atris 3.77.0 → 3.79.0

package/lib/claude-spend-guard.js

@@ -100,6 +100,28 @@ function checkClaudeSpend({ model, job = '', env = process.env, checkKey = false
   return { ok: false, reason: 'paid_model', model: resolved, message: blockMessage(resolved, job) };
 }
 
+// Whether an unattended `claude` run on this model would be stopped, for a caller that only wants to know
+// (the fleet's builder picker leaves such an engine out). The same rule the hook applies, with the key check
+// on, but nothing is written to the ledger: asking is not a block. Null when the run may start, else
+// { reason, model, why }, where why is a few plain words.
+//
+// The run has not started, so no settings file is read, from any home: that file belongs to the home the run will
+// get, which this caller may not know, and reading the wrong one can say Haiku about a run that is not. With no
+// model the answer is ANTHROPIC_MODEL in `env`, else the account default, which is paid. (The hook itself reads
+// the settings of the run it is stopping, and checkClaudeSpend still does.)
+function unattendedStop({ model, env = process.env } = {}) {
+  const asked = String(model || '').trim() || String(env.ANTHROPIC_MODEL || '').trim() || 'default';
+  const verdict = checkClaudeSpend({ model: asked, job: 'claude spend guard', env, checkKey: true, log: false });
+  if (verdict.ok) return null;
+  return {
+    reason: verdict.reason,
+    model: verdict.model,
+    why: verdict.reason === 'paid_key'
+      ? 'a pay-per-use Claude key is set'
+      : `paid model ${verdict.model}, no spend approval`,
+  };
+}
+
 // A copy of env safe to hand a `claude` child: no pay-per-use key, so the run
 // bills the plan login. ATRIS_CLAUDE_KEY_OK=1 keeps the key (servers only).
 function claudeChildEnv(env = process.env) {
@@ -277,8 +299,10 @@ function uninstallGuard({ env = process.env } = {}) {
 module.exports = {
   APPROVAL_ENV,
   checkClaudeSpend,
+  unattendedStop,
   claudeChildEnv,
   hookDecision,
+  modelFromArgv,
   guardStatus,
   installGuard,
   uninstallGuard,

package/lib/fleet.js

@@ -29,6 +29,7 @@ const { engineRunsView } = require('./roster-models');
 const { resolveDefaultVerifier } = require('./default-verifier');
 const { taskCheck } = require('./member-task-pick');
 const { rankEnginesDetailed } = require('./router-brain');
+const { startSteering, CHOICE_CHANGED } = require('./builder-pick');
 const {
   buildOneLapValidatorPrompt,
   parseOneLapValidatorVerdict,
@@ -815,6 +816,52 @@ function nextInstalledFleetEngine(current, { root = process.cwd(), installedEngi
   return rankFleetEngines(candidates, root)[0] || '';
 }
 
+// What the Claude spend guard reads in the environment a sealed worker (a one-lap build) is given: no approval for
+// a paid model, no pay-per-use key, and no model variable (ANTHROPIC_MODEL and the ANTHROPIC_DEFAULT_*_MODEL
+// remaps). Its home is new and has no settings file, which is why the guard is never asked to read one for it.
+// reviewOnlyEngineEnvironment builds that environment from scratch, and only where the sandbox exists, so this is
+// its spend-guard view; test/fleet-subscription-only.test.js holds the two together. A plain worker is not sealed:
+// it inherits this process's environment, approval, key, model variables and all.
+const SEALED_WORKER_GUARD_ENV = Object.freeze({
+  ANTHROPIC_API_KEY: '',
+  ANTHROPIC_AUTH_TOKEN: '',
+  ANTHROPIC_MODEL: '',
+  ANTHROPIC_DEFAULT_OPUS_MODEL: '',
+  ANTHROPIC_DEFAULT_SONNET_MODEL: '',
+  ANTHROPIC_DEFAULT_HAIKU_MODEL: '',
+  ATRIS_CLAUDE_SPEND_OK: '',
+  ATRIS_CLAUDE_KEY_OK: '',
+});
+
+// Steering for one flight. `named` says the caller named the engines: that list is never filtered, on the first
+// pick or on a retry. `sealed` says the workers run sealed, so the Claude spend guard is asked for the
+// environment they will really have, not the one this process has. The models are judged on the launch built here.
+function steeringFor({ root, pick, named = false, sealed = false } = {}) {
+  return startSteering({ root, pick, named, ...(sealed ? { workerEnv: SEALED_WORKER_GUARD_ENV } : {}) });
+}
+
+// The engine a retry goes to. Today's rule, unless steering is on and some candidate has a result since
+// steering began: then the best draw among the engines that are ready (lib/builder-pick.js), and the line
+// that says why. Steering with no results yet keeps today's rule, over the ready engines. `notes` are plain
+// sentences steering has to say that nobody has printed yet.
+function retryEngine(current, { root = process.cwd(), installedEngines = null, steer = null, task = null } = {}) {
+  if (!steer || !steer.on) return { engine: nextInstalledFleetEngine(current, { root, installedEngines }) };
+  const listed = installedEngines ? normalizeInstalledEngines(installedEngines) : installedFleetEngines(root);
+  const { ready } = steer.rest(listed.filter((name) => name !== current));
+  const picked = steer.next(task, ready);
+  const notes = steer.notes();
+  if (picked) return { ...picked, notes };
+  return { engine: nextInstalledFleetEngine(current, { root, installedEngines: listed.filter((name) => name === current || ready.includes(name)) }), notes };
+}
+
+// What steering said for a retry, right under the line that says it happened.
+function logPicks(log, result) {
+  const retry = result.restaffed;
+  if (!retry) return;
+  for (const note of retry.notes || []) log(`      ${note}`);
+  if (retry.pick) log(`      ${retry.pick}`);
+}
+
 function normalizeDispatchResult(result, engineName) {
   const normalized = { ...(result || {}) };
   normalized.engine = normalized.engine || engineName;
@@ -953,10 +1000,11 @@ async function dispatchEntryWithRestaff({
   job = 'build',
   prepAsk = undefined,
   beforeEngine = null,
+  steer = null,
 }) {
   const attempts = [];
   try {
-    const result = await dispatchEntryAttempts({ entry, engine, root, dispatch, installedEngines, restaffState, scoutAsk, clock, defaultPin, attempts, job, prepAsk, beforeEngine });
+    const result = await dispatchEntryAttempts({ entry, engine, root, dispatch, installedEngines, restaffState, scoutAsk, clock, defaultPin, attempts, job, prepAsk, beforeEngine, steer });
     return { ...result, attempts };
   } catch (err) {
     // One job's attempt blowing up (a retry brief that cannot be written, a store that throws) is that job's
@@ -1006,6 +1054,9 @@ async function dispatchEntryAttempts({
   // after a dead one, a handover to the next worker (all after any scout, prep, and brief), so the flight can
   // check it still holds the claim and mark it started. If it throws, that engine is not asked.
   beforeEngine = null,
+  // Steering for this flight (lib/builder-pick.js): which engine a retry goes to. A roster's handover order is
+  // the owner's and steering never reorders it. Null keeps today's rules.
+  steer = null,
 }) {
   const basePrompt = entry.prompt || buildFleetPrompt(entry.task, { worktreePath: entry.worktreePath, yolo: entry.yolo });
   const prepFor = prepPassCache({ entry, root, clock, prepAsk, job });
@@ -1099,7 +1150,8 @@ async function dispatchEntryAttempts({
     return { ...first, deadEngine: { ...outage, skipped: 'already_restaffed' } };
   }
 
-  const fallback = nextInstalledFleetEngine(engine, { root, installedEngines });
+  const retry = retryEngine(engine, { root, installedEngines, steer, task: entry.task });
+  const fallback = retry.engine;
   if (!fallback) {
     return { ...first, deadEngine: { ...outage, skipped: 'no_fallback_engine' } };
   }
@@ -1117,6 +1169,8 @@ async function dispatchEntryAttempts({
       to: fallback,
       reason: deadEngine.reason,
       ...(deadEngine.detail ? { detail: deadEngine.detail } : {}),
+      ...(retry.pick ? { pick: retry.pick } : {}),
+      ...(retry.notes && retry.notes.length ? { notes: retry.notes } : {}),
       failed_legs: [failedDispatchLeg(first, engine)],
     },
   };
@@ -1148,6 +1202,8 @@ async function handOverStalledDispatch({ entry, engine, first, root, runOnce, jo
     // Once every worker is benched the roster stops deciding; that is the
     // team running out, not a missing roster.
     const decided = Boolean(team && rosterDecided(team.source));
+    // The roster's backup order is the owner's explicit choice: the first worker listed that is still open
+    // takes over, whatever the results say.
     const next = decided
       ? team.team.find((worker) => worker && !tried.has(worker.id) && DISPATCH_CAPABLE.includes(worker.id))
       : null;
@@ -1456,13 +1512,18 @@ function surfacesOverlap(a, b) {
 
 // Pick up to `slots` open, safe-lane, mutually file-disjoint tasks. Tasks
 // whose surface cannot be guessed are allowed one at a time (the unknown
-// surface could overlap anything).
-function staffFlight(tasks, { slots = 3 } = {}) {
+// surface could overlap anything). `eligible` is asked of each task the loop
+// looks at, before anything else is: a task it turns down is not in the
+// flight, takes no slot, and holds neither a file nor the blind place against
+// the tasks after it (the fleet turns down the jobs whose chosen engine the
+// flight cannot give, see steering's gives).
+function staffFlight(tasks, { slots = 3, eligible = null } = {}) {
   const open = (tasks || []).filter((t) => t && t.status === 'open' && isSafeLane(t));
   const picked = [];
   let blindPicked = false;
   for (const task of open) {
     if (picked.length >= slots) break;
+    if (eligible && !eligible(task)) continue;
     const surface = fileSurface(task);
     if (surface.length === 0) {
       if (blindPicked) continue;
@@ -1749,6 +1810,8 @@ module.exports = {
   markClaimStarted,
   releaseOwnClaim,
   reviewOnlyEngineEnvironment,
+  SEALED_WORKER_GUARD_ENV,
+  steeringFor,
   runInReapedProcessGroup,
   shipWithRetry,
   shipFailureDetail,
@@ -3257,6 +3320,10 @@ async function runFleetFlight({
   root = process.cwd(),
   slots = 3,
   engines = null,
+  // --engine: every job goes to this one engine, and the picker is not asked.
+  engine = null,
+  // --pick: rating (the default) or turns. Turns deals engines to jobs in turn, as the fleet always did.
+  pick = '',
   dryRun = false,
   log = console.log,
   ownCli = null,
@@ -3274,24 +3341,40 @@ async function runFleetFlight({
 } = {}) {
   const cli = ownCli || defaultOwnCli(root);
   const landTarget = resolveDispatchLandTarget(root, checkoutBase);
-  // Staff first, rank second: every task staffFlight returns already cleared
+  // Staff, rank, then staff for real. Every task staffFlight returns already cleared
   // the safe-lane filter (not a decision row, no denied tags), so the rank
   // that pairs engines to those tasks is low stakes and the stretch zone
   // rule may trade the strongest engine for the cheapest learnable one.
   // Protected or denied work never reaches staffFlight's output, so it never
-  // gets the flag; when nothing is staffed there is no task to rank for and
-  // the flag stays off.
-  const staffedTasks = staffFlight(readProjectionTasks(root), { slots });
-  const rosterDetail = engines ? null : (() => {
+  // gets the flag; when nothing can be staffed there is no task to rank for and
+  // the flag stays off. That first question is asked of the list as it stands:
+  // the rank gives the roster, and the roster is what tells the jobs the flight
+  // can give an engine to from the ones it cannot, so no job is turned down yet.
+  if (engine && !FLEET_CAPABLE.includes(engine)) {
+    throw new Error(`runFleetFlight: engine "${engine}" cannot build in a fleet (capable: ${FLEET_CAPABLE.join(', ')})`);
+  }
+  const steer = steeringFor({ root, pick: engine ? 'turns' : pick, named: Boolean(engines) });
+  const listed = readProjectionTasks(root);
+  const anythingToStaff = staffFlight(listed, { slots }).length > 0;
+  const rosterDetail = engines || engine ? null : (() => {
     const { roster: fullRoster } = require('../commands/engine');
     const installed = fullRoster(root)
       .filter((e) => e.installed && FLEET_CAPABLE.includes(e.name))
       .map((e) => e.name);
-    return rankFleetEnginesDetailed(installed, root, { lowStakes: staffedTasks.length > 0 });
+    return rankFleetEnginesDetailed(installed, root, { lowStakes: anythingToStaff });
   })();
-  const roster = engines || rosterDetail.candidates;
-
-  const staffed = assignEngines(staffedTasks, roster);
+  const wholeRoster = engine ? [engine] : (engines || rosterDetail.candidates);
+  // The jobs whose chosen engine the roster cannot give are taken out first, each with its one line, and the slots and
+  // the file check are filled from what is left: a job left out takes no slot, and holds no file against a job that can go.
+  const staffedTasks = staffFlight(listed, { slots, eligible: steer.gives(wholeRoster) });
+  // The jobs are dealt in turn over the whole roster first: that is exactly what `--pick turns` gives. Steering
+  // then resolves every explicit choice against that whole roster (a job that names its engine, a job assigned
+  // to a member, whether or not that engine is resting) and picks for the rest from the engines that are ready:
+  // an engine that is out of credit, cooling after a stall, or one the Claude spend guard would stop sits this
+  // flight out. A caller that named its engines keeps every one of them in the pool.
+  const dealt = steer.deal(assignEngines(staffedTasks, wholeRoster), wholeRoster);
+  const roster = dealt.ready;
+  const staffed = dealt.entries;
   // The receipt path is decided BEFORE landings so each task's ready-proof
   // can cite it, the proof policy certifies receipt-backed proofs agent-side.
   const receiptPath = path.join(root, 'atris', 'runs', `fleet-${nowStamp()}.json`);
@@ -3300,7 +3383,7 @@ async function runFleetFlight({
     root,
     slots,
     roster,
-    staffed: staffed.map((s) => ({ task: s.task.display_id, title: String(s.task.title || '').slice(0, 140), engine: s.engine, surface: s.surface })),
+    staffed: staffed.map((s) => ({ task: s.task.display_id, title: String(s.task.title || '').slice(0, 140), engine: s.engine, surface: s.surface, ...(s.pick ? { pick: s.pick } : {}) })),
     stretch_zone_pick: rosterDetail && rosterDetail.stretch_zone_pick ? rosterDetail.stretch_zone_pick : null,
     results: [],
     landed: [],
@@ -3312,7 +3395,11 @@ async function runFleetFlight({
 
   log('');
   log(`  fleet, ${roster.length} engine${roster.length === 1 ? '' : 's'} ready, ${staffed.length} task${staffed.length === 1 ? '' : 's'} staffed`);
-  for (const s of staffed) log(`    ${s.engine.padEnd(8)} → ${s.task.display_id}  ${String(s.task.title || '').slice(0, 80)}`);
+  for (const note of dealt.notes) log(`  ${note}`);
+  for (const s of staffed) {
+    log(`    ${s.engine.padEnd(8)} → ${s.task.display_id}  ${String(s.task.title || '').slice(0, 80)}`);
+    if (s.pick) log(`      ${s.pick}`);
+  }
   log('');
 
   if (dryRun || staffed.length === 0) {
@@ -3326,6 +3413,12 @@ async function runFleetFlight({
   const lowDisk = lowDiskRefusal({ root, agent: 'fleet', task: 'flight', freeSpace, spaceGuard });
   if (lowDisk) return stopForLowDisk(flight, lowDisk, staffed.map((s) => ({ task: s.task.display_id, engine: s.engine })), log);
 
+  // A person's merge pays the builder with no command: the held-job check runs here, never before the disk look
+  // above (a flight that refuses writes nothing to any job) and never on a dry run: a dry run, and a flight with
+  // nothing staffed, end before this point. A pick that reads the results after this point (a retry choosing a
+  // fallback builder, say) sees what the check credited or released, and so does any pick in a later flight.
+  require('./held-autosweep').autoSweepHeld({ root });
+
   const liveLogPath = startLiveFlight(root, receiptPath, flight);
 
   // Claim + cut a worktree per assignment, then dispatch all in parallel.
@@ -3394,7 +3487,15 @@ async function runFleetFlight({
     // The row the list named is the row this claims, leases, proves and lets go of: named once,
     // by its row id, at every step (see jobRef).
     const rowRef = jobRef(entry.task, entry.task.display_id);
-    const claimed = claimJob({ cli, taskDb: leaseDb, db: leaseConnection, root, ref: rowRef, actor: `fleet-${entry.engine}` });
+    // The pick went on the words the list showed, who the job is assigned to and the engine it names. The claim asks
+    // the store for them again, inside its own transaction (see claimJob), and does not claim a job that now says
+    // something else: it is left for the next flight.
+    const claimed = claimJob({ cli, taskDb: leaseDb, db: leaseConnection, root, ref: rowRef, actor: `fleet-${entry.engine}`, refuseIf: steer.guardClaim(entry.task) });
+    if (claimed && claimed.choiceChanged) {
+      flight.paused.push({ task: entry.task.display_id, engine: entry.engine, stage: 'choice_changed', detail: CHOICE_CHANGED_DETAIL });
+      log(choiceChangedLine(entry.task.display_id));
+      continue;
+    }
     if (!claimed || claimed.status !== 0) {
       const detail = String(claimed && (claimed.stderr || claimed.stdout) || 'claim failed').trim().slice(0, 300);
       flight.paused.push({ task: entry.task.display_id, engine: entry.engine, stage: 'claim', detail });
@@ -3478,6 +3579,7 @@ async function runFleetFlight({
       defaultPin: fleetPrepPin(entry.engine, root),
       prepAsk,
       beforeEngine: markStarted,
+      steer,
     }).then((result) => {
       if (result.not_started) letGoNotStarted(entry, result);
       return { entry, result };
@@ -3511,6 +3613,7 @@ async function runFleetFlight({
     const landingEntry = { ...entry, engine: activeEngine };
     if (result.restaffed) log(`    restaffed ${entry.task.display_id}: ${result.restaffed.from} -> ${result.restaffed.to} (${result.restaffed.detail || result.restaffed.reason})`);
     if (result.handover) log(`    handed over ${entry.task.display_id}: ${result.handover_reason}`);
+    logPicks(log, result);
     const buildFailure = detectDeadEngineDispatch(result);
     if (buildFailure) {
       const paused = {
@@ -3760,7 +3863,13 @@ function storeHoldsJob(taskDb, db, ref) {
 // It answers like the task command (status 0, or status 1 and why), with eventId when it claimed in process. A
 // claim that landed but came back with no name is refused: the flight cannot tell later whether the job is
 // still its own, so it builds nothing on it and leaves it alone.
-function claimJob({ cli, taskDb, db, root, ref, actor, minutes = 60 }) {
+//
+// refuseIf is the flight's check on the job as it stands when the claim is made (see claimTask): asked inside the
+// claim's own transaction, so a job whose assigned member or named engine changed after the pick is not claimed for
+// the old choice. The answer then carries choiceChanged, and the task list files are drawn again from the store, so
+// the next flight reads the job as it is now and not as the old list had it. A job the store holds no row for is
+// claimed through the task command, as it always was: there is no row to ask.
+function claimJob({ cli, taskDb, db, root, ref, actor, minutes = 60, refuseIf = null }) {
   if (!storeHoldsJob(taskDb, db, ref)) {
     return cli(['task', 'claim', ref, '--as', actor, '--lease-minutes', String(minutes), '--lease-pid', String(process.pid)]);
   }
@@ -3779,12 +3888,14 @@ function claimJob({ cli, taskDb, db, root, ref, actor, minutes = 60 }) {
   taskDb.sweepExpiredLeases();
   let result;
   try {
-    result = taskDb.claimTask(db, { id: ref, claimedBy: actor, leaseMinutes: minutes, leasePid: process.pid });
+    result = taskDb.claimTask(db, { id: ref, claimedBy: actor, leaseMinutes: minutes, leasePid: process.pid, refuseIf });
   } catch (err) {
     return { status: 1, stdout: '', stderr: `claim failed: ${String(err?.message ?? err).trim() || 'unknown'}` };
   }
   if (!result.claimed) {
-    return { status: 1, stdout: '', stderr: `claim failed: ${result.reason}${result.claimed_by ? ` (held by ${result.claimed_by})` : ''}` };
+    const changed = Boolean(refuseIf) && result.reason === CHOICE_CHANGED;
+    if (changed) redrawTaskFiles({ taskDb, db, root });
+    return { status: 1, stdout: '', stderr: `claim failed: ${result.reason}${result.claimed_by ? ` (held by ${result.claimed_by})` : ''}`, ...(changed ? { choiceChanged: true } : {}) };
   }
   redrawTaskFiles({ taskDb, db, root });
   const eventId = result.event && result.event.event_id;
@@ -3795,6 +3906,11 @@ function claimJob({ cli, taskDb, db, root, ref, actor, minutes = 60 }) {
 // The one plain line for a job another run has claimed since this flight made its own claim.
 const claimTakenOverLine = (task) => `    left ${task} alone: another run claimed it after this one did`;
 
+// The one plain line for a job whose assigned member or named engine changed after this flight picked an engine for it:
+// the claim was refused, and the job waits for the next flight, which reads it as it is now.
+const CHOICE_CHANGED_DETAIL = 'who it is assigned to, or the engine it names, changed after this flight read the list';
+const choiceChangedLine = (task) => `    left ${task} for the next flight: ${CHOICE_CHANGED_DETAIL}`;
+
 // The one plain line for a job whose claim this flight no longer holds when it is about to ask the engine.
 const LOST_CLAIM_DETAIL = 'this run no longer holds the claim, so the engine was not started and the job was left alone';
 const claimLostLine = (task) => `    ${task}: ${LOST_CLAIM_DETAIL}`;
@@ -4141,6 +4257,9 @@ async function runDispatchFlight({
   // The disk check before anything is claimed (see lowDiskRefusal). Tests inject both.
   freeSpace = undefined,
   spaceGuard = undefined,
+  // --pick: rating (the default) or turns. The engine asked first is the caller's choice and stays; steering
+  // orders what comes after a dead or stalled engine.
+  pick = '',
 } = {}) {
   if (!engine) throw new Error('runDispatchFlight: engine is required');
   if (!DISPATCH_CAPABLE.includes(engine)) {
@@ -4205,6 +4324,10 @@ async function runDispatchFlight({
   // the flight writes anything into its folder.
   const workspace = leaseDb.workspaceRoot(root);
   try { leaseDb.expireLeases(leaseConnection); } catch (err) { if (process.env.ATRIS_DEBUG) process.stderr.write(`lease sweep failed: ${String(err?.message ?? err).replace(/[\r\n]+/g, ' ')}\n`); }
+  // A person's merge pays the builder with no command: the held-job check runs here, never before the disk look
+  // above. A pick that reads the results after this point (the picker is made below, and a retry choosing a
+  // fallback builder reads them) sees what the check credited or released, and so does any pick in a later flight.
+  require('./held-autosweep').autoSweepHeld({ root });
   // Cut worktrees from, and check self-landing against, the workspace's real
   // protected branch, not a hard-coded origin/master (CLI-1298).
   const localBase = reviewOnly ? '' : localDispatchBase(root);
@@ -4416,6 +4539,7 @@ async function runDispatchFlight({
     }));
   }));
   const restaffState = { used: false };
+  const steer = steeringFor({ root, pick, named: Boolean(installedEngines), sealed: enforceRemoteBoundary });
 
   if (engine === 'fable' && prepared.length) {
     log(`  fable handoff started: receipt ${path.relative(root, receiptPath)}`);
@@ -4470,6 +4594,7 @@ async function runDispatchFlight({
       job: rosterJob,
       prepAsk,
       beforeEngine: markStarted,
+      steer,
     }).then((result) => {
       if (result.not_started) letGoNotStarted(entry, result);
       const completedAtMs = Date.now();
@@ -4624,6 +4749,7 @@ async function runDispatchFlight({
     const landingEntry = { ...entry, engine: activeEngine, candidate };
     if (result.restaffed) log(`    restaffed ${entry.taskId}: ${result.restaffed.from} -> ${result.restaffed.to} (${result.restaffed.detail || result.restaffed.reason})`);
     if (result.handover) log(`    handed over ${entry.taskId}: ${result.handover_reason}`);
+    logPicks(log, result);
     const buildFailure = detectDeadEngineDispatch(result);
     if (buildFailure) {
       const paused = {

package/lib/gm-season.js

@@ -374,10 +374,7 @@ function outcomeFromEvent(row) {
   } else if (row.event_type === 'claim_expired') {
     kind = 'dropped';
     member = payload.claimed_by;
-  } else if ((row.event_type === 'proof_ready' || row.event_type === 'landing') && hasStructuredMerge(payload)) {
-    kind = 'landed';
-    member = holder;
-  } else if (row.event_type === 'completed' && KEPT_ACTIONS.has(payload.action)) {
+  } else if (isLandingRecord(row.event_type, payload)) {
     kind = 'landed';
     member = holder;
   } else if (row.event_type === 'revision_requested' || row.event_type === 'reopened') {
@@ -410,6 +407,15 @@ function outcomeFromEvent(row) {
   };
 }
 
+// Whether an event records a landing: a proof or landing event that names its merge, or a completion marked kept.
+// The rating counts each of these as a landed play, and the builder picker (lib/builder-pick.js) reads every one of
+// them, in every workspace of the store, to find which job recorded a commit first.
+function isLandingRecord(eventType, payload) {
+  const body = payload && typeof payload === 'object' ? payload : {};
+  return ((eventType === 'proof_ready' || eventType === 'landing') && hasStructuredMerge(body)) ||
+    (eventType === 'completed' && KEPT_ACTIONS.has(body.action));
+}
+
 function hasStructuredMerge(payload) {
   const objects = [payload, payload.landing, payload.pull_request, payload.pr].filter(x => x && typeof x === 'object' && !Array.isArray(x));
   return objects.some(x => {
@@ -683,6 +689,27 @@ function openReleasePlays(db, workspaceRoot) {
   return plays;
 }
 
+// Only the plays: the same rows and the same outcome builder as loadSeason, without the board around them
+// (open tasks, reviews, claims, targets, who is asleep). A reader that only counts plays uses this, because the
+// rest of loadSeason costs more the more tasks the workspace has ever held. Opens the db read-only.
+function loadOutcomes(workspaceRoot, { now = Date.now(), days = SEASON_DAYS, dbPath } = {}) {
+  const target = dbPath || require('./task-db').getDbPath();
+  if (!fs.existsSync(target)) return { outcomes: [], no_history: true };
+  let db;
+  try {
+    const { DatabaseSync } = require('node:sqlite');
+    db = new DatabaseSync(target, { readOnly: true });
+    const since = now - days * DAY_MS;
+    return { outcomes: outcomesFromEvents(db.prepare(playEventsSql('AND e.workspace_root = ?')).all(since, workspaceRoot), since) };
+  } catch (err) {
+    return { outcomes: [], error: err && err.message ? err.message : String(err) };
+  } finally {
+    if (db) {
+      try { db.close(); } catch {}
+    }
+  }
+}
+
 // The one loader: last 30 days of plays for a workspace, plus open claims,
 // who is asleep, and what is up next. Opens the db read-only.
 // `lastSeen` pins the recap to a session's opening look; without it the
@@ -1332,6 +1359,7 @@ function loadReplay({ workspaceRoot = null, since, now = Date.now(), dbPath, lea
 module.exports = {
   ageLabel,
   closeNames,
+  isLandingRecord,
   isSafeMemberName,
   rosterEngine,
   loadCard,
@@ -1353,6 +1381,7 @@ module.exports = {
   clockLabel,
   form,
   lastPlays,
+  loadOutcomes,
   loadSeason,
   memberRatings,
   missReasons,