toolroll 0.9.30 → 0.9.32

package/dist/store.d.ts

@@ -21,6 +21,14 @@ import { type RetentionKind, type RetentionPeriods } from "./retention.js";
 import { type CheckoutCleanup } from "./storage.js";
 import { type LedgerChainReport } from "./ledger-chain.js";
 import { type ApprovalGate, type ApprovalRules, type ApproverKind, type Filer } from "./approval-policy.js";
+/** A lead reply stopped at its deadline, in the thread as plain words: what happened, what it means, one next step. The
+ * proposals it made before then are kept; the cost line only when an unknown cost paused chat. */
+export declare function mateTimeoutNotice(keptProposals: boolean, unknownCost?: boolean): string;
+/** Whether a turn's proposals stand: it answered, or it stopped at its deadline after its completed tool calls proposed them. */
+export declare function mateTurnKeepsProposals(turn: {
+    state: string;
+    failureReason: string | null;
+} | null): boolean;
 /** What the lead promised to follow up on (lead-commitments.ts; no version bump: additive only, so a build that
  * predates it still opens the store). `condition_json` is a task, attempt, check or time; `check_at` is when to look
  * next; `channel` is where it reports (`chat`: the conversation it was promised in); a promise lapses at `expires_at`. */
@@ -6916,12 +6924,17 @@ export declare class Store {
         tokensIn: number;
         tokensOut: number;
         failureReason?: string;
-        /** Answered turns: the assistant row, written in the same transaction as the promotion. */
+        /** Answered turns: the assistant row, written in the same transaction as the promotion. A timed-out turn's notice. */
         message?: {
             text: string;
             activity: string;
         };
+        /** A timed-out turn keeps what its completed, validated tool calls proposed (its drafts go pending with its notice). */
+        keepProposals?: boolean;
     }, now: Date): boolean;
+    /** A turn stopped at its deadline: the proposals its completed tool calls drafted (each validated when drafted) go pending, as an
+     * answered turn's do; anything the provider sent after them was never acted on. Every other failure still deletes its drafts. */
+    private keepTimedOutMateProposals;
     /** Revocation's companion for a loop in flight (finding 5): every live
      * turn of the approver fails NOW, charged its whole reservation, its
      * generation moved so the returning loop's terminal CAS loses. */
@@ -6929,7 +6942,9 @@ export declare class Store {
     /** The crash sweep for turns: past the deadline, failed. The session is
      * charged the settled sum of the steps that answered — unless any step
      * is unproven (dispatched and never settled, or latched), in which case
-     * the WHOLE reservation is charged (finding 1). Drafts are deleted. */
+     * the WHOLE reservation is charged (finding 1). Like a turn that stopped
+     * at its own deadline, it keeps the proposals its completed tool calls
+     * drafted and says, in the thread, that the reply took too long. */
     sweepStaleMateTurns(now: Date): number;
     /** A task_ref by its row id: the external id and repo — for decisions, which hang off runs. */
     refById(id: number): {

package/dist/store.js

@@ -71,7 +71,7 @@ import { PROVIDER_AUTH_SCHEMA } from "./provider-auth.js";
 import { REVIEW_SCHEMA, reviewSwitchWords } from "./review-switch.js";
 import { SPEND_SCHEMA, billingOf, budgetStates, canPrice, claudeMachineBilling, countsToward, filersOf, monthOf, priceWork, seenBilling as seenBillingOf, spendItems, teammateFilers, usd } from "./spend.js";
 import { DEFAULT_PERIODS, RETENTION_SCHEMA, periodWords, widenRetentionSchema } from "./retention.js";
-import { CHECKOUT_CLEANUP_SCHEMA, DEFAULT_CLEANUP, cleanupWords } from "./storage.js";
+import { CHECKOUT_CLEANUP_SCHEMA, STORAGE_SWEEP_SCHEMA, DEFAULT_CLEANUP, cleanupWords } from "./storage.js";
 import { IN_RANGE, LEDGER_CHAIN_SCHEMA, safeWhole, sealLedger, verifyLedgerChain } from "./ledger-chain.js";
 import { NO_RULES, filerFor, isProtectedWork, protectedChanges, rulesWords } from "./approval-policy.js";
 import { configBase, envValue, namedPath } from "./names.js";
@@ -253,6 +253,19 @@ CREATE TABLE IF NOT EXISTS project_mute (
   PRIMARY KEY (account, repo)
 );
 `;
+/** A lead reply stopped at its deadline, in the thread as plain words: what happened, what it means, one next step. The
+ * proposals it made before then are kept; the cost line only when an unknown cost paused chat. */
+export function mateTimeoutNotice(keptProposals, unknownCost = false) {
+    return [
+        unknownCost ? "The reply took too long and was stopped, and its cost isn't known yet, so chat is paused." : "The reply took too long and was stopped.",
+        keptProposals ? "What it proposed is below." : null,
+        unknownCost ? "Confirm the cost on the Chat page to turn chat back on." : "Send your message again, or ask for less at once.",
+    ].filter(part => part !== null).join(" ");
+}
+/** Whether a turn's proposals stand: it answered, or it stopped at its deadline after its completed tool calls proposed them. */
+export function mateTurnKeepsProposals(turn) {
+    return turn !== null && (turn.state === "answered" || turn.state === "failed" && (turn.failureReason === "timeout" || turn.failureReason === "crashed"));
+}
 /** What the lead promised to follow up on (lead-commitments.ts; no version bump: additive only, so a build that
  * predates it still opens the store). `condition_json` is a task, attempt, check or time; `check_at` is when to look
  * next; `channel` is where it reports (`chat`: the conversation it was promised in); a promise lapses at `expires_at`. */
@@ -3992,6 +4005,8 @@ function initializeStore(db, file) {
     // 1-day evidence: an older file's retention_setting only allowed 7 days or more (no version bump: its rows carry over).
     widenRetentionSchema(db);
     db.exec(CHECKOUT_CLEANUP_SCHEMA);
+    // The daily storage sweep's record (no version bump: a new table, nothing carried over).
+    db.exec(STORAGE_SWEEP_SCHEMA);
     db.exec(BACKUP_SCHEMA);
     // Sprint 8: the organisation policy (one row, or none: nothing restricted).
     db.exec(POLICY_SCHEMA);
@@ -20282,12 +20297,23 @@ export class Store {
                 }
             }
             else {
-                this.discardMateProposals(id);
+                if (outcome.keepProposals === true)
+                    this.keepTimedOutMateProposals(id);
+                else
+                    this.discardMateProposals(id);
                 this.discardMateTurnEvidence(id);
+                if (outcome.message !== undefined) {
+                    this.appendMateMessage({ thread: Number(before["thread"]), turn: id, role: "assistant", text: outcome.message.text, activity: outcome.message.activity }, now);
+                }
             }
             return true;
         });
     }
+    /** A turn stopped at its deadline: the proposals its completed tool calls drafted (each validated when drafted) go pending, as an
+     * answered turn's do; anything the provider sent after them was never acted on. Every other failure still deletes its drafts. */
+    keepTimedOutMateProposals(turn) {
+        return Number(this.db.prepare("UPDATE mate_proposal SET state = 'pending' WHERE turn = ? AND state = 'drafting'").run(turn).changes);
+    }
     /** Revocation's companion for a loop in flight (finding 5): every live
      * turn of the approver fails NOW, charged its whole reservation, its
      * generation moved so the returning loop's terminal CAS loses. */
@@ -20309,12 +20335,14 @@ export class Store {
     /** The crash sweep for turns: past the deadline, failed. The session is
      * charged the settled sum of the steps that answered — unless any step
      * is unproven (dispatched and never settled, or latched), in which case
-     * the WHOLE reservation is charged (finding 1). Drafts are deleted. */
+     * the WHOLE reservation is charged (finding 1). Like a turn that stopped
+     * at its own deadline, it keeps the proposals its completed tool calls
+     * drafted and says, in the thread, that the reply took too long. */
     sweepStaleMateTurns(now) {
         return this.transact(() => {
             this.sweepStaleChatTurns(now);
             const rows = this.db
-                .prepare("SELECT id, session, reserved_microusd AS reserved FROM mate_turn WHERE state IN ('queued','running') AND deadline_at < ?")
+                .prepare("SELECT id, session, thread, reserved_microusd AS reserved FROM mate_turn WHERE state IN ('queued','running') AND deadline_at < ?")
                 .all(now.toISOString());
             for (const row of rows) {
                 const id = Number(row["id"]);
@@ -20329,8 +20357,12 @@ export class Store {
                     .prepare("UPDATE mate_turn SET state = 'failed', failure_reason = 'crashed', generation = generation + 1, settled_microusd = ?, finished_at = ? WHERE id = ?")
                     .run(spent, now.toISOString(), id);
                 this.db.prepare("UPDATE mate_session SET spent_microusd = spent_microusd + ? WHERE id = ?").run(spent, Number(row["session"]));
-                this.discardMateProposals(id);
+                const kept = this.keepTimedOutMateProposals(id);
                 this.discardMateTurnEvidence(id);
+                const latched = this.db.prepare("SELECT 1 AS hit FROM chat_turn WHERE mate_turn = ? AND unknown_spend = 1 AND acknowledged_at IS NULL LIMIT 1").get(id) !== undefined;
+                const open = this.db.prepare("SELECT 1 AS hit FROM mate_thread WHERE id = ? AND closed_at IS NULL").get(Number(row["thread"])) !== undefined;
+                if (open)
+                    this.appendMateMessage({ thread: Number(row["thread"]), turn: id, role: "assistant", text: mateTimeoutNotice(kept > 0, latched), activity: null }, now);
             }
             return rows.length;
         });

package/dist/subscription-chat.d.ts

@@ -10,6 +10,8 @@ export type SubscriptionMateRequest = {
     history: readonly MateHistoryMessage[];
     tools: readonly MateToolSchema[];
     timeoutMs: number;
+    /** The turn's own deadline: aborting it ends the harness's whole process group. */
+    signal?: AbortSignal;
     /** The reply as it is written, cumulative, when the harness can stream it
      * (Claude). Display only: the finished answer is still parsed whole. */
     onText?: (text: string) => void;
@@ -23,7 +25,7 @@ export type SubscriptionMateRunner = (request: SubscriptionMateRequest) => Promi
 }>;
 type CommandRunner = (file: string, args: readonly string[], options: Parameters<typeof run>[2]) => Promise<ExecResult>;
 /** The model-visible request. Tool results are already redacted by mateView. */
-export declare function composeSubscriptionMatePrompt(request: Omit<SubscriptionMateRequest, "provider" | "model" | "timeoutMs">): string;
+export declare function composeSubscriptionMatePrompt(request: Omit<SubscriptionMateRequest, "provider" | "model" | "timeoutMs" | "signal">): string;
 /** Strictly turn the harness's structured output into the provider-neutral answer. */
 export declare function parseSubscriptionMateAnswer(text: string, usage?: {
     tokensIn?: unknown;

package/dist/subscription-chat.js

@@ -224,6 +224,7 @@ export async function performSubscriptionMateRequest(request, runner = run) {
             cwd: dir,
             stdin: prompt,
             timeoutMs: request.timeoutMs,
+            ...(request.signal === undefined ? {} : { signal: request.signal }),
             // Events repeat the answer (deltas, the message, the result line).
             maxBuffer: streaming ? RESPONSE_CAP_BYTES * 16 : RESPONSE_CAP_BYTES,
             omitEnv: ALL_CREDENTIAL_ENV,

package/dist/surface.js

@@ -338,6 +338,7 @@ export const COMMAND_GUIDE = [
     operator("runner retire", "retire a worker"),
     operator("runner bind", "replace which repositories a worker may build in"),
     operator("runner capacity", "set how many tasks a worker runs at once; running work carries on, the new number applies at the next claim"),
+    operator("project checks", "show or set a project's batch checks (--batch on|off, off by default): results that finish within 10 minutes share one full check on a temporary batch commit; nothing is merged into a real branch"),
     operator("project concurrency", "set how many of a project's tasks build at once (default 2, never past the worker's capacity); running work carries on"),
     operator("coordinator mint", "mint the MCP filing credential — repo-bound, rate-limited, token shown once"),
     operator("coordinator revoke", "revoke an MCP filing credential"),

package/dist/task-status.d.ts

@@ -53,7 +53,20 @@ export type ChecksFact = {
     level?: "quick" | "full" | "off" | null;
     /** A follow-up check (Run checks) waiting or running on this commit. */
     running?: "quick" | "full" | null;
+    /** A batch check (batch-checks.ts): waiting for its batch, or how it was checked. */
+    batch?: ChecksBatch | null;
 };
+/** `waiting`: the result waits to be checked with others. Otherwise how its check ran: `together` on the
+ * temporary batch commit `tested` with `peers`; `split` (its batch failed), `conflict` or `alone` on its own commit. */
+export type ChecksBatch = {
+    state: "waiting" | "together" | "split" | "conflict" | "alone";
+    tested: string | null;
+    peers: string[];
+};
+/** "T2", "T2 and T3", "T2, T3 and 2 more": short enough for one line. The full list is on the result. */
+export declare function peerWords(peers: readonly string[], shown?: number): string;
+/** "Checked together with T2 on 1a2b3c4": every surface says a shared check the same way, naming the commit it tested. */
+export declare function checkedTogetherWords(batch: ChecksBatch): string | null;
 export type PullRequestFact = {
     state: "none" | "opening" | "open" | "merged" | "closed" | "failed";
     number: number | null;

package/dist/task-status.js

@@ -26,6 +26,21 @@ export const CHECKS_LABEL = "Project checks";
 export const PR_CI_LABEL = "PR CI";
 /** The one verb for opening a saved result, on every surface. */
 export const OPEN_RESULT = "Open result";
+/** "T2", "T2 and T3", "T2, T3 and 2 more": short enough for one line. The full list is on the result. */
+export function peerWords(peers, shown = 2) {
+    if (peers.length <= shown)
+        return peers.length <= 1 ? peers.join("") : `${peers.slice(0, -1).join(", ")} and ${peers.at(-1)}`;
+    return `${peers.slice(0, shown).join(", ")} and ${peers.length - shown} more`;
+}
+/** "Checked together with T2 on 1a2b3c4": every surface says a shared check the same way, naming the commit it tested. */
+export function checkedTogetherWords(batch) {
+    const sha = short(batch.tested);
+    return batch.state === "together" && batch.peers.length > 0 && sha !== null ? `Checked together with ${peerWords(batch.peers)} on ${sha}` : null;
+}
+const BATCH_WHY = {
+    split: "Its batch check failed, so it was checked on its own.",
+    conflict: "It conflicted with another result when merged for a batch check, so it was checked on its own.",
+};
 const short = (sha) => sha !== null && /^[a-f0-9]{7,40}$/.test(sha) ? sha.slice(0, 7) : null;
 export function headlineOf(facts) {
     switch (facts.stage) {
@@ -64,8 +79,15 @@ function sentenceOf(headline, facts) {
                 return "The report is ready to read. Read it, then mark it complete.";
             if (facts.checks?.level === "off" && facts.checks.status !== "passed")
                 return "Checks are off for this project. Review the change, then mark it complete.";
-            if (facts.checks?.status === "passed")
+            if (facts.checks?.status === "passed") {
+                // The Checks row names the others and the batch commit; the sentence doesn't repeat them.
+                const peers = facts.checks.batch?.state === "together" ? facts.checks.batch.peers.length : 0;
+                if (peers > 0)
+                    return `Checks passed together with ${peers === 1 ? "1 other result" : `${peers} other results`}. Review the change, then mark it complete.`;
                 return `${facts.checks.level === "quick" ? "Quick checks" : "Checks"} passed${sha === null ? "" : ` on ${sha}`}. Review the change, then mark it complete.`;
+            }
+            if (facts.checks?.batch?.state === "waiting")
+                return "Its full check runs with other results within 10 minutes. Review the change, then mark it complete.";
             // Never claim a check that isn't known to have passed.
             if (facts.checks == null)
                 return "Review the change, then mark it complete.";
@@ -93,8 +115,19 @@ function detailsOf(headline, facts) {
         const checksHref = facts.links?.checks ?? facts.links?.result ?? null;
         const runChecks = facts.links?.runChecks === undefined ? null : { label: "Run checks", href: facts.links.runChecks };
         const quick = checks.level === "quick";
-        if (checks.running != null)
+        const batch = checks.batch ?? null;
+        const together = batch === null ? null : checkedTogetherWords(batch);
+        const batchWhy = batch === null ? null : BATCH_WHY[batch.state] ?? null;
+        if (batch?.state === "waiting")
+            row("checks", CHECKS_LABEL, "Waiting to check with other results", "running", { href: checksHref });
+        else if (checks.running != null)
             row("checks", CHECKS_LABEL, `${checks.running === "quick" ? "Quick" : "Full"} checks running`, "running", { href: checksHref });
+        else if (checks.status === "passed" && together !== null)
+            row("checks", CHECKS_LABEL, together, "ok", { href: checksHref });
+        else if (checks.status === "passed" && batchWhy !== null)
+            row("checks", CHECKS_LABEL, `Passed on its own${sha === null ? "" : ` on ${sha}`}`, "ok", { href: checksHref, why: batchWhy });
+        else if (checks.status === "failed" && batchWhy !== null)
+            row("checks", CHECKS_LABEL, `Failed on its own${checks.exitCode === null ? "" : ` (exit ${checks.exitCode})`}`, problem(headline), headline === "Failed" ? { href: checksHref, why: batchWhy } : { action: { label: "See what failed", href: checksHref }, why: batchWhy });
         else if (checks.status === "passed")
             row("checks", CHECKS_LABEL, `${quick ? "Quick checks passed" : "Passed"}${sha === null ? "" : ` on ${sha}`}`, "ok", quick && runChecks !== null && headline !== "Complete" ? { href: checksHref, action: { label: "Run full checks", href: runChecks.href } } : { href: checksHref });
         else if (checks.status === "failed")
@@ -320,7 +353,8 @@ export function assignmentStatusFacts(assignment, options = {}) {
     const report = receipt?.completionKind === "research-report";
     const checks = receipt === null || !withResult ? null
         : { status: receipt.checks.status, exitCode: receipt.checks.exitCode, head: receipt.head,
-            ...(receipt.checks.level == null ? {} : { level: receipt.checks.level }), ...(receipt.checks.running == null ? {} : { running: receipt.checks.running }) };
+            ...(receipt.checks.level == null ? {} : { level: receipt.checks.level }), ...(receipt.checks.running == null ? {} : { running: receipt.checks.running }),
+            ...(receipt.checks.batch == null ? {} : { batch: receipt.checks.batch }) };
     const publication = assignment.publication;
     const pullRequest = options.pullRequest !== undefined ? options.pullRequest
         : publication === null ? (withResult && !report ? { state: "none", number: null, url: null, ci: null, error: null } : null)

package/dist/team-leads.js

@@ -32,6 +32,10 @@ function role(value) {
         refuse('invalid', 'Choose Viewer, Contributor or Manager.');
     return value;
 }
+/** A failed turn's words for its message: none when the turn said why in the thread itself (it stopped at its deadline). */
+function savedFailure(reason) {
+    return reason === 'timeout' || reason === 'crashed' ? null : String(reason ?? 'The saved turn failed.');
+}
 function hash(value) { return createHash('sha256').update(JSON.stringify(value)).digest('hex'); }
 function stable(value) {
     if (Array.isArray(value))
@@ -461,7 +465,7 @@ export class TeamLeads {
                 const uncertain = this.deliveryUncertain(Number(row['turn_id']));
                 const cancelled = Number(row['stop_requested']) === 1 || !this.authorStillAllowed(row);
                 const status = uncertain ? 'uncertain' : cancelled ? 'cancelled' : row['turn_state'] === 'answered' ? 'answered' : 'failed';
-                const error = uncertain ? 'Delivery could not be confirmed. Inspect saved activity before continuing.' : cancelled ? 'Stopped or conversation access changed.' : status === 'failed' ? String(row['failure_reason'] ?? 'The saved turn failed.') : null;
+                const error = uncertain ? 'Delivery could not be confirmed. Inspect saved activity before continuing.' : cancelled ? 'Stopped or conversation access changed.' : status === 'failed' ? savedFailure(row['failure_reason']) : null;
                 const result = this.db.prepare("UPDATE team_message SET status=?,error=?,generation=generation+1,revision=revision+1 WHERE message=? AND status='running' AND generation=?").run(status, error, Number(row['message']), Number(row['generation']));
                 if (Number(result.changes) === 1) {
                     changed++;
@@ -480,7 +484,7 @@ export class TeamLeads {
             for (const row of rows) {
                 const turn = row['turn_id'] === null ? null : this.store.getMateTurn(Number(row['turn_id']));
                 const status = turn?.state === 'answered' ? 'answered' : turn?.state === 'failed' && !this.deliveryUncertain(turn.id) ? 'failed' : 'uncertain';
-                const error = status === 'uncertain' ? 'Delivery unconfirmed after the previous worker stopped. Inspect activity before continuing.' : status === 'failed' ? (turn?.failureReason ?? 'The saved turn failed.') : null;
+                const error = status === 'uncertain' ? 'Delivery unconfirmed after the previous worker stopped. Inspect activity before continuing.' : status === 'failed' ? savedFailure(turn?.failureReason) : null;
                 this.db.prepare('UPDATE team_message SET status=?,generation=generation+1,revision=revision+1,error=? WHERE message=?').run(status, error, Number(row['message']));
                 this.event(String(row['lead']), String(row['conversation']), status === 'uncertain' ? 'delivery-unconfirmed' : 'message-reconciled', String(row['author']), now);
             }

package/dist/team-runtime.js

@@ -166,9 +166,10 @@ export function createTeamRuntime(options) {
                 const state = admission(claim.actor, claim.conversationId);
                 if (domain.defer(claim, result.message, clock()))
                     waiting.set(claim.messageId, state.stamp);
+                // A turn that saved its outcome in the thread (stopped at its deadline) is said there, not again on the message.
             }
             else
-                domain.finish(claim, { status: 'unknownSpend' in result && result.unknownSpend ? 'uncertain' : 'failed', error: result.message, ...('turn' in result ? { turnId: result.turn } : {}) }, clock());
+                domain.finish(claim, { status: 'unknownSpend' in result && result.unknownSpend ? 'uncertain' : 'failed', ...('saved' in result && result.saved ? {} : { error: result.message }), ...('turn' in result ? { turnId: result.turn } : {}) }, clock());
         }
         catch {
             // An exception may have followed native admission. Preserve an explicit

package/dist/test-temp.d.ts

@@ -1,5 +1,13 @@
+/** In a suite's temp root: who made it (scripts/suite-lifecycle.mjs). */
+export declare const OWNER_FILE = ".toolroll-temp-owner";
+export type TempOwner = {
+    pid: number;
+    startedAt: number;
+};
 /** Name prefixes of what tests, journeys and scripts leave in the temp folder. */
 export declare const TEST_TEMP_PREFIXES: readonly string[];
+/** Who made a temp root, from its owner file; null when it has none (older suites, scripts, Playwright). */
+export declare function tempOwner(path: string): TempOwner | null;
 export declare function isTestTemp(name: string): boolean;
 /** Where they collect: the temp folder (and /tmp, where some scripts write). */
 export declare function tempRoots(): string[];
@@ -12,8 +20,18 @@ export declare function testTempFolders(roots: readonly string[], now: Date): {
     all: TempLeftover[];
     stale: TempLeftover[];
 };
-/** Remove the test temp folders nothing has touched for a day; each is looked at again right before it goes. */
-export declare function removeStaleTestTemp(roots: readonly string[], now: Date): {
+export type RemoveOptions = {
+    /** Whether a temp root's owner (by its owner file) is still running: its root stays, however old it looks. */
+    ownerAlive?: (owner: TempOwner) => boolean;
+    /** At most this many go in one pass (a sweep after weeks can find 100,000); `more` says some were left. */
+    max?: number;
+};
+/**
+ * Remove the test temp folders nothing has touched for a day; each is looked at again right before it goes (still a
+ * folder of its own, not a link, still directly in its temp folder, still a day untouched, its owner gone).
+ */
+export declare function removeStaleTestTemp(roots: readonly string[], now: Date, options?: RemoveOptions): {
     removed: string[];
     failed: string[];
+    more: boolean;
 };

package/dist/test-temp.js

@@ -1,16 +1,20 @@
 /**
- * Test temp folders (`toolroll storage`, `storage clean`): what the unit tests, journeys and scripts make in the
- * system temp folder. The tests delete their own (each run gets one temp root that its global teardown removes:
- * test/temp-root.ts); a run that was killed, and older versions, leave folders behind. `toolroll storage` counts them
- * and `storage clean` removes the ones nothing has touched for a day.
+ * Test temp folders (`toolroll storage`, `storage clean`, the plane's daily storage sweep): what the unit tests,
+ * journeys and scripts make in the system temp folder. The suites delete their own on pass, failure, timeout and
+ * interrupt (scripts/suite-lifecycle.mjs, test/temp-root.ts); a run killed outright, a proof that keeps its output and
+ * older versions leave folders behind. `toolroll storage` counts them; the daily sweep (storage-sweep.ts) and
+ * `storage clean` remove the ones nothing has touched for a day, never one whose owner is still running.
  *
  * Every prefix the tests and scripts give tmpdir() is covered here (test-temp.test.ts reads the sources to keep it
  * so), and Playwright's own browser profiles.
  */
-import { lstatSync, readdirSync, rmSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { lstatSync, readFileSync, readdirSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { dirname, join, resolve } from "node:path";
 const DAY_MS = 86_400_000;
+/** In a suite's temp root: who made it (scripts/suite-lifecycle.mjs). */
+export const OWNER_FILE = ".toolroll-temp-owner";
 /** Name prefixes of what tests, journeys and scripts leave in the temp folder. */
 export const TEST_TEMP_PREFIXES = [
     "so-", "standing-orders-", "toolroll-", "no-wt", "epoch", "cancel-floor",
@@ -18,10 +22,21 @@ export const TEST_TEMP_PREFIXES = [
     "flow-goal-", "flow-scratch", "flows-chat-", "invoke-attest-", "knowledge-test-", "learning-", "peek-", "phone-origin-",
     "proposal-repo-", "race-", "refresh-migration-", "refresh-refusal-", "release-check-", "shared-chat-", "skills-test-",
     "task-status-surfaces-", "template-repo-", "template-test-", "v14-migrate-", "v17-migrate-", "watch-anchor-",
-    "needs-you-", "deps-lock-", "deps-state-", "upgrade-fresh-", "upgrade-path-", "deploy-restore-", "result-review-", "one-result-page-", "deploy-before-swap-", "one-vocabulary-", "accept-finishes-", "lead-promises-", "lead-people-", "sizing-repo-",
+    "needs-you-", "deps-lock-", "deps-state-", "upgrade-fresh-", "upgrade-path-", "deploy-restore-", "result-review-", "one-result-page-", "deploy-before-swap-", "one-vocabulary-", "accept-finishes-", "lead-promises-", "lead-people-", "sizing-repo-", "batch-checks-", "deps-identity-",
     // Playwright's browser profiles and artifacts.
     "playwright_chromiumdev_profile-", "playwright_firefoxdev_profile-", "playwright-artifacts-",
 ];
+/** Who made a temp root, from its owner file; null when it has none (older suites, scripts, Playwright). */
+export function tempOwner(path) {
+    try {
+        const parsed = JSON.parse(readFileSync(join(path, OWNER_FILE), "utf8"));
+        const startedAt = typeof parsed.startedAt === "string" ? Date.parse(parsed.startedAt) : NaN;
+        return Number.isSafeInteger(parsed.pid) && Number(parsed.pid) > 1 && Number.isFinite(startedAt) ? { pid: Number(parsed.pid), startedAt } : null;
+    }
+    catch {
+        return null;
+    }
+}
 export function isTestTemp(name) {
     return TEST_TEMP_PREFIXES.some(prefix => name.startsWith(prefix));
 }
@@ -79,20 +94,45 @@ export function testTempFolders(roots, now) {
     }
     return { all, stale: all.filter(one => now.getTime() - one.touchedAt > DAY_MS) };
 }
-/** Remove the test temp folders nothing has touched for a day; each is looked at again right before it goes. */
-export function removeStaleTestTemp(roots, now) {
+/**
+ * Remove the test temp folders nothing has touched for a day; each is looked at again right before it goes (still a
+ * folder of its own, not a link, still directly in its temp folder, still a day untouched, its owner gone).
+ */
+export function removeStaleTestTemp(roots, now, options = {}) {
     const removed = [];
     const failed = [];
-    for (const one of testTempFolders(roots, now).stale) {
+    const stale = testTempFolders(roots, now).stale;
+    const max = options.max ?? Infinity;
+    const inside = new Set(roots.map(root => resolve(root)));
+    for (const one of stale) {
+        if (removed.length + failed.length >= max)
+            return { removed, failed, more: true };
         try {
-            if (now.getTime() - (lstatSync(one.path).isDirectory() ? touchedAt(one.path) : lstatSync(one.path).mtimeMs) <= DAY_MS)
+            const stat = lstatSync(one.path);
+            if (stat.isSymbolicLink() || !inside.has(resolve(dirname(one.path))))
+                continue;
+            if (now.getTime() - (stat.isDirectory() ? touchedAt(one.path) : stat.mtimeMs) <= DAY_MS)
+                continue;
+            const owner = stat.isDirectory() ? tempOwner(one.path) : null;
+            if (owner !== null && (options.ownerAlive ?? (() => false))(owner))
                 continue;
-            rmSync(one.path, { recursive: true, force: true, maxRetries: 3 });
+            removeTree(one.path);
             removed.push(one.path);
         }
         catch {
             failed.push(one.path);
         }
     }
-    return { removed, failed };
+    return { removed, failed, more: false };
+}
+/** rm -r; a tree a test made read-only (a shared dependency copy, a locked fixture) is made writable first. */
+function removeTree(path) {
+    try {
+        rmSync(path, { recursive: true, force: true, maxRetries: 3 });
+        return;
+    }
+    catch { /* read-only inside */ }
+    if (process.platform !== "win32")
+        spawnSync("chmod", ["-R", "u+w", path], { timeout: 120_000 });
+    rmSync(path, { recursive: true, force: true, maxRetries: 3 });
 }

package/dist/toolroll-update.js

@@ -36,6 +36,7 @@ import { assertCodingUpdateStopped, backupCodingCatalog, codingCatalogExists, re
 import { installLaunchdService, launchdPlist, stopLaunchdService, writeFileDurably } from "./daemon.js";
 import { NAME } from "./names.js";
 import { isNewer, REGISTRY } from "./releases.js";
+import { markNeverIndex } from "./never-index.js";
 /** Loaded on first use (as backup.ts and store.ts do), so modules that only import this one (the console,
  * and tests that load it in a browser-like environment) never need `node:sqlite` itself. */
 function sqlite() {
@@ -699,6 +700,7 @@ function newJournal(kind, o, now) {
     const id = randomUUID(), stageDir = join(resolve(o.stateDir), "staged-upgrades", `${kind === "update" ? "release" : "rollback"}-${o.to.version}-${id.slice(0, 8)}`);
     mkdirSync(stageDir, { recursive: true, mode: 0o700 });
     chmodSync(stageDir, 0o700);
+    markNeverIndex(dirname(stageDir));
     return { version: 1, id, kind, stateDir: resolve(o.stateDir), databaseFile: o.databaseFile, stageDir, from: o.from, to: o.to, when: o.when, at: o.at, actor: o.actor, phase: "scheduled", detail: "", steps: [], startedAt: now.toISOString(), updatedAt: now.toISOString() };
 }
 function assertNoneActive(stateDir) {

package/dist/workspace-ui.js

@@ -371,7 +371,9 @@ function sentenceOf(text) {
  * the saved log. Null when the log printed nothing. */
 export function lastErrorLineOf(log) {
     const lines = log.split("\n");
-    const printed = (text) => text.trim() !== "" && !/^\$ /.test(text) && !/^\(exit -?[0-9]+\)$/.test(text.trim()) && !/^--- (stdout|stderr) ---$/.test(text.trim());
+    const printed = (text) => text.trim() !== "" && !/^\$ /.test(text) && !/^\(exit -?[0-9]+\)$/.test(text.trim()) && !/^--- (stdout|stderr) ---$/.test(text.trim())
+        // A section's own header ("=== Project check · attempt 1 ===") is the log's, never the check's output.
+        && !/^=== .* ===$/.test(text.trim());
     const stderr = lines.findIndex(text => text.trim() === "--- stderr ---");
     const pick = (from, to) => {
         let last = null;

package/dist/worktree.js

@@ -31,6 +31,7 @@ import { currentBootId, provenDeadByBootChange } from "./boot-identity.js";
 import { HANDOFF_PREFIX, MAILBOX_SUFFIX, looksLikeProtocolFile, readMailbox } from "./evidence.js";
 import { parseHandoff } from "./decision.js";
 import { diskBytes } from "./storage.js";
+import { markNeverIndex } from "./never-index.js";
 /**
  * The note a lease leaves in the checkout, naming the process holding it.
  *
@@ -337,6 +338,14 @@ export class WorktreePool {
             const branchExists = request.base !== undefined && request.reuseBranch === true &&
                 (await this.git(request.repo, ["rev-parse", "--verify", "--quiet", `refs/heads/${request.branch}`], READ_ONLY)).code === 0;
             const fromBase = request.base !== undefined && !branchExists;
+            // Spotlight leaves the checkouts alone: the marker sits in the pool and the project's folder, never inside a
+            // checkout, where a build's `git add -A` would commit it (never-index.ts).
+            try {
+                mkdirSync(dirname(path), { recursive: true });
+            }
+            catch { /* git reports it */ }
+            markNeverIndex(this.options.root);
+            markNeverIndex(dirname(path));
             const add = await this.git(request.repo, [
                 "worktree",
                 "add",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.9.30",
+  "version": "0.9.32",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"