tldr-experts 0.16.1 → 0.17.0

package/CHANGELOG.md

@@ -1,5 +1,94 @@
 # Changelog
 
+## 0.17.0 — 2026-09-12
+
+### Added
+
+- **A `gate.requested` payload says what is HOLDING the gate, and hands over the rejection that
+  carries on (#243).** The owner's phone renders a gate as two buttons, Yes and No, and the No
+  branch rejects nothing — it logs *"gate stays open"*. That is not the adapter being lazy: it is
+  the adapter working with what it was handed. Of the three things #239 taught the framework to
+  distinguish, exactly one travelled as data — `detail.stories` says there is unbuilt work —
+  while "there are open questions" travelled in nothing but the PREFIX of `command`
+  (`tldrx answer …`). Routing on that is a second, untested, out-of-repo copy of the mapping,
+  and it goes quietly wrong the day a command is reworded. So the branch `clearingCommand`
+  already takes is now NAMED: `detail.holding` is `questions`, `stories` or `none`, and
+  `clearingCommand` switches on it, so the field and the command are two renderings of one
+  derivation and cannot disagree (§7). And the payload now spells the other half of what a third
+  button needs: `detail.continue_command` is `tldrx reject --run <id> --and-continue --note "…"`
+  — #242's verb, with the substitutable `…` `answer_command` established, rather than
+  `reject_command`'s `<why>`, which is prose for a human and would have been sent literally as
+  the next turn's prompt. Its note is DERIVED, never canned: `continue_note` is the blocked
+  story and the handoff's own reason for it, the same two facts already on the payload as
+  `blocked_story` and `blocked_reason`. Both keys are absent together wherever the gate cannot
+  name what has to change — held by open questions (the gate is downstream of them, and a
+  one-tap refusal there is the mirror of the mistake #239 was filed over), held by nothing
+  mechanical (the reason to refuse a judgement is in a person's head), and held by stories none
+  of which is blocked or whose blocked one recorded no reason. `--note` is mechanically required
+  and becomes the next turn's prompt, so a canned *"rejected from Slack"* would satisfy the flag
+  and empty the rule it exists for: a button that hands the re-run an empty instruction is worse
+  than no button. Every key is additive — a consumer that reads none of them gets exactly the
+  payload it got before. Which buttons an adapter draws, and how, stays the adapter's.
+
+### Fixed
+
+- **`run status` could print more money left than it had ceiling, and the fix was to delete a
+  copy rather than synchronise one (#236).** Measured live on a hosted run after four raises:
+  `budget  $0.00 spent of $190.00 ceiling ($200.00 left)` — a sentence that cannot be true. The
+  two figures came from two files. The remainder has always been `budget.yml`'s; the ceiling was
+  `run.yml`'s `budget.ceiling_usd`, and the issue's own diagnosis — that `budget raise` never
+  wrote that key — was WRONG: it wrote it, on the line after it wrote `budget.yml`, and had since
+  the command's first commit. What defeated it was concurrency. `RunStore.save()` re-reads
+  budget.yml's ceilings from disk before every write, precisely because a store that loaded the
+  file an hour ago must not clobber a raise (`ceilingsToWrite`); run.yml's mirror had no such
+  re-read, so `rollUp` carried the pre-raise value straight back out. A long-lived `run auto`
+  saving after an operator's raise reverted the mirror, and the ceiling on screen fell below the
+  remainder beside it. Nothing decided against the stale figure — every refusal, gate and brake
+  already reads budget.yml (measured: all 47 `ceiling_usd` references read; the mirror's four
+  readers are all display), so this was a lie on a screen and not money spent wrongly, which is
+  the part the issue left open. The fix follows §7 rather than the obvious repair: two copies
+  that must both be fresh is the shape the house rule forbids, and writing both harder is exactly
+  what concurrency beat. So the live readers — `run status`, the open-runs table, `tldrx
+  statusline`'s validated path and the dashboard's headline — now read budget.yml, the same field
+  `budget show` reads, and `budget raise` no longer writes the mirror at all. run.yml's
+  `budget.ceiling_usd` and `per_agent_max_usd` are documented for what they always were: the
+  figures the run was CREATED with. That is not a `version: 1` meaning change — the keys are
+  required and still written, they held the creation ceiling before this change too, and what
+  moved is only that nothing reads them as the current one. The corollary is the part worth
+  writing down, because the first cut of this change got it wrong and a pre-merge review caught
+  it: run.yml's budget block is **half live**. `spent_usd` is re-derived by `rollUp` on every
+  save; `ceiling_usd` beside it is frozen. Printing the two as one sentence therefore reproduces
+  the same defect somewhere else, which is precisely what `tldrx replay` did — measured through
+  the CLI on a run raised $10 → $30 with $12 spent: `Status: **pending** · $12.00 spent of $10.00
+  ceiling`, no corruption and no concurrency needed, just a raise. "A replay narrates the
+  document" does not rescue it when the document itself is mixed. So the ceiling is resolved once
+  in `replay/loadRun.ts`, the single place both files are in hand, and `tldrx replay` and the
+  dashboard share that derivation. Swept for the same class: the only other frozen keys in
+  run.yml are `budget.per_agent_max_usd`, which no reader anywhere displays, and `created_with`,
+  which is frozen on purpose and paired with `last_written_by` to show exactly that difference.
+  One reader stays on the mirror by design: the statusline's tolerant fallback, which runs only
+  when run.yml fails validation, where a second tolerant parser for budget.yml would be a worse
+  trade than a figure on an already-degraded screen.
+
+- **A task row now says which ROLE took the turn, instead of filing every Build turn under the
+  developer (#234).** `run.yml`'s `tasks[].expert` is the STAGE's expert — one value copied onto
+  every row from `stage.experts[0]` — and a Build stage declares `experts: [developer]` while
+  running two roles under it. So the reviewer's turn, with its own money, its own token split
+  and its own measured span, was recorded as the developer's, and the golden fixtures had that
+  frozen: three of the four Build scenarios shipped a `fake-reviewer-*` session labelled
+  `developer`. The role was never unknown — the executor spawns under it and emits it on
+  `agent.spawned` — it was thrown away one function later, because `ExecutorTask` had nowhere to
+  put it. Nothing downstream computed a wrong NUMBER from this (no reader reads the field; the
+  per-role cost report it looked like it fed does not exist), which is exactly why it was worth
+  fixing now rather than after something started reading it: what was broken is the audit
+  record, and §7's rule is that those never lie in the dangerous direction. The fix is a new
+  additive `tasks[].role`, NOT a new meaning for `expert` — a `version: 1` field never changes
+  what it says — carried from the four places the Build executor records a turn. A turn whose
+  role nothing recorded carries no key at all: absent is "not recorded", never a `developer` of
+  convenience, which is the same guess the bug was made of. Rows written before the key exist
+  unchanged and still validate. `docs/spec.md` documents the new field and, while it was open,
+  the `tasks[].expert` that has been written on every row since 0.1 and was never documented.
+
 ## 0.16.1 — 2026-09-12
 
 ### Added

package/README.md

@@ -316,6 +316,7 @@ back on the registry is 0.3.0.
 
 | Version | Date | Status | Contains |
 |---|---|---|---|
+| 0.17.0 | 2026-09-12 | `beta` | three things the framework knew and recorded wrongly, each found by reading its own records rather than by using it: a gate notification now carries the condition HOLDING the gate as data instead of leaving it to be guessed from the text of the command it suggests — `holding` says questions, stories or nothing-mechanical, and when a story is blocked with a recorded reason the payload also hands over a ready-made rejection that lets the loop carry on, with the note DERIVED from the blocked story rather than canned, because a rejection's note is fed to the next turn's prompt and a generic one would hand that turn an empty instruction, so when no reason can be derived the offer is absent rather than invented; the emitted command keeps a literal placeholder and never interpolates the reason, which keeps the quoting hazard out of the record and puts it where a substituting client can see it; `run status` stopped printing more money left than it had ceiling — the run ceiling now has ONE live copy, read from `budget.yml` by every live screen, and `run.yml`'s mirror is documented as the creation value and no longer written by a raise, since the break was never that a raise failed to write the mirror but that an ordinary concurrent save carried a stale copy over it, and the fix was to delete the half-sync rather than to build a better one — pre-merge review caught the first version pairing a LIVE spend with that now-frozen ceiling inside `tldrx replay`, which would have reproduced the same impossible line in a different command on every run whose budget had been raised, measured on the real CLI as `$12.00 spent of $10.00 ceiling` with no concurrency required; and a task row now records the ROLE its turn actually ran under, where every Build turn had been filed as the developer including the reviewer's — the role was known at spawn and written to the event stream, and was dropped on the way to the ledger, so the audit record named the wrong actor for work it had itself measured; the new key is additive and written on EVERY row including the developer's, because a role present only on reviewers would make its absence mean developer-or-not-recorded and send a reader back to inferring the role from an absence, which is the guess the change exists to remove |
 | 0.16.1 | 2026-09-12 | `beta` | five things the framework knew and did not say, or said wrong — four of them found by using it rather than by reading it: a red base pre-flight now KEEPS its output, so a refusal that blocks every story in a Build names the failing test and cites the file, where it used to record only the last line of stdout — measured 2026-09-10, a stage refused with `tail: "Test run completed with non-success exit code: 2"` while the cause, `DockerUnavailableException`, sat on line 12 of 163,702 lines the run had already captured and thrown away, so diagnosing a refusal the framework had itself measured meant re-running the workspace's test command by hand; it now routes through the same seam #211 built for a story's DoD, which had been naming its failing test correctly all along on the same command, the same day, in the same repo — the path with the SMALLER blast radius was the legible one; a gate notification now offers the command that CLEARS it rather than always `tldrx approve` — questions open give `tldrx answer <id>`, unfinished stories give `tldrx run status`, and `approve` is offered only when nothing mechanical is outstanding, after an owner approved a Build gate by mistake twice in one evening over unbuilt stories, each time from a phone, each time needing a revoke, while a ten-minute heartbeat repeated `Run: tldrx approve` seven times under a sentence that correctly named the five open questions holding it; `tldrx reject --and-continue` lets a rejection mean "redo it this way and carry on" instead of ending the run — the loop resumed after an approve and stopped after a reject, so the button meaning "there is still work to do" was the one that stopped the work and only a terminal could revive it; five real rejections that night all meant continue, five cost a manual relaunch, and a bare `tldrx reject` still writes a byte-identical `run.yml` and stops exactly as before; the expert-recompute fixture anchors its evidence dates to a `now` it can move, so `bun test` stops going red by the calendar — pristine `main` was red at the exact sha of the published 0.16.0 with no commit in between, and a clock moved one year forward reddened FIVE cases, not the one that had already fired; and `test/merge-wave.test.ts`'s concurrency failure, documented as a known flake since #115 and carrying a written licence to re-run it, was never one: `merge-guard.sh` rewrote `.git/hooks/reference-transaction` IN PLACE while a sibling wave's `git merge` was exec'ing it — ETXTBSY on Linux at 31% under contention, benign on macOS, which is why it was green locally and red in CI, and why a same-sha re-run failed 2 for 2 rather than passing; the hook is now written to a temp file and RENAMED into place, the refusal that used to borrow `2`/`merge conflict` for a hook abort now says what it was and exits 11, and AGENTS.md §4 withdraws the re-run licence for those two cases while naming the interrupted-merge case (#237) as still open and undiagnosed — because "all real" for a whole file costs the same as "all flake", in the other direction |
 | 0.16.0 | 2026-09-11 | `beta` | an unattended run can now clear the one kind of failure it was stopping on, and a gate that refuses says why it refused: measured 2026-09-10 on a real unattended `run auto`, the loop drove itself through what → how → plan and signed all three `auto` gates by itself, and still needed a person four times — three of those were content or money decisions a loop must not make, and the fourth was a plan that failed its own check by five characters over a cap, where a person relaunched the same command and the next attempt fixed the two files and passed, so the loop stopped on the one failure it could have cleared; `tldrx run auto --retry-failed <n>` now runs a failed stage again at most `n` times in a row, bounding exit `5` and nothing else — a usage error (`1`), a money refusal (`2`) and an awaiting-human park (`4`) are each attempted ONCE however large `n` is, because a phase ceiling means a human decides about money and a retry would turn that sentence into a delay — only CONSECUTIVE failures count since what is bounded is "this run is stuck" and not "this run has ever failed", a retry SPENDS as a fresh metered stage under the same phase ceiling and the same `--max-usd`, `0` is the default and a default invocation's lines are byte-identical to what they were, and when the bound is spent the loop stops on the failure's own exit `5` and says the count LAST, so the sentence that reaches a phone is what the loop tried and not a bare number; and an `auto` gate that REFUSES now writes down the verdict its note was always designed to carry — a gate sat pending ~40 minutes while `run status` and `--verbose` named no condition at all, and the reason surfaced only when a person guessed at the `tldrx approve` the status line suggested, which is the one route nobody unattended is going to take — recording all seven conditions WITH THEIR VALUES on the still-`pending` gate, since a note that dropped the passing ones would answer "was it the money" with the same silence, and naming the holding ids on the gate row and on the `waiting` line; it writes only over a `pending` gate, so a gate a person has since signed keeps THEIR words, and only when the verdict would change, so a four-hour `--wait-gates` poll writes once per distinct verdict rather than thousands of times — and that test and that write are a compare-and-set under the workspace lock, because pre-merge review reproduced, with two real processes, a check-then-act over an earlier snapshot erasing a concurrent `approve` outright, and the poll runs every two seconds precisely while a person is deciding |
 | 0.15.0 | 2026-09-10 | `beta` | defaults for the models actually running today, and records that name what happened: measured 2026-09-07/09 across three real workspaces, the first engine-driven run of each was ended by a calibration rather than by the work — a `how` turn and two Build developer turns killed at a 900 s per-turn clock while Opus turns on real repositories run 15-50 minutes, a 202 KB prompt refused by a ceiling whose own message called it "29% of a 200k window", and a 169 KB `facts.yml` sliced to 96 KB on its way into a design turn that then died. So a turn gets two hours (`timeout_s` 900 → 7200), a prompt 400 KB and inputs 256 KB, a phase ceiling holds every attempt its stages may take so the first retry of a stage that spent anything is no longer refused by arithmetic — `warn_at_pct` still measured against one attempt's share, so the warning still arrives before the money — and the four numbers that were calibrations rather than invariants (`attempts`, `fixlist_rounds`, `reviewer_share`, `gate_signer_share`) became optional `stage.yml` keys, refused by name out of range instead of clamped, absent meaning today's constant byte for byte, with `tldrx run auto --prompt-max-bytes` and `--max-reads` for the unattended run that would otherwise need a file edit to get past one refusal; a story's Definition of Done now runs with its dependencies installed — the `install:` slot has sat unread in `templates/workspace.yml` since the beginning and now runs in every fresh story worktree through the same allowlist-and-argv runner, recorded with its own exit code and duration, blocking the story rather than paying a turn to discover it — an exit 127 is reported as a named absent binary and not as a red test, a declared command may be run WITH ARGUMENTS (the exact `Bash(npm run test)` grant matched nothing the developer actually typed, so its own 127 was first seen by the gate, after the turn was paid for), and every DoD check says which tree it ran in; the Build gate now names story outcomes on every policy and not only `auto` — two runs approved from a phone printed `run is done` over zero stories delivered — `run.yml` records an additive `outcome:` written once by all three commands that close a run and rendered by six surfaces, and `tldrx ship` refuses with exit 1 instead of opening a PR over nothing; a red DoD keeps its real failure — the last 200 lines on disk (gitignored, since a tail can carry a secret), up to five failure-looking lines as the detail rather than the last `DeprecationWarning` on stderr, the failing line cited at the line it starts on, and the next attempt told it was the check and not a reviewer; a watcher card may honestly say `Query: none — <reason> [src: …]`, earned only over a card whose own `## Signal` cites `absent:` and refused like any unsourced item otherwise, after a stage spent real money writing the honest answer and was refused for it; a truncated input is told to the OWNER at spawn and not only to the sub-agent, a turn killed on timeout keeps the usage it had already streamed and never a price; and the maintain skill says which sha a review record must cite — the code head — a rule that cost a wave and was written down nowhere an agent reads |

package/dist/hooks/answer-capture.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   conflictOf
-} from "./chunk-z0hnthw4.js";
+} from "./chunk-tj66vg1n.js";
 import {
   FactsStore,
   formatJaccard
@@ -13,7 +13,7 @@ import {
 import {
   EventLog,
   PHASE_ID_RE
-} from "./chunk-rz0qr006.js";
+} from "./chunk-jp6jscsd.js";
 import {
   PHASE_IDS
 } from "./chunk-d0rp8c68.js";

package/dist/hooks/budget-gate.js

@@ -25,7 +25,7 @@ import {
 } from "./chunk-3kmx3dmz.js";
 import {
   EventLog
-} from "./chunk-rz0qr006.js";
+} from "./chunk-jp6jscsd.js";
 import {
   cursorStage,
   hostTokensIn,

package/dist/hooks/{chunk-gv3sj8gv.js → chunk-g8kkq85r.js}

@@ -21,7 +21,7 @@ import {
   isTerminal,
   stageAt,
   validateRunFile
-} from "./chunk-rz0qr006.js";
+} from "./chunk-jp6jscsd.js";
 import {
   cursorStage,
   isAttendedByHostView,
@@ -109,8 +109,9 @@ function task(t, indent) {
   const tokens = t.tokens === undefined ? "" : `, tokens: ${String(t.tokens)}`;
   const inTokens = t.input_tokens === undefined ? "" : `, input_tokens: ${String(t.input_tokens)}`;
   const outTokens = t.output_tokens === undefined ? "" : `, output_tokens: ${String(t.output_tokens)}`;
+  const role = t.role === undefined ? "" : `, role: ${yamlScalar(t.role)}`;
   return [
-    `${indent} - {id: ${yamlScalar(t.id)}, status: ${yamlScalar(t.status)}, expert: ${yamlScalar(t.expert)}, ` + `model: ${yamlScalar(t.model)}, cost_usd: ${cost}${metered}${tokens}${inTokens}${outTokens},`,
+    `${indent} - {id: ${yamlScalar(t.id)}, status: ${yamlScalar(t.status)}, expert: ${yamlScalar(t.expert)}${role}, ` + `model: ${yamlScalar(t.model)}, cost_usd: ${cost}${metered}${tokens}${inTokens}${outTokens},`,
     `${inner}error: ${yamlScalar(t.error)}, session_id: ${yamlScalar(t.session_id)},`,
     `${inner}started_at: ${yamlScalar(t.started_at)}, ended_at: ${yamlScalar(t.ended_at)},`,
     ...t.stopped_by === undefined || t.stopped_by === null ? [] : [`${inner}stopped_by: ${yamlScalar(t.stopped_by)},`],
@@ -606,7 +607,7 @@ function fromStore(root) {
     expert: entry?.stage.expert ?? null,
     done: stages.filter((stage2) => isTerminal(stage2.status)).length,
     total: stages.length,
-    ceilingUsd: run.budget.ceiling_usd,
+    ceilingUsd: store.budget.ceiling_usd,
     spentUsd: run.budget.spent_usd,
     openCount: open.length,
     machineGates: stages.filter((s) => s.gate.status === "approved" && closedByMachine(s.gate)).length,

package/dist/hooks/{chunk-rz0qr006.js → chunk-jp6jscsd.js}

@@ -700,6 +700,9 @@ function validateRunFile(input) {
           requireEnum(task.status, STAGE_STATUSES, `${tp}.status`, issues);
           if (task.cost_usd !== null)
             requireNumber(task.cost_usd, `${tp}.cost_usd`, issues);
+          if (task.role !== undefined && typeof task.role !== "string") {
+            issues.push({ path: `${tp}.role`, message: "expected a string" });
+          }
           if (task.metered !== undefined && typeof task.metered !== "boolean") {
             issues.push({ path: `${tp}.metered`, message: "expected true or false" });
           }

package/dist/hooks/{chunk-z0hnthw4.js → chunk-tj66vg1n.js}

@@ -5,7 +5,7 @@ import {
   evidencePath,
   gateEvidencePath,
   parseEvidence
-} from "./chunk-rz0qr006.js";
+} from "./chunk-jp6jscsd.js";
 import {
   openBlocks,
   parseQuestions

package/dist/hooks/session-start.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   questionsCard
-} from "./chunk-z0hnthw4.js";
+} from "./chunk-tj66vg1n.js";
 import"./chunk-54vzevgt.js";
 import {
   allow,
@@ -20,7 +20,7 @@ import {
   runSnapshot,
   statusWithOutcome,
   whatIsWaiting
-} from "./chunk-gv3sj8gv.js";
+} from "./chunk-g8kkq85r.js";
 import {
   expertsDir,
   loadExperts,
@@ -30,7 +30,7 @@ import {
 } from "./chunk-3kmx3dmz.js";
 import {
   isFinished
-} from "./chunk-rz0qr006.js";
+} from "./chunk-jp6jscsd.js";
 import"./chunk-d0rp8c68.js";
 import {
   openRunViews

package/dist/hooks/statusline.js

@@ -2,9 +2,9 @@
 import {
   bar,
   runSnapshot
-} from "./chunk-gv3sj8gv.js";
+} from "./chunk-g8kkq85r.js";
 import"./chunk-3kmx3dmz.js";
-import"./chunk-rz0qr006.js";
+import"./chunk-jp6jscsd.js";
 import"./chunk-d0rp8c68.js";
 import"./chunk-4mjxyfp9.js";
 import"./chunk-k4nqzdw5.js";

package/dist/tldrx.js

@@ -11912,8 +11912,9 @@ function task(t, indent) {
   const tokens = t.tokens === undefined ? "" : `, tokens: ${String(t.tokens)}`;
   const inTokens = t.input_tokens === undefined ? "" : `, input_tokens: ${String(t.input_tokens)}`;
   const outTokens = t.output_tokens === undefined ? "" : `, output_tokens: ${String(t.output_tokens)}`;
+  const role = t.role === undefined ? "" : `, role: ${yamlScalar(t.role)}`;
   return [
-    `${indent} - {id: ${yamlScalar(t.id)}, status: ${yamlScalar(t.status)}, expert: ${yamlScalar(t.expert)}, ` + `model: ${yamlScalar(t.model)}, cost_usd: ${cost}${metered}${tokens}${inTokens}${outTokens},`,
+    `${indent} - {id: ${yamlScalar(t.id)}, status: ${yamlScalar(t.status)}, expert: ${yamlScalar(t.expert)}${role}, ` + `model: ${yamlScalar(t.model)}, cost_usd: ${cost}${metered}${tokens}${inTokens}${outTokens},`,
     `${inner}error: ${yamlScalar(t.error)}, session_id: ${yamlScalar(t.session_id)},`,
     `${inner}started_at: ${yamlScalar(t.started_at)}, ended_at: ${yamlScalar(t.ended_at)},`,
     ...t.stopped_by === undefined || t.stopped_by === null ? [] : [`${inner}stopped_by: ${yamlScalar(t.stopped_by)},`],
@@ -13292,6 +13293,9 @@ function validateRunFile(input) {
           requireEnum(task2.status, STAGE_STATUSES, `${tp}.status`, issues);
           if (task2.cost_usd !== null)
             requireNumber(task2.cost_usd, `${tp}.cost_usd`, issues);
+          if (task2.role !== undefined && typeof task2.role !== "string") {
+            issues.push({ path: `${tp}.role`, message: "expected a string" });
+          }
           if (task2.metered !== undefined && typeof task2.metered !== "boolean") {
             issues.push({ path: `${tp}.metered`, message: "expected true or false" });
           }
@@ -28980,6 +28984,14 @@ function gateStoriesPayload(view) {
     ...blocked === null ? {} : { blocked_story: blocked.id, blocked_reason: blocked.reason }
   };
 }
+function continueNote(view) {
+  const blocked = view.firstBlocked;
+  if (blocked === null)
+    return null;
+  if (blocked.reason === REASON_NOT_RECORDED)
+    return null;
+  return `${blocked.id} is blocked: ${blocked.reason}. Redo ${blocked.id}.`;
+}
 var REASON_IN_SUMMARY = 80;
 var NAMED_IN_SUMMARY = 3;
 function deliveredPhrase(view) {
@@ -29959,7 +29971,7 @@ function buildStatus(run, budget, runDir) {
     phases,
     budget: {
       spent_usd: run.budget.spent_usd,
-      ceiling_usd: run.budget.ceiling_usd,
+      ceiling_usd: budget.ceiling_usd,
       remaining_usd: remaining(budget)
     },
     attempts: stageAttempts(runDir, run.cursor.phase, run.cursor.stage),
@@ -30166,7 +30178,7 @@ function openRunRow(store) {
     cursor: `${run.cursor.phase}/${run.cursor.stage}`,
     waiting: whatIsWaiting(run, store.runDir).kind,
     spentUsd: run.budget.spent_usd,
-    ceilingUsd: run.budget.ceiling_usd
+    ceilingUsd: store.budget.ceiling_usd
   };
 }
 function openRunRows(stores) {
@@ -30301,6 +30313,9 @@ function approveCommand(runId) {
 function rejectCommand(runId) {
   return `tldrx reject --run ${runId} --note "<why>"`;
 }
+function continueCommand(runId) {
+  return `tldrx reject --run ${runId} --and-continue --note "…"`;
+}
 function toQuestion(block2, runId, recommendations) {
   const recommended = recommendations.get(block2.id);
   return {
@@ -30675,17 +30690,28 @@ function gatePhrase(policy) {
   }
 }
 function clearingCommand(runId, openQuestions2, unfinishedStories) {
-  const first2 = openQuestions2[0];
-  if (first2 !== undefined)
-    return answerCommand(first2, runId);
+  switch (gateHolding(openQuestions2, unfinishedStories)) {
+    case "questions":
+      return answerCommand(openQuestions2[0] ?? "", runId);
+    case "stories":
+      return `tldrx run status ${runId}`;
+    default:
+      return approveCommand(runId);
+  }
+}
+function gateHolding(openQuestions2, unfinishedStories) {
+  if (openQuestions2[0] !== undefined)
+    return "questions";
   if (unfinishedStories > 0)
-    return `tldrx run status ${runId}`;
-  return approveCommand(runId);
+    return "stories";
+  return "none";
 }
 function gateNotification(ctx, costUsd, policy = null, held2 = [], stories = null, openQuestions2 = []) {
   const approve = approveCommand(ctx.runId);
   const why = held2.length === 0 ? "" : policy === "auto" ? ` It is held by: ${held2.join("; ")}.` : ` The engine's signer held it: ${held2.join("; ")}.`;
   const delivered = stories === null ? "" : ` It has ${deliveredPhrase(stories)}.`;
+  const holding = gateHolding(openQuestions2, stories?.unfinished.length ?? 0);
+  const note = holding === "stories" && stories !== null ? continueNote(stories) : null;
   return {
     ...base(ctx, "gate.requested"),
     summary: `${ctx.runId} finished ${ctx.stage ?? "a stage"} for $${costUsd.toFixed(2)} and is waiting ` + `at ${gateArticle(policy)} ${gatePhrase(policy)}.${delivered}${why} Nothing runs after it until the gate is ` + "approved or rejected.",
@@ -30696,6 +30722,8 @@ function gateNotification(ctx, costUsd, policy = null, held2 = [], stories = nul
       reject_command: rejectCommand(ctx.runId),
       ...policy === null ? {} : { gate_policy: policy },
       ...stories === null ? {} : gateStoriesPayload(stories),
+      holding,
+      ...note === null ? {} : { continue_command: continueCommand(ctx.runId), continue_note: note },
       ...held2.length === 0 ? {} : policy === "auto" ? { held_by: held2 } : { signer_held: held2 }
     }
   };
@@ -35099,6 +35127,7 @@ function loadRunResult(root2, id) {
       budget = null;
     }
   }
+  const withLiveCeiling = budget?.ceiling_usd === null || budget?.ceiling_usd === undefined ? run : { ...run, ceiling_usd: budget.ceiling_usd };
   const { events, error, skipped, mtime } = readEvents2(dir);
   return {
     kind: "ok",
@@ -35106,7 +35135,7 @@ function loadRunResult(root2, id) {
       root: root2,
       dir,
       id,
-      run,
+      run: withLiveCeiling,
       budget,
       events,
       eventsError: error,
@@ -37181,6 +37210,7 @@ class BuildSession {
       costUsd: cost ?? 0,
       sessionId: result2.session_id,
       error: null,
+      role: "developer",
       outputs: result2.outputs,
       ...cost === null ? { metered: false } : {},
       ...this.ctx.tokens === null ? {} : { tokens: this.ctx.tokens }
@@ -37739,6 +37769,7 @@ class BuildSession {
       costUsd: round25(agent.costUsd),
       sessionId: agent.sessionId,
       error: agent.error,
+      role: "developer",
       outputs: agent.envelope?.outputs ?? [],
       metered: agent.metered,
       inputTokens: agent.usage.input_tokens,
@@ -37866,6 +37897,7 @@ class BuildSession {
       costUsd: task2.costUsd,
       sessionId: task2.sessionId,
       error: null,
+      role: "reviewer",
       outputs: [],
       ...task2.metered ? {} : { metered: false },
       ...task2.tokens === undefined ? {} : { tokens: task2.tokens },
@@ -37939,6 +37971,7 @@ class BuildSession {
       costUsd: task2.costUsd,
       sessionId: task2.sessionId,
       error: task2.error ?? null,
+      role: "reviewer",
       outputs: [],
       ...task2.metered ? {} : { metered: false },
       ...task2.tokens === undefined ? {} : { tokens: task2.tokens },
@@ -39491,6 +39524,7 @@ function recordExecutorTasks(store, options, phaseId, stageId, spec, outcome) {
       id,
       status: task2.error === null ? "done" : "failed",
       expert: spec.planned.experts[0] ?? null,
+      ...task2.role === undefined ? {} : { role: task2.role },
       model: task2.model,
       cost_usd: metered ? round26(task2.costUsd) : null,
       ...metered ? {} : { metered: false },
@@ -45007,7 +45041,6 @@ function budgetRaise(argv) {
       return EXIT_GATE_REFUSED;
     }
     store.mutateBudget(() => outcome.budget);
-    store.mutate((run) => ({ ...run, budget: { ...run.budget, ceiling_usd: outcome.runCeilingAfter } }));
     store.append({
       ts: nowRfc3339(),
       run: store.runId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tldr-experts",
-  "version": "0.16.1",
+  "version": "0.17.0",
   "description": "tldr-experts: an evidence-first, file-based AI development framework - five stages, a gate on every one, and every claim cited or refused. Installs the `tldrx` (and `tldr-experts`) command. Beta.",
   "license": "MIT",
   "author": "Alan Martinez",

package/plugin/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$doc": "Shape verified from https://code.claude.com/docs/en/plugins.md (Quickstart > Create the plugin manifest). Fields used here: name, description, version, author.name. Only plugin.json goes inside .claude-plugin/; skills/, agents/ and hooks/ live at the plugin root.",
   "name": "tldrx",
   "description": "tldr-experts: an evidence-first, file-based AI development framework. Five stages, a gate on every one, every claim cited or refused. Beta.",
-  "version": "0.16.1",
+  "version": "0.17.0",
   "author": {
     "name": "Alan Martinez"
   }