tldr-experts 0.16.0 → 0.17.0

package/CHANGELOG.md

@@ -1,5 +1,205 @@
 # Changelog
 
+## 0.17.0 — 2026-09-12
+
+### Added
+
+- **A `gate.requested` payload says what is HOLDING the gate, and hands over the rejection that
+  carries on (#243).** The owner's phone renders a gate as two buttons, Yes and No, and the No
+  branch rejects nothing — it logs *"gate stays open"*. That is not the adapter being lazy: it is
+  the adapter working with what it was handed. Of the three things #239 taught the framework to
+  distinguish, exactly one travelled as data — `detail.stories` says there is unbuilt work —
+  while "there are open questions" travelled in nothing but the PREFIX of `command`
+  (`tldrx answer …`). Routing on that is a second, untested, out-of-repo copy of the mapping,
+  and it goes quietly wrong the day a command is reworded. So the branch `clearingCommand`
+  already takes is now NAMED: `detail.holding` is `questions`, `stories` or `none`, and
+  `clearingCommand` switches on it, so the field and the command are two renderings of one
+  derivation and cannot disagree (§7). And the payload now spells the other half of what a third
+  button needs: `detail.continue_command` is `tldrx reject --run <id> --and-continue --note "…"`
+  — #242's verb, with the substitutable `…` `answer_command` established, rather than
+  `reject_command`'s `<why>`, which is prose for a human and would have been sent literally as
+  the next turn's prompt. Its note is DERIVED, never canned: `continue_note` is the blocked
+  story and the handoff's own reason for it, the same two facts already on the payload as
+  `blocked_story` and `blocked_reason`. Both keys are absent together wherever the gate cannot
+  name what has to change — held by open questions (the gate is downstream of them, and a
+  one-tap refusal there is the mirror of the mistake #239 was filed over), held by nothing
+  mechanical (the reason to refuse a judgement is in a person's head), and held by stories none
+  of which is blocked or whose blocked one recorded no reason. `--note` is mechanically required
+  and becomes the next turn's prompt, so a canned *"rejected from Slack"* would satisfy the flag
+  and empty the rule it exists for: a button that hands the re-run an empty instruction is worse
+  than no button. Every key is additive — a consumer that reads none of them gets exactly the
+  payload it got before. Which buttons an adapter draws, and how, stays the adapter's.
+
+### Fixed
+
+- **`run status` could print more money left than it had ceiling, and the fix was to delete a
+  copy rather than synchronise one (#236).** Measured live on a hosted run after four raises:
+  `budget  $0.00 spent of $190.00 ceiling ($200.00 left)` — a sentence that cannot be true. The
+  two figures came from two files. The remainder has always been `budget.yml`'s; the ceiling was
+  `run.yml`'s `budget.ceiling_usd`, and the issue's own diagnosis — that `budget raise` never
+  wrote that key — was WRONG: it wrote it, on the line after it wrote `budget.yml`, and had since
+  the command's first commit. What defeated it was concurrency. `RunStore.save()` re-reads
+  budget.yml's ceilings from disk before every write, precisely because a store that loaded the
+  file an hour ago must not clobber a raise (`ceilingsToWrite`); run.yml's mirror had no such
+  re-read, so `rollUp` carried the pre-raise value straight back out. A long-lived `run auto`
+  saving after an operator's raise reverted the mirror, and the ceiling on screen fell below the
+  remainder beside it. Nothing decided against the stale figure — every refusal, gate and brake
+  already reads budget.yml (measured: all 47 `ceiling_usd` references read; the mirror's four
+  readers are all display), so this was a lie on a screen and not money spent wrongly, which is
+  the part the issue left open. The fix follows §7 rather than the obvious repair: two copies
+  that must both be fresh is the shape the house rule forbids, and writing both harder is exactly
+  what concurrency beat. So the live readers — `run status`, the open-runs table, `tldrx
+  statusline`'s validated path and the dashboard's headline — now read budget.yml, the same field
+  `budget show` reads, and `budget raise` no longer writes the mirror at all. run.yml's
+  `budget.ceiling_usd` and `per_agent_max_usd` are documented for what they always were: the
+  figures the run was CREATED with. That is not a `version: 1` meaning change — the keys are
+  required and still written, they held the creation ceiling before this change too, and what
+  moved is only that nothing reads them as the current one. The corollary is the part worth
+  writing down, because the first cut of this change got it wrong and a pre-merge review caught
+  it: run.yml's budget block is **half live**. `spent_usd` is re-derived by `rollUp` on every
+  save; `ceiling_usd` beside it is frozen. Printing the two as one sentence therefore reproduces
+  the same defect somewhere else, which is precisely what `tldrx replay` did — measured through
+  the CLI on a run raised $10 → $30 with $12 spent: `Status: **pending** · $12.00 spent of $10.00
+  ceiling`, no corruption and no concurrency needed, just a raise. "A replay narrates the
+  document" does not rescue it when the document itself is mixed. So the ceiling is resolved once
+  in `replay/loadRun.ts`, the single place both files are in hand, and `tldrx replay` and the
+  dashboard share that derivation. Swept for the same class: the only other frozen keys in
+  run.yml are `budget.per_agent_max_usd`, which no reader anywhere displays, and `created_with`,
+  which is frozen on purpose and paired with `last_written_by` to show exactly that difference.
+  One reader stays on the mirror by design: the statusline's tolerant fallback, which runs only
+  when run.yml fails validation, where a second tolerant parser for budget.yml would be a worse
+  trade than a figure on an already-degraded screen.
+
+- **A task row now says which ROLE took the turn, instead of filing every Build turn under the
+  developer (#234).** `run.yml`'s `tasks[].expert` is the STAGE's expert — one value copied onto
+  every row from `stage.experts[0]` — and a Build stage declares `experts: [developer]` while
+  running two roles under it. So the reviewer's turn, with its own money, its own token split
+  and its own measured span, was recorded as the developer's, and the golden fixtures had that
+  frozen: three of the four Build scenarios shipped a `fake-reviewer-*` session labelled
+  `developer`. The role was never unknown — the executor spawns under it and emits it on
+  `agent.spawned` — it was thrown away one function later, because `ExecutorTask` had nowhere to
+  put it. Nothing downstream computed a wrong NUMBER from this (no reader reads the field; the
+  per-role cost report it looked like it fed does not exist), which is exactly why it was worth
+  fixing now rather than after something started reading it: what was broken is the audit
+  record, and §7's rule is that those never lie in the dangerous direction. The fix is a new
+  additive `tasks[].role`, NOT a new meaning for `expert` — a `version: 1` field never changes
+  what it says — carried from the four places the Build executor records a turn. A turn whose
+  role nothing recorded carries no key at all: absent is "not recorded", never a `developer` of
+  convenience, which is the same guess the bug was made of. Rows written before the key exist
+  unchanged and still validate. `docs/spec.md` documents the new field and, while it was open,
+  the `tasks[].expert` that has been written on every row since 0.1 and was never documented.
+
+## 0.16.1 — 2026-09-12
+
+### Added
+
+- **`tldrx reject --and-continue` — a rejection that means "redo it this way and carry on"
+  (#242).** `run auto --wait-gates` resumed after an approve and STOPPED after a reject, so on a
+  phone the button meaning *there is still work to do* was the one that ended the run: the only
+  way to act on a rejection was to walk to a terminal and relaunch. The stop was deliberate and
+  its reasoning is real — resuming re-spends the stage on a decision the person who rejected it
+  has not been shown the result of — but it is the reasoning for ONE kind of rejection, "stop, I
+  will look", and the issue measured five consecutive live rejections that all meant the other
+  one: *"faltan 4 stories sin arrancar; continuar el build"*, *"Rehacer S2 y las waves 3 y 4"*,
+  *"Una ronda mas"*. Five rejections, five manual relaunches, the assumption holding zero times
+  out of five. So the rejection now SAYS which act it is instead of the loop guessing from the
+  note's words or from what was holding the gate: `--and-continue` records `and_continue: true`
+  on the gate record `tldrx reject` writes — the same object `--wait-gates` already reads the
+  gate's `status` off, in the same read, so there is no second derivation and no second process
+  to ask — and the loop re-runs the stage with the note, exactly as the manual relaunch did. A
+  bare `tldrx reject` is byte-identical to what it wrote before and stops the loop exactly as
+  before; `and_continue` is additive and only ever `true`, so a gate written before this key
+  existed reads as "stop". It is cleared when the stage parks on its gate again, so it never
+  outlives the rejection it describes. The rationale in `runAuto.ts` now names both kinds and
+  says which one is the default. Which BUTTON a notification offers for which effect is
+  deliberately not part of this change.
+
+### Fixed
+
+- **The `merge-wave` "known flake" was a real race, and it was in the guard's own INSTALL
+  (#115).** For months `test/merge-wave.test.ts`'s concurrency cases reddened CI, went green on
+  a same-sha re-run, and were waved through under §4's re-run licence — three separate cases in
+  one night alone. Nobody had read the failure detail. `gh run view 34671878974 --log-failed`
+  (sha `8cd4df2`) says it in two lines: `fatal: cannot exec '.git/hooks/reference-transaction':
+  Text file busy` → `update aborted by the reference-transaction hook`. `merge-wave.sh` installs
+  the ref guard BEFORE it queues for the lock — deliberately, so an unguarded window never
+  exists — so two invocations overlap on exactly one file, and `install_hook` wrote it with
+  `cat > "$hook"`: truncate-and-rewrite THE SAME INODE, while the invocation holding the lock
+  has a `git merge` exec'ing it. On Linux exec of a file open for write is ETXTBSY; on macOS the
+  identical race is benign, which is the whole of why it was green locally and red on CI, and
+  why a same-sha re-run failed 2-for-2 rather than passing. The hook is now written to
+  `reference-transaction.tmp.$$`, made executable there, and `mv -f`'d into place — the exec'd
+  inode is never the written inode, and no reader can catch a zero-length window. It is the
+  answer `$MARKER` in `merge-wave.sh` already used, and the trap AGENTS.md §12 already named.
+  The race is untestable on macOS by design, so the WRITE is what is pinned: a reinstall must
+  land on a new inode and must leave the inode a hard link is holding byte-identical — red on
+  both counts before the fix. And the refusal that hid all this now tells the truth: a merge the
+  ref-transaction hook aborted, with no conflicting path anywhere, says so and exits **11**, its
+  own code, instead of borrowing `2` and telling the agent to go rebase against a conflict that
+  never existed. A mislabelled refusal is how a deterministic defect becomes folklore; §4's
+  re-run licence for this test is withdrawn in the same change.
+- **The views fixture no longer decays: `test/experts.test.ts` was a wall-clock time bomb
+  (#240).** `main` went red at `e1d284d` — the exact sha of published 0.16.0, with no commit in
+  between — because `competencyLevel` weighs every evidence row by its AGE and the fixture dated
+  its rows ABSOLUTELY (`at: 2026-08-20`, …). An in-process test hands the reader `VIEWS_NOW` and
+  is hermetic; a test that spawns the CLI cannot, because the CLI reads `new Date()`. So
+  `dotnet-stack/ef-core` sat 3% above the level-3 threshold on the day the assertion was written
+  and fell through it eleven days later, by the calendar alone. Bumping the expected number would
+  only have re-armed the bomb for a later date, so the FIXTURE moved instead:
+  `makeViewsWorkspace({ now })` re-dates the copied evidence so every row keeps the age the
+  fixture meant, relative to the clock the assertion is evaluated against, and `NOW` in
+  `experts.test.ts` is the real clock rather than a pinned calendar day. Measured with the clock
+  moved a year forward: reverted, five tests red (the one that reds today plus four with longer
+  fuses); fixed, the whole suite is green at +1 year and the fixture's own consumers are green at
+  +5. §8's hermeticity rule now covers the clock as well as `$TMPDIR`.
+- **A parked gate hands over the command that CLEARS it, not `tldrx approve` whatever is
+  holding it (#239).** Measured on an owner's phone, 2026-09-10: a gate held BY five
+  unanswered questions was announced as `Run: tldrx approve --run <id>`, and the
+  `--notify-every` heartbeat repeated that same line seven times in an hour. The sentence
+  named the holding condition correctly — #203 was working — and the ACTION contradicted it,
+  which is the worse half: a notification exists to be obeyed off a lock screen. Two Build
+  gates were approved by mistake that evening, both over unbuilt stories, both revoked with
+  `reject --stage`; the owner said so himself — *"no sé por qué me avisa que ya puedo cerrarlo
+  si aún hay preguntas"*. `command` now follows the holding condition, in ONE mapping shared by
+  `gate.requested` and the parked heartbeat — and over ONE reading of the pending gate,
+  `gateStories`, so the alert and its reminder can never offer two different taps: open blocking questions → the `tldrx answer` line (the gate is downstream of
+  them); unfinished stories → `tldrx run status` (not `reject` — nobody has decided to abandon
+  that work, and a one-tap refusal is the mirror of the mistake being fixed — and not `null`,
+  because what is missing there is knowledge, not a signature); nothing mechanical outstanding
+  → `tldrx approve`, which is what the field always meant. `approve_command` and
+  `reject_command` stay in the `detail` of every payload, so an adapter that renders buttons
+  keeps both. The open question ids are read off disk by the loop through `blockingQuestionIds`
+  — the one predicate `--wait-answers` polls — at the moment the notification is SENT, so a
+  gate whose questions cleared while the send was deferred does not point at an answered
+  question; the heartbeat reads the gate's stories the same way, every tick, instead of the
+  hard-wired "nothing unfinished" that kept it saying `approve` at a Build gate held by unbuilt
+  work — the gate the two mistaken approvals were on.
+- **The Build gate's summary has a verb again (#239).** `deliveredPhrase` is a noun phrase and
+  three callers embed it after a label, so `It 5 of 6 stories delivered, S6 blocked (…)` was
+  reaching lock screens as a typo. The article is fixed at the one call site that needed a
+  sentence — `It has 5 of 6 stories delivered` — and the phrase's contract is unchanged for
+  `run next`, `ship` and the decision card.
+
+- **A red base pre-flight now keeps what the command SAID, so a stage-wide refusal names a
+  cause (#229).** #211 taught a red story DoD to keep its output — the file on disk, an
+  excerpt, the failing line, a failure-shaped `tail` — and the base row, produced a hundred
+  lines away in the same file, was left on `outcome.tail`: the last line of stdout+stderr.
+  The blast radius and the evidence were the wrong way round. A red story DoD blocks ONE
+  story; a red base refuses the WHOLE stage before anything is dispatched or charged.
+  Measured in the field: a `dotnet test` whose 163,702 captured lines named a dead container
+  daemon on line 12 refused all six stories of a stage with `Test run completed with
+  non-success exit code: 2` — the sentence every failing run of that runner prints, whatever
+  broke. Nothing in the run directory contained the word `Docker`, so diagnosing the refusal
+  meant re-running by hand the command the pre-flight exists to have already run. The base
+  row now goes through the SAME seam, not a second reading of it: `tail` is the
+  failure-looking line, `excerpt` the few lines around it, and the whole bounded tail is
+  written to `04-build/log/dod-output/base-<hash>-1.txt`, which the refusal cites by file and
+  line. A GREEN base still writes nothing — #211's argument holds harder here, since a green
+  base is re-used from cache far more often than a story's — and an `unmeasured` row is
+  untouched: nothing ran, it refuses nothing, and its `tail` is already a reason sentence.
+  `04-build/preflight.yml` stays `version: 1`: four optional fields, and every older file
+  still reads.
+
 ## 0.16.0 — 2026-09-11
 
 ### Added

package/README.md

@@ -316,6 +316,8 @@ back on the registry is 0.3.0.
 
 | Version | Date | Status | Contains |
 |---|---|---|---|
+| 0.17.0 | 2026-09-12 | `beta` | three things the framework knew and recorded wrongly, each found by reading its own records rather than by using it: a gate notification now carries the condition HOLDING the gate as data instead of leaving it to be guessed from the text of the command it suggests — `holding` says questions, stories or nothing-mechanical, and when a story is blocked with a recorded reason the payload also hands over a ready-made rejection that lets the loop carry on, with the note DERIVED from the blocked story rather than canned, because a rejection's note is fed to the next turn's prompt and a generic one would hand that turn an empty instruction, so when no reason can be derived the offer is absent rather than invented; the emitted command keeps a literal placeholder and never interpolates the reason, which keeps the quoting hazard out of the record and puts it where a substituting client can see it; `run status` stopped printing more money left than it had ceiling — the run ceiling now has ONE live copy, read from `budget.yml` by every live screen, and `run.yml`'s mirror is documented as the creation value and no longer written by a raise, since the break was never that a raise failed to write the mirror but that an ordinary concurrent save carried a stale copy over it, and the fix was to delete the half-sync rather than to build a better one — pre-merge review caught the first version pairing a LIVE spend with that now-frozen ceiling inside `tldrx replay`, which would have reproduced the same impossible line in a different command on every run whose budget had been raised, measured on the real CLI as `$12.00 spent of $10.00 ceiling` with no concurrency required; and a task row now records the ROLE its turn actually ran under, where every Build turn had been filed as the developer including the reviewer's — the role was known at spawn and written to the event stream, and was dropped on the way to the ledger, so the audit record named the wrong actor for work it had itself measured; the new key is additive and written on EVERY row including the developer's, because a role present only on reviewers would make its absence mean developer-or-not-recorded and send a reader back to inferring the role from an absence, which is the guess the change exists to remove |
+| 0.16.1 | 2026-09-12 | `beta` | five things the framework knew and did not say, or said wrong — four of them found by using it rather than by reading it: a red base pre-flight now KEEPS its output, so a refusal that blocks every story in a Build names the failing test and cites the file, where it used to record only the last line of stdout — measured 2026-09-10, a stage refused with `tail: "Test run completed with non-success exit code: 2"` while the cause, `DockerUnavailableException`, sat on line 12 of 163,702 lines the run had already captured and thrown away, so diagnosing a refusal the framework had itself measured meant re-running the workspace's test command by hand; it now routes through the same seam #211 built for a story's DoD, which had been naming its failing test correctly all along on the same command, the same day, in the same repo — the path with the SMALLER blast radius was the legible one; a gate notification now offers the command that CLEARS it rather than always `tldrx approve` — questions open give `tldrx answer <id>`, unfinished stories give `tldrx run status`, and `approve` is offered only when nothing mechanical is outstanding, after an owner approved a Build gate by mistake twice in one evening over unbuilt stories, each time from a phone, each time needing a revoke, while a ten-minute heartbeat repeated `Run: tldrx approve` seven times under a sentence that correctly named the five open questions holding it; `tldrx reject --and-continue` lets a rejection mean "redo it this way and carry on" instead of ending the run — the loop resumed after an approve and stopped after a reject, so the button meaning "there is still work to do" was the one that stopped the work and only a terminal could revive it; five real rejections that night all meant continue, five cost a manual relaunch, and a bare `tldrx reject` still writes a byte-identical `run.yml` and stops exactly as before; the expert-recompute fixture anchors its evidence dates to a `now` it can move, so `bun test` stops going red by the calendar — pristine `main` was red at the exact sha of the published 0.16.0 with no commit in between, and a clock moved one year forward reddened FIVE cases, not the one that had already fired; and `test/merge-wave.test.ts`'s concurrency failure, documented as a known flake since #115 and carrying a written licence to re-run it, was never one: `merge-guard.sh` rewrote `.git/hooks/reference-transaction` IN PLACE while a sibling wave's `git merge` was exec'ing it — ETXTBSY on Linux at 31% under contention, benign on macOS, which is why it was green locally and red in CI, and why a same-sha re-run failed 2 for 2 rather than passing; the hook is now written to a temp file and RENAMED into place, the refusal that used to borrow `2`/`merge conflict` for a hook abort now says what it was and exits 11, and AGENTS.md §4 withdraws the re-run licence for those two cases while naming the interrupted-merge case (#237) as still open and undiagnosed — because "all real" for a whole file costs the same as "all flake", in the other direction |
 | 0.16.0 | 2026-09-11 | `beta` | an unattended run can now clear the one kind of failure it was stopping on, and a gate that refuses says why it refused: measured 2026-09-10 on a real unattended `run auto`, the loop drove itself through what → how → plan and signed all three `auto` gates by itself, and still needed a person four times — three of those were content or money decisions a loop must not make, and the fourth was a plan that failed its own check by five characters over a cap, where a person relaunched the same command and the next attempt fixed the two files and passed, so the loop stopped on the one failure it could have cleared; `tldrx run auto --retry-failed <n>` now runs a failed stage again at most `n` times in a row, bounding exit `5` and nothing else — a usage error (`1`), a money refusal (`2`) and an awaiting-human park (`4`) are each attempted ONCE however large `n` is, because a phase ceiling means a human decides about money and a retry would turn that sentence into a delay — only CONSECUTIVE failures count since what is bounded is "this run is stuck" and not "this run has ever failed", a retry SPENDS as a fresh metered stage under the same phase ceiling and the same `--max-usd`, `0` is the default and a default invocation's lines are byte-identical to what they were, and when the bound is spent the loop stops on the failure's own exit `5` and says the count LAST, so the sentence that reaches a phone is what the loop tried and not a bare number; and an `auto` gate that REFUSES now writes down the verdict its note was always designed to carry — a gate sat pending ~40 minutes while `run status` and `--verbose` named no condition at all, and the reason surfaced only when a person guessed at the `tldrx approve` the status line suggested, which is the one route nobody unattended is going to take — recording all seven conditions WITH THEIR VALUES on the still-`pending` gate, since a note that dropped the passing ones would answer "was it the money" with the same silence, and naming the holding ids on the gate row and on the `waiting` line; it writes only over a `pending` gate, so a gate a person has since signed keeps THEIR words, and only when the verdict would change, so a four-hour `--wait-gates` poll writes once per distinct verdict rather than thousands of times — and that test and that write are a compare-and-set under the workspace lock, because pre-merge review reproduced, with two real processes, a check-then-act over an earlier snapshot erasing a concurrent `approve` outright, and the poll runs every two seconds precisely while a person is deciding |
 | 0.15.0 | 2026-09-10 | `beta` | defaults for the models actually running today, and records that name what happened: measured 2026-09-07/09 across three real workspaces, the first engine-driven run of each was ended by a calibration rather than by the work — a `how` turn and two Build developer turns killed at a 900 s per-turn clock while Opus turns on real repositories run 15-50 minutes, a 202 KB prompt refused by a ceiling whose own message called it "29% of a 200k window", and a 169 KB `facts.yml` sliced to 96 KB on its way into a design turn that then died. So a turn gets two hours (`timeout_s` 900 → 7200), a prompt 400 KB and inputs 256 KB, a phase ceiling holds every attempt its stages may take so the first retry of a stage that spent anything is no longer refused by arithmetic — `warn_at_pct` still measured against one attempt's share, so the warning still arrives before the money — and the four numbers that were calibrations rather than invariants (`attempts`, `fixlist_rounds`, `reviewer_share`, `gate_signer_share`) became optional `stage.yml` keys, refused by name out of range instead of clamped, absent meaning today's constant byte for byte, with `tldrx run auto --prompt-max-bytes` and `--max-reads` for the unattended run that would otherwise need a file edit to get past one refusal; a story's Definition of Done now runs with its dependencies installed — the `install:` slot has sat unread in `templates/workspace.yml` since the beginning and now runs in every fresh story worktree through the same allowlist-and-argv runner, recorded with its own exit code and duration, blocking the story rather than paying a turn to discover it — an exit 127 is reported as a named absent binary and not as a red test, a declared command may be run WITH ARGUMENTS (the exact `Bash(npm run test)` grant matched nothing the developer actually typed, so its own 127 was first seen by the gate, after the turn was paid for), and every DoD check says which tree it ran in; the Build gate now names story outcomes on every policy and not only `auto` — two runs approved from a phone printed `run is done` over zero stories delivered — `run.yml` records an additive `outcome:` written once by all three commands that close a run and rendered by six surfaces, and `tldrx ship` refuses with exit 1 instead of opening a PR over nothing; a red DoD keeps its real failure — the last 200 lines on disk (gitignored, since a tail can carry a secret), up to five failure-looking lines as the detail rather than the last `DeprecationWarning` on stderr, the failing line cited at the line it starts on, and the next attempt told it was the check and not a reviewer; a watcher card may honestly say `Query: none — <reason> [src: …]`, earned only over a card whose own `## Signal` cites `absent:` and refused like any unsourced item otherwise, after a stage spent real money writing the honest answer and was refused for it; a truncated input is told to the OWNER at spawn and not only to the sub-agent, a turn killed on timeout keeps the usage it had already streamed and never a price; and the maintain skill says which sha a review record must cite — the code head — a rule that cost a wave and was written down nowhere an agent reads |
 | 0.14.3 | 2026-09-10 | `beta` | foreign uncommitted work no longer stops a Build, and the dashboard flake that blocked four merges in two days has a root cause: the dirty-tree guard used to count every `git status --porcelain` entry and refuse, offering only "commit it" or "stash it" — neither of which an agent may take with another person's files — and measured across three real workspaces on 0.14.2, every first engine-driven run reaching Build stopped at `04-build`, over seed docs, a data export and one untracked note; the dirt is now classified, `own` and `overlapping` refusing or passing exactly as before while everything `foreign` is set aside with a pathspec-limited `git stash push` as the LAST step before the epic branch is cut, recorded as `worktree.foreign_work_aside` and given back with `--index` on every exit path, success or failure, nothing ever deleted and nothing force-popped, a repo mid-merge, rebase, cherry-pick or bisect refused outright because that state has no clean undo, and a pop git refuses said as the stage's last line and carried into the handoff and the notification; the refusal's printed remedy is now the SAME string the engine runs, limited to the paths it listed and relaunching by mode, after an owner ran the pathspec-less line exactly as printed and it swept the run's own records under `tldrx-work/<run>/` into the stash until `tldrx next` answered `no run`; every path handed to git for a write is `:(literal)` and `git status` is read with `-z`, since a glob pathspec moved the neighbouring `x.txt` for a file called `[x].txt`; and the dashboard's live tests stop racing a typed millisecond — five consecutive runs of the two files went red 3 times, at 5084.27 / 5108.01 / 5256.49 ms against a hard-coded 5000 under load averages 65–107 on 14 cores — every deadline now deriving from one `eventWaitMs()` helper that scales like every other budget, with `test/machine-load.test.ts` refusing a hard-coded deadline in either file so it cannot come back at somebody's merge, while that measurement surfaced the product half: `watchWorkspace` armed its mtime sweep only in `poll` mode, so a dropped FSEvents notification left a live dashboard silently stale for the life of the process — measured with `fseventsd` at 98–115% CPU, directory events that never arrived AT ALL at 82,556 ms and 113,942 ms — and the sweep now runs in watch mode too, at 2 s, so a dropped notification is bounded rather than fatal |

package/dist/hooks/answer-capture.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   conflictOf
-} from "./chunk-z0hnthw4.js";
+} from "./chunk-tj66vg1n.js";
 import {
   FactsStore,
   formatJaccard
@@ -13,7 +13,7 @@ import {
 import {
   EventLog,
   PHASE_ID_RE
-} from "./chunk-rz0qr006.js";
+} from "./chunk-jp6jscsd.js";
 import {
   PHASE_IDS
 } from "./chunk-d0rp8c68.js";

package/dist/hooks/budget-gate.js

@@ -25,7 +25,7 @@ import {
 } from "./chunk-3kmx3dmz.js";
 import {
   EventLog
-} from "./chunk-rz0qr006.js";
+} from "./chunk-jp6jscsd.js";
 import {
   cursorStage,
   hostTokensIn,

package/dist/hooks/{chunk-vvr4rk82.js → chunk-g8kkq85r.js}

@@ -21,7 +21,7 @@ import {
   isTerminal,
   stageAt,
   validateRunFile
-} from "./chunk-rz0qr006.js";
+} from "./chunk-jp6jscsd.js";
 import {
   cursorStage,
   isAttendedByHostView,
@@ -99,7 +99,8 @@ function gate(g) {
   const evidence = g.evidence === undefined ? "" : `, evidence: ${gateEvidence(g.evidence)}`;
   const executor = g.executed_by === undefined ? "" : `, executed_by: ${gateExecutor(g.executed_by)}`;
   const authority = g.authority === undefined ? "" : `, authority: ${gateAuthority(g.authority)}`;
-  return `{type: ${yamlScalar(g.type)}, status: ${yamlScalar(g.status)}, by: ${yamlScalar(g.by)}, ` + `at: ${yamlScalar(g.at)}, note: ${yamlScalar(g.note)}${evidence}${executor}${authority}}`;
+  const andContinue = g.and_continue === undefined ? "" : ", and_continue: true";
+  return `{type: ${yamlScalar(g.type)}, status: ${yamlScalar(g.status)}, by: ${yamlScalar(g.by)}, ` + `at: ${yamlScalar(g.at)}, note: ${yamlScalar(g.note)}${evidence}${executor}${authority}${andContinue}}`;
 }
 function task(t, indent) {
   const inner = `${indent}   `;
@@ -108,8 +109,9 @@ function task(t, indent) {
   const tokens = t.tokens === undefined ? "" : `, tokens: ${String(t.tokens)}`;
   const inTokens = t.input_tokens === undefined ? "" : `, input_tokens: ${String(t.input_tokens)}`;
   const outTokens = t.output_tokens === undefined ? "" : `, output_tokens: ${String(t.output_tokens)}`;
+  const role = t.role === undefined ? "" : `, role: ${yamlScalar(t.role)}`;
   return [
-    `${indent} - {id: ${yamlScalar(t.id)}, status: ${yamlScalar(t.status)}, expert: ${yamlScalar(t.expert)}, ` + `model: ${yamlScalar(t.model)}, cost_usd: ${cost}${metered}${tokens}${inTokens}${outTokens},`,
+    `${indent} - {id: ${yamlScalar(t.id)}, status: ${yamlScalar(t.status)}, expert: ${yamlScalar(t.expert)}${role}, ` + `model: ${yamlScalar(t.model)}, cost_usd: ${cost}${metered}${tokens}${inTokens}${outTokens},`,
     `${inner}error: ${yamlScalar(t.error)}, session_id: ${yamlScalar(t.session_id)},`,
     `${inner}started_at: ${yamlScalar(t.started_at)}, ended_at: ${yamlScalar(t.ended_at)},`,
     ...t.stopped_by === undefined || t.stopped_by === null ? [] : [`${inner}stopped_by: ${yamlScalar(t.stopped_by)},`],
@@ -605,7 +607,7 @@ function fromStore(root) {
     expert: entry?.stage.expert ?? null,
     done: stages.filter((stage2) => isTerminal(stage2.status)).length,
     total: stages.length,
-    ceilingUsd: run.budget.ceiling_usd,
+    ceilingUsd: store.budget.ceiling_usd,
     spentUsd: run.budget.spent_usd,
     openCount: open.length,
     machineGates: stages.filter((s) => s.gate.status === "approved" && closedByMachine(s.gate)).length,

package/dist/hooks/{chunk-rz0qr006.js → chunk-jp6jscsd.js}

@@ -700,6 +700,9 @@ function validateRunFile(input) {
           requireEnum(task.status, STAGE_STATUSES, `${tp}.status`, issues);
           if (task.cost_usd !== null)
             requireNumber(task.cost_usd, `${tp}.cost_usd`, issues);
+          if (task.role !== undefined && typeof task.role !== "string") {
+            issues.push({ path: `${tp}.role`, message: "expected a string" });
+          }
           if (task.metered !== undefined && typeof task.metered !== "boolean") {
             issues.push({ path: `${tp}.metered`, message: "expected true or false" });
           }

package/dist/hooks/{chunk-z0hnthw4.js → chunk-tj66vg1n.js}

@@ -5,7 +5,7 @@ import {
   evidencePath,
   gateEvidencePath,
   parseEvidence
-} from "./chunk-rz0qr006.js";
+} from "./chunk-jp6jscsd.js";
 import {
   openBlocks,
   parseQuestions

package/dist/hooks/session-start.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   questionsCard
-} from "./chunk-z0hnthw4.js";
+} from "./chunk-tj66vg1n.js";
 import"./chunk-54vzevgt.js";
 import {
   allow,
@@ -20,7 +20,7 @@ import {
   runSnapshot,
   statusWithOutcome,
   whatIsWaiting
-} from "./chunk-vvr4rk82.js";
+} from "./chunk-g8kkq85r.js";
 import {
   expertsDir,
   loadExperts,
@@ -30,7 +30,7 @@ import {
 } from "./chunk-3kmx3dmz.js";
 import {
   isFinished
-} from "./chunk-rz0qr006.js";
+} from "./chunk-jp6jscsd.js";
 import"./chunk-d0rp8c68.js";
 import {
   openRunViews

package/dist/hooks/statusline.js

@@ -2,9 +2,9 @@
 import {
   bar,
   runSnapshot
-} from "./chunk-vvr4rk82.js";
+} from "./chunk-g8kkq85r.js";
 import"./chunk-3kmx3dmz.js";
-import"./chunk-rz0qr006.js";
+import"./chunk-jp6jscsd.js";
 import"./chunk-d0rp8c68.js";
 import"./chunk-4mjxyfp9.js";
 import"./chunk-k4nqzdw5.js";

package/dist/tldrx.js

@@ -11902,7 +11902,8 @@ function gate(g) {
   const evidence = g.evidence === undefined ? "" : `, evidence: ${gateEvidence(g.evidence)}`;
   const executor = g.executed_by === undefined ? "" : `, executed_by: ${gateExecutor(g.executed_by)}`;
   const authority = g.authority === undefined ? "" : `, authority: ${gateAuthority(g.authority)}`;
-  return `{type: ${yamlScalar(g.type)}, status: ${yamlScalar(g.status)}, by: ${yamlScalar(g.by)}, ` + `at: ${yamlScalar(g.at)}, note: ${yamlScalar(g.note)}${evidence}${executor}${authority}}`;
+  const andContinue = g.and_continue === undefined ? "" : ", and_continue: true";
+  return `{type: ${yamlScalar(g.type)}, status: ${yamlScalar(g.status)}, by: ${yamlScalar(g.by)}, ` + `at: ${yamlScalar(g.at)}, note: ${yamlScalar(g.note)}${evidence}${executor}${authority}${andContinue}}`;
 }
 function task(t, indent) {
   const inner = `${indent}   `;
@@ -11911,8 +11912,9 @@ function task(t, indent) {
   const tokens = t.tokens === undefined ? "" : `, tokens: ${String(t.tokens)}`;
   const inTokens = t.input_tokens === undefined ? "" : `, input_tokens: ${String(t.input_tokens)}`;
   const outTokens = t.output_tokens === undefined ? "" : `, output_tokens: ${String(t.output_tokens)}`;
+  const role = t.role === undefined ? "" : `, role: ${yamlScalar(t.role)}`;
   return [
-    `${indent} - {id: ${yamlScalar(t.id)}, status: ${yamlScalar(t.status)}, expert: ${yamlScalar(t.expert)}, ` + `model: ${yamlScalar(t.model)}, cost_usd: ${cost}${metered}${tokens}${inTokens}${outTokens},`,
+    `${indent} - {id: ${yamlScalar(t.id)}, status: ${yamlScalar(t.status)}, expert: ${yamlScalar(t.expert)}${role}, ` + `model: ${yamlScalar(t.model)}, cost_usd: ${cost}${metered}${tokens}${inTokens}${outTokens},`,
     `${inner}error: ${yamlScalar(t.error)}, session_id: ${yamlScalar(t.session_id)},`,
     `${inner}started_at: ${yamlScalar(t.started_at)}, ended_at: ${yamlScalar(t.ended_at)},`,
     ...t.stopped_by === undefined || t.stopped_by === null ? [] : [`${inner}stopped_by: ${yamlScalar(t.stopped_by)},`],
@@ -13291,6 +13293,9 @@ function validateRunFile(input) {
           requireEnum(task2.status, STAGE_STATUSES, `${tp}.status`, issues);
           if (task2.cost_usd !== null)
             requireNumber(task2.cost_usd, `${tp}.cost_usd`, issues);
+          if (task2.role !== undefined && typeof task2.role !== "string") {
+            issues.push({ path: `${tp}.role`, message: "expected a string" });
+          }
           if (task2.metered !== undefined && typeof task2.metered !== "boolean") {
             issues.push({ path: `${tp}.metered`, message: "expected true or false" });
           }
@@ -15652,7 +15657,7 @@ var ENTRIES = [
       {
         name: "wait-gates",
         arg: "<duration>",
-        meaning: "Instead of exiting 4 the moment a stage parks on a pending GATE, poll the run for this long and resume if somebody signs it. `--wait-answers`' sibling for the other half of exit 4: a gate is closed by `tldrx approve` / `tldrx reject`, not by an answer. Approved → the loop carries on; rejected → it stops and prints the note; lapsed → exit 4 with the same lines it always had, after one `gate.timeout` notification. It WAITS FOR a signature and never produces one. A stage on `gates_policy: agent` has already had the engine's own gate signer run on it before this flag ever sees the gate (see the `gates_policy: agent` note below), so what is left to wait for here is a PERSON — the same wait a `human` gate gets. Nothing is spent while it waits. Both wait flags may be given together.",
+        meaning: "Instead of exiting 4 the moment a stage parks on a pending GATE, poll the run for this long and resume if somebody signs it. `--wait-answers`' sibling for the other half of exit 4: a gate is closed by `tldrx approve` / `tldrx reject`, not by an answer. Approved → the loop carries on; rejected → it stops and prints the note, unless the rejection was `tldrx reject --and-continue`, which re-runs the stage with the note instead (#242); lapsed → exit 4 with the same lines it always had, after one `gate.timeout` notification. It WAITS FOR a signature and never produces one. A stage on `gates_policy: agent` has already had the engine's own gate signer run on it before this flag ever sees the gate (see the `gates_policy: agent` note below), so what is left to wait for here is a PERSON — the same wait a `human` gate gets. Nothing is spent while it waits. Both wait flags may be given together.",
         sub: "auto"
       },
       {
@@ -15988,6 +15993,11 @@ var ENTRIES = [
     args: [],
     flags: [
       { name: "note", arg: "<text>", meaning: "What has to change. Required — a rejection with no reason is not actionable." },
+      {
+        name: "and-continue",
+        arg: null,
+        meaning: "This rejection means “redo it this way and carry on”, not “stop, I will look”. The stage goes back to `ready` with the note exactly as a bare rejection leaves it — what changes is that an unattended `tldrx run auto --wait-gates` re-runs the stage instead of exiting 4, so a rejection sent from a phone does not need a walk to a terminal to take effect. Recorded on the gate, so the waiting loop reads it rather than guessing from the note’s words. Without it a rejection stops the loop, which is the default and always was. Refused with exit 1 beside `--stage`: a revoke leaves that gate pending for a decision nobody has made yet, so there is no rejection for it to describe."
+      },
       {
         name: "stage",
         arg: "<phase>/<stage>",
@@ -15998,6 +16008,7 @@ var ENTRIES = [
     ],
     examples: [
       'tldrx reject --note "contracts.md does not name the events"',
+      'tldrx reject --and-continue --note "S2 fell over on a missing binary — redo S2 and waves 3 and 4"',
       'tldrx reject --stage 02-how/design --note "the auto gate signed over four open questions"'
     ],
     exits: [EXIT_OK, EXIT_USAGE, EXIT_GATE_REFUSED, EXIT_NOT_FOUND]
@@ -28963,6 +28974,9 @@ function blockedReasons(runDir) {
   }
   return out;
 }
+function gateStories(runDir, phaseId) {
+  return phaseId === BUILD_PHASE2 ? storiesView(runDir) : null;
+}
 function gateStoriesPayload(view) {
   const blocked = view.firstBlocked;
   return {
@@ -28970,6 +28984,14 @@ function gateStoriesPayload(view) {
     ...blocked === null ? {} : { blocked_story: blocked.id, blocked_reason: blocked.reason }
   };
 }
+function continueNote(view) {
+  const blocked = view.firstBlocked;
+  if (blocked === null)
+    return null;
+  if (blocked.reason === REASON_NOT_RECORDED)
+    return null;
+  return `${blocked.id} is blocked: ${blocked.reason}. Redo ${blocked.id}.`;
+}
 var REASON_IN_SUMMARY = 80;
 var NAMED_IN_SUMMARY = 3;
 function deliveredPhrase(view) {
@@ -29949,7 +29971,7 @@ function buildStatus(run, budget, runDir) {
     phases,
     budget: {
       spent_usd: run.budget.spent_usd,
-      ceiling_usd: run.budget.ceiling_usd,
+      ceiling_usd: budget.ceiling_usd,
       remaining_usd: remaining(budget)
     },
     attempts: stageAttempts(runDir, run.cursor.phase, run.cursor.stage),
@@ -30156,7 +30178,7 @@ function openRunRow(store) {
     cursor: `${run.cursor.phase}/${run.cursor.stage}`,
     waiting: whatIsWaiting(run, store.runDir).kind,
     spentUsd: run.budget.spent_usd,
-    ceilingUsd: run.budget.ceiling_usd
+    ceilingUsd: store.budget.ceiling_usd
   };
 }
 function openRunRows(stores) {
@@ -30291,6 +30313,9 @@ function approveCommand(runId) {
 function rejectCommand(runId) {
   return `tldrx reject --run ${runId} --note "<why>"`;
 }
+function continueCommand(runId) {
+  return `tldrx reject --run ${runId} --and-continue --note "…"`;
+}
 function toQuestion(block2, runId, recommendations) {
   const recommended = recommendations.get(block2.id);
   return {
@@ -30664,20 +30689,41 @@ function gatePhrase(policy) {
       return "gate";
   }
 }
-function gateNotification(ctx, costUsd, policy = null, held2 = [], stories = null) {
+function clearingCommand(runId, openQuestions2, unfinishedStories) {
+  switch (gateHolding(openQuestions2, unfinishedStories)) {
+    case "questions":
+      return answerCommand(openQuestions2[0] ?? "", runId);
+    case "stories":
+      return `tldrx run status ${runId}`;
+    default:
+      return approveCommand(runId);
+  }
+}
+function gateHolding(openQuestions2, unfinishedStories) {
+  if (openQuestions2[0] !== undefined)
+    return "questions";
+  if (unfinishedStories > 0)
+    return "stories";
+  return "none";
+}
+function gateNotification(ctx, costUsd, policy = null, held2 = [], stories = null, openQuestions2 = []) {
   const approve = approveCommand(ctx.runId);
   const why = held2.length === 0 ? "" : policy === "auto" ? ` It is held by: ${held2.join("; ")}.` : ` The engine's signer held it: ${held2.join("; ")}.`;
-  const delivered = stories === null ? "" : ` It ${deliveredPhrase(stories)}.`;
+  const delivered = stories === null ? "" : ` It has ${deliveredPhrase(stories)}.`;
+  const holding = gateHolding(openQuestions2, stories?.unfinished.length ?? 0);
+  const note = holding === "stories" && stories !== null ? continueNote(stories) : null;
   return {
     ...base(ctx, "gate.requested"),
     summary: `${ctx.runId} finished ${ctx.stage ?? "a stage"} for $${costUsd.toFixed(2)} and is waiting ` + `at ${gateArticle(policy)} ${gatePhrase(policy)}.${delivered}${why} Nothing runs after it until the gate is ` + "approved or rejected.",
-    command: approve,
+    command: clearingCommand(ctx.runId, openQuestions2, stories?.unfinished.length ?? 0),
     detail: {
       cost_usd: costUsd,
       approve_command: approve,
       reject_command: rejectCommand(ctx.runId),
       ...policy === null ? {} : { gate_policy: policy },
       ...stories === null ? {} : gateStoriesPayload(stories),
+      holding,
+      ...note === null ? {} : { continue_command: continueCommand(ctx.runId), continue_note: note },
       ...held2.length === 0 ? {} : policy === "auto" ? { held_by: held2 } : { signer_held: held2 }
     }
   };
@@ -30737,7 +30783,7 @@ function runEndNotification(ctx, exitCode, spentUsd, lastLine2, tally = { usd: s
     }
   };
 }
-function statusNotification(ctx, statusText, waitingOn = [], waitingOnGate = null, truncation = null) {
+function statusNotification(ctx, statusText, waitingOn = [], waitingOnGate = null, truncation = null, stories = null) {
   const ids = [...waitingOn];
   const parked = ids.length > 0;
   const gateSummary = waitingOnGate === null ? "" : `${ctx.runId} is parked at ${waitingOnGate.stage} waiting for a person to SIGN it: ` + `${gatePhrase(waitingOnGate.policy)}. Nothing runs after it and nothing is being spent ` + "while it waits." + (parked ? ` It also has ${String(ids.length)} open question(s): ${ids.join(", ")}.` : "");
@@ -30745,7 +30791,7 @@ function statusNotification(ctx, statusText, waitingOn = [], waitingOnGate = nul
   return {
     ...base(ctx, "status"),
     summary: (waitingOnGate !== null ? gateSummary : parked ? `${ctx.runId} is parked at ${ctx.stage ?? "an unnamed stage"} waiting on YOU: ` + `${String(ids.length)} open question(s), ${ids.join(", ")}. Nothing is being spent ` + "while it waits, and it resumes the moment one is answered." : `${ctx.runId} is still running at ${ctx.stage ?? "an unnamed stage"}. ` + "Nothing is waiting on you — this is the periodic heartbeat `--notify-every` asked for.") + tail2,
-    command: waitingOnGate !== null ? approveCommand(ctx.runId) : parked ? answerCommand(ids[0] ?? "Q1", ctx.runId) : `tldrx run status ${ctx.runId}`,
+    command: waitingOnGate !== null || parked ? clearingCommand(ctx.runId, ids, stories?.unfinished.length ?? 0) : `tldrx run status ${ctx.runId}`,
     detail: {
       status_text: statusText,
       waiting_on: ids,
@@ -31055,15 +31101,23 @@ function reject(store, ctx) {
     ...stage2,
     status: "ready",
     ended_at: null,
-    gate: { ...stage2.gate, status: "rejected", by: ctx.actor, at: ctx.at, note: ctx.note }
+    gate: {
+      ...stage2.gate,
+      status: "rejected",
+      by: ctx.actor,
+      at: ctx.at,
+      note: ctx.note,
+      and_continue: ctx.andContinue === true ? true : undefined
+    }
   })));
   store.append(event2(ctx.at, store.runId, entry.stage.id, "gate.rejected", ctx.actor, {
     phase: entry.phase.id,
     note: ctx.note,
-    from
+    from,
+    ...ctx.andContinue === true ? { and_continue: true } : {}
   }));
   store.save();
-  return { stage: entry.stage.id, phase: entry.phase.id, note: ctx.note, from };
+  return { stage: entry.stage.id, phase: entry.phase.id, note: ctx.note, from, andContinue: ctx.andContinue === true };
 }
 function revoke(store, ctx, target) {
   if (ctx.note.trim() === "") {
@@ -33636,6 +33690,14 @@ function emitPreflightYaml(preflight) {
       lines.push(`  - repo: ${yamlScalar(row2.repo)}`, `    command: ${yamlScalar(row2.command)}`, `    base_ref: ${yamlScalar(row2.baseRef)}`, `    base_sha: ${yamlScalar(row2.baseSha)}`, ...typeof row2.exitCode === "number" ? [`    exit_code: ${String(row2.exitCode)}`] : [], `    timed_out: ${row2.timedOut ? "true" : "false"}`, `    status: ${yamlScalar(row2.status)}`, `    tail: ${yamlScalar(row2.tail)}`);
       if (row2.refusedBecause !== undefined)
         lines.push(`    refused_because: ${yamlScalar(row2.refusedBecause)}`);
+      if (row2.excerpt !== undefined)
+        lines.push(`    excerpt: ${yamlScalar(row2.excerpt)}`);
+      if (row2.outputPath !== undefined)
+        lines.push(`    output_path: ${yamlScalar(row2.outputPath)}`);
+      if (row2.outputBytes !== undefined)
+        lines.push(`    output_bytes: ${String(row2.outputBytes)}`);
+      if (row2.outputLine !== undefined)
+        lines.push(`    output_line: ${String(row2.outputLine)}`);
       if (row2.commandHash !== undefined)
         lines.push(`    command_hash: ${yamlScalar(row2.commandHash)}`);
       if (row2.checkedAt !== undefined)
@@ -33678,6 +33740,8 @@ function parsePreflight(text3) {
         return null;
     }
     const hash = asText(row2.command_hash);
+    const excerpt = asText(row2.excerpt);
+    const outputPath = asText(row2.output_path);
     const rowCheckedAt = asText(row2.checked_at);
     results.push({
       repo,
@@ -33690,6 +33754,10 @@ function parsePreflight(text3) {
       ...refusedBecause === "" ? {} : { refusedBecause },
       status: row2.status === "ok" || row2.status === "failed" ? row2.status : "unmeasured",
       ...hash === "" ? {} : { commandHash: hash },
+      ...excerpt === "" ? {} : { excerpt },
+      ...outputPath === "" ? {} : { outputPath },
+      ...Number.isInteger(row2.output_bytes) ? { outputBytes: row2.output_bytes } : {},
+      ...Number.isInteger(row2.output_line) ? { outputLine: row2.output_line } : {},
       ...rowCheckedAt === "" ? {} : { checkedAt: rowCheckedAt }
     });
   }
@@ -33757,7 +33825,8 @@ function baseFailureLine(result2) {
   const at = result2.baseSha === "" ? "" : ` (${result2.baseSha})`;
   const why = result2.tail === "" ? "" : ` — ${result2.tail}`;
   const ran = result2.exitCode === undefined ? "was refused and never ran" : `exited ${String(result2.exitCode)}`;
-  return `  · \`${result2.command}\` ${ran}` + `${result2.timedOut ? " (timed out)" : ""} in repo ${result2.repo}` + ` on \`${result2.baseRef}\`${at}${why}`;
+  const cite2 = result2.outputPath === undefined ? "" : ` [src: ${result2.outputPath}:${String(result2.outputLine ?? 1)}]`;
+  return `  · \`${result2.command}\` ${ran}` + `${result2.timedOut ? " (timed out)" : ""} in repo ${result2.repo}` + ` on \`${result2.baseRef}\`${at}${why}${cite2}`;
 }
 function baseRefusalLines(failures, workspace) {
   const failed3 = [];
@@ -33888,6 +33957,9 @@ var FAILURE_RE = /FAIL|Failed|failed|\bfail\b|Error|error:|assert|✗|✖|not ok
 function dodOutputRel(storyId, index) {
   return `${BUILD_PHASE}/${LOG_DIR}/${DOD_OUTPUT_DIR}/${storyId}-${String(index + 1)}.txt`;
 }
+function baseOutputId(repo, command2) {
+  return `base-${hashText(JSON.stringify([repo, command2]))}`;
+}
 function meaningfulLines(output) {
   return output.split(`
 `).map((line) => line.trimEnd()).filter((line) => line.trim() !== "");
@@ -33994,6 +34066,8 @@ async function baseResultOf(parts, repo, command2) {
   try {
     const outcome = await runDodCommand(command2, repoDir, timeoutMs, parts.workspace.commands);
     const exitCode = outcome.timedOut ? 124 : outcome.exitCode;
+    const output = outcome.output ?? "";
+    const kept = exitCode === 0 && !outcome.timedOut ? null : writeDodOutput(parts.runDir, baseOutputId(repo, command2), 0, output);
     measured = {
       repo,
       command: command2,
@@ -34001,7 +34075,13 @@ async function baseResultOf(parts, repo, command2) {
       baseSha,
       exitCode,
       timedOut: outcome.timedOut,
-      tail: outcome.tail,
+      tail: kept === null ? outcome.tail : failureSummaryLine(output),
+      ...kept === null ? {} : {
+        excerpt: failureExcerpt(output),
+        outputPath: kept.rel,
+        outputBytes: kept.bytes,
+        outputLine: kept.line
+      },
       status: exitCode === 0 && !outcome.timedOut ? "ok" : "failed",
       commandHash: hash
     };
@@ -35047,6 +35127,7 @@ function loadRunResult(root2, id) {
       budget = null;
     }
   }
+  const withLiveCeiling = budget?.ceiling_usd === null || budget?.ceiling_usd === undefined ? run : { ...run, ceiling_usd: budget.ceiling_usd };
   const { events, error, skipped, mtime } = readEvents2(dir);
   return {
     kind: "ok",
@@ -35054,7 +35135,7 @@ function loadRunResult(root2, id) {
       root: root2,
       dir,
       id,
-      run,
+      run: withLiveCeiling,
       budget,
       events,
       eventsError: error,
@@ -37129,6 +37210,7 @@ class BuildSession {
       costUsd: cost ?? 0,
       sessionId: result2.session_id,
       error: null,
+      role: "developer",
       outputs: result2.outputs,
       ...cost === null ? { metered: false } : {},
       ...this.ctx.tokens === null ? {} : { tokens: this.ctx.tokens }
@@ -37687,6 +37769,7 @@ class BuildSession {
       costUsd: round25(agent.costUsd),
       sessionId: agent.sessionId,
       error: agent.error,
+      role: "developer",
       outputs: agent.envelope?.outputs ?? [],
       metered: agent.metered,
       inputTokens: agent.usage.input_tokens,
@@ -37814,6 +37897,7 @@ class BuildSession {
       costUsd: task2.costUsd,
       sessionId: task2.sessionId,
       error: null,
+      role: "reviewer",
       outputs: [],
       ...task2.metered ? {} : { metered: false },
       ...task2.tokens === undefined ? {} : { tokens: task2.tokens },
@@ -37887,6 +37971,7 @@ class BuildSession {
       costUsd: task2.costUsd,
       sessionId: task2.sessionId,
       error: task2.error ?? null,
+      role: "reviewer",
       outputs: [],
       ...task2.metered ? {} : { metered: false },
       ...task2.tokens === undefined ? {} : { tokens: task2.tokens },
@@ -38193,6 +38278,7 @@ class BuildSession {
       at: this.ctx.at,
       preparing: this.ctx.mode === "prepare",
       timeoutMs: this.ctx.spec.planned.timeout_s * 1000,
+      runDir: this.ctx.runDir,
       write: (work) => this.writes.run(work),
       advisories: this.advisories
     };
@@ -39438,6 +39524,7 @@ function recordExecutorTasks(store, options, phaseId, stageId, spec, outcome) {
       id,
       status: task2.error === null ? "done" : "failed",
       expert: spec.planned.experts[0] ?? null,
+      ...task2.role === undefined ? {} : { role: task2.role },
       model: task2.model,
       cost_usd: metered ? round26(task2.costUsd) : null,
       ...metered ? {} : { metered: false },
@@ -39615,7 +39702,7 @@ async function finishStage(store, options, phaseId, stageId, spec, notes, gateOv
       ...s,
       status: "awaiting_gate",
       ended_at: nowish(options),
-      gate: { ...s.gate, type: "approve", status: "pending" }
+      gate: { ...s.gate, type: "approve", status: "pending", and_continue: undefined }
     }));
     const autoVerdict = policy === "auto" ? await evaluateAutoGate({
       root: options.root,
@@ -40326,7 +40413,8 @@ async function runAuto(options) {
       } catch {
         return;
       }
-      await notifier.send(statusNotification(notifyCtx(), text3, stillBlocking(runDir2), pendingGate(runDir2), cutInputs(stageIdOf())), stageIdOf());
+      const gate2 = pendingGate(runDir2);
+      await notifier.send(statusNotification(notifyCtx(), text3, stillBlocking(runDir2), gate2, cutInputs(stageIdOf()), gate2 === null ? null : gateStories(runDir2, gate2.phase)), stageIdOf());
     })();
   }, options.notifyEveryMs);
   const finish = async (code, spentUsd) => {
@@ -40384,11 +40472,11 @@ async function runAuto(options) {
     if (requested !== null && !autoApproved) {
       const cost = requested;
       const policy = gatePolicyNow(runDir2);
-      const stories = requestedPhase === BUILD_PHASE2 ? storiesView(runDir2) : null;
+      const stories = gateStories(runDir2, requestedPhase);
       const send = async () => {
         if (notifier === null)
           return;
-        await notifier.send(gateNotification(notifyCtx(), cost, policy, gateHeld(fresh), stories), stageIdOf());
+        await notifier.send(gateNotification(notifyCtx(), cost, policy, gateHeld(fresh), stories, stillBlocking(runDir2)), stageIdOf());
       };
       if (onlyHeldByQuestions(fresh))
         return { costUsd: cost, deferredGate: send };
@@ -40500,6 +40588,10 @@ async function runAuto(options) {
                 continue;
               }
               if (waited.resolution === "rejected") {
+                if (waited.andContinue) {
+                  say(`waited ${String(Math.round(waited.ms / 1000))}s at ${cursorBefore} — ` + `the gate on ${gate2.stage} was REJECTED with --and-continue` + (waited.note === null ? "" : `: ${waited.note}`) + " — re-running the stage with the note, resuming");
+                  continue;
+                }
                 rejection = `waited ${String(Math.round(waited.ms / 1000))}s at ${cursorBefore} — ` + `the gate on ${gate2.stage} was REJECTED` + (waited.note === null ? "" : `: ${waited.note}`);
               } else {
                 await flushGate();
@@ -40561,6 +40653,7 @@ function pendingGate(runDir2) {
     return {
       stage: `${cursor.phase}/${cursor.stage}`,
       stageId: cursor.stage,
+      phase: cursor.phase,
       policy: gatePolicyFor(store.run.gates_policy, cursor.stage)
     };
   } catch {
@@ -40580,16 +40673,22 @@ async function waitForGate(runDir2, stageId, limitMs, gate2) {
   for (;; ) {
     const elapsed = Date.now() - started;
     const found = gateOf(runDir2, stageId);
-    if (found !== null && found.status === "approved")
-      return { resolution: "approved", ms: elapsed, note: null };
+    if (found !== null && found.status === "approved") {
+      return { resolution: "approved", ms: elapsed, note: null, andContinue: false };
+    }
     if (found !== null && found.status === "rejected") {
-      return { resolution: "rejected", ms: elapsed, note: found.note.trim() === "" ? null : found.note.trim() };
+      return {
+        resolution: "rejected",
+        ms: elapsed,
+        note: found.note.trim() === "" ? null : found.note.trim(),
+        andContinue: found.andContinue
+      };
     }
     if (found !== null && await selfCloseAutoGate(runDir2, stageId, gate2)) {
-      return { resolution: "approved", ms: Date.now() - started, note: null };
+      return { resolution: "approved", ms: Date.now() - started, note: null, andContinue: false };
     }
     if (elapsed >= limitMs)
-      return { resolution: "lapsed", ms: elapsed, note: null };
+      return { resolution: "lapsed", ms: elapsed, note: null, andContinue: false };
     const pollMs = pollInterval(limitMs);
     await new Promise((resolve11) => setTimeout(resolve11, Math.min(pollMs, limitMs - elapsed)));
   }
@@ -40622,7 +40721,11 @@ async function selfCloseAutoGate(runDir2, stageId, gate2) {
 function gateOf(runDir2, stageId) {
   try {
     const found = flatten(RunStore.open(runDir2).run).find((entry) => entry.stage.id === stageId);
-    return found === undefined ? null : { status: found.stage.gate.status, note: found.stage.gate.note };
+    return found === undefined ? null : {
+      status: found.stage.gate.status,
+      note: found.stage.gate.note,
+      andContinue: found.stage.gate.and_continue === true
+    };
   } catch {
     return null;
   }
@@ -44938,7 +45041,6 @@ function budgetRaise(argv) {
       return EXIT_GATE_REFUSED;
     }
     store.mutateBudget(() => outcome.budget);
-    store.mutate((run) => ({ ...run, budget: { ...run.budget, ceiling_usd: outcome.runCeilingAfter } }));
     store.append({
       ts: nowRfc3339(),
       run: store.runId,
@@ -45134,11 +45236,12 @@ function costReport(argv) {
 var rejectCommand2 = {
   name: "reject",
   summary: "Request changes at the current gate, or revoke an approval already given",
-  usage: "tldrx reject --note <text> [--stage <phase>/<stage>] [--run <id>] [--root <path>]",
+  usage: "tldrx reject --note <text> [--and-continue] [--stage <phase>/<stage>] [--run <id>] [--root <path>]",
   implemented: true,
   async run(argv) {
     try {
       const args = parseArgs(argv, ["run", "note", "root", "stage"]);
+      const andContinue = boolFlag(args, "and-continue");
       const note = stringFlag(args, "note") ?? args.positionals.join(" ");
       if (note.trim() === "") {
         throw new UsageError('reject needs --note: `tldrx reject --note "what to change"`');
@@ -45146,11 +45249,14 @@ var rejectCommand2 = {
       const root2 = workspaceRootFrom(args);
       const wanted = stringFlag(args, "run");
       const target = stringFlag(args, "stage");
+      if (andContinue && target !== undefined && target !== "") {
+        throw new UsageError("--and-continue is about a rejection at the CURRENT gate; --stage revokes an approval " + "already given, which leaves that gate pending for a decision nobody has made yet");
+      }
       const resolved = target === undefined || target === "" ? resolveRunOrExplain("tldrx reject", root2, wanted) : resolveIncludingFinished(root2, wanted);
       if (!isResolved(resolved))
         return resolved.exit;
       const store = resolved.store;
-      const ctx = { root: root2, actor: currentActor(), at: nowRfc3339(), note };
+      const ctx = { root: root2, actor: currentActor(), at: nowRfc3339(), note, andContinue };
       if (target !== undefined && target !== "") {
         const outcome2 = revoke(store, ctx, target);
         const signed = outcome2.signedBy === "auto" ? "it had been auto-approved by the facilitator" : `it had been approved by ${outcome2.signedBy}`;
@@ -45171,9 +45277,11 @@ var rejectCommand2 = {
       }
       const outcome = reject(store, ctx);
       const came = outcome.from === "failed" ? " (it had failed)" : "";
+      const loop = outcome.andContinue ? "an unattended `tldrx run auto --wait-gates` re-runs the stage instead of stopping (--and-continue)" : "an unattended `tldrx run auto --wait-gates` STOPS here — pass --and-continue to have it carry on instead";
       process.stdout.write(`rejected ${outcome.phase}/${outcome.stage}${came} — back to \`ready\`
 ` + `note: ${outcome.note}
 the note goes into the next prompt — \`tldrx next\` to re-run the stage
+` + `${loop}
 `);
       return EXIT_OK;
     } catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tldr-experts",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "tldr-experts: an evidence-first, file-based AI development framework - five stages, a gate on every one, and every claim cited or refused. Installs the `tldrx` (and `tldr-experts`) command. Beta.",
   "license": "MIT",
   "author": "Alan Martinez",

package/plugin/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$doc": "Shape verified from https://code.claude.com/docs/en/plugins.md (Quickstart > Create the plugin manifest). Fields used here: name, description, version, author.name. Only plugin.json goes inside .claude-plugin/; skills/, agents/ and hooks/ live at the plugin root.",
   "name": "tldrx",
   "description": "tldr-experts: an evidence-first, file-based AI development framework. Five stages, a gate on every one, every claim cited or refused. Beta.",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "author": {
     "name": "Alan Martinez"
   }