toolroll 0.9.10 → 0.9.12

package/dist/telegram.js

@@ -31,6 +31,7 @@ import { isLifecycleNotification, isTelegramProgressNotification, TELEGRAM_HOLD_
 import { telegramProgressCard } from "./telegram-progress.js";
 import { enqueueEveningDigests, finishedView, isTaskFact, joinsBatch, needsPerson, quietCardView } from "./chat-quiet.js";
 import { BATCH_MS, chatText, chatTitle, factLinkLabel, mentions, nameTelegramBot } from "./chat-voice.js";
+import { LEAD_SAY_KIND, enqueueLeadLapses, leadSayEarlier, leadSayText } from "./lead-voice.js";
 import { applyTeamInbound, deliverTeamChats, teamCommand } from "./telegram-team.js";
 import { applyFlowReply, applyFlowTap, FLOW_DECIDE_KEY, flowButtons, flowDecisionAt } from "./telegram-flow.js";
 import { connectChannel, FLOW_WORDS, takeChannelMessage, watchedChannel } from "./chat-inbox.js";
@@ -194,7 +195,7 @@ export function createTransport(token, timeoutMs = 30_000) {
         catch (error) {
             return {
                 ok: false,
-                description: scrub(error instanceof Error ? error.message : String(error), token),
+                description: scrub(transportError(error), token),
                 uncertain: true,
             };
         }
@@ -204,6 +205,48 @@ export function createTransport(token, timeoutMs = 30_000) {
         }
     };
 }
+/**
+ * Why this process can't reach Telegram the way the service does, or null.
+ * A coding agent's sandbox fences the network: Codex says so in its own
+ * variables, and Claude Code's sandbox routes traffic through a proxy on
+ * this computer, which curl uses and Node's fetch does not — so sends fail
+ * "fetch failed" while curl works (Oct 2). Builds, checks and agents also
+ * get a database of their own, so none of them can hold the live bridge;
+ * this keeps an agent-launched `watch` or `bridge` from holding it either.
+ */
+export function networkFence(env) {
+    const set = (name) => (env[name] ?? "") !== "";
+    if (set("CODEX_SANDBOX_NETWORK_DISABLED") || set("CODEX_SANDBOX"))
+        return "a Codex sandbox";
+    const agent = ["CLAUDECODE", "CLAUDE_CODE_ENTRYPOINT"].some(set);
+    const loopbackProxy = ["HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy", "ALL_PROXY", "all_proxy"].some(name => {
+        const value = env[name] ?? "";
+        if (value === "")
+            return false;
+        try {
+            return /^(?:localhost|127\.\d+\.\d+\.\d+|\[::1\])$/i.test(new URL(value.includes("://") ? value : `http://${value}`).hostname);
+        }
+        catch {
+            return false;
+        }
+    });
+    return agent && loopbackProxy ? "a Claude Code sandbox" : null;
+}
+/** The plain line a fenced process says instead of polling or sending. */
+export function networkFenceLine(reason) {
+    return `Telegram: not connecting from here — this process runs inside ${reason}, which blocks its network. Replies and notifications go out from the Toolroll service.`;
+}
+/** fetch's own message ("fetch failed") with the reason under it, e.g. "fetch failed (EMFILE: too many open files)". */
+export function transportError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const cause = error instanceof Error ? error.cause : undefined;
+    if (cause === undefined || cause === null)
+        return message;
+    const code = typeof cause.code === "string" ? cause.code : null;
+    const detail = cause instanceof Error ? cause.message : String(cause);
+    const why = code !== null && !detail.includes(code) ? `${code}: ${detail}` : detail;
+    return why === "" || why === message ? message : `${message} (${why.slice(0, 160)})`;
+}
 /** The multipart body: every param a field (objects as JSON), the file last. Exported for the adapter's own test only. */
 export function multipartOf(params, upload) {
     const form = new FormData();
@@ -332,12 +375,16 @@ export async function followBridge(store, options) {
     // turn must not stall the long poll, and each cycle's lease re-acquire is
     // the renewal that keeps this the only live poller meanwhile. One
     // processor at a time; its counts land on the totals when it finishes.
+    // It only persists the reply: the cycle sends it, in the same slot as
+    // notifications, so a reply never needs a connection of its own beside
+    // the long poll (Oct 2: replies failed "fetch failed" for minutes while
+    // notifications from the same process went out).
     let inFlight = null;
     const kick = () => {
         if (inFlight !== null || options.conversation === undefined || options.readProjects === undefined)
             return;
         const report = { sent: 0, answered: 0, paired: 0, ignored: 0, backlog: false, problems: [] };
-        inFlight = processConversations(store, botId, transport, owner, clock, report, options.readProjects, options.conversation, signal)
+        inFlight = processConversations(store, botId, transport, owner, clock, report, options.readProjects, options.conversation, signal, "turns")
             .catch(error => { report.problems.push(`telegram chat: ${error instanceof Error ? error.message : String(error)}`); })
             .finally(() => {
             inFlight = null;
@@ -435,12 +482,13 @@ export async function followBridge(store, options) {
             // the picker first. Best effort; typed commands work either way.
             if (!commandsListed && options.conversation !== undefined) {
                 commandsListed = true;
+                // Both carry the stop signal: a stop never waits on a slow Bot API for them.
                 try {
-                    await transport("setMyCommands", { commands: TELEGRAM_COMMANDS });
+                    await transport("setMyCommands", { commands: TELEGRAM_COMMANDS }, signal);
                 }
                 catch { /* typed commands still work */ }
                 // After an upgrade, a bot still called StandingOrders becomes Toolroll, once per start; any other name is kept.
-                await nameTelegramBot(transport, "upgrade");
+                await nameTelegramBot(transport, "upgrade", signal);
             }
             const startedAt = Date.now();
             const report = { sent: 0, answered: 0, paired: 0, ignored: 0, backlog: false, problems: [] };
@@ -449,13 +497,18 @@ export async function followBridge(store, options) {
                 await deliverOutbox(store, botId, transport, owner, clock, report, options.readProjects, options.canDeliver, options.conversation?.phoneOrigin, options.conversation?.evidenceRoot);
                 await deliverTeam(store, botId, transport, clock, report, options.readProjects, options.canDeliver, options.conversation?.phoneOrigin);
             }
+            // Replies the turn worker has planned go out here, like notifications.
+            if (options.conversation !== undefined && options.readProjects !== undefined) {
+                await processConversations(store, botId, transport, owner, clock, report, options.readProjects, options.conversation, signal, "replies");
+            }
             // Pushed updates first (some may wait from before a fall back), then — only while
             // Telegram isn't pushing — ask for more.
             const pushed = await drainInbox({ store, botId, transport, clock, report, readProjects: options.readProjects, conversation: options.conversation, projects: null }, owner, lease.generation);
             if (pushed > 0)
                 report.pushed = pushed;
             if (!pushing()) {
-                await drainUpdates(store, botId, transport, owner, lease.generation, lease.cursor, clock, report, pollSeconds, signal, options.readProjects, options.conversation);
+                // While a turn is running, poll briefly so its reply is sent within a second or two of being written.
+                await drainUpdates(store, botId, transport, owner, lease.generation, lease.cursor, clock, report, inFlight === null ? pollSeconds : 1, signal, options.readProjects, options.conversation);
                 // A push address nobody here wants any more (the public address was removed): take it down, so asking works again.
                 if (report.webhookActive === true && push === null)
                     await transport("deleteWebhook", { drop_pending_updates: false }, signal);
@@ -474,11 +527,13 @@ export async function followBridge(store, options) {
                 total.chatRefused = (total.chatRefused ?? 0) + report.chatRefused;
             if (report.chatConfirmed !== undefined)
                 total.chatConfirmed = (total.chatConfirmed ?? 0) + report.chatConfirmed;
+            if (report.chatAnswered !== undefined)
+                total.chatAnswered = (total.chatAnswered ?? 0) + report.chatAnswered;
             total.problems.push(...report.problems);
-            if (report.sent > 0 || report.answered > 0 || report.paired > 0 || (report.statusReplies ?? 0) > 0 || (report.chatQueued ?? 0) > 0 || (report.chatRefused ?? 0) > 0 || (report.chatConfirmed ?? 0) > 0 || report.problems.length > 0) {
+            if (report.sent > 0 || report.answered > 0 || report.paired > 0 || (report.statusReplies ?? 0) > 0 || (report.chatQueued ?? 0) > 0 || (report.chatAnswered ?? 0) > 0 || (report.chatRefused ?? 0) > 0 || (report.chatConfirmed ?? 0) > 0 || report.problems.length > 0) {
                 options.onCycle?.(report);
             }
-            if (report.problems.length > 0 && report.sent === 0 && report.answered === 0) {
+            if (report.problems.length > 0 && report.sent === 0 && report.answered === 0 && (report.chatAnswered ?? 0) === 0) {
                 // The wire is down. Back off; the counter resets on the first clean cycle.
                 if (!signal.aborted) {
                     await wait(FOLLOW_BACKOFF_MS[Math.min(failures, FOLLOW_BACKOFF_MS.length - 1)]);
@@ -493,7 +548,7 @@ export async function followBridge(store, options) {
             const took = Date.now() - startedAt;
             // While Telegram pushes (v98) there is no long poll to wait on: a pushed update waits at most this long.
             const floor = pushing() ? PUSH_IDLE_MS : FOLLOW_IDLE_FLOOR_MS;
-            if (!signal.aborted && report.sent === 0 && report.answered === 0 && took < floor) {
+            if (!signal.aborted && report.sent === 0 && report.answered === 0 && (report.chatAnswered ?? 0) === 0 && took < floor) {
                 await wait(floor - took);
             }
         }
@@ -501,16 +556,25 @@ export async function followBridge(store, options) {
     finally {
         // A turn in flight finishes on its own bounds (the engine's wall clock);
         // its reply is fenced on the claim and the channel like every other part.
-        if (inFlight !== null)
+        if (inFlight !== null) {
             await inFlight;
+            // Its reply was written for the cycle that will not come: send it now, while the lease is still ours.
+            if (options.conversation !== undefined && options.readProjects !== undefined) {
+                const report = { sent: 0, answered: 0, paired: 0, ignored: 0, backlog: false, problems: [] };
+                await processConversations(store, botId, transport, owner, clock, report, options.readProjects, options.conversation, undefined, "replies").catch(() => { });
+                if (report.chatAnswered !== undefined)
+                    total.chatAnswered = (total.chatAnswered ?? 0) + report.chatAnswered;
+                total.problems.push(...report.problems);
+            }
+        }
         store.releaseBridgeLease(botId, owner, clock());
     }
     return total;
 }
 /** The queued turns for one bot, counted onto the pass's report. */
-async function processConversations(store, botId, transport, owner, clock, report, readProjects, conversation, signal) {
+async function processConversations(store, botId, transport, owner, clock, report, readProjects, conversation, signal, only) {
     const chat = { answered: 0, refused: 0, problems: [] };
-    await processTelegramConversations({ store, botId, transport, owner, clock, readProjects, options: conversation, report: chat, ...(signal === undefined ? {} : { signal }) });
+    await processTelegramConversations({ store, botId, transport, owner, clock, readProjects, options: conversation, report: chat, ...(signal === undefined ? {} : { signal }), ...(only === undefined ? {} : { only }) });
     if (chat.answered > 0)
         report.chatAnswered = (report.chatAnswered ?? 0) + chat.answered;
     if (chat.refused > 0)
@@ -580,6 +644,8 @@ async function deliverOutbox(store, botId, transport, owner, clock, report, read
     catch {
         report.problems.push("evening digest could not be prepared");
     }
+    // A lead claim that went two hours quiet repaints its owner's card back to the task's real state.
+    enqueueLeadLapses(store, now);
     const digestDue = digest.everyMs === null || digest.lastSentAt === null || now.getTime() >= new Date(digest.lastSentAt).getTime() + digest.everyMs;
     // Every paired person is a destination of their own: each binding claims
     // and settles its own rows under its own ceiling, in turn.
@@ -852,8 +918,35 @@ async function deliverOutboxTo(store, botId, binding, transport, owner, clock, r
             }
             return fact.kind === "acceptance-evidence" ? imageSender(fact) : deliverOne(store, botId, binding, sender, fact, clock, phoneOrigin, evidenceRoot, projects);
         };
+        /** The lead's words (lead-voice.ts): one message; a later say within two minutes edits it in place. */
+        const leadSayOutcome = async (fact) => {
+            const words = leadSayText(fact);
+            const button = fact.link === null ? null : factButton(phoneOrigin, fact.link);
+            const keyboard = button === null ? [] : [button];
+            const earlier = leadSayEarlier(store, fact).map(id => store.telegramMessageOf(id, fact.destination)).find(one => one !== null) ?? null;
+            if (earlier !== null) {
+                const problem = (await readAccess()) ?? fence();
+                if (problem !== null)
+                    return { ok: false, error: problem };
+                const edited = await editProgress(transport, binding.chatId, earlier, words, keyboard);
+                if (edited.ok) {
+                    store.recordTelegramMessage(fact, binding, earlier, clock());
+                    const after = (await readAccess()) ?? fence();
+                    return after === null ? { ok: true, receipt: receiptFor(botId, binding.chatId, earlier) } : { ok: false, error: after };
+                }
+                if (edited.retryAfter !== undefined)
+                    store.deferTelegram(botId, new Date(clock().getTime() + edited.retryAfter * 1000).toISOString());
+                // Only Telegram's definitive missing/uneditable answer permits a new message.
+                if (!edited.replace)
+                    return edited;
+            }
+            const sent = await sender(words, keyboard.length === 0 ? undefined : keyboard, [fact]);
+            return sent.ok ? { ok: true, receipt: receiptFor(botId, binding.chatId, sent.messageId) } : sent;
+        };
         let outcome;
-        if (quiet && rows.length === 1 && isTaskFact(row))
+        if (rows.length === 1 && row.kind === LEAD_SAY_KIND)
+            outcome = await leadSayOutcome(row);
+        else if (quiet && rows.length === 1 && isTaskFact(row))
             outcome = await quietOutcome(row);
         else {
             // A failure or decision still gets its own alert. Refresh an existing

package/dist/test-temp.js

@@ -18,7 +18,7 @@ export const TEST_TEMP_PREFIXES = [
     "flow-goal-", "flow-scratch", "flows-chat-", "invoke-attest-", "knowledge-test-", "learning-", "peek-", "phone-origin-",
     "proposal-repo-", "race-", "refresh-migration-", "refresh-refusal-", "release-check-", "shared-chat-", "skills-test-",
     "task-status-surfaces-", "template-repo-", "template-test-", "v14-migrate-", "v17-migrate-", "watch-anchor-",
-    "needs-you-", "deps-lock-", "deps-state-", "upgrade-fresh-", "upgrade-path-",
+    "needs-you-", "deps-lock-", "deps-state-", "upgrade-fresh-", "upgrade-path-", "deploy-restore-", "result-review-",
     // Playwright's browser profiles and artifacts.
     "playwright_chromiumdev_profile-", "playwright_firefoxdev_profile-", "playwright-artifacts-",
 ];

package/dist/toolroll-update.d.ts

@@ -1,5 +1,6 @@
 import type { DatabaseSync } from "node:sqlite";
 import { type LingeringRun, type UpdateWaiting } from "./desktop-update.js";
+import { type ReleasedCodingOwner } from "./coding-update.js";
 import { type SupervisorRunner } from "./daemon.js";
 export declare const PROVENANCE_REPOSITORY = "https://github.com/ap9000/toolroll";
 export declare const PROVENANCE_WORKFLOW = ".github/workflows/publish.yml";
@@ -103,6 +104,8 @@ export type RuntimeUpdateJournal = {
     /** The restore put the backup back: a retried restore never puts it back again (what was written since belongs to
      * the restored version and would be lost), and it keeps a fresh copy aside before every attempt until then. */
     restoredDatabase?: boolean;
+    /** A stale coding owner record this run released after proving its processes gone. */
+    codingOwnerReleased?: ReleasedCodingOwner;
     seen?: boolean;
     /** The finished run the update is waiting on (or stopped waiting on): what is in the way and the command that
      * clears it. Absent while it waits on ordinary running work. */

package/dist/toolroll-update.js

@@ -31,7 +31,8 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { createRequire } from "node:module";
 import { clearWords, durableJson, LINGERING_LIMIT_MS, lingeringRun, lingeringWords, settleLeftoverRecords, sqliteLock, desktopUpdateWaitingOf, stoppedWaitingWords, updateWaitingWords, verifiedDatabaseBackup } from "./desktop-update.js";
 import { activeUpdateWork, freezeUpdateGate, installUpdateGate, removeUpdateGate, updateAdmissionPaused, updateGateOwned } from "./desktop-update-gate.js";
-import { assertCodingUpdateStopped, backupCodingCatalog, codingCatalogExists, removeCodingUpdateGate } from "./coding-update.js";
+import { processMayBeAlive } from "./process-liveness.js";
+import { assertCodingUpdateStopped, backupCodingCatalog, codingCatalogExists, releaseStaleCodingOwner, removeCodingUpdateGate } from "./coding-update.js";
 import { installLaunchdService, launchdPlist, stopLaunchdService, writeFileDurably } from "./daemon.js";
 import { NAME } from "./names.js";
 import { isNewer, REGISTRY } from "./releases.js";
@@ -887,6 +888,12 @@ async function driveRuntimeUpdate(j, system) {
             refuseWhileWatching(j, system);
             const db = new (sqlite().DatabaseSync)(j.databaseFile, { readOnly: true });
             try {
+                // An older runtime killed before its close left its owner record behind: released once its processes are proved gone.
+                const released = releaseStaleCodingOwner(db, [...j.service?.pids ?? [], ...(j.watches ?? []).flatMap(w => w.pids)], (pid, group) => system.processAlive(pid) || processMayBeAlive(pid, group));
+                if (released !== null) {
+                    j.codingOwnerReleased = released;
+                    ledger(j.databaseFile, system.now(), j.actor, "toolroll coding owner released", "released", `${j.from.version} stopped without releasing the coding workspace; process ${released.pid}${released.nativePid === null ? "" : ` and agent ${released.nativePid}`} proved gone`);
+                }
                 assertCodingUpdateStopped(db);
             }
             finally {
@@ -1392,7 +1399,11 @@ export function machineSystem(home = homedir(), env = process.env, seams = {}) {
         servicePids: async (unit) => {
             const printed = await supervise("launchctl", ["print", `${domain}/${labelOf(unit)}`]);
             const pid = Number(printed.stdout.match(/\n\s*pid = (\d+)/)?.[1]);
-            return printed.code === 0 && pid > 1 ? [pid] : [];
+            if (printed.code !== 0 || !(pid > 1))
+                return [];
+            // Its `up` child too: the process that owns the coding catalog, so its exit is proved as well.
+            const children = await supervise("pgrep", ["-P", String(pid)]);
+            return [pid, ...(children.code === 0 ? children.stdout.trim().split(/\s+/).map(Number).filter(one => Number.isSafeInteger(one) && one > 1) : [])];
         },
         stopService: async (unit) => {
             // As long as a watch's toolroll up takes to exit.

package/dist/work-index.d.ts

@@ -2,6 +2,7 @@ import { type Store, type TaskState } from './store.js';
 import type { AssignmentSnapshot } from './assignment.js';
 import type { WorkAction, WorkSummaryAccess } from './work-summary.js';
 import type { WorkStatus, WorkView } from './workspace-ui.js';
+import { type Ask } from './needs-you.js';
 export type WorkIndexCounts = Record<WorkView, number>;
 export type WorkIndexItem = {
     rootId: string;
@@ -22,6 +23,8 @@ export type WorkIndexItem = {
     resultOutcome: string | null;
     publicationUrl: string | null;
     status: WorkStatus;
+    /** What a Needs you row asks of a person (needs-you.ts); null for every other row. */
+    ask: Ask | null;
     primaryAction: WorkAction | null;
     completion: {
         actor: string;
@@ -38,9 +41,13 @@ export type WorkIndexOptions = {
     state?: TaskState;
     leadId?: string;
 };
+/** How the list is grouped: the Needs you rows by their ask, then building, then the rest. */
+export type WorkIndexGroup = Ask | 'building' | 'rest';
+export type WorkIndexGroupCounts = Record<WorkIndexGroup, number>;
 export type WorkIndexPage = {
     items: WorkIndexItem[];
     totals: WorkIndexCounts;
+    groups: WorkIndexGroupCounts;
     projects: WorkProjectCounts[];
     nextCursor: string | null;
     limit: number;
@@ -54,6 +61,8 @@ export type WorkProjectCounts = {
 };
 export declare const WORK_INDEX_PAGE_LIMIT = 40;
 export declare const WORK_INDEX_MAX_LIMIT = 100;
+/** A code's ask: a saved result is Review (unless its build may still run), otherwise its need's ask. */
+export declare function askOfCode(code: string, custody?: boolean): Ask;
 export declare class WorkIndexCursorError extends Error {
     constructor();
 }

package/dist/work-index.js

@@ -11,10 +11,12 @@ import { plainReasonOf, replacedWords, stageOfCode, taskStatusOf, workToneOf } f
 import { isCheckLevel } from './check-levels.js';
 import { MARKER } from './worktree.js';
 import { withFollowUps } from './result-follow-ups.js';
-import { NEEDS, processNeedOf } from './needs-you.js';
+import { ASKS, NEED_ASK, NEEDS, processNeedOf } from './needs-you.js';
+import { LEAD_CLAIM_SQL, LEAD_IDLE_MS } from './lead-voice.js';
 export const WORK_INDEX_PAGE_LIMIT = 40;
 export const WORK_INDEX_MAX_LIMIT = 100;
 const EMPTY = { all: 0, 'needs-you': 0, running: 0, completed: 0 };
+const NO_GROUPS = { decide: 0, review: 0, unblock: 0, building: 0, rest: 0 };
 const FAMILY_PROBLEM = 'Task history is unavailable or incomplete. This task is shown separately.';
 const VIEWS = ['all', 'needs-you', 'running', 'completed'];
 const n = (row, key) => Number(row[key] ?? 0);
@@ -25,6 +27,27 @@ const s = (row, key) => row[key] == null ? null : String(row[key]);
  * MATERIALIZED prevents counts + page selection repeating correlated reads. */
 /** A gate note counts only while its pause is on one of the task's current providers. */
 const GATE_PAUSE_ON_TASK = pauseOnTaskProviders('p', 'c.ref_id');
+/** Index codes that wait on a person, as their need (needs-you.ts); dispatch codes come from task-status's own table. */
+const INDEX_NEED = {
+    'earlier-active': 'earlier-version', 'process-needs-attention': 'confirm-stopped', 'invalid-scope': 'define-task', 'decision-queue': 'questions',
+};
+/** Every index code that can wait on a person. */
+const PERSON_CODES = ['history-problem', 'earlier-active', 'ready-to-check', 'waiting-decision', 'decision-queue', 'result-needs-attention',
+    'process-needs-attention', 'failed', 'vanished-run', 'stopping', 'stopped', 'held', 'waiting-incident', 'terminal-dependency', 'needs-project',
+    'needs-scope', 'invalid-scope', 'needs-agent-profile', 'needs-approval', 'missing-requirement', 'no-worker-registered', 'no-worker-online', 'signed-out'];
+/** A code's ask: a saved result is Review (unless its build may still run), otherwise its need's ask. */
+export function askOfCode(code, custody = false) {
+    if (custody)
+        return 'unblock';
+    if (code === 'ready-to-check' || code === 'result-needs-attention')
+        return 'review';
+    return NEED_ASK[INDEX_NEED[code] ?? stageOfCode(code, { needsPerson: true }).need ?? 'other'];
+}
+const codesOf = (ask) => PERSON_CODES.filter(code => askOfCode(code) === ask).map(code => `'${code}'`).join(',');
+/** The ask as its place in the list (ASKS order), read by the same code the row's status reads. */
+const ASK_RANK = `CASE WHEN code IN (${codesOf('decide')}) THEN 0 WHEN code IN (${codesOf('review')}) AND NOT custody_unresolved THEN 1 ELSE 2 END`;
+/** Where a row sits in the list: Decide, Review, Unblock, then building, then the rest by recency. */
+const ORDER = `(CASE WHEN rank=0 THEN ask_rank WHEN rank=1 THEN 3 ELSE 4 END)`;
 /** A row whose build may still be running (the store's reading, custodyReadings): Waiting, not Needs you. */
 const CUSTODY_WAITS = `(custody_unresolved AND code IN ('process-needs-attention','result-needs-attention') AND ref_id IN (SELECT value FROM json_each($waitingCustody)))`;
 const PROJECTION = `WITH RECURSIVE admitted AS MATERIALIZED (
@@ -204,13 +227,18 @@ const PROJECTION = `WITH RECURSIVE admitted AS MATERIALIZED (
     WHEN deliverable='report' THEN 'scouting-ready'
     ELSE 'queued' END code
   FROM checked f
+), claimed AS MATERIALIZED (
+  SELECT c.*,CASE WHEN code IN ('cancelled','complete') THEN 0 ELSE ${LEAD_CLAIM_SQL} END lead_claim FROM classified c
 ), ranked AS MATERIALIZED (
-  SELECT c.*,code NOT IN ('cancelled','complete','running','updating','retry-scheduled','waiting-dependency','worker-at-capacity','planning-ready','scouting-ready','queued') AND NOT ${CUSTODY_WAITS} needs,
+  -- A task the person's lead is on (lead-voice.ts) waits on nobody: it leaves Needs you until the claim ends or lapses.
+  SELECT c.*,code NOT IN ('cancelled','complete','running','updating','retry-scheduled','waiting-dependency','worker-at-capacity','planning-ready','scouting-ready','queued') AND NOT ${CUSTODY_WAITS} AND lead_claim<>1 needs,
+    code NOT IN ('cancelled','complete','running','updating','retry-scheduled','waiting-dependency','worker-at-capacity','planning-ready','scouting-ready','queued') AND NOT ${CUSTODY_WAITS} person_need,
     CASE WHEN code='complete' THEN 3 WHEN code='cancelled' THEN 4 WHEN code='running' THEN 1
       WHEN ${CUSTODY_WAITS} OR code IN ('updating','retry-scheduled','waiting-dependency','worker-at-capacity','planning-ready','scouting-ready','queued') THEN 2 ELSE 0 END rank,
+    ${ASK_RANK} ask_rank,
     CASE WHEN code='complete' THEN completed.at ELSE family_updated END sort_at,
     completed.actor checked_actor,completed.at checked_at,completed.outcome checked_digest
-  FROM classified c LEFT JOIN action_ledger completed ON completed.id=c.checked_id WHERE ($state IS NULL OR c.state=$state) AND ($leadId IS NULL OR EXISTS(SELECT 1 FROM team_task_owner own WHERE own.task_ref=c.root_ref AND own.lead=$leadId))
+  FROM claimed c LEFT JOIN action_ledger completed ON completed.id=c.checked_id WHERE ($state IS NULL OR c.state=$state) AND ($leadId IS NULL OR EXISTS(SELECT 1 FROM team_task_owner own WHERE own.task_ref=c.root_ref AND own.lead=$leadId))
 )`;
 const registered = new WeakMap();
 /** Connection-local pure parsing, with exactly the authoritative stored-scope
@@ -277,12 +305,19 @@ function parameters(now, access, options, custody) {
         $now: now.toISOString(), $alive: new Date(now.getTime() - 180_000).toISOString(),
         $all: access.repos === null ? 1 : 0, $repos: JSON.stringify(access.repos ?? []),
         $unplaced: access.principal === 'operator' && access.includeUnplaced === true ? 1 : 0,
-        $projectSet: options.project != null ? 1 : 0, $project: options.project ?? null, $state: options.state ?? null, $leadId: options.leadId ?? null };
+        $projectSet: options.project != null ? 1 : 0, $project: options.project ?? null, $state: options.state ?? null, $leadId: options.leadId ?? null,
+        $leadIdleSince: new Date(now.getTime() - LEAD_IDLE_MS).toISOString(),
+        $leadOf: access.principal === 'operator' && access.viewer != null && access.viewer !== '' ? `lead for ${access.viewer}` : null };
 }
 function counts(row) {
     return { all: n(row, 'all_count'), 'needs-you': n(row, 'needs_count'), running: n(row, 'running_count'), completed: n(row, 'completed_count') };
 }
 const TOTALS = `COUNT(*) all_count,COALESCE(SUM(needs),0) needs_count,COALESCE(SUM(family_running),0) running_count,COALESCE(SUM(code='complete'),0) completed_count`;
+const GROUP_TOTALS = `COALESCE(SUM(rank=0 AND ask_rank=0),0) decide_count,COALESCE(SUM(rank=0 AND ask_rank=1),0) review_count,COALESCE(SUM(rank=0 AND ask_rank=2),0) unblock_count,`
+    + `COALESCE(SUM(rank=1),0) building_count,COALESCE(SUM(rank>1),0) rest_count`;
+function groupCounts(row) {
+    return { decide: n(row, 'decide_count'), review: n(row, 'review_count'), unblock: n(row, 'unblock_count'), building: n(row, 'building_count'), rest: n(row, 'rest_count') };
+}
 export class WorkIndexCursorError extends Error {
     constructor() { super('This work page cursor is invalid or belongs to a different view.'); this.name = 'WorkIndexCursorError'; }
 }
@@ -299,7 +334,7 @@ function readCursor(value, scope) {
         if (value.length > 1024 || !/^[\w-]+$/.test(value))
             throw Error();
         const c = JSON.parse(Buffer.from(value, 'base64url').toString());
-        if (c.version !== 1 || c.scope !== scope || !Number.isSafeInteger(c.rank) || c.rank < 0 || c.rank > 4 ||
+        if (c.version !== 2 || c.scope !== scope || !Number.isSafeInteger(c.rank) || c.rank < 0 || c.rank > 4 ||
             !Number.isSafeInteger(c.root) || c.root < 1 || typeof c.at !== 'string' || !/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d{3}Z$/.test(c.at))
             throw Error();
         return c;
@@ -323,16 +358,16 @@ export function workIndexPage(store, now, access, options = {}) {
     const scope = cursorScope(access, options, view), cursor = readCursor(options.cursor, scope);
     const filter = view === 'needs-you' ? 'needs=1' : view === 'running' ? 'family_running=1' : view === 'completed' ? "code='complete'" : '1';
     const rows = store.handle.prepare(`${projection}, selected_page AS MATERIALIZED (
-    SELECT * FROM ranked WHERE ${filter} AND ($cursorRoot=0 OR rank>$cursorRank OR
-      (rank=$cursorRank AND (sort_at<$cursorAt OR (sort_at=$cursorAt AND root_ref<$cursorRoot))))
-    ORDER BY rank,sort_at DESC,root_ref DESC LIMIT $limit
-  ), page AS (SELECT p.*,COALESCE(p.result_id,(SELECT id FROM run WHERE task_ref=p.ref_id AND finished_at IS NOT NULL AND role IN ('builder','scout') ORDER BY id DESC LIMIT 1)) page_result_id FROM selected_page p), totals AS (SELECT ${TOTALS} FROM ranked), project_totals AS (
+    SELECT * FROM ranked WHERE ${filter} AND ($cursorRoot=0 OR
+      ${ORDER}>$cursorRank OR (${ORDER}=$cursorRank AND (sort_at<$cursorAt OR (sort_at=$cursorAt AND root_ref<$cursorRoot))))
+    ORDER BY ${ORDER},sort_at DESC,root_ref DESC LIMIT $limit
+  ), page AS (SELECT p.*,COALESCE(p.result_id,(SELECT id FROM run WHERE task_ref=p.ref_id AND finished_at IS NOT NULL AND role IN ('builder','scout') ORDER BY id DESC LIMIT 1)) page_result_id FROM selected_page p), totals AS (SELECT ${TOTALS},${GROUP_TOTALS} FROM ranked), project_totals AS (
     SELECT repo,${TOTALS},SUM(state='queued' AND family_running=0) queued,
       SUM(state='done' AND family_running=0 AND updated_at>=$recent) done_recently FROM ranked GROUP BY repo
   )
   SELECT 0 record_kind,totals.*,(SELECT json_group_array(json_object('repo',repo,'all_count',all_count,'needs_count',needs_count,
     'running_count',running_count,'completed_count',completed_count,'queued',queued,'done_recently',done_recently)) FROM project_totals) row_json FROM totals
-  UNION ALL SELECT 1,0,0,0,0,json_object('root_ref',root_ref,'root_id',root_id,'id',id,'root_title',root_title,'repo',repo,
+  UNION ALL SELECT 1,0,0,0,0,0,0,0,0,0,json_object('root_ref',root_ref,'root_id',root_id,'id',id,'root_title',root_title,'repo',repo,
     'state',state,'created_at',created_at,'family_updated',family_updated,'version_count',version_count,'earlier_active',earlier_active,
     'earlier_id',earlier_id,'broken',broken,'live_run',live_run,'result_id',page_result_id,'result_outcome',(SELECT outcome FROM run WHERE id=page_result_id),
     'publication_url',(SELECT pr_url FROM publication WHERE run=page_result_id),
@@ -342,7 +377,7 @@ export function workIndexPage(store, now, access, options = {}) {
     'check_follows',(SELECT json_group_array(q.outcome||' '||COALESCE((SELECT substr(f.outcome,instr(f.outcome,':')+1) FROM action_ledger f WHERE f.repo IS page.repo AND f.run_id=page_result_id
       AND f.action='checks finished' AND f.outcome LIKE q.id||':%' LIMIT 1),'open')) FROM (SELECT id,outcome FROM action_ledger WHERE repo IS page.repo AND run_id=page_result_id AND action='checks requested' ORDER BY id) q),
     'proof_verdict',(SELECT COALESCE(machine_verdict,verdict) FROM proof_verdict WHERE run=page_result_id),
-    'proof_failed_check',(SELECT verdict='refuted' AND reasons_json LIKE '%approved verification command exited%' FROM proof_verdict WHERE run=page_result_id),'code',code,'needs',needs,'family_running',family_running,'rank',rank,'sort_at',sort_at,
+    'proof_failed_check',(SELECT verdict='refuted' AND reasons_json LIKE '%approved verification command exited%' FROM proof_verdict WHERE run=page_result_id),'code',code,'needs',needs,'person_need',person_need,'lead_claim',lead_claim,'family_running',family_running,'rank',rank,'ask_rank',ask_rank,'list_order',${ORDER},'sort_at',sort_at,
     'checked_actor',checked_actor,'checked_at',checked_at,'checked_digest',checked_digest,'question_id',question_id,
     'dependency_id',dependency_id,'dependency_state',dependency_state,'custody_unresolved',custody_unresolved,'hold_kind',hold_kind,'hold_reason',substr(hold_reason,1,300),'stop_run',stop_run,'unfinished',unfinished,'signed_out',signed_out,
     'question_run',(SELECT run FROM decision WHERE id=page.question_id),'replaced_by',(SELECT successor FROM task_replacement WHERE task_ref=page.ref_id),
@@ -351,15 +386,16 @@ export function workIndexPage(store, now, access, options = {}) {
         .all({ ...parameters(now, access, options, custody), $cursorRoot: cursor?.root ?? 0, $cursorRank: cursor?.rank ?? 0, $cursorAt: cursor?.at ?? '', $limit: limit + 1, $recent: new Date(now.getTime() - 86_400_000).toISOString() });
     const selected = rows.slice(1).map(row => JSON.parse(String(row['row_json'])));
     const page = selected.slice(0, limit), last = page.at(-1);
-    const nextCursor = selected.length > limit && last !== undefined ? Buffer.from(JSON.stringify({ version: 1, scope,
-        rank: n(last, 'rank'), at: s(last, 'sort_at'), root: n(last, 'root_ref') })).toString('base64url') : null;
+    const nextCursor = selected.length > limit && last !== undefined ? Buffer.from(JSON.stringify({ version: 2, scope,
+        rank: n(last, 'list_order'), at: s(last, 'sort_at'), root: n(last, 'root_ref') })).toString('base64url') : null;
     const projects = JSON.parse(String(rows[0]?.['row_json'] ?? '[]')).map(row => ({ repo: s(row, 'repo'), totals: counts(row), queued: n(row, 'queued'), doneRecently: n(row, 'done_recently') }));
     // A row whose build Toolroll can't confirm stopped reads the store's own answer, as the task page does.
     const probe = (taskId) => {
         const ref = store.lookupRef(taskId);
         return ref === null ? null : custody.readings.get(ref.id) ?? null;
     };
-    return { items: page.map(row => itemOf(row, access.principal, probe)), projects, totals: rows[0] === undefined ? { ...EMPTY } : counts(rows[0]), nextCursor, limit, view };
+    return { items: page.map(row => itemOf(row, access.principal, probe)), projects, totals: rows[0] === undefined ? { ...EMPTY } : counts(rows[0]),
+        groups: rows[0] === undefined ? { ...NO_GROUPS } : groupCounts(rows[0]), nextCursor, limit, view };
 }
 export function workCountsByProject(store, now, access) {
     const projection = registerValidators(store);
@@ -404,16 +440,15 @@ function listChecksOf(own, level, follows) {
         return null;
     return { status: read.status, exitCode: null, head: null, level: read.level, running: read.running };
 }
-/** Index codes that wait on a person, as their need (needs-you.ts); dispatch codes come from task-status's own table. */
-const INDEX_NEED = {
-    'earlier-active': 'earlier-version', 'process-needs-attention': 'confirm-stopped', 'invalid-scope': 'define-task', 'decision-queue': 'questions',
-};
 function itemOf(row, principal, probe) {
     const code = String(row['code']), id = String(row['id']);
     const custody = code === 'process-needs-attention' || (code === 'result-needs-attention' && n(row, 'custody_unresolved') === 1);
     const process = custody && probe !== undefined ? processNeedOf(probe(id)) : null;
     const waiting = process !== null && 'wait' in process;
     const need = n(row, 'needs') === 1 && !waiting, running = n(row, 'family_running') === 1;
+    // The lead's claim (lead-voice.ts): the row still reads its own stage, worded "Your lead is on it".
+    const lead = n(row, 'lead_claim') === 1 ? 'on-it' : n(row, 'lead_claim') === 2 ? 'lapsed' : null;
+    const personNeed = (n(row, 'person_need') === 1 || need) && !waiting;
     const assignmentState = code === 'complete' ? 'complete' : code === 'ready-to-check' ? 'ready-to-check'
         : code === 'cancelled' ? 'cancelled' : need ? 'needs-decision' : 'working';
     const words = {
@@ -499,7 +534,7 @@ function itemOf(row, principal, probe) {
         access: read ? 'read' : principal === 'operator' ? 'operator-control' : ['answer-decision', 'write-scope', 'unhold'].includes(actionCode) ? 'proposal-only' : 'operator-handoff',
         retry: actionCode === 'reconcile-run' ? 'reconcile-before-retry' : read ? 'read-again' : 'refresh-before-acting' };
     // The one shared status: the headline and sentence every surface uses.
-    const coded = stageOfCode(code, { needsPerson: need, planning: s(row, 'live_role') === 'planner', operatorHold: s(row, 'hold_kind') === 'operator' });
+    const coded = stageOfCode(code, { needsPerson: personNeed, planning: s(row, 'live_role') === 'planner', operatorHold: s(row, 'hold_kind') === 'operator' });
     const reading = process !== null
         ? 'wait' in process ? { stage: 'waiting', wait: process.wait } : { stage: 'needs-you', need: process.need }
         : custody ? { stage: 'needs-you', need: 'confirm-stopped' }
@@ -511,7 +546,8 @@ function itemOf(row, principal, probe) {
         ...(process === null ? {} : { needContext: { build: process.build } }),
         reason: finished ? null : plainReasonOf(reading.stage, code, detail || null), report: s(row, 'result_role') === 'scout',
         checks: !finished ? null : listChecksOf(own, s(row, 'check_level'), row['check_follows']),
-        completedBy: code !== 'complete' ? null : n(row, 'completed_by_lead') === 1 ? 'the lead' : String(row['checked_actor']).replace(/^(?:operator|coordinator|lead):/, '') });
+        completedBy: code !== 'complete' ? null : n(row, 'completed_by_lead') === 1 ? 'the lead' : String(row['checked_actor']).replace(/^(?:operator|coordinator|lead):/, ''),
+        ...(lead === null ? {} : { lead }) });
     label = shared.headline;
     detail = shared.sentence;
     // Every Needs you action wears its need's own words.
@@ -533,6 +569,7 @@ function itemOf(row, principal, probe) {
         resultOutcome: s(row, 'result_outcome'), publicationUrl: s(row, 'publication_url'),
         status: { token: `assignment-${assignmentState}`, label, detail, tone: workToneOf(shared.headline),
             action: primaryAction === null ? null : { label: actionLabel, kind: actionCode === 'open-result' ? 'open-result' : 'open-task' }, views, rank: n(row, 'rank') },
+        ask: need ? ASKS[n(row, 'ask_rank')] ?? 'unblock' : null,
         primaryAction, completion: code === 'complete' ? { actor: String(row['checked_actor']), at: String(row['checked_at']), digest: String(row['checked_digest']) } : null,
         evidence: 'recorded' };
 }

package/dist/work-summary.d.ts

@@ -41,10 +41,13 @@ export declare function openWorkDecisionOf(store: Store, taskRef: number, now: D
 export declare function workDecisionAction(taskId: string, decision: NonNullable<WorkFacts["openDecision"]>, principal: WorkPrincipal): WorkAction;
 /** Pure counterpart for callers already holding the same facts. */
 export declare function workSummaryOf(facts: WorkFacts, principal: WorkPrincipal, resultDisplay?: DisplayStatus): WorkSummary;
-export type WorkSummaryAccess = {
+export type WorkSummaryAccess = 
+/** `viewer`: the person reading, whose own lead's claim (lead-voice.ts) a task reads as "Your lead is on it". */
+{
     principal: "operator";
     repos: readonly string[] | null;
     includeUnplaced?: boolean;
+    viewer?: string | null;
 } | {
     principal: "coordinator";
     repos: readonly string[];

package/dist/workspace-ui.d.ts

@@ -190,6 +190,31 @@ export declare function dispatchActionLabel(dispatch: DispatchDiagnosis | null):
 /** A finished result's display status in the shared headline's words: a
  * failed project check is Failed, a result missing its record needs a
  * person, every other saved result is Ready for review. Token and action stay. */
+/** The result page's own sentence when the decision is on it. */
+export declare const RESULT_DECISION_SENTENCE = "Review the change, then accept it or ask for changes.";
+/** What the result page's Accept says, from facts it already shows: the
+ * recorded checks, the requirements not met, the ones a person still checks,
+ * whether the saved proof reads, and what the button posts. "Accept" only when everything is met and the
+ * checks passed; otherwise "Accept without checks" and one line naming what.
+ * `effect` says what pressing it does, in the action's own terms. */
+export type AcceptFacts = {
+    checks: "passed" | "failed" | "not-run" | "off" | "running" | "unavailable" | null;
+    unmet: number;
+    yours: number;
+    /** `complete`: marks the exact result complete; `accept`: records a person's acceptance only. */
+    action: "complete" | "accept";
+    /** `pull-request`: one can be opened from the task after; `off`: publishing isn't set up; `other`: neither is said. Accept itself never publishes. */
+    publishing: "pull-request" | "off" | "other";
+    /** False when the saved proof is missing or can't be read: nothing on record says what was met. */
+    proof: boolean;
+};
+export type AcceptWords = {
+    label: "Accept" | "Accept without checks";
+    ready: boolean;
+    why: string | null;
+    effect: string;
+};
+export declare function acceptWordsOf(facts: AcceptFacts): AcceptWords;
 export declare function resultHeadlineOf<T extends DisplayStatus>(status: T): T;
 /** The one shared headline (task-status.ts) over the work status below: the
  * token, views, rank, action and diagnostics stay; the words and tone are

package/dist/workspace-ui.js

@@ -195,7 +195,7 @@ function storedResultStatusOf(result, publication) {
         };
     }
     if (result.verdict === "short" && humanReview) {
-        return { token: "verification-needed", label: "Ready to inspect", detail: withPublication("The remaining requirements need a person's inspection. Open the result and record your decision."), tone: "attention", action: { label: "Inspect the result", kind: "open-review" } };
+        return { token: "verification-needed", label: "Ready to inspect", detail: withPublication("The remaining requirements need a person's inspection."), tone: "attention", action: { label: "Inspect the result", kind: "open-review" } };
     }
     if (result.verdict === "short") {
         return {
@@ -312,6 +312,25 @@ const VERIFIED_RESULT = new Set(["ready-to-review", "pr-opened", "merge-observed
 /** A finished result's display status in the shared headline's words: a
  * failed project check is Failed, a result missing its record needs a
  * person, every other saved result is Ready for review. Token and action stay. */
+/** The result page's own sentence when the decision is on it. */
+export const RESULT_DECISION_SENTENCE = "Review the change, then accept it or ask for changes.";
+export function acceptWordsOf(facts) {
+    const plural = (n, one, many) => `${n} ${n === 1 ? one : many}`;
+    const parts = [
+        ...(facts.proof ? [] : ["nothing on record says what was met"]),
+        ...(facts.checks === "passed" ? [] : [facts.checks === "failed" ? "checks failed" : facts.checks === "off" ? "checks are off for this project"
+                : facts.checks === "running" ? "checks are still running" : facts.checks === "unavailable" ? "saved checks can't be read" : "checks didn't run"]),
+        ...(facts.unmet > 0 ? [`${plural(facts.unmet, "requirement isn't", "requirements aren't")} met`] : []),
+        ...(facts.yours > 0 ? [`${plural(facts.yours, "item still needs", "items still need")} your check`] : []),
+    ];
+    const ready = parts.length === 0;
+    const joined = parts.length <= 1 ? parts.join("") : `${parts.slice(0, -1).join(", ")} and ${parts.at(-1)}`;
+    const effect = facts.action === "accept" ? "Records that you accept it. You mark it complete next."
+        : facts.publishing === "pull-request" ? "Marks it complete. No pull request opens; you can open one from the task after."
+            : facts.publishing === "off" ? "Marks it complete. The branch stays; publishing isn't set up."
+                : "Marks it complete. Nothing is published.";
+    return { label: ready ? "Accept" : "Accept without checks", ready, why: ready ? null : `${joined.charAt(0).toUpperCase()}${joined.slice(1)}.`, effect };
+}
 export function resultHeadlineOf(status) {
     const read = RESULT_NEEDS_YOU.has(status.token) ? { stage: "needs-you", need: "other" }
         : status.token === "checks-failed" ? { stage: "failed" } : { stage: "finished" };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.9.10",
+  "version": "0.9.12",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"