batch = { hash: named.hash, bytes };
         const fields = options.explain === true ? explained(batch.bytes) : undefined;
         // A batch past one request prints every part's request, in the order they are sent.
         const request = callsOf(token, batch.bytes, batch.hash).map((call) => printed(outgoing(deps, server, POOL_DEPOSITS, call), masker)).join('\n');
@@ -1052,15 +1269,74 @@ export const poolFetch = async (deps, options) => {
     };
 };
 const JOIN = 'pool-join';
+/** The join's invite step: `POST /v1/invites/redeem`. An account that joined on an invite already is a run repeated, which is not an error; any other refusal ends the run with the pool's own words. */
+const redeemInvite = async (deps, storeDir, server, code) => {
+    const { token } = await signedIn(deps, storeDir, server, JOIN);
+    const credential = new Masker();
+    credential.add(token);
+    const reply = await ask(deps, JOIN, server, '/v1/invites/redeem', { body: { code }, token, show: credential });
+    if (reply.status === 200)
+        return { redeemed: true };
+    if (reply.status === 409 && isObject(reply.body) && textIn(reply.body, 'error') === 'already_vouched')
+        return { skipped: true, reason: 'already_vouched' };
+    throw refusal(JOIN, reply);
+};
 const JOIN_AGAIN = 'Run oars pool join again to continue from here.';
+const INVITE_AGAIN = 'The invite code was not accepted, and running the same line again fails the same way. Run oars pool join again without --invite, or with a new code.';
+/** The steps `--plan` lists: the seven the join runs, in order, then the raw question, which `oars pool raw` asks and the join never does. */
+const PLAN_STEPS = [...JOIN_STEPS, 'raw'];
+/** The two steps only a person can do: typing the covenant phrase, and answering the raw prompt. Nothing here, no flag and no variable, does either for them. Region and terms are a person's too until a flag or the term file answers them. */
+const PERSON_STEPS = ['covenant', 'raw'];
+/** Whether the pool reports the covenant accepted for this sign-in. A pool that cannot be asked, or refuses, reads as not accepted: a plan states what it can see. */
+const covenantAccepted = async (deps, server, token) => {
+    try {
+        const reply = await ask(deps, JOIN, server, '/v1/covenant', { token });
+        return reply.status === 200 && isObject(reply.body) && Reflect.get(reply.body, 'accepted') === true;
+    }
+    catch {
+        return false;
+    }
+};
+/** Whether this batch has been printed by `outbox` or sent: the proof `--send` asks for. */
+const batchSeen = async (outbox, hash, sent) => sent.has(hash) || (await wasShown(outbox, hash));
 /**
- * `oars pool join`: the five commands of a first deposit in one run, each by the handler the command itself uses: `login`, `deposit`, `outbox --explain`, `deposit --send <hash>` for each batch not yet sent, then `fetch`. It asks and checks
- * nothing they do not, and a step that stops ends the run with that step's own error. Run again it skips what stands: a held sign-in, a prepared batch not yet sent, a batch in `sent.log`.
- * Each step's text prints as it finishes, so the explanation is on screen before the send asks anything: on stdout, or with `json` on stderr, so stdout holds the one document.
+ * `oars pool join --plan`: each step of the join and whether it stands, from the sign-in, the term file, the outbox, and (when signed in) one read of the covenant. It signs in to nothing, writes nothing, and sends nothing.
+ * `needs_person` marks the steps a person does: the typed covenant phrase and the raw prompt, and region and terms while no flag or file answers them.
  */
-export const poolJoin = async (deps, options) => {
+const joinPlan = async (deps, server, flagged) => {
     const { storeDir } = runtimeOf(deps);
+    const outbox = outboxFolder(storeDir, server);
+    const held = await heldSignIn(deps, storeDir, server, JOIN);
+    const accepted = held !== undefined && (await covenantAccepted(deps, server, held.token));
+    const { batches } = await heldAcross(outbox);
+    const sent = await sentLog(outbox);
+    const seen = await Promise.all(batches.map(({ hash }) => batchSeen(outbox, hash, sent)));
+    const state = await readState(storeDir);
+    const standing = {
+        signin: held !== undefined,
+        region: accepted || state.pool.euEeaUk !== null,
+        terms: (await currentTerms(deps)).length > 0,
+        batch: batches.length > 0,
+        outbox: batches.length > 0 && seen.every(Boolean),
+        covenant: accepted,
+        send: batches.length > 0 && batches.every(({ hash }) => sent.has(hash)),
+        raw: state.pool.rawConsent === 'granted',
+    };
+    const steps = PLAN_STEPS.map((step) => ({ step, state: standing[step] ? 'done' : 'pending', needs_person: PERSON_STEPS.includes(step) || (!standing[step] && (step === 'terms' || (step === 'region' && !flagged))) }));
+    return { document: { ok: true, plan: true, server, steps }, text: steps.map(({ step, state, needs_person: person }) => `${step}: ${state}${person ? ' (a person does this)' : ''}`).join('\n') };
+};
+/**
+ * `oars pool join`: the first deposit in one run, each step by the handler its own command uses: sign-in (`login`), the region question, the exclusion term file (scaffolded empty, never filled in), the batch (`deposit`), what it holds (`outbox
+ * --explain`), the covenant (the screen and typed phrase `deposit --send` shows), and the send (`deposit --send <hash>` for each batch not yet sent), then `fetch` when a harness version is named. A step that stops ends the run with its own
+ * error. Run again, each step that stands is skipped: a held sign-in, terms in the file, a prepared batch, an accepted covenant, a batch in `sent.log`. Acceptance is the person's own: this never types the phrase, and off a terminal it stops.
+ * Each step's text prints as it finishes, so the explanation is on screen before the send asks anything: on stdout, or with `json` on stderr, so stdout holds the one document. One `join-step` event per step says which of the closed steps ran and
+ * what it did (done, skipped, or stopped), and nothing else.
+ */
+export const poolJoin = async (deps, options) => {
+    const { storeDir, projectsRoot } = runtimeOf(deps);
     const server = poolServer(deps.env, JOIN, options.server);
+    if (options.plan === true)
+        return joinPlan(deps, server, options.inEuEeaUk !== undefined);
     const say = (line) => {
         deps.io.stderr(`${line}
 `);
@@ -1077,47 +1353,205 @@ export const poolJoin = async (deps, options) => {
         const sent = await sentLog(outbox);
         return (await heldAcross(outbox)).batches.flatMap(({ hash }) => (sent.has(hash) ? [] : [hash]));
     };
+    const emit = emitOf(deps);
+    let settled;
+    const record = (step, state) => {
+        settled = step;
+        emit('join-step', { step, state });
+    };
+    const state = { refused: false };
+    let current = 'signin';
+    let fetching = false;
+    // Ctrl-C reaches every step: the sign-in poll and the line reads take the signal, and each step begins by checking it.
+    const interrupt = watchInterrupt();
+    const begin = (step) => {
+        current = step;
+        interrupt.signal.throwIfAborted();
+    };
+    let reader;
+    const lines = () => (reader ??= readerOf(deps, interrupt.signal));
     try {
         const held = await heldSignIn(deps, storeDir, server, LOGIN);
         let login = { skipped: true, account: held?.account };
         if (held === undefined) {
             say(`Signing in to ${server}.`);
-            login = show(await poolLogin(deps, { server, provider: options.provider, verbose: options.verbose })).document;
+            login = show(await poolLogin(deps, { server, provider: options.provider, verbose: options.verbose, signal: interrupt.signal })).document;
+            record('signin', 'done');
         }
         else {
             say(`Already signed in to ${server} as ${held.account}.`);
+            record('signin', 'skipped');
+        }
+        const { token } = await signedIn(deps, storeDir, server, JOIN);
+        const via = networkSender(deps, DEPOSIT, { stallMs: SEND_STALL_MS, signal: interrupt.signal });
+        let vouched = { skipped: true };
+        if (options.invite !== undefined) {
+            say('Using your invite code.');
+            try {
+                vouched = await redeemInvite(deps, storeDir, server, options.invite);
+            }
+            catch (error) {
+                state.refused = true;
+                throw error;
+            }
         }
+        // The region question: asked plainly, once, of a person at a terminal whose covenant is not yet accepted, and sent with the acceptance. A flag answers it; off a terminal the covenant step is what stops.
+        begin('region');
+        let region = regionOf(options.inEuEeaUk);
+        if (options.inEuEeaUk !== undefined && region === undefined)
+            throw usage(`${REGION_FLAG} takes yes or no, not "${options.inEuEeaUk}". Nothing was accepted.`, JOIN);
+        // An answer given on an earlier run stands: the person is not asked twice, whatever stopped the run after the question.
+        if (region === undefined)
+            region = (await readState(storeDir)).pool.euEeaUk ?? undefined;
+        if (region === undefined && isTerminal(deps) && !(await covenantAccepted(deps, server, token))) {
+            say('Before the covenant screen, one question that goes with your acceptance.');
+            deps.io.stderr(`${REGION_QUESTION} > `);
+            region = regionOf(await lines().next());
+            if (region === undefined)
+                throw usage('Answer yes or no: are you in the EU, the EEA, or the UK? Nothing was accepted.', JOIN);
+            const answer = region;
+            await updatePoolChoices(storeDir, (choices) => {
+                choices.euEeaUk = answer;
+            });
+            record('region', 'done');
+        }
+        else {
+            record('region', 'skipped');
+        }
+        // The term file: the person's own list of names to keep out. Without a term every session stays out of the outbox, so an empty file stops the run here, with the file made for them to edit.
+        begin('terms');
+        if ((await currentTerms(deps)).length === 0) {
+            const file = exclusionPaths(projectsRoot, deps.env).terms;
+            await mkdir(dirname(file), { recursive: true });
+            await writeFile(file, '', { flag: 'a' });
+            say(`Your exclusion terms go in ${file}, one per line: a client, a project, or a person whose name must never leave your machine. Every session that mentions one stays out of the outbox. oars adds none for you.`);
+            if (isTerminal(deps)) {
+                say('Press Enter when you have saved the file.');
+                await lines().next();
+            }
+            if ((await currentTerms(deps)).length === 0) {
+                const title = `The exclusion term file ${file} still holds no term, so every session would stay out of the outbox. Add one term per line, save it, and run this again.`;
+                throw new CliError(title, ExitCode.INVALID, JOIN, { code: 'terms_missing', title });
+            }
+            record('terms', 'done');
+        }
+        else {
+            record('terms', 'skipped');
+        }
+        begin('batch');
         let prepared = { skipped: true };
         if ((await unsent()).length > 0) {
             say('Your outbox already holds a prepared batch; not preparing it again.');
+            record('batch', 'skipped');
         }
         else {
             say('Preparing your deposit in the outbox.');
             prepared = show(await poolDeposit(deps, { server })).document;
+            record('batch', 'done');
         }
+        begin('outbox');
         say('Showing what will be sent, field by field.');
         const shown = show(await poolOutbox(deps, { server, explain: true, print: screen })).document;
+        record('outbox', 'done');
         const hashes = await unsent();
+        // The covenant, read from the pool and, if not accepted, shown for a person to type the phrase: before the first send, so its own step ends before the sends begin.
+        begin('covenant');
+        const nothingPrepared = (await heldAcross(outbox)).batches.length === 0;
+        if (hashes.length === 0) {
+            record('covenant', nothingPrepared ? 'none' : 'skipped');
+        }
+        else {
+            record('covenant', (await openCovenant(deps, server, token, options.acceptCovenant, region, via, interrupt.signal, undefined, false, reader)) ? 'done' : 'skipped');
+        }
+        begin('send');
         const sends = [];
         if (hashes.length === 0) {
-            say((await heldAcross(outbox)).batches.length === 0 ? 'No session is ready to deposit yet; sending nothing.' : 'Everything prepared is already sent; sending nothing.');
+            say(nothingPrepared ? 'No session is ready to deposit yet; sending nothing.' : 'Everything prepared is already sent; sending nothing.');
+            record('send', nothingPrepared ? 'none' : 'skipped');
         }
         else {
             say(`Sending ${plural(hashes.length, 'batch', 'batches')} to ${server}.`);
             for (const hash of hashes)
-                sends.push(show(await poolDeposit(deps, { server, send: hash, acceptCovenant: options.acceptCovenant, inEuEeaUk: options.inEuEeaUk })).document);
+                sends.push(show(await poolDeposit(deps, { server, send: hash, acceptCovenant: options.acceptCovenant, inEuEeaUk: region })).document);
+            record('send', 'done');
+        }
+        await rememberCrew(deps, storeDir, server, token, JOIN);
+        let fetched;
+        if (options.harnessVersion !== undefined) {
+            fetching = true;
+            say(`Fetching the bundle for ${options.harness ?? 'your most used harness'} ${options.harnessVersion}.`);
+            fetched = show(await poolFetch(deps, { server, harness: options.harness, harnessVersion: options.harnessVersion }));
         }
-        say(`Fetching the bundle for ${options.harness ?? 'your most used harness'} ${options.harnessVersion}.`);
-        const fetched = show(await poolFetch(deps, { server, harness: options.harness, harnessVersion: options.harnessVersion }));
         return {
-            document: { ok: true, server, login, deposit: prepared, outbox: shown, sends, fetch: fetched.document },
-            text: `Joined ${server}: ${plural(sends.length, 'batch', 'batches')} sent this run, and the ${options.harnessVersion} bundle is kept.`,
+            document: { ok: true, server, login, invite: vouched, deposit: prepared, outbox: shown, sends, ...(fetched === undefined ? {} : { fetch: fetched.document }) },
+            text: `Joined ${server}: ${plural(sends.length, 'batch', 'batches')} sent this run${options.harnessVersion === undefined ? '' : `, and the ${options.harnessVersion} bundle is kept`}.`,
         };
     }
     catch (error) {
-        say(JOIN_AGAIN);
+        // A step that threw is the one that stopped; the fetch after the sends is not one of the seven.
+        // A step already recorded done or skipped is not stopped as well: the failure came after it, in the code between steps.
+        if (!fetching && settled !== current)
+            record(current, 'stopped');
+        say(state.refused ? INVITE_AGAIN : JOIN_AGAIN);
+        // A signal ended the run (the readline read throws its own abort error, the poll and the steps throw the reason): exit as deposit does, 130 for Ctrl-C.
+        if (interrupt.signal.aborted && interrupt.signal.reason instanceof SendInterrupted)
+            throw stopped(JOIN, interrupt.signal.reason, false);
         throw error;
     }
+    finally {
+        interrupt.stop();
+        reader?.close();
+    }
+};
+const INVITE = 'pool-invite';
+/** Asks the pool for this account's crew number and keeps it for the card. Best effort: a refusal or a failed call leaves what was held, because nothing the person asked for depends on it. */
+const rememberCrew = async (deps, storeDir, server, token, step) => {
+    try {
+        const credential = new Masker();
+        credential.add(token);
+        const reply = await ask(deps, step, server, '/v1/me', { token, show: credential });
+        if (reply.status !== 200 || !isObject(reply.body))
+            return undefined;
+        const account = Reflect.get(reply.body, 'account');
+        if (typeof account === 'string')
+            await keepCrewNumber(storeDir, server, account, numberIn(reply.body, 'crewNumber'));
+        return numberIn(reply.body, 'vouchesGiven');
+    }
+    catch {
+        // The card shows the number when it is known and says nothing when it is not.
+        return undefined;
+    }
+};
+/** The one line an invitee runs. `<version>` stays a placeholder: the harness version is the invitee's own to name. */
+export const joinLineOf = (code) => `oars pool join --invite ${code} --harness-version <version>`;
+/**
+ * `oars pool invite`: makes one invite code (`POST /v1/invites`, a founding or standing account, three open at most) and prints it once with the line to hand on and what the vouch gives. The code is the only secret here, so it is the one thing the pool never shows again.
+ */
+export const poolInvite = async (deps, options) => {
+    const { storeDir } = runtimeOf(deps);
+    const server = poolServer(deps.env, INVITE, options.server);
+    const { token } = await signedIn(deps, storeDir, server, INVITE);
+    const credential = new Masker();
+    credential.add(token);
+    const reply = await ask(deps, INVITE, server, '/v1/invites', { body: {}, token, show: credential });
+    if (reply.status !== 201)
+        throw refusal(INVITE, reply);
+    const code = isObject(reply.body) ? textIn(reply.body, 'code') : undefined;
+    const left = isObject(reply.body) ? numberIn(reply.body, 'invitesLeft') : undefined;
+    if (code === undefined)
+        throw new CliError('The pool answered an invite with no code.', ExitCode.UNEXPECTED, INVITE);
+    const given = await rememberCrew(deps, storeDir, server, token, INVITE);
+    const line = joinLineOf(code);
+    return {
+        document: { ok: true, server, code, join: line, ...(left === undefined ? {} : { invitesLeft: left }), ...(given === undefined ? {} : { vouchesGiven: given }) },
+        text: [
+            `Invite code: ${code}`,
+            'This is the only time the code is shown. It works once, for one person.',
+            `Send them this line: ${line}`,
+            `What you get: your vouch is recorded${given === undefined ? '' : ` (you have vouched for ${String(given)} so far)`}. What they get: once they have rowed two counting weeks, the next founding-crew grant lets them join the open board without waiting 90 days, unless you and they are the same operator, which gives neither of you anything.`,
+            ...(left === undefined ? [] : [`Open codes you can still make: ${String(left)}.`]),
+        ].join('\n'),
+    };
 };
 const RAW = 'pool-raw';
 /** The raw prompt, in plain words: shown by `oars pool raw` until it is answered, and what the detached sender relies on. Redaction is best effort and the text says so. */