@quickchatai/quickreview 1.2.0 → 1.3.2

package/src/state.ts

@@ -2,7 +2,10 @@
 // Core tables: pr_state, rounds, bot_comments (registry), deliveries
 // (webhook dedupe), events (append log).
 import { findingRowFields } from "@quickchatai/pi-quickreview/src/finding-row.js";
-import { roundStageDeadlines } from "@quickchatai/pi-quickreview/src/round-stage-deadlines.js";
+import {
+  discoveryRowsOf,
+  roundStageDeadlines,
+} from "@quickchatai/pi-quickreview/src/round-stage-deadlines.js";
 import Database from "better-sqlite3";
 import { chmodSync, mkdirSync, renameSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
@@ -550,8 +553,9 @@ export type DrainState =
       /** When the hold lapses; null = until lifted (operator only). */
       expires_at: string | null;
       /** Why a SYSTEM engaged it (`worker_failures`, the crash-loop breaker); null
-       * for a hand-set drain. A drain with a reason is lifted only by an explicit
-       * `drain off`, never by a boot's first reconcile pass. */
+       * for a hand-set drain. A drain with a reason is never lifted by a boot's
+       * first reconcile pass: the breaker's lapses at its `expires_at`, or an
+       * explicit `drain off` lifts it sooner. */
       reason: string | null;
       /** The operator's no-auto-lift HOLD (`qcr drain on --hold`): no
        * boot's first reconcile lifts it, only an explicit operator `drain off`.
@@ -1050,7 +1054,8 @@ CREATE TABLE IF NOT EXISTS drain_state (
 -- with parked_at set gets no worker until the operator's rerun-round or
 -- restart-session clears the row. worker_breaker_global.epoch ticks at every
 -- worker success (and at the lift of the breaker's drain); a failure counts
--- toward the global drain only while it carries the current epoch.
+-- toward the global drain only while it carries the current epoch. trips
+-- counts the breaker's drains since then: each waits twice as long to lapse.
 CREATE TABLE IF NOT EXISTS worker_breaker (
   pr              INTEGER PRIMARY KEY,
   failures        INTEGER NOT NULL DEFAULT 0,
@@ -1064,6 +1069,7 @@ CREATE TABLE IF NOT EXISTS worker_breaker (
 CREATE TABLE IF NOT EXISTS worker_breaker_global (
   id         INTEGER PRIMARY KEY CHECK (id = 1),
   epoch      INTEGER NOT NULL DEFAULT 0,
+  trips      INTEGER NOT NULL DEFAULT 0,
   updated_at TEXT NOT NULL
 );
 -- The host lease: who holds a PR's session while the operator works
@@ -1828,6 +1834,7 @@ export class StateStore {
     this.db.exec("CREATE INDEX IF NOT EXISTS bot_comments_id ON bot_comments(comment_id)");
     this.migrateRecheckReceipts();
     this.migrateDrainHold();
+    this.migrateBreakerHeal();
     this.migrateSessionCommandCancelledStatus();
     this.runDataMigrations();
   }
@@ -1932,6 +1939,37 @@ export class StateStore {
     })();
   }
 
+  /**
+   * The breaker's drain lapses on its own (src/workerbreaker.ts). One an older
+   * daemon set stands with no expiry, and only `drain off` would lift it: the
+   * boot that adds the `trips` column gives it an expiry of now, so the first
+   * sweep lifts it and the queue retries, with the failures that tripped it
+   * spent. Only the breaker's drain is carried
+   * (its reason, no hold); a hand-set drain stands as it was set.
+   */
+  private migrateBreakerHeal(): void {
+    this.db.transaction(() => {
+      if (
+        !this.addColumn(
+          "ALTER TABLE worker_breaker_global ADD COLUMN trips INTEGER NOT NULL DEFAULT 0",
+        )
+      )
+        return;
+      const info = this.db
+        .prepare(
+          `UPDATE drain_state SET expires_at = ?
+            WHERE id = 1 AND draining = 1 AND reason = ? AND expires_at IS NULL AND hold = 0`,
+        )
+        .run(this.ts(), WORKER_FAILURES_DRAIN_REASON);
+      if (info.changes > 0) {
+        // The failures that tripped it are spent, as at a new trip: a retry
+        // failing once more must not re-drain with them.
+        this.resetWorkerFailureWindow();
+        this.logEvent("breaker_drain_heal_carried", null, {});
+      }
+    })();
+  }
+
   /** Existing databases carry a CHECK constraint that predates operator
    * cancellation. Rebuild this one table in-place; every column and index is
    * copied, and the transaction makes the old or new shape visible atomically. */
@@ -6696,18 +6734,31 @@ export class StateStore {
    * One more consecutive worker failure for `pr`. The PR is parked when the count
    * reaches `parkAfter`; `parked` says whether it stands parked now and
    * `newlyParked` whether THIS failure parked it (the caller raises the anomaly
-   * once).
+   * once). With `drain: false` it does not count toward the global drain: its
+   * epoch is one no window ever carries, so `failedWorkerPrsSince` never lists
+   * it. With `park: false` it counts but does not park the PR by itself.
    */
   recordWorkerFailure(
     pr: number,
-    o: { commandId: string; error: string; at: string; parkAfter: number },
+    o: {
+      commandId: string;
+      error: string;
+      at: string;
+      parkAfter: number;
+      drain?: boolean;
+      park?: boolean;
+    },
   ): { failures: number; parked: boolean; newlyParked: boolean } {
     return this.db
       .transaction(() => {
         const row = this.workerBreaker(pr);
         const failures = (row?.failures ?? 0) + 1;
         const wasParked = row?.parked_at != null;
-        const parkedAt = wasParked ? row.parked_at : failures >= o.parkAfter ? o.at : null;
+        const parkedAt = wasParked
+          ? row.parked_at
+          : o.park !== false && failures >= o.parkAfter
+            ? o.at
+            : null;
         this.db
           .prepare(
             `INSERT INTO worker_breaker (pr, failures, parked_at, last_error, last_failure_at, last_command_id, failure_epoch, updated_at)
@@ -6722,7 +6773,7 @@ export class StateStore {
             error: o.error,
             at: o.at,
             command: o.commandId,
-            epoch: this.workerEpoch(),
+            epoch: o.drain === false ? -1 : this.workerEpoch(),
           });
         return {
           failures,
@@ -6770,12 +6821,31 @@ export class StateStore {
     return row?.epoch ?? 0;
   }
 
-  /** Start the global failure window afresh: earlier failures stop counting. */
+  /** Start the global failure window afresh: earlier failures stop counting,
+   * and the breaker's next drain waits the shortest time again. */
   resetWorkerFailureWindow(): void {
     this.db
       .prepare(
-        `INSERT INTO worker_breaker_global (id, epoch, updated_at) VALUES (1, 1, @ts)
-         ON CONFLICT(id) DO UPDATE SET epoch = epoch + 1, updated_at = @ts`,
+        `INSERT INTO worker_breaker_global (id, epoch, trips, updated_at) VALUES (1, 1, 0, @ts)
+         ON CONFLICT(id) DO UPDATE SET epoch = epoch + 1, trips = 0, updated_at = @ts`,
+      )
+      .run({ ts: this.ts() });
+  }
+
+  /** The breaker's drains since the last worker success or operator lift. */
+  workerBreakerTrips(): number {
+    const row = this.db.prepare("SELECT trips FROM worker_breaker_global WHERE id = 1").get() as
+      { trips: number } | undefined;
+    return row?.trips ?? 0;
+  }
+
+  /** The breaker drained once more: the failures that tripped it are spent (a
+   * new epoch), and its next drain waits longer. */
+  recordWorkerBreakerTrip(): void {
+    this.db
+      .prepare(
+        `INSERT INTO worker_breaker_global (id, epoch, trips, updated_at) VALUES (1, 1, 1, @ts)
+         ON CONFLICT(id) DO UPDATE SET epoch = epoch + 1, trips = trips + 1, updated_at = @ts`,
       )
       .run({ ts: this.ts() });
   }
@@ -7005,6 +7075,25 @@ export class StateStore {
     return someMarkHasKey(rows, key);
   }
 
+  /** Has a check after this (pr, key)'s spent nudge already been recorded? */
+  ledgerRepeatSeen(pr: number, key: string): boolean {
+    const rows = this.db
+      .prepare("SELECT payload FROM events WHERE kind = 'ledger_stale_repeat' AND pr = ?")
+      .all(pr) as Array<{ payload: string | null }>;
+    return someMarkHasKey(rows, key);
+  }
+
+  /** The heads a recheck upheld on `pr` at or after `since` (every one when null). */
+  recheckUpheldHeads(pr: number, since: string | null): string[] {
+    const rows = this.db
+      .prepare("SELECT payload FROM events WHERE kind = 'recheck_upheld' AND pr = ? AND ts >= ?")
+      .all(pr, since ?? "") as Array<{ payload: string | null }>;
+    // An unreadable mark names no head.
+    return rows
+      .map((r) => readStringField(r.payload, "head_sha"))
+      .filter((head): head is string => head !== undefined && head !== "");
+  }
+
   /**
    * What the event log says about the migration-collision COMMENT with this
    * fingerprint on this PR (the collision comment's dedupe). Scans every such event for the
@@ -7781,9 +7870,27 @@ export interface OpenPrsSnapshot {
   prs: OpenPrSummary[];
 }
 
+/** The authoritative reconcile poll's last pass (status.json `poll`): what
+ * "auto-review is working" is judged on, beside the heartbeat (the home's
+ * label, src/home/autoreview.ts). */
+export interface PollStatus {
+  /** When the last pass ran, ISO; null before the boot's first pass has ended. */
+  last_at: string | null;
+  /** That pass ran with no step error; null before the first pass. */
+  ok: boolean | null;
+  /** The first error, while not ok. */
+  error?: string;
+  /** The daemon's `[daemon] poll_interval_s`: freshness is judged against
+   * the daemon's own cadence, never a reader's guess. */
+  interval_s: number;
+}
+
 export interface StatusSnapshot {
   written_at: string;
   dry_run: boolean;
+  /** The reconcile poll's last pass. Absent in snapshots from an older
+   * daemon — readers say "unknown", never "working". */
+  poll?: PollStatus;
   /** Where the daemon runs (src/runhost.ts). Absent: not reported (an older
    * daemon, or one assembled without its host facts). */
   run_host?: import("./runhost.js").RunHostStatus;
@@ -7874,6 +7981,11 @@ export interface StatusSnapshot {
   max_concurrent_rounds?: number;
   total_spend_usd: number;
   today_spend_usd?: number;
+  /** The month's spend so far: every round started in the snapshot's UTC
+   * month (the same rule as `today_spend_usd`, expired rounds included).
+   * Absent in snapshots from an older daemon: the home's spend line then
+   * reads unknown, never a zero. */
+  month_spend_usd?: number;
   digest_headline?: string;
   /** Present while pi sessions are failing API calls with token-expired
    * errors (packages/pi-plugin/src/authwatch.ts, fresh < 30 min). The TUI raises an alert. */
@@ -8155,6 +8267,7 @@ export function buildStatusSnapshot(
                   started,
                   roundStageBounds,
                   round.sweep_owed === 1,
+                  discoveryRowsOf(round),
                 );
                 return {
                   ...identity,
@@ -8224,6 +8337,8 @@ export function buildStatusSnapshot(
     ...(maxConcurrentRounds !== undefined ? { max_concurrent_rounds: maxConcurrentRounds } : {}),
     total_spend_usd: store.totalSpend(),
     today_spend_usd: roundUsage(store.roundsOn(today)).spend_usd,
+    // roundsOn matches by prefix: the month's `YYYY-MM` is every day of it
+    month_spend_usd: roundUsage(store.roundsOn(today.slice(0, 7))).spend_usd,
     ...(digestHeadline ? { digest_headline: digestHeadline } : {}),
     ...(piAuth
       ? {

package/src/takeover.ts

@@ -82,6 +82,9 @@ export interface TakeoverPlan {
   cwd: string;
   /** The login's owner dir (`pihome/agent`): read-only, borrowed from. */
   agent_dir: string;
+  /** The login's dir when it is not `agent_dir` (the single box's shared
+   * login): the login is borrowed from here, the rest from `agent_dir`. */
+  login_dir?: string;
   /** The PR's JSONL, which the pi resumes and appends to. */
   session_file: string;
   model: string;
@@ -597,6 +600,7 @@ function rmQuiet(file: string): void {
 export function takeoverPlanFor(o: {
   root: string;
   agentDir: string;
+  loginDir?: string;
   sessionsRoot: string;
   model: string;
   pr: number;
@@ -612,6 +616,7 @@ export function takeoverPlanFor(o: {
     root: o.root,
     cwd: o.root,
     agent_dir: o.agentDir,
+    ...(o.loginDir !== undefined && o.loginDir !== o.agentDir ? { login_dir: o.loginDir } : {}),
     session_file: file,
     model: o.model,
     ...(o.systemPromptFile ? { system_prompt_file: o.systemPromptFile } : {}),

package/src/takeoverpi.ts

@@ -91,6 +91,7 @@ export function readTakeoverSpec(file: string): TakeoverSpec {
     raw.session !== `takeover-pr-${raw.pr}` ||
     typeof raw.session_file !== "string" ||
     typeof raw.agent_dir !== "string" ||
+    (raw.login_dir !== undefined && typeof raw.login_dir !== "string") ||
     typeof raw.borrow_dir !== "string" ||
     typeof raw.model !== "string" ||
     typeof raw.cwd !== "string" ||
@@ -119,11 +120,11 @@ export function readLogin(agentDir: string): string | null {
  * the owner's dir.
  */
 export function prepareBorrowedAgent(
-  spec: Pick<TakeoverSpec, "agent_dir" | "borrow_dir" | "idle_ms">,
+  spec: Pick<TakeoverSpec, "agent_dir" | "login_dir" | "borrow_dir" | "idle_ms">,
   now?: () => number,
 ): { expiresAt: number | null } {
   const { expiresAt } = copyPiAuth({
-    srcDir: spec.agent_dir,
+    srcDir: spec.login_dir ?? spec.agent_dir,
     dstDir: spec.borrow_dir,
     needMs: spec.idle_ms + PI_REFRESH_MARGIN_MS,
     words: ENGINE_AUTH_WORDS,

package/src/tui/alerts.ts

@@ -30,6 +30,7 @@ import { zoneDateString } from "../eod.js";
 import { curationNeedsAttention } from "../learner/status.js";
 import { memoryStatusLine, type MemoryStatus } from "../memory/health.js";
 import type { StatusSnapshot } from "../state.js";
+import { DEFAULT_BREAKER_LIMITS } from "../workerbreaker.js";
 
 export type AlertTier = "notice" | "alert";
 
@@ -616,7 +617,11 @@ export interface WorkerCrashAlertMemory {
 export function maybeWriteWorkerCrashAlerts(
   alertsDir: string,
   snapshot:
-    Pick<StatusSnapshot, "prs" | "draining" | "draining_reason" | "draining_since"> | undefined,
+    | Pick<
+        StatusSnapshot,
+        "prs" | "draining" | "draining_reason" | "draining_since" | "draining_until"
+      >
+    | undefined,
   fresh: boolean,
   mem: WorkerCrashAlertMemory,
   now: () => Date = () => new Date(),
@@ -660,7 +665,9 @@ export function maybeWriteWorkerCrashAlerts(
       "worker-failures-drain",
       null,
       "workers failing on several PRs: the bot is draining",
-      "Workers failed on three PRs within 15 minutes with no success, so the bot drains: no round, answer or debug worker starts. Fix the cause, then run drain off.",
+      snapshot.draining_until
+        ? `Workers failed on three PRs within 15 minutes with no success, so the bot drains: no round, answer or debug worker starts. It lifts itself at ${snapshot.draining_until} and the queue retries; if workers fail again it drains again, each time waiting twice as long (up to ${DEFAULT_BREAKER_LIMITS.healMaxMs / 3_600_000} h). Run drain off to retry now.`
+        : "Workers failed on three PRs within 15 minutes with no success, so the bot drains: no round, answer or debug worker starts. Fix the cause, then run drain off.",
     );
   return names;
 }

package/src/tui/board.ts

@@ -522,7 +522,7 @@ function barSegments(view: BoardView, alerts: boolean): string[] {
   }
   // Short on the bar, where every segment competes for the width; the list
   // carries the full sentence with the next step.
-  const setupSeg = view.setup ? `${WARN}▲ setup not finished — qcr onboard${DRESET}` : "";
+  const setupSeg = view.setup ? `${WARN}▲ setup not finished${DRESET}` : "";
   const s = view.snapshot;
   const rounds = s ? `rounds ${s.running_rounds}/${s.max_concurrent_rounds ?? "?"}` : "";
   const spend = s?.today_spend_usd !== undefined ? `today $${s.today_spend_usd.toFixed(2)}` : "";
@@ -534,7 +534,7 @@ function barSegments(view: BoardView, alerts: boolean): string[] {
   // guessed at. The operator's HOLD says that no boot lifts it; an
   // operator drain from a daemon that reports no hold marker says "hold ?".
   const drainSeg = s?.draining
-    ? `${FG.anomaly}⛔ DRAINING — ${s.running_rounds} round${s.running_rounds === 1 ? "" : "s"} finishing · ${s.drain_failed_loud ?? 0} failed loud · ${s.drained_deliveries ?? 0} dropped · ${leverHolderLabel(s.draining_by, s.draining_until)}${drainHoldLabel(s)}${s.draining_reason === "worker_failures" ? " · workers keep failing, drain off lifts it" : ""}${RESET}`
+    ? `${FG.anomaly}⛔ DRAINING — ${s.running_rounds} round${s.running_rounds === 1 ? "" : "s"} finishing · ${s.drain_failed_loud ?? 0} failed loud · ${s.drained_deliveries ?? 0} dropped · ${leverHolderLabel(s.draining_by, s.draining_until)}${drainHoldLabel(s)}${s.draining_reason === "worker_failures" ? (s.draining_until ? " · workers kept failing, it retries when it lapses; drain off lifts it now" : " · workers keep failing, drain off lifts it") : ""}${RESET}`
     : "";
   const td = s?.thread_decisions;
   const breakerSeg =

package/src/tui/companion.ts

@@ -45,6 +45,7 @@ import { COMPANION_IMAGE, type CompanionConfig } from "../config.js";
 import { writeAtomic } from "../channelfs.js";
 import { appStamp } from "../appstamp.js";
 import { TOKEN_FILE } from "./ghread.js";
+import { MEMORY_PORT } from "./memoryurl.js";
 
 export interface DockerResult {
   ok: boolean;
@@ -274,7 +275,7 @@ export const MEMORY = {
   subnet: "198.51.100.0/24",
   gateway: "198.51.100.1",
   /** Same port the server listens on in the VM container ([openviking] port). */
-  port: 1933,
+  port: MEMORY_PORT,
   /** The OpenViking user whose memory the companion owns — becomes the
    * `X-OpenViking-User` header on every request it makes. */
   user: "companion",

package/src/tui/deploytab.ts

@@ -1,6 +1,6 @@
 // `[5] deploy` — "what would a deploy ship?" plus the deploy button.
-// Every deploy is a RELEASE: the tag, the two-arch build, the paid e2e and the
-// owner's approval already happened in CI, so the tab only chooses a version.
+// Every deploy is a RELEASE: the tag and the two-arch build with its smoke
+// already happened in CI, so the tab only chooses a version.
 // It shows the version and revision the VM runs (`qcr-update status --json`,
 // read over ssh) against the chosen version, the commits between the two
 // revisions (from the local checkout), and deploy.sh's own

package/src/tui/index.ts

@@ -114,8 +114,8 @@ troubleshooting:
                      project): every read is docker exec into the daemon
                      container, no ssh. The board names an absent or stopped
                      container with the docker compose command that starts it
-  setup not finished the onboarding checklist is not complete: run qcr onboard
-                     (the board names the next step)
+  setup not finished the setup checklist is not complete: run qcr (the board
+                     names the next step)
   ▲ DATA STALE       ssh works but status.json stopped updating — the
                      container is down or the daemon hung (qcr-side:
                      ssh <host> sudo docker ps / docker logs)
@@ -454,11 +454,14 @@ export async function runTui(argv: string | string[] = [], deps: RunTuiDeps = {}
 
   const fileConfig = deps.config ?? loadConfig();
   // The route — which daemon the board reads, and how — from [tui] plus the
-  // facts this checkout holds locally (the compose project's .env, the
-  // onboarding checklist, the Docker socket's mode). Two small file reads and
-  // one access(2): no docker, network or walk, so it may precede the frame.
+  // facts the stack holds locally (the compose project's .env, the
+  // onboarding checklist, the Docker socket's mode). The stack is the one the
+  // home sets up (src/homes.ts `stackRoot`), so an app installed by a package
+  // manager reads it from its state home. Two small file reads and one
+  // access(2): no docker, network or walk, so it may precede the frame.
   const { readRouteFacts, resolveTuiRoute, pinnedVersion } = await import("./route.js");
-  const routeFacts = deps.routeFacts ?? readRouteFacts(sandboxRoot());
+  const { stackRoot } = await import("../homes.js");
+  const routeFacts = deps.routeFacts ?? readRouteFacts(stackRoot(process.env, sandboxRoot()));
   const route = resolveTuiRoute(fileConfig.tui, routeFacts);
   const loaded: Config = { ...fileConfig, tui: route.cfg };
   // In the containerised TUI the companion is a container the host wrapper

package/src/tui/memory.ts

@@ -52,7 +52,7 @@ import {
 import { countOutcome, emptyRequestCounter, type RequestCounter } from "../memory/health.js";
 import { OpenVikingStore } from "../openviking/store.js";
 import { readRetiredUrisFile, writeRetiredUris } from "../memory/ovsession.js";
-import { keysFilePath, MEMORY } from "./companion.js";
+import { keysFilePath } from "./companion.js";
 
 export { matchesQuery, normalizeTag, refOf } from "../memory/store.js";
 export type {
@@ -227,20 +227,8 @@ export function keysFileReader(
   };
 }
 
-/**
- * Where the TUI reaches OpenViking: the memory forward's loopback listener.
- *
- * `QCR_MEMORY_URL` overrides it wholesale; `QCR_MEMORY_PORT` matches the flag
- * the forward itself takes, so a non-default port only has to be spelled once.
- * `MEMORY.port` is the shared constant the forward and the companion already
- * agree on.
- */
-export function tuiMemoryBaseUrl(env: NodeJS.ProcessEnv = process.env): string {
-  const explicit = (env["QCR_MEMORY_URL"] ?? env["QCR_MEMORY_ENDPOINT"] ?? "").trim();
-  if (explicit !== "") return explicit.replace(/\/+$/, "");
-  const port = Number(env["QCR_MEMORY_PORT"] ?? MEMORY.port) || MEMORY.port;
-  return `http://127.0.0.1:${port}`;
-}
+import { tuiMemoryBaseUrl } from "./memoryurl.js";
+export { tuiMemoryBaseUrl };
 
 // ---- the store ---------------------------------------------------------------
 

package/src/tui/memoryurl.ts

@@ -0,0 +1,22 @@
+// Where this host reaches OpenViking: the memory forward's loopback
+// listener. A leaf module, so a reader of the URL (the wizard's memory step,
+// the home) never imports the TUI's memory store or the companion.
+
+/** The port the memory forward and the companion agree on, the server's own
+ * in the VM container (`[openviking] port`). */
+export const MEMORY_PORT = 1933;
+
+/**
+ * Where the TUI reaches OpenViking: the memory forward's loopback listener.
+ *
+ * `QCR_MEMORY_URL` overrides it wholesale; `QCR_MEMORY_PORT` matches the flag
+ * the forward itself takes, so a non-default port only has to be spelled once.
+ * `MEMORY_PORT` is the shared constant the forward and the companion already
+ * agree on.
+ */
+export function tuiMemoryBaseUrl(env: NodeJS.ProcessEnv = process.env): string {
+  const explicit = (env["QCR_MEMORY_URL"] ?? env["QCR_MEMORY_ENDPOINT"] ?? "").trim();
+  if (explicit !== "") return explicit.replace(/\/+$/, "");
+  const port = Number(env["QCR_MEMORY_PORT"] ?? MEMORY_PORT) || MEMORY_PORT;
+  return `http://127.0.0.1:${port}`;
+}

package/src/tui/remote.ts

@@ -341,7 +341,7 @@ export function killInFlightSsh(): number {
  * die on "Could not resolve hostname" and every surface would print an ssh
  * remedy with no host in it. */
 export const NO_SSH_HOST_STDERR =
-  '[tui] ssh_host is empty — run `qcr onboard`, or set [tui] target = "local"';
+  '[tui] ssh_host is empty — set it to the VM\'s ssh alias, or set [tui] target = "local"';
 
 export const realSshRunner: SshRunner = (host, argv, opts) =>
   host.trim() === ""

package/src/tui/route.ts

@@ -109,7 +109,7 @@ export function resolveTuiRoute(file: TuiConfig, facts: RouteFacts): TuiRoute {
       };
       notes.push(
         `[tui] target is "ssh" with no ssh_host — reading the local compose stack in ${facts.projectDir} instead ` +
-          '(run `qcr onboard`, or set [tui] target = "local", to make it explicit)',
+          '(set [tui] target = "local" to make it explicit)',
       );
     } else {
       return {
@@ -117,7 +117,7 @@ export function resolveTuiRoute(file: TuiConfig, facts: RouteFacts): TuiRoute {
         notes,
         unconfigured:
           topology === "vm"
-            ? "[tui] ssh_host is empty — the VM route's ssh alias is written by onboarding: run `qcr onboard`"
+            ? "[tui] ssh_host is empty — set it to the VM's ssh alias in config.toml"
             : EMPTY_SSH_HOST,
       };
     }

package/src/tui/setupstate.ts

@@ -1,25 +1,27 @@
-// Is onboarding finished? Read from the checklist file the wizard keeps
-// (src/onboard/engine.ts), so a TUI opened halfway through `qcr onboard` says
-// so on its first frame instead of troubleshooting a daemon nobody has started
-// yet.
+// Is setup finished? Read from the checklist file switch-on and Advanced keep
+// (src/onboard/engine.ts), so a TUI opened halfway through says so on its
+// first frame instead of troubleshooting a daemon nobody has started yet.
 //
 // Only a checklist that EXISTS and is not complete counts: an install that
-// never ran the wizard (a hand-written config, the VM operator's own setup)
-// has no checklist and gets no banner. The next step is the first enabled step,
-// in the wizard's own order, that the file does not record as done — the same
-// predicates the engine applies, so the TUI cannot name a step the wizard would
-// skip.
+// never switched auto-review on (a hand-written config, the VM operator's own
+// setup) has no checklist and gets no banner. Setup is finished in the home
+// (a bare `qcr`), so the steps judged are the home's: switch-on's and
+// Advanced's registry (src/home/advanced.ts), with the engine's own
+// predicates. The next step is the first enabled, required one the file does
+// not record as done; when there is none, nothing is left that the home could
+// finish, and there is no banner (the home never runs the wizard's finish, so
+// its checklist need not carry the wizard's completion marker).
 import { type ChecklistFile } from "../onboard/engine.js";
 
 export interface SetupState {
-  /** The title of the first pending step ("the final verification" when only
-   * finish is left), or undefined when it could not be computed. */
+  /** The title of the first pending step, or undefined when it could not be
+   * computed. */
   next: string | undefined;
 }
 
 /** The one sentence every surface uses. */
 export function setupLine(s: SetupState): string {
-  return `setup not finished — run \`qcr onboard\` to continue${s.next ? ` (next: ${s.next})` : ""}`;
+  return `setup not finished — run \`qcr\` to finish setting up${s.next ? ` (next: ${s.next})` : ""}`;
 }
 
 /** Complete now: finished once and not reopened since (engine.ts `completeNow`). */
@@ -27,22 +29,24 @@ function completeNow(file: ChecklistFile): boolean {
   return typeof file.completed_at === "string" && !file.reopened_at;
 }
 
-/** undefined = nothing to say (no checklist, or onboarding is complete). */
+/** undefined = nothing to say (no checklist, setup is complete, or the home
+ * has no step left to finish). */
 export async function setupStateOf(
   checklist: ChecklistFile | null,
 ): Promise<SetupState | undefined> {
   if (checklist === null || completeNow(checklist)) return undefined;
   let next: string | undefined;
   try {
-    const { defaultSteps } = await import("../onboard/steps/index.js");
-    const steps = [...defaultSteps()].sort((a, b) => a.order - b.order);
+    const { advancedRegistry } = await import("../home/advanced.js");
+    const steps = [...advancedRegistry().steps()].sort((a, b) => a.order - b.order);
     const pending = steps.find(
       (s) =>
         !s.optional &&
         (s.enabled ? s.enabled(checklist.choices) : true) &&
         checklist.steps[s.id]?.status !== "done",
     );
-    next = pending?.title ?? "the final verification";
+    if (pending === undefined) return undefined;
+    next = pending.title;
   } catch {
     // The step registry could not be loaded: the banner still says setup is
     // unfinished, without naming a step it could not compute.

package/src/tui/sshtriage.ts

@@ -584,7 +584,7 @@ export async function triageConnection(
     return {
       kind: "unconfigured",
       cause: deps.unconfigured ?? NO_SSH_HOST_STDERR,
-      remedy: "qcr onboard",
+      remedy: "set [tui] ssh_host in config.toml",
     };
   }
   const exists = deps.exists ?? existsSync;

package/src/verdicts.ts

@@ -80,6 +80,7 @@ import {
 import { estimateUsd, type ModelPricing } from "./usage.js";
 import { TranscriptIndex } from "./transcriptindex.js";
 import { withinBudget } from "@quickchatai/pi-quickreview/src/budget.js";
+import { VALIDATE_PASS } from "@quickchatai/pi-quickreview/src/include.js";
 import type { GateResult } from "@quickchatai/pi-quickreview/src/gate.js";
 import { applyEvent, restoreStandingLifecycle } from "./statemachine.js";
 import type { VerdictAnnouncer } from "./slack/announce.js";
@@ -505,6 +506,12 @@ function plannedTierMismatches(passes: VerdictPassEntry[], rows: PlanRow[]): str
   return wrong;
 }
 
+/** Every lens of the stage reported its candidate count, and every count is zero. */
+function nothingToValidate(passes: VerdictPassEntry[]): boolean {
+  const lenses = passes.filter((p) => p.name !== VALIDATE_PASS);
+  return lenses.length > 0 && lenses.every((p) => p.findings === 0);
+}
+
 function comparePlan(
   passes: VerdictPassEntry[],
   plan: PlanRow[] | null,
@@ -3003,6 +3010,12 @@ export class VerdictWatcher {
       const deltaPasses = followUp ? v.passes.filter((p) => p.phase !== "sweep") : v.passes;
       const sweepPasses = followUp ? v.passes.filter((p) => p.phase === "sweep") : [];
       const main = comparePlan(deltaPasses, plan, addable, legacyPlanned, true);
+      // A follow-up's delta stage dispatches no validator when its lenses
+      // found nothing (prompts/round-follow-up.md, "Nothing to validate ⇒ no
+      // validator"): that absence keeps the rule. Only a count every lens
+      // reported as zero says so; an unreported one still owes the validator.
+      if (followUp && nothingToValidate(deltaPasses))
+        main.missing = main.missing.filter((name) => name !== VALIDATE_PASS);
       let sweep: PlanComparison | null = null;
       if (sweepPasses.length > 0 || sweepStatus === "ran") {
         const sweepPlan = round.sweep_plan ? (JSON.parse(round.sweep_plan) as PlanRow[]) : [];