cloving 1.4.0 → 1.5.0

package/README.md

@@ -100,7 +100,7 @@ For a project-local tarball installation, use `./node_modules/.bin/cloving` wher
 
 Each file requires `"version": 1`. Environment settings override private settings, which override project settings, which override built-in defaults. The start guide names each configured field's source: `environment`, `private` or `project`.
 
-The project file supports `checks.beforeMerge`, `checks.required`, `checks.redGreen`, `tickets.command`, `tickets.nextCommand`, `queue.everySeconds`, `queue.lanes` and `queue.dailySpendLimitUsd`. The private file supports these same fields plus `harness.name`, `harness.kind`, `harness.path`, `harness.command`, `harness.turn`, `harness.output`, `profiles`, `fallbackModels`, `tokenPrices`, `privateTexts`, `notify.command`, `watch.port`, `watch.actions`, `selfUpdate.everySeconds`, `github.command` and `workflows.folder`. Commands are arrays of arguments; seconds, lanes, spend limits and ports are numbers. A watch port can also be `"off"`; watch actions are `"on"` or `"off"`.
+The project file supports `checks.beforeMerge`, `checks.required`, `checks.redGreen`, `tickets.command`, `tickets.nextCommand`, `queue.everySeconds`, `queue.lanes` and `queue.dailySpendLimitUsd`. The private file supports these same fields plus `harness.name`, `harness.kind`, `harness.path`, `harness.command`, `harness.turn`, `harness.output`, `profiles`, `fallbackModels`, `tokenPrices`, `privateTexts`, `notify.command`, `watch.port`, `watch.actions`, `selfUpdate.everySeconds`, `github.command`, `workflows.folder`, `retention.days`, `retention.action` and `retention.archiveFolder`. Commands are arrays of arguments; seconds, lanes, spend limits and ports are numbers. A watch port can also be `"off"`; watch actions are `"on"` or `"off"`. The retention days are a whole number of at least 1, or `null` to keep all records; the default is 30. The retention action is `"archive"` or `"delete"`; the default is `"archive"`. The archive folder is an absolute path, or `null` for the `archive` folder in the state folder.
 
 For example, a shared `.cloving/config.json` can contain:
 
@@ -126,16 +126,18 @@ cloving config unset queue.lanes --private
 
 All four commands accept `--json` and `--repository <directory>`. Use the setting names listed above; `profiles` and `tokenPrices` are whole JSON maps, and dictionary subpaths are unknown settings. Values are parsed as JSON, falling back to text. Changes are validated before writing and go to the field's default file; `--private` writes an override in the private file. `list` and `get` show each value's source, including `default`, and all hidden file values. JSON results have `schemaVersion: 1`; list returns a `settings` array, get returns `field`, `value`, `source` and `hidden`. A default `null` means no configured value. Mutation results include `field`, `scope`, `action` and `notice`; notice is null when no service is running.
 
-Each change holds a file lock from read through atomic replacement, keeping the previous bytes as `<file>.bak`. A first write needs no backup. Private files, backups and temporary files have mode 0600. Locks from stopped processes are reclaimed; a live lock waits at most ten seconds, then exits with `settings-locked`. Invalid settings and unknown fields exit with status 2 without changing a file. For a running service, the result explains whether to restart to use the new value or whether an environment or private source will keep hiding it after a restart. Settings do not reload automatically.
+Each change holds a file lock from read through atomic replacement, keeping the previous bytes as `<file>.bak`. A first write needs no backup. Private files, backups and temporary files have mode 0600. Locks from stopped processes are reclaimed; a live lock waits at most ten seconds, then exits with `settings-locked`. Invalid settings and unknown fields exit with status 2 without changing a file. For a running service, the result explains whether to run `cloving reload` or to restart to use the new value, or whether an environment or private source will keep hiding it after a restart. Settings do not reload automatically.
 
 Changing or unsetting `harness.name` clears kind, path and command. Changing or unsetting kind clears path and command; changing or unsetting path clears command. This keeps the previous harness's configuration from carrying into a new selection.
 
 The package includes [the project schema](src/project-config.schema.json) and [the private schema](src/private-config.schema.json), also installed under `dist/src/`. Unknown fields fail with `unknown-setting: <field>`, invalid values with `invalid-setting: <field>`, and unsupported or missing versions with `unsupported-config-version: version`. Private fields in the project file fail with `private-setting-in-project-file: <field>`. Files cannot set runtime directories, ownership leases, host bounds or the watch repository; those remain environment settings.
 
-Run `cloving doctor` from the repository before starting the service. It lists each requirement with a fixed code, `ok`, `fail` or `skip`, and a fixing command. Required failures and skipped prerequisites exit with status 1. `cloving doctor --json` prints the same checks as `{ "version": 1, "checks": [...] }` for setup agents.
+Run `cloving doctor` from the repository before starting the service. It lists each requirement with a fixed code, `ok`, `warn`, `fail` or `skip`, and a fixing command. Required failures and skipped prerequisites exit with status 1. A warning does not change the exit status. `cloving doctor --json` prints the same checks as `{ "version": 1, "checks": [...] }` for setup agents.
 
 The required `no-workflow` check fails when neither the project nor the user folder has a workflow declaration. Its fix is `cloving init`. During `cloving init-prompt` setup, defer this check to the template step, copy or create the workflow, then run doctor again. `no-workflow` must report `ok` before setup is ready.
 
+The optional `retention` check shows the size and the folder count of `journal/` and `github/` in the state folder, the age of the oldest kept record folder, and the values of `retention.days`, `retention.action` and `retention.archiveFolder`. The size includes all files in the two folders. The folder count and the age include only the record folders that the retention rule can archive or delete. The age of a folder starts at the change time of its newest file. The check gives `warn` when `retention.days` is `null` and the records are larger than 1 GB (1,000,000,000 bytes). An invalid retention setting fails the check and names the variable.
+
 Doctor probes harness versions and effective executable paths without running a turn. Shell scripts and simple `node script` wrappers receive `--version` from the repository folder; unsupported launcher arguments fail the probe. GitHub login and reads use the origin's host, including GitHub Enterprise. GitHub calls are reads limited to ten seconds each; a service probe waits at most five seconds. Recent Greptile activity does not establish that a usable review is available, and missing activity does not prove the app is absent.
 
 ## First run
@@ -169,7 +171,7 @@ The form sends the same run request as the CLI and retains its random command ID
 - `CLOVING_NOTIFY_COMMAND`: a JSON list naming a command to notify the operator about pending decisions, blocked runs, failed runs and stopped schedules. It has no default.
 - `CLOVING_NEXT_COMMAND`: a JSON list of a command and its arguments that prints the next ready ticket ID for `--next`. It has no default.
 - `CLOVING_CLAUDE_COMMAND`: a replacement of the `claude` command of the worker.
-- `CLOVING_PROFILES`: a JSON file of named turn profiles, read once when the service starts.
+- `CLOVING_PROFILES`: a JSON file of named turn profiles. The service reads it at the start and at each `cloving reload`.
 - `CLOVING_COMMANDS`: a JSON object mapping command names to argument arrays, such as `{"review-requests":["/opt/cloving/scan-reviews.mjs"]}`. Names contain 1–64 ASCII letters, digits or hyphens; the first argument must be an absolute executable path. Unset means no commands. Invalid values stop startup with `invalid-commands`.
 - `CLOVING_COMMAND_SECONDS`: a whole number from 1 to 3600, default 60. Invalid values stop startup with `invalid-command-seconds`. A command exceeding the deadline fails with `command-timeout`.
 - `CLOVING_WATCH_ACTIONS`: `off` disables starting runs from the board; default `on`.
@@ -186,6 +188,63 @@ The private `notify-events.json` journal records a notification as `pending` bef
 
 Journal updates use a temporary file and rename. Sent and exhausted failed delivery details expire after seven days; their keys remain to prevent later duplicate delivery. Unfinished deliveries remain until resolved. A crash after command success but before recording that success can repeat delivery. Decisions opened and closed between checks can be missed.
 
+#### Read API of the watch page
+
+The watch page has a read API at `http://127.0.0.1:3663/api/v1`. Its OpenAPI 3.1 document is at `http://127.0.0.1:3663/api/v1/openapi.json`. OpenAPI client generators can read the document and make a typed client. The API accepts only `GET` and needs no authentication. An error reply is `application/problem+json` with a `code` member, for example `not-found` or `invalid-query`.
+
+- `GET /api/v1/` gives the version of the API and its endpoints.
+- `GET /api/v1/openapi.json` gives the OpenAPI document.
+- `GET /api/v1/service` tells if the Cloving service answers.
+- `GET /api/v1/workflows` gives the workflows with their counts and card fields.
+- `GET /api/v1/runs` gives one page of runs, newest first. The query parameters `workflowId`, `state`, `limit` (1 to 200, default 50) and `cursor` select the runs. The `nextCursor` of a page gives the next page.
+- `GET /api/v1/runs/{runId}` gives one run with its phases, open decisions, reviews and agent turns.
+- `GET /api/v1/runs/{runId}/events` gives the events of one run, the lowest sequence first. The query parameter `after` (default 0) gives only the events with a higher sequence.
+- `GET /api/v1/stream` sends Server-Sent Events. Each message has the event `change` and the data `{"updatedAt":"<time>"}`. Read the runs again when a message arrives.
+
+Replace `<run-id>` with the ID of a run of `develop`, for example from the run list:
+
+```sh
+curl http://127.0.0.1:3663/api/v1/
+curl http://127.0.0.1:3663/api/v1/openapi.json
+curl http://127.0.0.1:3663/api/v1/service
+curl http://127.0.0.1:3663/api/v1/workflows
+curl 'http://127.0.0.1:3663/api/v1/runs?workflowId=develop&state=waiting_gate&limit=20'
+curl 'http://127.0.0.1:3663/api/v1/runs/<run-id>'
+curl 'http://127.0.0.1:3663/api/v1/runs/<run-id>/events?after=40'
+curl -N http://127.0.0.1:3663/api/v1/stream
+```
+
+The run list has the active runs and the runs of the last 7 days. The run detail reads each run, also a run older than 7 days. The events endpoint gives no event payloads, and the API has no write endpoint.
+
+### Use Cloving from an MCP client
+
+`cloving mcp --repository <directory>` serves Cloving tools to an MCP client over standard input and output. The server connects to the service of that repository. Start the service with `cloving start` before the client calls a tool.
+
+Register the server in Claude Code:
+
+```sh
+claude mcp add cloving -- cloving mcp --repository <directory>
+```
+
+Register the server in Codex with this table in `~/.codex/config.toml`:
+
+```toml
+[mcp_servers.cloving]
+command = "cloving"
+args = ["mcp", "--repository", "<directory>"]
+```
+
+The server has ten tools:
+
+- `cloving_status`, `cloving_questions` and `cloving_events` read the runs, the pending decisions and the events, as `cloving status`, `cloving questions` and `cloving events` do.
+- `cloving_run` submits a run, as `cloving run` does. Give exactly one source: `prompt`, `ticket` (a ticket ID or `next`) or `input` (a JSON object, not a file path).
+- `cloving_answer`, `cloving_approve` and `cloving_deny` record a decision. Read `reference`, `expectedRevision`, `generation` and `subjectDigest` from `cloving_questions`.
+- `cloving_pause`, `cloving_resume` and `cloving_drop` send a run command with the `expectedRevision` of the run.
+
+Each of the seven tools that change state requires a `commandId`. The server never makes a command ID. After a lost reply (`outcome-unknown`), send the same request with the same `commandId` again. The service then gives the stored receipt, also when the first request came from the CLI. A tool gives the same JSON object as the CLI command with `--json`. A refusal of the service gives `isError: true`, and an argument that is not valid gives the JSON-RPC error `-32602`. A cancel of a tool call stops the wait for the reply, but it does not cancel a command that the service admitted.
+
+A tool call cannot start the service and cannot select a different repository. The server binds to one repository when it starts.
+
 ### Answer decisions from a phone
 
 Cloving can send its pending decisions to the Cloving app on your phone, and the phone can answer them. `cloving start` runs the phone relay as a child process. `CLOVING_PHONE_RELAY` with the value `off` starts no relay. `CLOVING_RELAY_ORIGIN` selects the relay server; the default is `https://cloving.ai`.
@@ -273,6 +332,10 @@ Operator values combine GitHub merges and repository issue-label events with dae
 
 `cloving start` compiles and registers only project and user workflows. The start guide lists each registered workflow with a run command that matches its input contract. With no workflow, the service still starts and prints "No workflow. Run: cloving init". Status continues to show stored runs after their workflows have been removed.
 
+To add, change or remove a workflow file while the service runs, run `cloving reload`. The service checks and compiles the workflow files again in a child process. New runs use the new bundle. A run that started before the reload stays on the bundle of its pin, and its agent turn continues. When a workflow file gets a new refusal, for example a compile error, the reload keeps the current workflows and shows the reason. A change of the queue workflow or of a schedule needs a restart. After you remove all workflow files, a reload removes all workflows. `cloving status --json` shows the current `bundleDigest`.
+
+The reload also reads the settings files and the profiles file again. It applies changes of `profiles`, `fallbackModels`, `tokenPrices` and `workflows.folder`. New turns use the new values, and a turn in work keeps the values of its start. A changed `workflows.folder` applies to the workflow part of the same reload. The reply lists these fields in `reloadedFields`. It lists each other changed field in `restartFields`, and the service keeps the old value of that field until a restart. The environment variables of the start keep their precedence over the files. An invalid settings file, an invalid profiles file or a profile that names a harness with no worker at the start of the service refuses the reload with its code, for example `invalid-config-json`, `invalid-profiles` or `harness-no-worker`. Then nothing changes.
+
 Use `cloving init` to choose and configure a template. The `develop` template supports ticket input, queue selection, review and merge choices. The `idea-to-issue` template researches an idea and hands the resulting issue to a declared development workflow. The commands below assume those templates have been copied and configured:
 
 ```sh
@@ -291,6 +354,8 @@ The rule: read the diff before you approve.
 
 Claude turns have web research tools by default, an empty GitHub CLI configuration folder, and no GitHub token environment variables. This is not a sandbox: a turn can still find other credentials. The PRD refusal rules catch the listed private text and common sensitive forms; unlisted private names can pass. A `post-uncertain` result requires checking GitHub before trying another run.
 
+`cloving status --active` lists only the runs that are not `completed`, `failed` or `cancelled`. It uses the same order and format as `cloving status`. The service selects the active runs before it builds a run view. Thus it makes no view query for a finished run. The number of queries does not change with the number of finished runs, but the service still reads the stored state of each run. `--active` works with `--json`, `--limit` and `--after`. With `--json`, one request returns one page of active runs and its `next` cursor.
+
 `cloving status RUN_ID --json` includes `run.input`, and `cloving status --json` includes `input` on each listed run. It is the normalized submission admitted with the run, such as `{"ticket":"297"}` for a ticket workflow or the submitted fields of another declared workflow. It survives service restarts and excludes resolver-added ticket text and repository paths. Older runs without a stored submission show `null`. The text status of one run shows `Input:` as compact JSON, limited to the first 200 characters with `…` appended when longer. Terminal control and hidden format characters are escaped.
 
 ### The ticket command
@@ -332,7 +397,7 @@ Before enabling more than one lane, update the next-ticket command to honor `CLO
 
 In the ticket text returned by `CLOVING_TICKET_COMMAND`, each `#N` in a sentence starting with **Needs** inside `## Dependencies` is a hard dependency. For example, `Needs #123 and #124.` waits until both GitHub issues close. Other references and sections do not create dependencies. Cloving reads dependency state with `CLOVING_GH_COMMAND` (default `gh`); an unavailable or invalid response prevents admission. An open dependency returns `ticket-dependency-open` and puts the ticket in the skip list. Waiting tickets are checked again each cycle with a free lane, so a closed dependency makes its ticket eligible again.
 
-`cloving status` and watch display busy lanes and skipped tickets with their reasons. A pending self-update holds new admissions while active lanes drain. Three unsuccessful runs in a row, counted in the order they finish, stop the queue; a successful handoff clears the streak. Ordinary restarts preserve it. After inspecting and reconciling the failures, start with `--reset-queue` to clear the streak. A conflict caused by an earlier lane's merge returns its diagnostics to a fix round. Lanes do not add CI runners or parallelize turns within one run.
+`cloving status` and watch display the queue state, busy lanes and skipped tickets with their reasons. A pending self-update holds new admissions while active lanes drain. Three unsuccessful runs in a row, counted in the order they finish, stop the queue; a successful handoff clears the streak. Ordinary restarts preserve it. After inspecting and reconciling the failures, run `cloving queue resume`, or start with `--reset-queue`, to clear the streak. A conflict caused by an earlier lane's merge returns its diagnostics to a fix round. The merge steps of one repository take turns: a step waits until the earlier step ends, and then it merges `main`, runs the merge check, pushes and waits for CI. Lanes do not add CI runners or parallelize turns within one run.
 
 An empty selection gives `no-ready-ticket`; a failed command gives `next-ticket-not-available`. Missing configuration gives `next-source-not-configured`. Multiple IDs, an invalid ID, or `next` as the selected ID give `invalid-ticket-id`. Use only one of `--next`, `--ticket`, `--prompt` and `--input`.
 
@@ -346,7 +411,7 @@ Worker turns retry an exact Codex capacity refusal or a Claude overload after 60
 
 Each retry keeps the work tree, profile, budget and limits, and starts a new session with a continuation line before the full prompt. After any network failure, every later attempt gets the network continuation, which asks it to check earlier commits, pushes, review comments and messages, avoid repeating completed writes, and stop to report a write whose result is unknown. It also gets fresh git evidence for commits since this turn's first attempt. Cloving fetches the branch from `origin` and marks each commit `pushed`, `not pushed` or `unknown`; an absent origin branch means `not pushed`. Each git command has a 30-second limit and is cancelled by drop. Failed reads give explicit unknown evidence.
 
-Before a retry, Cloving checks the work tree's git index lock, including linked work trees. Capacity and network retries never remove a lock: `worktree-index-locked` records its path and tells the operator to remove it when no git process uses the work tree. Before a Claude resume after a daemon restart or a dead turn process, Cloving stops same-user processes whose working directories are in the turn work tree, waits up to 15 seconds after SIGTERM, then sends SIGKILL. The daemon itself and processes outside that tree are excluded. Cloving removes a work tree index lock only when it identified the lock owners before cleanup, those owners have exited, and the lock has not changed. A lock with an unknown owner, including one whose owner closed its descriptor, stays in place and reports `worktree-index-locked`; inspect its owner before removing it manually. Stopped process IDs are recorded in `resume-processes.json` in the turn folder. An unreadable index path gives `worktree-index-unknown`. Neither failure starts another attempt. The step keeps one operation identity and sums usage across attempts. Private turn journals, status text and JSON, and watch retain each attempt's model, token counts, cost estimate and `retryKind` (`capacity`, `network`, or `null` for other results). Older attempts without the field show no kind. Attempt kinds appear after the turn ends. Resumed attempts also show `resumedAfter: daemon-restart` in status text, JSON and watch.
+Before a retry, Cloving checks the work tree's git index lock, including linked work trees. Capacity and network retries never remove a lock: `worktree-index-locked` records its path and tells the operator to remove it when no git process uses the work tree. Before a Claude resume after a daemon restart or a dead turn process, Cloving stops same-user processes whose working directories are in the turn work tree, waits up to 15 seconds after SIGTERM, then sends SIGKILL. Cloving does the same cleanup before it reports `claude-turn-interrupted` for a turn that it cannot resume, so a later turn does not share the work tree with an earlier process. A cleanup failure gives its own reason instead of `claude-turn-interrupted`. The daemon itself and processes outside that tree are excluded. Cloving removes a work tree index lock only when it identified the lock owners before cleanup, those owners have exited, and the lock has not changed. A lock with an unknown owner, including one whose owner closed its descriptor, stays in place and reports `worktree-index-locked`; inspect its owner before removing it manually. Stopped process IDs are recorded in `resume-processes.json` in the turn folder. An unreadable index path gives `worktree-index-unknown`. Neither failure starts another attempt. The step keeps one operation identity and sums usage across attempts. Private turn journals, status text and JSON, and watch retain each attempt's model, token counts, cost estimate and `retryKind` (`capacity`, `network`, or `null` for other results). Older attempts without the field show no kind. Attempt kinds appear after the turn ends. Resumed attempts also show `resumedAfter: daemon-restart` in status text, JSON and watch.
 
 `CLOVING_FALLBACK_MODELS` accepts a JSON array of at most three nonempty model names, for example `'["gpt-6-astra"]'`. Without the setting or with `[]`, every attempt keeps the main model. The first attempt and first retry use the main model; each later attempt uses the next configured fallback within the existing attempt limit. With three attempts, only the first fallback can be used. The worker command must explicitly name a model with `-m NAME`, `--model NAME` or `--model=NAME`; otherwise it stays unchanged and the private journal records `fallback-model-unavailable`. Fallbacks apply only when the preceding attempt ended with a capacity refusal. A network retry keeps the model of the configured command. A fallback model can have a higher price. Each attempt's estimate uses its own model's price; an unknown price or missing token count leaves the total estimate unknown. Malformed settings refuse daemon start with `invalid-fallback-models`.
 
@@ -360,6 +425,8 @@ The worker is not confined. It runs the `claude` command of the search path as t
 
 Single-run status (`cloving status RUN_ID`, also with `--json`) and watch show each worker command call and its run totals. Token counts retain the reported input, cache read and output categories separately. Codex input includes cached tokens; cache read tokens are not added to input tokens. These selected counts are not complete billing usage or a record of all subagent work. Missing or invalid fields show `Token usage not known`. Costs show the worker-reported USD price when available, otherwise `≈ 7.82 USD (estimate)` when an estimate is available, otherwise `Price not known`; a reported zero shows `0.00 USD`. Totals for an unfinished run are labeled `so far`. JSON uses `null` for unknown numeric values, retains the total reported price field `claudeCostUsd`, and adds `costDisplay` to the run and each worker turn.
 
+The totals of a run stay in the service state after the retention rule moves its operation records. When a turn folder of the run is in the `journal` folder of the archive, single-run status shows `Turn details are archived in the journal folder of the archive: <folder>`, and JSON adds `run.turnDetails` as `{ "state": "archived", "folder": "<archive>/journal" }`. With the `delete` action, status shows `Turn details were deleted by the retention rule`, and JSON adds `{ "state": "deleted" }`. The daemon shows a deletion only for a finished run that ended before the retention period and has no turn folder in the state folder. Runs with kept records have no `turnDetails` field.
+
 The built-in table uses standard short-context prices read on **2026-10-18** from the [OpenAI pricing page](https://openai.com/api/pricing/), in USD per million tokens:
 
 | Model         | Input | Cached input | Output |
@@ -452,7 +519,9 @@ The last worker report must end with exactly one line: `Ticket status: complete`
 
 After a merge, a protected GitHub operation updates the issue body and labels. Complete work closes the issue with reason `completed` and adds "Completed in pull request #M." to `## Cloving status`. Partial work keeps the issue open and appends `- Pull request #M: partial. Remaining: ...` to that section at the end of the body, preserving earlier partial lines and other body text. Items are separated by semicolons. The issue privacy check runs before new remaining text is written; a refusal uses "Remaining work is in the private run report." instead. No issue comment is posted. Status writes add and remove only workflow labels, preserving unrelated label edits. Before a body write, Cloving rereads the issue and refuses a changed body with `github-issue-conflict`; the merged outcome records `issueUpdate: failed`. GitHub does not support conditional PATCH requests for this endpoint, so this check cannot make the read and write atomic.
 
-Partial work removes `cloving: in progress` and adds `cloving: ready`, so the next queue cycle can select the same issue and read its remaining work from the issue body. The third partial run adds `cloving: blocked` instead of `cloving: ready`. Completion removes these workflow labels. Status operations reconcile the pull request number in the stored history after a restart to avoid duplicate writes. The unmodified develop template declares an effect limit of 27 units.
+Partial work removes `cloving: in progress` and adds `cloving: ready`, so the next queue cycle can select the same issue and read its remaining work from the issue body. The third partial run adds `cloving: blocked` instead of `cloving: ready`. Completion removes these workflow labels. Status operations reconcile the pull request number in the stored history after a restart to avoid duplicate writes. The unmodified develop template declares an effect limit of 31 units.
+
+When a worker turn ends with `claude-turn-interrupted`, the develop template runs the turn again once in the same work tree. This occurs when the daemon cannot resume an open turn after a restart, for example when the turn has no recorded session. The prompt of the new turn tells the worker that the earlier turn stopped before its report, and that the work tree holds its work. A second interruption of the same turn ends the run as blocked with the reason `turn-interrupted` and adds `cloving: blocked`. Other turn failures fail the run.
 
 Partial history comes only from a hidden HTML comment at the end of the issue body, beginning with `cloving-status`. Its JSON object has `version: 1`, a `partialRuns` array of pull request numbers and remaining-item lists, and an optional `completedPullRequest`. Double hyphens and greater-than signs in JSON strings are escaped so they cannot end the comment. Each write regenerates the readable section from this data and replaces the exact previously generated section. Other Markdown stays unchanged, including status examples, lists, tables, HTML and unclosed fences. Missing, broken or unknown metadata counts as zero earlier partial runs and is replaced on the next write; readable text is never used to reconstruct history. A block followed by other issue text is left unchanged and counts as missing terminal metadata.
 
@@ -462,6 +531,20 @@ Merged runs retain `handoff_requested` with `ticketStatus: complete` or `partial
 
 To resume a queue stopped at this limit, stop the service with Control-C, inspect the failures and reconcile the affected issues, then run `cloving start --reset-queue` with the same repository, runtime and queue settings. This clears the failure streak once and preserves tracked commands. Ordinary restarts, including automatic self-updates, preserve the count. Resetting the queue does not change issue labels or retry blocked issues.
 
+### Queue control
+
+The operator controls the queue of a running service with three commands. Each command uses the service protocol, and `--json` prints one JSON object.
+
+- `cloving queue [--json]` shows the state of the queue: `running`, `stopped`, `draining` or `drained`. It also shows the busy lanes, the failed runs in a row and, for a stopped queue, the reason. `cloving status` and the watch page show the same state.
+- `cloving queue resume [--command-id <id>] [--json]` sets the failure count to 0 and ends a stop or a drain. The next queue check can start a ready ticket. No restart is necessary.
+- `cloving queue drain [--command-id <id>] [--json]` makes the queue start no new run. The runs in work continue to their end. When no lane is busy, the queue journal records the drain time, the service log shows `Queue drained` one time, and the state changes to `drained`. Until the queue records that time, the state stays `draining`.
+
+A drained queue is a safe point for a restart. The drain stays in place after a restart. `cloving queue resume` or `cloving start --reset-queue` ends it. A drain does not stop manual runs. A manual run that starts after the drain time shows `draining` until the run ends.
+
+With no `--command-id`, the command makes an ID. The text output prints it on standard error, and the JSON result includes it as `commandId`. The queue journal keeps the newest 32 command IDs across restarts. A repeated command with a kept ID does not apply the command again, and the reply shows the current queue state with `replayed: true`. A different command with a kept ID gets `conflicting-command`. The queue applies a command with an older ID as a new command.
+
+A queue that stopped on an error shows the error as the reason and refuses commands until a restart. An invalid queue journal and a queue command that the journal cannot save are two examples of these errors.
+
 At the confidence score 5/5, the worker runs the local merge check and waits for CI of the exact head it will merge, including an updated head pushed after merging the default branch. When CI passes, it merges the pull request with a merge commit, with no human approval. Then it removes the remote branch, the work tree and the local branch. With a lower score, the Claude worker gets the summary and the findings of the review for one more round. After three such rounds, or after 60 minutes with no review, the run stops and the pull request stays open.
 
 Set `CLOVING_REQUIRED_CHECKS` to a JSON list of check run names, such as `["quality", "quality_linux"]`, to require those checks. Without the setting, all GitHub Actions checks on the head commit are required. The newest run of each name decides; `success`, `neutral` and `skipped` pass. With no setting and no Actions checks after a 60-second grace period, a repository without CI can merge. A configured missing check keeps waiting. CI is polled every 30 seconds with a separate 90-minute limit. A timeout returns `ci-pending` and blocks without a fix round.
@@ -805,7 +888,7 @@ const attached = await protectedEffect({
 });
 ```
 
-The method uploads the file as an asset of the release `release`, with the asset name `pr-<number>-<name>`. Then it creates or updates one comment on the pull request with a link to the asset, so a second call adds no second comment. When the release does not exist, the method creates it as a pre-release that is not the latest release. `name` is a file name with the extension `.mp4`, `.webm` or `.png`. The file must be a regular file of at most 100 MB, and a symbolic link is refused. `release` has lowercase letters, digits and hyphens, and it cannot start with `v` and a digit, so it never matches a version tag. The comment text must pass the same privacy check as issue texts. The failure reasons are `invalid-payload`, `attachment-not-available`, `attachment-too-large` and the usual GitHub reasons. The candidate declaration must include `methods: { "github": ["attach-asset"] }`.
+The method uploads the file as an asset of the release `release`, with the asset name `pr-<number>-<name>`. Then it creates or updates one comment on the pull request with a link to the asset, so a second call adds no second comment. GitHub does not play a release video in the page. An optional `place` is `comment` (the default) or `description`. With `description`, the method writes the text and the file into the pull request body between the markers `<!-- cloving-attachment:<number>:<name> -->` and `<!-- /cloving-attachment:<number>:<name> -->`, with `gh pr edit --body-file <file> --attach <file>`. `gh` uploads the file to GitHub, and GitHub shows a video as a player. This place makes no release asset and no comment, a second call replaces the block, and it needs a `gh` version with `gh pr edit --attach`. When the release does not exist, the method creates it as a pre-release that is not the latest release. `name` is a file name with the extension `.mp4`, `.webm` or `.png`. The file must be a regular file of at most 100 MB, and a symbolic link is refused. `release` has lowercase letters, digits and hyphens, and it cannot start with `v` and a digit, so it never matches a version tag. The comment text must pass the same privacy check as issue texts. The failure reasons are `invalid-payload`, `attachment-not-available`, `attachment-too-large` and the usual GitHub reasons. The candidate declaration must include `methods: { "github": ["attach-asset"] }`.
 
 The template tests use `fakeStepBridge` from `cloving/workflows/testing` to record effect and gate requests and supply fake results. `templates/develop/develop.test.ts` exercises the develop template through that public testing API.
 
@@ -1048,7 +1131,7 @@ Three consecutive failed scheduled runs stop a schedule. A completed run with ou
 
 Schedule settings load at startup. A scheduler transport or journal failure stops scheduling and writes a diagnostic; reconcile the state and restart to retry a pending slot. Full product admission remains subject to the external verification policy.
 
-Startup retains each complete compiled project under `workflow-bundles` in private daemon state, beside the generated `project` directory. Each content-addressed snapshot includes workflow sources, declarations, registration manifests, all compiler artifacts, and the installed dependency graph and Node identity. Snapshots bind to the canonical repository and survive later source edits or removal. Storage lookup validates every captured file and returns `pinned-workflow-unavailable` for missing or changed bytes; startup refuses reuse of a matching damaged snapshot without repairing it. No retained generation is deleted automatically. Before Local World starts, the daemon loads the retained generations needed by unfinished runs. Their starts, replays and continuations use the recorded bundle, including after workflow removal; new submissions use current registrations. Duplicate answers and replay preserve effect receipts and spending.
+Startup retains each complete compiled project under `workflow-bundles` in private daemon state, beside the generated `project` directory. Each content-addressed snapshot includes workflow sources, declarations, registration manifests, all compiler artifacts, and the installed dependency graph and Node identity. Snapshots bind to the canonical repository and survive later source edits or removal. Storage lookup validates every captured file and returns `pinned-workflow-unavailable` for missing or changed bytes; startup refuses reuse of a matching damaged snapshot without repairing it. No retained generation is deleted automatically. Before Local World starts, the daemon loads the retained generations needed by unfinished runs. Their starts, replays and continuations use the recorded bundle, including after workflow removal; new submissions use current registrations. A workflow message of a dropped run gets a done answer. No workflow code runs, the daemon records no observation, and the Local World queue stops its retries. Duplicate answers and replay preserve effect receipts and spending.
 
 ### Project and user workflows
 
@@ -1116,13 +1199,15 @@ After a merge or branch update changes `package.json` or `package-lock.json`, re
 
 `npm run check` and `npm run test:concurrency` currently reject admission because the complete quality policy is not implemented. Setup checks are not product acceptance. State and retained releases will live outside the package installation; installing or updating the package does not activate a daemon or migrate state.
 
-Run `npm run test:scale` on an otherwise idle machine to measure authority opening at 1,000, 10,000 and 50,000 events. This command runs the benchmark alone, without coverage; the regular test suite excludes it. The fixture uses completed runs with budgets, gates and released continuations. It requires each opening to take less than two seconds and the largest opening to take less than eight times the 10,000-event opening. Replay uses the pure reducer with run-scoped projections and preserves shared effect and lease state. Large effect histories, growing gate or pending-intent state within one run, and cancelled-run recovery still require separate scaling work; this benchmark does not establish their bounds. The generated-history parity and tamper tests compare replay with the full reducer and cover every event type.
+Run `npm run test:scale` on an otherwise idle machine to measure authority opening at 1,000, 10,000 and 50,000 events. This command runs the benchmark alone, without coverage; the regular test suite excludes it. The fixture uses completed runs with budgets, gates and released continuations. It requires each opening to take less than two seconds and the largest opening to take less than eight times the 10,000-event opening. Replay uses the pure reducer with run-scoped projections and preserves shared effect and lease state. Large effect histories, growing gate or pending-intent state within one run, and cancelled-run recovery still require separate scaling work; this benchmark does not establish their bounds. The generated-history parity and tamper tests compare replay with the full reducer and cover every event type. The same command also measures the first status page of a service with 700 runs and 7,000 events, and requires an answer in less than 200 ms. The service keeps the projected authority state in memory, so a status request reads no projected table in full after the start.
 
-`npm run check:quality` checks the npm manifest, lock and installed versions, regenerates TypeScript output in memory, inventories first-party files, and runs strict compilation, the proposed module catalog, workflow/effect boundaries, suppression and test-integrity checks, formatting, typed lint, structural checks, clone detection and the regular local test suite. Production modules require at least 90% line, statement and function coverage and 85% branch coverage per file. Coverage uses native V8 ranges mapped to the syntax tree of the exact Node-stripped source; unimported production files fail. Class and named object types allow at most 24 callable members; interfaces allow 10. Clone checks support ordinary TypeScript and JavaScript; JSX is rejected until separately qualified. `npm run check:lint`, `npm run check:format` and `npm run test:quality` run individual development checks.
+`npm run check:quality` checks the npm manifest, lock and installed versions, builds the package with `npm run build`, regenerates TypeScript output in memory, inventories first-party files, and runs strict compilation, the proposed module catalog, workflow/effect boundaries, suppression and test-integrity checks, formatting, typed lint, structural checks, clone detection and the regular local test suite. Production modules require at least 90% line, statement and function coverage and 85% branch coverage per file. Coverage uses native V8 ranges mapped to the syntax tree of the exact Node-stripped source; unimported production files fail. Class and named object types allow at most 24 callable members; interfaces allow 10. Clone checks support ordinary TypeScript and JavaScript; JSX is rejected until separately qualified. `npm run check:lint`, `npm run check:format` and `npm run test:quality` run individual development checks.
 
 The gate uses the committed `quality/test-durations.json` record to start files with unknown durations first in path order, then recorded files from longest to shortest, breaking ties by path. Stale entries have no effect. The launcher passes the ordered list directly to Node’s programmatic test runner because CLI discovery sorts positional paths. The test inventory and sorted report stay the same. Run `npm run record:test-durations` to refresh the record after adding or changing tests, then commit the JSON. This runs the regular suite with the gate's worker count, timeout settings, isolated environment and V8 coverage, sums each file's top-level test and suite durations in seconds, and writes entries in path order after a successful complete run. Nested tests are not counted twice. Temporary coverage stays outside the repository and is removed afterward. The command accepts the same concurrency and time-factor settings as the gate.
 
-CI runs two duration-balanced shards for macOS and each Linux Node version. Only shard 1 runs the static checks. Each shard builds the package before testing so runtime declarations are available independently of other test files, then exports raw production coverage. A final job checks their joined coverage. The required checks remain `quality` and `quality_linux`. Without a shard setting, the local gate runs all checks and coverage as before.
+CI runs three duration-balanced shards for macOS and each Linux Node version on each pull request and each push to `main`. Only shard 1 runs the static checks. Each shard builds the package before testing, the same as the local gate, so runtime declarations are available independently of other test files. On a pull request, each shard exports raw production coverage, and a final job checks their joined coverage. A push to `main` runs the same shards with `CLOVING_TEST_COVERAGE=off`, so its test processes collect no coverage, and it skips the coverage job. The required checks remain `quality` and `quality_linux`. Without a shard setting, the local gate runs all checks and coverage as before and ignores `CLOVING_TEST_COVERAGE`.
+
+A version tag runs no tests, because the `main` CI already tested its commit. The `release_check` job requires that the tagged commit is on `main`, and it waits up to 80 minutes for the `main` CI run of the same commit to pass. Then the publish job builds the package, publishes it and creates the GitHub release.
 
 The quality report includes elapsed time and the effective limit in milliseconds for each bounded command: npm inventory, clone detection, tests and coverage conversion. Commands using more than 80 percent of their limit produce a warning in the JSON report and on stderr after the report. Failed checks print the collected timings and warnings with the original error and a failing exit status. Warnings preserve a passing result. If your change made the check slower, address the warning in the same ticket.
 
@@ -1138,13 +1223,13 @@ done
 
 The expansion helper waits for two animation frames before horizontal input. Resolving in the first callback can send the gesture before the widened Done column renders, leaving the board at its old horizontal scroll limit even after scrolling settles. The regression delays that rendering pass with `testMilliseconds(250)` and keeps the full card visibility assertion. A failure reports the card, column and board rectangles, both scroll positions and the viewport; compare the card's right edge with the board's right edge to distinguish horizontal clipping from an incomplete vertical scroll.
 
-Before a ticket report, commit your work and run `npm run check:clean`. It refuses uncommitted changes, archives the committed tree of `HEAD` into a temporary directory, copies the worktree's `node_modules`, and runs `node tools/check-quality.ts` there with the same environment and exit code. Ignored build output such as `dist/` is absent, so tests that rely on stale local files fail. The temporary copy is removed after success, failure or SIGINT/SIGTERM interruption.
+Before a ticket report, commit your work and run `npm run check:clean`. It refuses uncommitted changes, archives the committed tree of `HEAD` into a temporary directory, copies the worktree's `node_modules`, and runs `node tools/check-quality.ts` there with the same environment and exit code. Ignored files are absent, so tests that rely on stale local files fail. The gate builds `dist/` again from the committed sources. The temporary copy is removed after success, failure or SIGINT/SIGTERM interruption.
 
-After merging dependency changes, run `npm ci --ignore-scripts` in the worktree before checking it. Copied dependencies can belong to an earlier lockfile; `check:clean` copies them unchanged. An `installed-lock-mismatch` requires refreshing that installation and rerunning the checks. If existing `dist/` output produces `generated-output-mismatch`, regenerate it with `npm run build` before rerunning `check:quality`.
+After merging dependency changes, run `npm ci --ignore-scripts` in the worktree before checking it. Copied dependencies can belong to an earlier lockfile; `check:clean` copies them unchanged. An `installed-lock-mismatch` requires refreshing that installation and rerunning the checks.
 
 Set `CLOVING_CHECK_TIME_FACTOR` to a whole number from 1 to 9 (default 1) to multiply the developer gate test and coverage command time limits, the inner hook check limit (15 seconds by default), and the installed hook limit (30 seconds by default). With factor 3, the hook limits are 45 and 90 seconds, respectively.
 
-Set `CLOVING_TEST_CONCURRENCY` to a whole number from 1 to 8 to override the developer gate's test worker count. Without the setting, the gate uses one fewer worker than the available cores, with a minimum of 2 and a maximum of 4. macOS CI sets it to 3 and Ubuntu CI sets it to 4. CI also sets `NODE_OPTIONS` to `--max-old-space-size=4096`, because the gate process needs about 2 GB of heap, and the hosted macOS runner gives only about 2 GB by default. Pull requests run on the same hosted runners. Pushes start CI only for `main` and `v*` tags. A new push to a pull request cancels the older CI runs of that pull request, and a new manual run cancels the older manual runs of its branch; runs of `main` and of tags are never cancelled. Invalid values fail with an error.
+Set `CLOVING_TEST_CONCURRENCY` to a whole number from 1 to 16 to override the developer gate's test worker count. Without the setting, the gate uses one fewer worker than the available cores, with a minimum of 2 and a maximum of 4. macOS CI sets it to 3 and Ubuntu CI sets it to 4. CI also sets `NODE_OPTIONS` to `--max-old-space-size=4096`, because the gate process needs about 2 GB of heap, and the hosted macOS runner gives only about 2 GB by default. Fork pull requests and other events use GitHub-hosted runners. Pushes start CI only for `main` and `v*` tags. A new push to a pull request cancels the older CI runs of that pull request, and a new manual run cancels the older manual runs of its branch; runs of `main` and of tags are never cancelled. Invalid values fail with an error.
 
 Tests that stop a child process should await `stopChild` from `test/stop-child.ts`. Use `stopChildGroup` for a detached process group, including descendants whose leader has exited. Both helpers send `SIGTERM`, wait up to five seconds times `CLOVING_CHECK_TIME_FACTOR` for exit, then escalate to `SIGKILL`. When a test requires a hard crash or an unresponsive child, start that child with `NODE_V8_COVERAGE` omitted so a kill cannot interrupt its coverage recording. Keep coverage enabled for ordinary child runs and recovery runs.
 

package/dist/src/broker/actor/authority-health.d.ts

@@ -0,0 +1,9 @@
+import type { Logger } from "solid-objects";
+export interface AuthorityHealth {
+    readonly refresh: () => Promise<void>;
+    readonly condition: () => string | null;
+}
+export declare function authorityHealth(source: {
+    readonly condition: () => Promise<string | undefined>;
+    readonly logger: Logger;
+}): AuthorityHealth;

package/dist/src/broker/actor/authority-health.js

@@ -0,0 +1,24 @@
+export function authorityHealth(source) {
+    const state = { condition: null, checks: 0, checked: 0 };
+    return {
+        refresh: async () => {
+            state.checks += 1;
+            const check = state.checks;
+            const detected = (await source.condition()) ?? null;
+            if (check < state.checked)
+                return;
+            state.checked = check;
+            changed(state, { detected, logger: source.logger });
+        },
+        condition: () => state.condition,
+    };
+}
+function changed(state, change) {
+    const { detected, logger } = change;
+    const previous = state.condition;
+    state.condition = detected;
+    if (previous === null && detected !== null)
+        logger.warn({ event: "authority-unhealthy", condition: detected });
+    if (previous !== null && detected === null)
+        logger.info({ event: "authority-recovered", condition: previous });
+}

package/dist/src/broker/actor/authority-runtime.d.ts

@@ -1,8 +1,9 @@
-import { type Database, type InstrumentationEvent, type JsonObject, type SolidObjectsRuntime } from "solid-objects";
+import { type Database, type InstrumentationEvent, type JsonObject, type Logger, type SolidObjectsRuntime } from "solid-objects";
 import { type SequenceListener } from "./authority-changes.ts";
 import { type SchemaState } from "../../storage/domain-schema.ts";
 import { type AvailableManifest, type Delivery } from "./authority-delivery.ts";
 import { type AuthorityTiming, type EffectSettings } from "./authority-settings.ts";
+import { type ProjectionMemory } from "./projection-memory.ts";
 export interface AuthorityOptions {
     readonly delivery?: Delivery;
     readonly timing?: AuthorityTiming;
@@ -44,11 +45,12 @@ export interface SessionLimits {
 export interface AuthorityRuntime {
     readonly runtime: SolidObjectsRuntime;
     readonly reader: Database;
+    readonly memory: ProjectionMemory;
     readonly invoker: (actorId: string, idempotencyKey?: string) => AuthorityInvoker;
     readonly stop: () => Promise<void>;
     readonly handlersSettled: () => Promise<boolean>;
     readonly setEpoch: (epoch: number) => void;
-    readonly unhealthy: () => string | undefined;
+    readonly logger: Logger;
     readonly watchMilliseconds: number;
     readonly limits: SessionLimits;
     readonly releaseEarlierOwners: () => Promise<void>;

package/dist/src/broker/actor/authority-runtime.js

@@ -11,9 +11,10 @@ import { sequenceSubscriber, } from "./authority-changes.js";
 import { contentionMilliseconds, lockContention, lockExclusively, observeSettings, requiredSettingsViolation, takeOwnership, } from "./authority-connection.js";
 import { inspectSchema, } from "../../storage/domain-schema.js";
 import { deliveryHandler, } from "./authority-delivery.js";
-import { authorityTiming, effectConfiguration, } from "./authority-settings.js";
+import { authorityLogger, authorityTiming, effectConfiguration, } from "./authority-settings.js";
 import { failureCounter, registeredRuntime, runtimeSettings, wallClock, } from "./runtime-parts.js";
 import { strandingWatchdog, } from "./authority-watchdog.js";
+import { projectionMemory, } from "./projection-memory.js";
 export { authorityTiming } from "./authority-settings.js";
 export function refused(reason, error) {
     return {
@@ -78,13 +79,6 @@ export async function recoverDeliveries(invoker) {
             return staged;
     }
 }
-function unhealthy(watchdog) {
-    const dead = watchdog.deadLettered();
-    if (dead !== undefined)
-        return `dead-lettered message ${dead}`;
-    const stranded = watchdog.stranded();
-    return stranded === undefined ? undefined : `stranded message ${stranded}`;
-}
 const deliveryCallbacks = ["deliveryCompleted", "deliveryFailed"];
 async function retryDeliveryCallbacks(retry) {
     const administration = { authorizationContext: retry.broker };
@@ -131,11 +125,18 @@ async function storedActorRefusal(check) {
     return sequence === latest ? undefined : actorSequenceMismatch;
 }
 async function condition(watch) {
-    const { runtime, broker, watchdog } = watch;
-    const dead = watchdog.deadLettered();
-    if (dead === undefined)
-        return unhealthy(watchdog);
-    return `dead-lettered message ${dead}: ${await deadLetterCause({ runtime, broker, messageId: dead })}`;
+    const { runtime, broker, database, watchdog } = watch;
+    const report = await watchdog.report((messageIds) => messageRuns(database, messageIds));
+    if (report === undefined)
+        return undefined;
+    const { kind, messageId } = report;
+    if (kind === "stranded")
+        return `stranded message ${messageId}`;
+    return `dead-lettered message ${messageId}: ${await deadLetterCause({ runtime, broker, messageId })}`;
+}
+async function messageRuns(database, messageIds) {
+    const rows = await database.connection((connection) => connection.all(`SELECT messages.id AS message_id, runs.status AS status FROM solid_messages AS messages JOIN runs ON runs.run_id = coalesce(json_extract(messages.arguments, '$.command.runId'), json_extract(messages.arguments, '$.arguments.runId')) WHERE messages.id IN (${messageIds.map(() => "?").join(", ")})`, messageIds));
+    return new Map(rows.map((row) => [text(row, "message_id"), text(row, "status")]));
 }
 async function deadLetterCause(lookup) {
     const { runtime, broker, messageId } = lookup;
@@ -150,6 +151,14 @@ async function deadLetterCause(lookup) {
         return "unreadable cause";
     }
 }
+function invokerOf(parts) {
+    const { runtime, actor, broker, timing } = parts;
+    return (actorId, idempotencyKey) => runtime.ref(actor, actorId).with({
+        authorizationContext: broker,
+        timeoutMilliseconds: timing.callTimeoutMilliseconds,
+        ...(idempotencyKey === undefined ? {} : { idempotencyKey }),
+    });
+}
 export function authorityRuntime(database, options) {
     const timing = options.timing ?? authorityTiming;
     const reader = guardApplicationDatabase(database);
@@ -159,6 +168,8 @@ export function authorityRuntime(database, options) {
         boundMilliseconds: timing.callTimeoutMilliseconds,
     });
     const effects = effectConfiguration(options);
+    const logger = authorityLogger(options.log);
+    const memory = projectionMemory({ logger });
     const shared = { reader, effects, clock: options.clock ?? wallClock };
     const ClovingAuthority = authorityActor({
         ...shared,
@@ -168,6 +179,7 @@ export function authorityRuntime(database, options) {
         database,
         actor: ClovingAuthority,
         settings: runtimeSettings({ timing, options, broker, watchdog }),
+        record: memory.record,
     });
     const delivery = trackedDelivery({
         runtime,
@@ -183,22 +195,19 @@ export function authorityRuntime(database, options) {
     return {
         runtime,
         reader,
-        invoker: (actorId, idempotencyKey) => runtime.ref(ClovingAuthority, actorId).with({
-            authorizationContext: broker,
-            timeoutMilliseconds: timing.callTimeoutMilliseconds,
-            ...(idempotencyKey === undefined ? {} : { idempotencyKey }),
-        }),
+        memory,
+        invoker: invokerOf({ runtime, actor: ClovingAuthority, broker, timing }),
         ...delivery,
         setEpoch: (value) => {
             epoch = value;
         },
-        unhealthy: () => unhealthy(watchdog),
+        logger,
         watchMilliseconds: timing.leaseMilliseconds,
         limits: effects,
         releaseEarlierOwners: () => releaseEarlierOwners({ runtime, broker, timing }),
         retryDeliveryCallbacks: () => retryDeliveryCallbacks({ runtime, broker }),
         storedActorRefusal: (actorId) => storedActorRefusal({ database, actor: ClovingAuthority, actorId }),
-        condition: () => condition({ runtime, broker, watchdog }),
+        condition: () => condition({ runtime, broker, database, watchdog }),
         subscribe: sequenceSubscriber({ realtime: runtime.realtime, broker }),
     };
 }

package/dist/src/broker/actor/authority-session.d.ts

@@ -1,35 +1,22 @@
-import type { Database, JsonObject } from "solid-objects";
-import { type AuthorityEvent, type EffectIntent } from "../../authority/reducer.ts";
-import { type ProjectionSnapshot } from "../../storage/decision-snapshots.ts";
+import type { Database, JsonObject, Logger } from "solid-objects";
+import type { AuthorityEvent, EffectIntent } from "../../authority/reducer.ts";
 import type { AdmissionResult, ExecutionManifest } from "../../workflow-admission.ts";
 import { type StoredState } from "../authority-restore.ts";
 import { type SequenceChanges, type SequenceListener } from "./authority-changes.ts";
 import { type AuthorityQueries } from "./authority-queries.ts";
 import { type EffectQueries } from "./effect-queries.ts";
+import type { OperationRecord, ProjectionMemory } from "./projection-memory.ts";
 import { type ConnectionSettings } from "./authority-connection.ts";
 import { type StoreReceipt } from "./authority-receipts.ts";
 export type { StoreReceipt } from "./authority-receipts.ts";
 export type { StoredState } from "../authority-restore.ts";
+export { operationRecords, type OperationRecord } from "./projection-memory.ts";
 export interface CommandContext {
     readonly recordedAt: string;
     readonly manifest?: ExecutionManifest;
     readonly epoch?: number;
     readonly documents?: readonly string[];
 }
-export interface OperationRecord {
-    readonly operationId: string;
-    readonly kind: EffectIntent["kind"];
-    readonly runId: string;
-    readonly createdSequence: number;
-    readonly releasedSequence: number | null;
-    readonly deliveries: readonly {
-        readonly effectId: string;
-        readonly outcome: string | null;
-        readonly receipt: string | null;
-        readonly purpose: string;
-        readonly epoch: number | null;
-    }[];
-}
 export interface Authority {
     readonly execute: (command: unknown, context: CommandContext) => Promise<StoreReceipt>;
     readonly state: () => Promise<StoredState>;
@@ -50,6 +37,7 @@ export interface Authority {
 export interface SessionParts {
     readonly database: Database;
     readonly reader: Database;
+    readonly memory: ProjectionMemory;
     readonly execute: (request: JsonObject) => Promise<unknown>;
     readonly run: (signal: AbortSignal) => Promise<void>;
     readonly stop: () => Promise<void>;
@@ -58,10 +46,9 @@ export interface SessionParts {
     readonly epoch: number;
     readonly stopLimit: number;
     readonly recoveryLimit: number;
-    readonly unhealthy: () => string | undefined;
     readonly condition: () => Promise<string | undefined>;
+    readonly logger: Logger;
     readonly watchMilliseconds: number;
     readonly subscribe: (listener: SequenceListener) => () => void;
 }
 export declare function authoritySession(parts: SessionParts): Authority;
-export declare function operationRecords(snapshot: Pick<ProjectionSnapshot, "outbox" | "deliveries">): readonly OperationRecord[];