toolroll 0.9.27 → 0.9.29

package/dist/store.d.ts

@@ -1,7 +1,7 @@
 import { type Actor } from "./actor.js";
 import { type CriterionMatrixRow, type CriterionJudgementWord } from "./proof.js";
 import { type ExecutionProfile, type ChainEntry, type UnattendedPermissionMode, type AcceptanceCriterion } from "./scope.js";
-import { type PhaseRoute, type PublicationAuthority, type RouteStamp, type ReadinessLookup, type ReadinessObservation, type RiskLevel, type RouteOverride } from "./phase-routing.js";
+import { type ProviderRoom, type CandidateTier, type TaskSize, type TaskSizing, type PhaseRoute, type PublicationAuthority, type RouteStamp, type ReadinessLookup, type ReadinessObservation, type RiskLevel, type RouteOverride } from "./phase-routing.js";
 import { type TerminalClass } from "./exhaustion.js";
 import { type ProviderId } from "./provider.js";
 import type { BoardFacts } from "./board.js";
@@ -26,7 +26,7 @@ import { type ApprovalGate, type ApprovalRules, type ApproverKind, type Filer }
  * next; `channel` is where it reports (`chat`: the conversation it was promised in); a promise lapses at `expires_at`. */
 export declare const LEAD_COMMITMENT_SCHEMA = "\nCREATE TABLE IF NOT EXISTS lead_commitment (\n  id             INTEGER PRIMARY KEY AUTOINCREMENT,\n  owner          TEXT NOT NULL,\n  repo           TEXT,\n  thread         INTEGER NOT NULL,\n  turn           INTEGER,\n  channel        TEXT NOT NULL DEFAULT 'chat',\n  what           TEXT NOT NULL,\n  condition_json TEXT NOT NULL,\n  check_at       TEXT NOT NULL,\n  expires_at     TEXT NOT NULL,\n  state          TEXT NOT NULL DEFAULT 'open' CHECK (state IN ('open', 'done', 'cancelled', 'expired')),\n  created_at     TEXT NOT NULL,\n  checked_at     TEXT,\n  closed_at      TEXT,\n  closed_by      TEXT,\n  outcome        TEXT\n);\nCREATE INDEX IF NOT EXISTS lead_commitment_due ON lead_commitment (state, check_at);\nCREATE INDEX IF NOT EXISTS lead_commitment_owner ON lead_commitment (owner, state, id);\n";
 /** What stops a finished run reading stopped (Store.stopQuiescenceFact). */
-export type StopFactKind = "open" | "alive" | "elsewhere" | "unprovable" | "unknown";
+export type StopFactKind = "open" | "alive" | "elsewhere" | "unprovable" | "unknown" | "settling";
 export type TaskAct = "filed" | "approved" | "cancelled" | "completed" | "asked";
 /** Store.stopQuiescenceFact, read safely: a deploy proves completion with this code over the INSTALLED runtime's store,
  * which may predate the method. There the older stopQuiescenceProblem decides, and its words give the kind. */
@@ -232,6 +232,12 @@ export type TaskRef = {
      * list is malformed; the next filing goes unresolved rather than routing
      * as if nobody had overridden anything. */
     routeOverrides?: RouteOverride[] | null;
+    /** v2 routing: how big the change is (sized at filing by the classifier
+     * or the description, or set by a person); null when never sized. */
+    sizing?: TaskSizing | null;
+    /** The build tier the task's latest filed route chose (light, routine,
+     * strong — or override/pinned when a person or a pin chose the agent). */
+    routeTier?: string | null;
     /** Plan pins (P2/C7): read ONLY by the plan phase; precedence plan pin
      * > plan flags > plan config > installation > default. */
     planProvider: string | null;
@@ -3849,6 +3855,8 @@ export declare class Store {
          * exactly as the source's was, never over the installation's
          * defaults of the day. */
         riskLevel?: RiskLevel;
+        /** How big the change is, sized at filing (v2 routing). */
+        sizing?: TaskSizing;
         routeOverridesJson?: string | null;
         agentPin?: {
             provider: string;
@@ -4012,7 +4020,7 @@ export declare class Store {
     /** The operator's named STRONG candidate for a phase at a scope, or null.
      * Read by the routing policy only — a phase_config row stays the routine
      * tier, so every pre-v47 resolution is untouched. */
-    phaseTierConfig(scope: string, phase: string, tier: "strong"): {
+    phaseTierConfig(scope: string, phase: string, tier: "light" | "strong"): {
         provider: string;
         model: string | null;
         updatedAt: string;
@@ -4020,14 +4028,36 @@ export declare class Store {
     } | null;
     listPhaseTierConfig(scope: string): {
         phase: string;
-        tier: "strong";
+        tier: "light" | "strong";
         provider: string;
         model: string | null;
         updatedAt: string;
         updatedBy: string;
     }[];
-    setPhaseTierConfig(scope: string, phase: string, tier: "strong", provider: string, model: string | null, by: string, now: Date): void;
-    clearPhaseTierConfig(scope: string, phase: string, tier: "strong"): boolean;
+    setPhaseTierConfig(scope: string, phase: string, tier: "light" | "strong", provider: string, model: string | null, by: string, now: Date): void;
+    clearPhaseTierConfig(scope: string, phase: string, tier: "light" | "strong"): boolean;
+    /** A tier's candidates on other providers at a scope, in provider order (sized routing). */
+    phaseTierAlternates(scope: string, phase: string, tier: CandidateTier): {
+        provider: string;
+        model: string;
+        updatedAt: string;
+        updatedBy: string;
+    }[];
+    listPhaseTierAlternates(scope: string): {
+        phase: string;
+        tier: CandidateTier;
+        provider: string;
+        model: string;
+        updatedAt: string;
+        updatedBy: string;
+    }[];
+    /** Name this provider's candidate on a tier, beside the tier's own (one per provider; a second replaces the first). */
+    setPhaseTierAlternate(scope: string, phase: "plan" | "build", tier: CandidateTier, provider: string, model: string, by: string, now: Date): void;
+    /** Remove one provider's candidate from a tier, or every one when no provider is named; how many went. */
+    clearPhaseTierAlternates(scope: string, phase: string, tier: CandidateTier, provider: string | null): number;
+    /** Each provider's plan headroom right now, from the latest readings of
+     * its usage windows — the routing policy's headroom input at filing. */
+    planHeadroom(now: Date): ProviderRoom[];
     /** How far the plane may carry this repo's results unattended: a live
      * automerge mode, a publication grant whose merges wait for a person, or
      * nothing. A signed routing input, read at filing. */
@@ -4054,6 +4084,11 @@ export declare class Store {
             reason: string;
         };
         risk?: RiskLevel;
+        /** v2: a person's size for the task — it outranks the classifier's. */
+        size?: {
+            size: TaskSize;
+            risky: boolean;
+        };
         override?: {
             phase: RouteOverride["phase"];
             provider: ProviderId;
@@ -4084,6 +4119,30 @@ export declare class Store {
             model: string;
         }[];
     };
+    /** Store a task's size (v2 routing); the next scope filing routes by it. */
+    writeSizing(taskRef: number, sizing: TaskSizing): void;
+    /** Planning follows the size and risk while nothing has run: a small
+     * change at routine risk drops a plan that is only requested; a large or
+     * risky one, or any task at elevated or high risk, asks for a plan. A
+     * drafted plan is never discarded. */
+    private planToSizing;
+    /**
+     * The classifier's answer, applied after filing (v2 routing): filing never
+     * waits for it, so its size lands here — only while the task is still
+     * unapproved, unclaimed, and not sized by a person. The scope is re-filed
+     * under its own words so the route (and its digest) carries the size, and
+     * planning follows it unless the filer chose planning explicitly.
+     */
+    applySizing(taskId: string, sizing: TaskSizing, options: {
+        followPlanning: boolean;
+    }, now: Date): {
+        ok: true;
+        changed: boolean;
+        planning: "requested" | "cleared" | null;
+    } | {
+        ok: false;
+        reason: "no-task" | "person" | "running" | "approved";
+    };
     /** A runner's own non-spending observations, replacing its previous ones
      * per provider. Callers authenticate the runner first (runner.ts). */
     recordProviderReadiness(runner: string, observations: readonly Omit<ReadinessObservation, "runner" | "observedAt">[], now: Date): void;
@@ -7215,7 +7274,8 @@ export declare class Store {
      * another computer can tell, `unprovable` when nothing is known to run
      * but its exit was never recorded, `unknown` when this computer can't
      * check at all (both are what `run settle` resolves; only the first may
-     * be called not running). */
+     * be called not running). `settling` already meets the automatic
+     * reconciliation proof, so no confirmation is needed. */
     stopQuiescenceFact(runId: number): {
         run: number;
         kind: StopFactKind;
@@ -7247,7 +7307,11 @@ export declare class Store {
      * process groups is alive, it settles as never started, with a ledger
      * entry. A sole pid-less witness has no group to prove gone and stays for
      * `run settle`. Native witnesses keep their OS-only road. */
-    settleUnspawnedWitnesses(now: Date): number;
+    settleUnspawnedWitnesses(now: Date, onlyRun?: number): number;
+    /** The existing automatic settlement proof, shared with its read-only
+     * status. Unknown-only, foreign, native and still-running custody keep
+     * their fences; only an observed single-process exit avoids a new probe. */
+    private settleableUnspawnedWitnesses;
     /** `run settle` (an approver's last resort): every witness of a finished
      * run that cannot be proven either way is recorded settled under the
      * approver's reason, in the ledger. Refuses while anything of the run is

package/dist/store.js

@@ -7,6 +7,7 @@ import { KNOWLEDGE_SCHEMA } from "./project-knowledge.js";
 import { MEMORY_SCHEMA } from "./project-memory.js";
 import { MODELS_SCHEMA } from "./model-catalog.js";
 import { validateTaskText } from "./task-text.js";
+import { flowDefinitionForStore, flowDefinitionFromStore } from "./flows.js";
 import { chatControlHref, chatResultHref } from "./chat-controls.js";
 import { actorLabel, currentActor, leadSecretMatches, mintLeadToken, parseLeadToken } from "./actor.js";
 import { scanForSecrets } from "./evidence.js";
@@ -52,7 +53,7 @@ import { parseReviewContext, reviewContextCustodyProblem } from "./review-contex
 import { foldReview, manualReviewOnly } from "./proof.js";
 import { approvalOf, digestOf, canonicalProfileJson, canonicalChainJson, chainFromJson, chainDigestOf, entryDigestOf, profileDigestOf, profileFromJson, scopeAuthorityOf, routeParityProblem, parseAcceptanceCriteria, exactAcceptance, exactStringList, exactSafeIntegerOrNull, exactKeys, CLAUDE_LIMITS, CODEX_SHAPED_LIMITS, GEMINI_LIMITS } from "./scope.js";
 import { resolveScopeProfile, resolveScopeChain, resolveRouteCandidates, exactPinOf, routeOfTask, agentChoicesFor } from "./agentconfig.js";
-import { canonicalOverridesJson, canonicalRouteJson, exactModelId, isRiskLevel, legOf, overridesFromJson, phaseOfRole, recommendRoute, routeDigestOf, routeFromJson, routeProblems, routeStampProblem, ROUTE_ERA, } from "./phase-routing.js";
+import { canonicalOverridesJson, canonicalRouteJson, exactModelId, isRiskLevel, isTaskSize, headroomFrom, makesNoPlan, legOf, overridesFromJson, phaseOfRole, recommendRoute, routeDigestOf, routeFromJson, routeProblems, routeStampProblem, ROUTE_ERA, PROVIDER_ID_LIST, } from "./phase-routing.js";
 import { readAuthModeStrict } from "./keys.js";
 import { isFallbackEligible, recognizesEligible, classMatchesAuthMode } from "./exhaustion.js";
 import { modeDigestOf, modeTermsFromJson } from "./modes.js";
@@ -655,7 +656,7 @@ function readTeammateQuestion(row) {
         suggestion: row["suggestion"] === null || row["suggestion"] === undefined ? null : Number(row["suggestion"]) };
 }
 function readFlowRow(row) {
-    return { id: Number(row["id"]), repo: String(row["repo"]), name: String(row["name"]), definitionJson: String(row["definition_json"]), revision: Number(row["revision"]),
+    return { id: Number(row["id"]), repo: String(row["repo"]), name: String(row["name"]), definitionJson: flowDefinitionFromStore(String(row["definition_json"])), revision: Number(row["revision"]),
         state: String(row["state"]), createdBy: String(row["created_by"]), createdAt: String(row["created_at"]), updatedBy: String(row["updated_by"]), updatedAt: String(row["updated_at"]),
         owner: row["owner"] === null || row["owner"] === undefined ? String(row["created_by"]) : String(row["owner"]) };
 }
@@ -1084,7 +1085,7 @@ CREATE TABLE IF NOT EXISTS fallback_config (
 CREATE TABLE IF NOT EXISTS phase_tier_config (
   scope      TEXT NOT NULL,
   phase      TEXT NOT NULL CHECK (phase IN ('plan','build','repair','review')),
-  tier       TEXT NOT NULL CHECK (tier IN ('strong')),
+  tier       TEXT NOT NULL CHECK (tier IN ('light','strong')),
   provider   TEXT NOT NULL CHECK (provider IN ('claude','codex','openrouter','gemini')),
   model      TEXT,
   updated_at TEXT NOT NULL,
@@ -3977,6 +3978,15 @@ function initializeStore(db, file) {
     db.exec(PROVIDER_AUTH_SCHEMA);
     // The sign-in pause the dispatch gate last left this task waiting on (null: none), for the work index.
     addColumn(db, "task_ref", "auth_wait_pause", "INTEGER REFERENCES provider_auth_pause(id)");
+    // Sized routing (no version bump: additive, and a wider tier check whose rows carry over): how big each task is,
+    // who sized it and why, and the build tier its route chose; the light tier joins the strong one.
+    addColumn(db, "task_ref", "size", "TEXT CHECK (size IN ('small','medium','large'))");
+    addColumn(db, "task_ref", "size_risky", "INTEGER CHECK (size_risky IN (0, 1))");
+    addColumn(db, "task_ref", "size_source", "TEXT CHECK (size_source IN ('classifier','heuristic','person'))");
+    addColumn(db, "task_ref", "size_reason", "TEXT");
+    addColumn(db, "task_ref", "route_tier", "TEXT");
+    widenPhaseTierSchema(db);
+    db.exec(PHASE_TIER_ALTERNATE_SCHEMA);
     db.exec(REVIEW_SCHEMA);
     db.exec(RETENTION_SCHEMA);
     // 1-day evidence: an older file's retention_setting only allowed 7 days or more (no version bump: its rows carry over).
@@ -7099,6 +7109,57 @@ function hasColumn(db, table, column) {
         .all()
         .some(row => String(row["name"]) === column);
 }
+/** A tier's candidates on other providers (sized routing): one row per provider, beside the tier's own candidate
+ * (phase_config for routine, phase_tier_config for light and strong). At filing the one with more plan room runs. */
+const PHASE_TIER_ALTERNATE_SCHEMA = `
+CREATE TABLE IF NOT EXISTS phase_tier_alternate (
+  scope      TEXT NOT NULL,
+  phase      TEXT NOT NULL CHECK (phase IN ('plan','build')),
+  tier       TEXT NOT NULL CHECK (tier IN ('light','routine','strong')),
+  provider   TEXT NOT NULL CHECK (provider IN ('claude','codex','openrouter','gemini')),
+  model      TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  updated_by TEXT NOT NULL,
+  PRIMARY KEY (scope, phase, tier, provider)
+);
+`;
+/** A file from before the light tier keeps `tier IN ('strong')` in phase_tier_config's CHECK: rebuild the table with
+ * the wider one, keeping every row, in one transaction. A file already widened is untouched. */
+function widenPhaseTierSchema(db) {
+    const row = db.prepare("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'phase_tier_config'").get();
+    if (row === undefined || /'light'/.test(String(row["sql"])))
+        return;
+    db.exec("BEGIN IMMEDIATE");
+    try {
+        db.exec(`CREATE TABLE phase_tier_config_next (
+  scope      TEXT NOT NULL,
+  phase      TEXT NOT NULL CHECK (phase IN ('plan','build','repair','review')),
+  tier       TEXT NOT NULL CHECK (tier IN ('light','strong')),
+  provider   TEXT NOT NULL CHECK (provider IN ('claude','codex','openrouter','gemini')),
+  model      TEXT,
+  updated_at TEXT NOT NULL,
+  updated_by TEXT NOT NULL,
+  PRIMARY KEY (scope, phase, tier)
+)`);
+        db.exec("INSERT INTO phase_tier_config_next SELECT scope, phase, tier, provider, model, updated_at, updated_by FROM phase_tier_config");
+        db.exec("DROP TABLE phase_tier_config");
+        db.exec("ALTER TABLE phase_tier_config_next RENAME TO phase_tier_config");
+        db.exec("COMMIT");
+    }
+    catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+    }
+}
+/** A task's stored size, or null when it was never sized (or reads as nothing this code writes). */
+function sizingOfRow(row) {
+    if (!isTaskSize(row["size"]))
+        return null;
+    const source = row["size_source"];
+    if (source !== "classifier" && source !== "heuristic" && source !== "person")
+        return null;
+    return { size: row["size"], risky: Number(row["size_risky"] ?? 0) === 1, source, reason: row["size_reason"] == null ? "" : String(row["size_reason"]) };
+}
 function addColumn(db, table, column, definition) {
     if (hasColumn(db, table, column))
         return;
@@ -8454,11 +8515,20 @@ export class Store {
                     candidates: candidatesResolved.candidates,
                     overrides,
                     pins: { plan: planPin.pin, build: buildPin.pin, repair: repairPin },
+                    // v2: the task's size and each provider's plan headroom, sealed
+                    // with the route like every other input.
+                    size: ref?.sizing ?? null,
+                    headroom: this.planHeadroom(new Date(scope.proposedAt)),
                 });
                 const problems = routeProblems(route);
                 if (problems.length > 0)
                     unresolvedReason = problems.join("; ");
             }
+            // The tier the build leg runs on, recorded per task for the spend report.
+            if (route !== null && ref !== null) {
+                const buildLeg = legOf(route, "build");
+                this.db.prepare("UPDATE task_ref SET route_tier = ? WHERE id = ?").run(buildLeg.chosen === "recommended" ? buildLeg.tier : buildLeg.chosen, ref.id);
+            }
             if (unresolvedReason !== null) {
                 // Fail closed: an explicit profile does not outrank a route that
                 // cannot be made exact — the scope says why, and nothing runs.
@@ -13090,6 +13160,8 @@ export class Store {
             if (spec.routeOverridesJson !== undefined && spec.routeOverridesJson !== null) {
                 this.db.prepare("UPDATE task_ref SET route_overrides_json = ? WHERE id = ?").run(spec.routeOverridesJson, ref.id);
             }
+            if (spec.sizing !== undefined)
+                this.writeSizing(ref.id, spec.sizing);
             if (spec.agentPin !== undefined && spec.agentPin !== null)
                 this.pinTaskAgent(ref.id, spec.agentPin.provider, spec.agentPin.model);
             if (spec.planPin !== undefined && spec.planPin !== null) {
@@ -13467,7 +13539,7 @@ export class Store {
             .all(scope)
             .map(row => ({
             phase: String(row["phase"]),
-            tier: "strong",
+            tier: row["tier"] === "light" ? "light" : "strong",
             provider: String(row["provider"]),
             model: row["model"] === null ? null : String(row["model"]),
             updatedAt: String(row["updated_at"]),
@@ -13475,6 +13547,9 @@ export class Store {
         }));
     }
     setPhaseTierConfig(scope, phase, tier, provider, model, by, now) {
+        // A small change makes no plan and repairs resume the builder: only the build phase has a light agent.
+        if (tier === "light" && phase !== "build")
+            throw new Error(`a light agent is for the build phase only, not ${phase}`);
         this.db
             .prepare(`INSERT INTO phase_tier_config (scope, phase, tier, provider, model, updated_at, updated_by)
          VALUES (?, ?, ?, ?, ?, ?, ?)
@@ -13486,6 +13561,50 @@ export class Store {
         const { changes } = this.db.prepare("DELETE FROM phase_tier_config WHERE scope = ? AND phase = ? AND tier = ?").run(scope, phase, tier);
         return Number(changes) > 0;
     }
+    /** A tier's candidates on other providers at a scope, in provider order (sized routing). */
+    phaseTierAlternates(scope, phase, tier) {
+        return this.db
+            .prepare("SELECT * FROM phase_tier_alternate WHERE scope = ? AND phase = ? AND tier = ?")
+            .all(scope, phase, tier)
+            .map(row => ({ provider: String(row["provider"]), model: String(row["model"]), updatedAt: String(row["updated_at"]), updatedBy: String(row["updated_by"]) }))
+            .sort((a, b) => PROVIDER_ID_LIST.indexOf(a.provider) - PROVIDER_ID_LIST.indexOf(b.provider));
+    }
+    listPhaseTierAlternates(scope) {
+        return this.db
+            .prepare("SELECT * FROM phase_tier_alternate WHERE scope = ? ORDER BY phase, tier, provider")
+            .all(scope)
+            .map(row => ({
+            phase: String(row["phase"]),
+            tier: (row["tier"] === "light" ? "light" : row["tier"] === "strong" ? "strong" : "routine"),
+            provider: String(row["provider"]),
+            model: String(row["model"]),
+            updatedAt: String(row["updated_at"]),
+            updatedBy: String(row["updated_by"]),
+        }));
+    }
+    /** Name this provider's candidate on a tier, beside the tier's own (one per provider; a second replaces the first). */
+    setPhaseTierAlternate(scope, phase, tier, provider, model, by, now) {
+        if (tier === "light" && phase !== "build")
+            throw new Error(`a light agent is for the build phase only, not ${phase}`);
+        this.db
+            .prepare(`INSERT INTO phase_tier_alternate (scope, phase, tier, provider, model, updated_at, updated_by)
+         VALUES (?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT (scope, phase, tier, provider) DO UPDATE SET model = excluded.model,
+                                                                  updated_at = excluded.updated_at, updated_by = excluded.updated_by`)
+            .run(scope, phase, tier, provider, model, now.toISOString(), by);
+    }
+    /** Remove one provider's candidate from a tier, or every one when no provider is named; how many went. */
+    clearPhaseTierAlternates(scope, phase, tier, provider) {
+        const { changes } = provider === null
+            ? this.db.prepare("DELETE FROM phase_tier_alternate WHERE scope = ? AND phase = ? AND tier = ?").run(scope, phase, tier)
+            : this.db.prepare("DELETE FROM phase_tier_alternate WHERE scope = ? AND phase = ? AND tier = ? AND provider = ?").run(scope, phase, tier, provider);
+        return Number(changes);
+    }
+    /** Each provider's plan headroom right now, from the latest readings of
+     * its usage windows — the routing policy's headroom input at filing. */
+    planHeadroom(now) {
+        return headroomFrom(this.providerLimits(), now);
+    }
     /** How far the plane may carry this repo's results unattended: a live
      * automerge mode, a publication grant whose merges wait for a person, or
      * nothing. A signed routing input, read at filing. */
@@ -13518,7 +13637,7 @@ export class Store {
             const ref = this.refForId(taskRef);
             if (ref === null)
                 return { ok: false, reason: "no-task", detail: "no such task" };
-            if (edit.risk === undefined && edit.override === undefined)
+            if (edit.risk === undefined && edit.override === undefined && edit.size === undefined)
                 return { ok: false, reason: "nothing", detail: "nothing to change" };
             if (this.hasLiveClaim(taskRef, now))
                 return { ok: false, reason: "live-claim", detail: "this task is running — the agents cannot change under a live claim" };
@@ -13552,6 +13671,9 @@ export class Store {
             if (edit.risk !== undefined) {
                 this.db.prepare("UPDATE task_ref SET risk_level = ? WHERE id = ?").run(edit.risk, taskRef);
             }
+            if (edit.size !== undefined) {
+                this.writeSizing(taskRef, { size: edit.size.size, risky: edit.size.risky, source: "person", reason: `set by ${edit.by}` });
+            }
             let overrides = ref.routeOverrides ?? [];
             if (edit.override !== undefined) {
                 const kept = overrides.filter(one => one.phase !== edit.override.phase);
@@ -13570,6 +13692,10 @@ export class Store {
             const wasApproved = before !== null && before.approvedAt !== null && before.approvedDigest === before.digest;
             const refiled = before === null ? null : this.refileScope(ref.externalId, now);
             const staled = wasApproved && refiled !== null && refiled.approvedDigest !== refiled.digest;
+            // Planning follows a new size, and elevated or high risk always plans — after the re-file, so an approval
+            // this edit staled does not refuse the plan request.
+            if (edit.size !== undefined || (edit.risk !== undefined && edit.risk !== "routine"))
+                this.planToSizing(taskRef, now);
             // A plan drafted by the previous planner is not relabeled: a plan
             // override (set or cleared) asks for a REAL re-plan.
             let replanned = false;
@@ -13581,6 +13707,63 @@ export class Store {
             return { ok: true, scope: refiled, staled, replanned, overrides: overridesFromJson(canonicalOverridesJson(overrides)) ?? [] };
         });
     }
+    /** Store a task's size (v2 routing); the next scope filing routes by it. */
+    writeSizing(taskRef, sizing) {
+        this.db
+            .prepare("UPDATE task_ref SET size = ?, size_risky = ?, size_source = ?, size_reason = ? WHERE id = ?")
+            .run(sizing.size, sizing.risky ? 1 : 0, sizing.source, sizing.reason.slice(0, 300), taskRef);
+    }
+    /** Planning follows the size and risk while nothing has run: a small
+     * change at routine risk drops a plan that is only requested; a large or
+     * risky one, or any task at elevated or high risk, asks for a plan. A
+     * drafted plan is never discarded. */
+    planToSizing(taskRef, now) {
+        const ref = this.refForId(taskRef);
+        if (ref === null || ref.repo === null || ref.deliverable === "report")
+            return null;
+        const sizing = ref.sizing ?? null;
+        if (makesNoPlan(sizing, ref.riskLevel ?? "routine")) {
+            if (ref.plan !== "requested" || this.hasLiveClaim(taskRef, now))
+                return null;
+            this.db.prepare("UPDATE task_ref SET plan = NULL WHERE id = ? AND plan = 'requested'").run(taskRef);
+            return "cleared";
+        }
+        const wanted = (ref.riskLevel ?? "routine") !== "routine" || (sizing !== null && (sizing.size === "large" || sizing.risky));
+        if (wanted && ref.plan === null)
+            return this.requestPlan(taskRef, now).ok ? "requested" : null;
+        return null;
+    }
+    /**
+     * The classifier's answer, applied after filing (v2 routing): filing never
+     * waits for it, so its size lands here — only while the task is still
+     * unapproved, unclaimed, and not sized by a person. The scope is re-filed
+     * under its own words so the route (and its digest) carries the size, and
+     * planning follows it unless the filer chose planning explicitly.
+     */
+    applySizing(taskId, sizing, options, now) {
+        return this.transact(() => {
+            const ref = this.lookupRef(taskId);
+            if (ref === null)
+                return { ok: false, reason: "no-task" };
+            if (ref.sizing?.source === "person")
+                return { ok: false, reason: "person" };
+            if (this.hasLiveClaim(ref.id, now))
+                return { ok: false, reason: "running" };
+            const scope = this.getScope(taskId);
+            if (scope !== null && scope.approvedAt !== null && scope.approvedDigest === scope.digest)
+                return { ok: false, reason: "approved" };
+            const before = ref.sizing ?? null;
+            if (before !== null && before.size === sizing.size && before.risky === sizing.risky && before.source === sizing.source && before.reason === sizing.reason) {
+                return { ok: true, changed: false, planning: null };
+            }
+            this.writeSizing(ref.id, sizing);
+            if (scope !== null)
+                this.refileScope(taskId, now);
+            const planning = options.followPlanning ? this.planToSizing(ref.id, now) : null;
+            this.bumpWake();
+            return { ok: true, changed: true, planning };
+        });
+    }
     /** A runner's own non-spending observations, replacing its previous ones
      * per provider. Callers authenticate the runner first (runner.ts). */
     recordProviderReadiness(runner, observations, now) {
@@ -16296,6 +16479,9 @@ export class Store {
             // retained witnesses and every owned run; recovery revisits a pending
             // stop after an orphan or held supervisor finishes shutdown.
             this.recordRunProcessExits(id, result.now);
+            // Use the existing reconciliation proof now, while exits are fresh. In
+            // particular, a returned --candidate check need not await the next scan.
+            this.settleUnspawnedWitnesses(result.now, id);
             this.settleRunStop(id, result.stopSettlement ?? "finished", result.now);
             // The first Ready result is an installation fact the moment it lands,
             // not only when something later looks for it. A run that changed
@@ -19096,7 +19282,7 @@ export class Store {
     createFlow(flow, now) {
         const stamp = now.toISOString();
         return Number(this.db.prepare("INSERT INTO flow (repo, name, definition_json, revision, state, created_by, created_at, updated_by, updated_at) VALUES (?, ?, ?, 1, 'active', ?, ?, ?, ?)")
-            .run(flow.repo, flow.name, flow.definitionJson, flow.by, stamp, flow.by, stamp).lastInsertRowid);
+            .run(flow.repo, flow.name, flowDefinitionForStore(flow.definitionJson), flow.by, stamp, flow.by, stamp).lastInsertRowid);
     }
     /** Hand a flow to another person: its "the owner decides" zones ask them from now on. */
     setFlowOwner(id, owner, now) {
@@ -19114,7 +19300,7 @@ export class Store {
     /** Save a new drawing of the flow only over the revision the editor saw (two editors never overwrite each other silently). */
     saveFlow(id, change, now) {
         const { changes } = this.db.prepare("UPDATE flow SET name = ?, definition_json = ?, revision = revision + 1, updated_by = ?, updated_at = ? WHERE id = ? AND revision = ? AND state = 'active'")
-            .run(change.name, change.definitionJson, change.by, now.toISOString(), id, change.sawRevision);
+            .run(change.name, flowDefinitionForStore(change.definitionJson), change.by, now.toISOString(), id, change.sawRevision);
         return Number(changes) === 1;
     }
     archiveFlow(id, by, now) {
@@ -21290,7 +21476,8 @@ export class Store {
      * another computer can tell, `unprovable` when nothing is known to run
      * but its exit was never recorded, `unknown` when this computer can't
      * check at all (both are what `run settle` resolves; only the first may
-     * be called not running). */
+     * be called not running). `settling` already meets the automatic
+     * reconciliation proof, so no confirmation is needed. */
     stopQuiescenceFact(runId) {
         const fact = (run, kind, problem) => ({ run, kind, problem });
         const ids = this.ownedRunsOf(runId);
@@ -21306,10 +21493,13 @@ export class Store {
             if (held !== null && held.endedAt === null)
                 return fact(id, "alive", `run #${id}'s held supervisor has not finished shutdown`);
             const witnesses = this.db.prepare("SELECT * FROM run_process WHERE run = ? ORDER BY id").all(id);
+            let incompleteSpawn = false;
             if (run.providerStartedAt !== null && witnesses.length === 0) {
                 return fact(id, "unprovable", `run #${id} may have spawned before its process witness was recorded; exit is unproven`);
             }
             for (const witness of witnesses) {
+                // A recorded group exit proves the whole group ended, not just its
+                // leader. Re-probing its number could mistake reuse for the old group.
                 if (witness["exited_at"] !== null)
                     continue;
                 const host = String(witness["host"]);
@@ -21339,10 +21529,12 @@ export class Store {
                         return fact(id, "unknown", `run #${id}'s ${backend} object ${container} cannot be proven empty from here`);
                     continue;
                 }
-                if (witness["pid"] === null)
-                    return fact(id, "unprovable", `run #${id} has an incomplete spawn witness; exit is unproven`);
+                if (witness["pid"] === null) {
+                    incompleteSpawn = true;
+                    continue;
+                }
                 const pid = Number(witness["pid"]);
-                if (processMayBeAlive(pid, witness["process_group"] === 1, { observedAt: witness["observed_at"], finishedAt: run.finishedAt }))
+                if (processMayBeAlive(pid, witness["process_group"] === 1, { observedAt: witness["observed_at"], finishedAt: run.finishedAt, exitedAt: witness["exited_at"] }))
                     return fact(id, "alive", `run #${id}'s process ${pid} may still be running`);
             }
             if (run.worktree !== null) {
@@ -21357,6 +21549,8 @@ export class Store {
                         return fact(id, "unknown", `run #${id}'s workspace occupancy could not be established`);
                 }
             }
+            if (incompleteSpawn)
+                return fact(id, this.settleableUnspawnedWitnesses(run, witnesses).length > 0 ? "settling" : "unprovable", `run #${id} has an incomplete spawn witness; exit is unproven`);
         }
         return null;
     }
@@ -21435,10 +21629,11 @@ export class Store {
      * process groups is alive, it settles as never started, with a ledger
      * entry. A sole pid-less witness has no group to prove gone and stays for
      * `run settle`. Native witnesses keep their OS-only road. */
-    settleUnspawnedWitnesses(now) {
+    settleUnspawnedWitnesses(now, onlyRun) {
         const candidates = this.db.prepare(`SELECT DISTINCT p.run FROM run_process p JOIN run r ON r.id = p.run
       WHERE p.exited_at IS NULL AND p.pid IS NULL AND p.containment IS NULL AND p.container IS NULL
-        AND p.host = ? AND r.outcome IS NOT NULL AND r.finished_at IS NOT NULL ORDER BY p.run`).all(hostname());
+        AND p.host = ? AND r.outcome IS NOT NULL AND r.finished_at IS NOT NULL
+        AND (? IS NULL OR p.run = ?) ORDER BY p.run`).all(hostname(), onlyRun ?? null, onlyRun ?? null);
         let settled = 0;
         for (const candidate of candidates) {
             const runId = Number(candidate["run"]);
@@ -21447,22 +21642,8 @@ export class Store {
                 const run = this.getRun(runId);
                 if (run === null || run.outcome === null)
                     return 0;
-                if (ownedProcessCount(runOwnerTag(this, runId)) > 0)
-                    return 0;
-                const held = this.heldSessionOf(runId);
-                if (held !== null && held.endedAt === null)
-                    return 0;
                 const rows = this.db.prepare("SELECT * FROM run_process WHERE run = ? ORDER BY id").all(runId);
-                const pidless = rows.filter(row => row["exited_at"] === null && row["pid"] === null && row["containment"] === null && row["container"] === null && row["host"] === hostname());
-                const others = rows.filter(row => !pidless.includes(row));
-                if (pidless.length === 0 || others.length === 0)
-                    return 0;
-                if (others.some(row => row["exited_at"] === null))
-                    return 0;
-                // Exit was recorded once; the group's members are asked again now.
-                const groups = others.filter(row => row["pid"] !== null && row["host"] === hostname());
-                if (groups.length === 0 || groups.some(row => processMayBeAlive(Number(row["pid"]), row["process_group"] === 1, { observedAt: row["observed_at"], finishedAt: run.finishedAt })))
-                    return 0;
+                const pidless = this.settleableUnspawnedWitnesses(run, rows);
                 const ref = this.refById(run.taskRef);
                 let count = 0;
                 for (const row of pidless) {
@@ -21481,6 +21662,24 @@ export class Store {
         }
         return settled;
     }
+    /** The existing automatic settlement proof, shared with its read-only
+     * status. Unknown-only, foreign, native and still-running custody keep
+     * their fences; only an observed single-process exit avoids a new probe. */
+    settleableUnspawnedWitnesses(run, rows) {
+        if (run.outcome === null || run.finishedAt === null || ownedProcessCount(runOwnerTag(this, run.id)) > 0)
+            return [];
+        const held = this.heldSessionOf(run.id);
+        if (held !== null && held.endedAt === null)
+            return [];
+        const pidless = rows.filter(row => row["exited_at"] === null && row["pid"] === null && row["containment"] === null && row["container"] === null && row["host"] === hostname());
+        const others = rows.filter(row => !pidless.includes(row));
+        if (pidless.length === 0 || others.length === 0 || others.some(row => row["exited_at"] === null))
+            return [];
+        const known = others.filter(row => row["pid"] !== null && row["host"] === hostname());
+        if (known.length === 0 || known.some(row => processMayBeAlive(Number(row["pid"]), row["process_group"] === 1, { observedAt: row["observed_at"], finishedAt: run.finishedAt, exitedAt: row["exited_at"] })))
+            return [];
+        return pidless;
+    }
     /** `run settle` (an approver's last resort): every witness of a finished
      * run that cannot be proven either way is recorded settled under the
      * approver's reason, in the ledger. Refuses while anything of the run is
@@ -21508,7 +21707,7 @@ export class Store {
                         return alive(`run #${args.runId}'s process ${String(row["pid"])} belongs to ${String(row["host"])}; settle it there`);
                     continue;
                 }
-                if (processMayBeAlive(Number(row["pid"]), row["process_group"] === 1, { observedAt: row["observed_at"], finishedAt: run.finishedAt }))
+                if (processMayBeAlive(Number(row["pid"]), row["process_group"] === 1, { observedAt: row["observed_at"], finishedAt: run.finishedAt, exitedAt: row["exited_at"] }))
                     return alive(`run #${args.runId}'s process ${String(row["pid"])} is still running`);
             }
             for (const row of open) {
@@ -23653,6 +23852,8 @@ function readTaskRef(row) {
             : null,
         riskLevel: isRiskLevel(row["risk_level"]) ? row["risk_level"] : null,
         routeOverrides: overridesFromJson(row["route_overrides_json"] === null || row["route_overrides_json"] === undefined ? null : String(row["route_overrides_json"])),
+        sizing: sizingOfRow(row),
+        routeTier: row["route_tier"] === null || row["route_tier"] === undefined ? null : String(row["route_tier"]),
         planProvider: row["plan_provider"] === null || row["plan_provider"] === undefined
             ? null
             : String(row["plan_provider"]),