toolroll 0.9.33 → 0.9.34

package/dist/contracts/contract.js

@@ -0,0 +1,181 @@
+/**
+ * The one way Toolroll describes a contract (docs/plans/zod-revamp.md): one Zod schema, and everything else — the
+ * TypeScript type, the runtime check, the JSON Schema a model gets, the text limits — derived from it.
+ *
+ * The helpers here hold the ground rules every contract shares: limits come from TEXT_LIMITS, persisted payloads are
+ * versioned, refusals name the path, and a model-facing schema is exactly what its JSON Schema says (no refinements or
+ * transforms; those checks run in plain code after parsing, with a named error).
+ */
+import { z } from "zod";
+import { limitRule, TEXT_LIMITS } from "../text-limits.js";
+/**
+ * A string bounded by its TEXT_LIMITS entry, never a literal. The limit rule rides along as the field's description,
+ * so a model reads the bound before it writes. Zod counts UTF-16 code units; for a limit named in bytes this is the
+ * schema's necessary bound (a string within N bytes is within N code units), and the byte count itself is checked in
+ * plain code after parsing.
+ */
+export function limited(field, limitKey) {
+    const limit = TEXT_LIMITS[limitKey];
+    const unit = limitKey.endsWith("Bytes") ? "bytes" : "characters";
+    return z.string().max(limit, { error: `over ${limit.toLocaleString("en-US")} ${unit}` }).describe(limitRule(field, limit, unit));
+}
+/** A versioned payload envelope: a strict object whose `version` is exactly `version`. */
+export function versioned(version, shape) {
+    return z.strictObject({ version: z.literal(version), ...shape });
+}
+/** `["steps", 0, "routes", 0, "goesTo"]` as `steps[0].routes[0].goesTo`. */
+export function pathOf(path) {
+    let out = "";
+    for (const part of path) {
+        if (typeof part === "number")
+            out += `[${part}]`;
+        else
+            out += out === "" ? String(part) : `.${String(part)}`;
+    }
+    return out === "" ? "payload" : out;
+}
+function got(input) {
+    if (input === null)
+        return "null";
+    if (Array.isArray(input))
+        return "an array";
+    return typeof input === "object" ? "an object" : `a ${typeof input}`;
+}
+function issuesOf(issue) {
+    const at = pathOf(issue.path);
+    const one = (kind, what) => ({ path: at, kind, line: `${at}: ${what}` });
+    switch (issue.code) {
+        case "unrecognized_keys":
+            return issue.keys.map(key => ({ path: at, kind: "unknown-key", line: `${at}: unknown key '${key}'` }));
+        case "invalid_type": {
+            const missing = "input" in issue ? issue.input === undefined : / received undefined$/.test(issue.message);
+            if (missing)
+                return [one("required", "required")];
+            return [one("wrong-type", `must be ${issue.expected === "array" ? "an array" : issue.expected === "object" ? "an object" : `a ${issue.expected}`}${"input" in issue ? ` (got ${got(issue.input)})` : ""}`)];
+        }
+        case "too_big":
+            if (issue.origin === "array" || issue.origin === "set")
+                return [one("too-many", `at most ${String(issue.maximum)} items`)];
+            return [one("too-long", issue.origin === "string" && issue.message.startsWith("over ") ? issue.message : `at most ${String(issue.maximum)}${issue.origin === "string" ? " characters" : ""}`)];
+        case "too_small":
+            if (issue.origin === "string" && Number(issue.minimum) === 1)
+                return [one("empty", "must not be empty")];
+            if (issue.origin === "array" || issue.origin === "set")
+                return [one("too-few", `at least ${String(issue.minimum)} item${Number(issue.minimum) === 1 ? "" : "s"}`)];
+            return [one("too-few", `at least ${String(issue.minimum)}`)];
+        case "invalid_value":
+            return [one("bad-value", `must be ${issue.values.length === 1 ? JSON.stringify(issue.values[0]) : `one of ${issue.values.map(value => JSON.stringify(value)).join(", ")}`}`)];
+        case "invalid_union":
+            return [one("invalid", "does not match any allowed shape")];
+        default:
+            return [one("invalid", issue.message)];
+    }
+}
+/** A Zod error as path-named issues, in the error's own order. */
+export function contractIssues(error) {
+    return error.issues.flatMap(issuesOf);
+}
+/** A Zod error as path-named lines: `steps[0].routes[0].goesTo: required`, `routes[0]: unknown key 'to'`. */
+export function contractError(error) {
+    return contractIssues(error).map(issue => issue.line);
+}
+/** Parse with the input reported, so a missing field reads `required` rather than a wrong type. */
+export function parseContract(schema, input) {
+    const parsed = schema.safeParse(input, { reportInput: true });
+    return parsed.success ? { ok: true, value: parsed.data } : { ok: false, issues: contractIssues(parsed.error) };
+}
+/**
+ * Read a versioned payload. The current version parses as itself; an older known version (0 for a payload saved
+ * before it carried `version`) is upgraded by its adapter and then parsed by the same schema; a newer version is
+ * refused plainly; anything else is an unknown version.
+ */
+export function readVersioned(schema, input, upgrades = {}) {
+    const current = schema.shape.version.value;
+    if (typeof input !== "object" || input === null || Array.isArray(input)) {
+        return { ok: false, issues: [{ path: "payload", kind: "wrong-type", line: `payload: must be an object (got ${got(input)})` }] };
+    }
+    const body = input;
+    const version = Object.prototype.hasOwnProperty.call(body, "version") ? body["version"] : 0;
+    if (version === current)
+        return parseContract(schema, body);
+    if (typeof version === "number" && Number.isInteger(version) && version > current) {
+        return { ok: false, issues: [{ path: "version", kind: "newer-version", line: `version: made by a newer Toolroll (version ${version}; this one reads up to ${current})` }] };
+    }
+    const upgrade = typeof version === "number" ? upgrades[version] : undefined;
+    if (upgrade === undefined) {
+        return { ok: false, issues: [{ path: "version", kind: "bad-value", line: `version: unknown version ${JSON.stringify(version)} (this Toolroll reads ${current}${Object.keys(upgrades).length === 0 ? "" : ` and ${Object.keys(upgrades).join(", ")}`})` }] };
+    }
+    return parseContract(schema, upgrade(body));
+}
+/** The Zod node kinds a model-facing schema may use: each says exactly what its JSON Schema says. */
+const MODEL_FACING_TYPES = new Set(["string", "number", "int", "boolean", "null", "literal", "enum", "array", "object", "optional", "nullable", "union", "tuple", "record", "lazy", "readonly", "unknown", "any"]);
+/** Checks that only constrain (never rewrite) and that JSON Schema can state. */
+const MODEL_FACING_CHECKS = new Set(["max_length", "min_length", "length_equals", "greater_than", "less_than", "multiple_of", "number_format", "string_format", "size_equals", "max_size", "min_size"]);
+/** Every node of a schema graph, refusing a refinement, transform, preprocess or unknown node by its schema path. */
+function assertModelFacing(schema, at, seen) {
+    if (seen.has(schema))
+        return;
+    seen.add(schema);
+    const def = schema._zod.def;
+    const where = at === "" ? "the schema" : at;
+    if (def.type === "pipe") {
+        const into = def["in"]?._zod.def.type;
+        const out = def["out"]?._zod.def.type;
+        const what = into === "transform" ? "preprocess" : out === "transform" ? "transform" : "pipe";
+        throw new Error(`toModelSchema: ${where} uses ${what}; a model-facing schema must be JSON-Schema-exact — check it in plain code after parsing`);
+    }
+    if (def.type === "transform")
+        throw new Error(`toModelSchema: ${where} uses transform; a model-facing schema must be JSON-Schema-exact — check it in plain code after parsing`);
+    if (!MODEL_FACING_TYPES.has(def.type))
+        throw new Error(`toModelSchema: ${where} uses a ${def.type} node, which a model-facing schema may not use`);
+    for (const check of def.checks ?? []) {
+        const kind = check._zod.def.check;
+        if (kind === "custom")
+            throw new Error(`toModelSchema: ${where} uses refine or superRefine; a model-facing schema must be JSON-Schema-exact — check it in plain code after parsing`);
+        if (!MODEL_FACING_CHECKS.has(kind))
+            throw new Error(`toModelSchema: ${where} uses a ${kind} check, which rewrites or cannot be stated in JSON Schema`);
+    }
+    const child = (value, path) => assertModelFacing(value, path, seen);
+    const join = (key) => (at === "" ? key : `${at}.${key}`);
+    switch (def.type) {
+        case "object":
+            for (const [key, value] of Object.entries(def["shape"]))
+                child(value, join(key));
+            // A strict object's catchall is `never` (additionalProperties: false); any other catchall is a schema too.
+            if (def["catchall"] !== undefined && def["catchall"]._zod.def.type !== "never")
+                child(def["catchall"], join("*"));
+            break;
+        case "array":
+            child(def["element"], `${at}[]`);
+            break;
+        case "optional":
+        case "nullable":
+        case "readonly":
+            child(def["innerType"], at);
+            break;
+        case "union":
+            def["options"].forEach((option, index) => child(option, `${at}|${index}`));
+            break;
+        case "tuple":
+            def["items"].forEach((item, index) => child(item, `${at}[${index}]`));
+            if (def["rest"] !== undefined && def["rest"] !== null)
+                child(def["rest"], `${at}[]`);
+            break;
+        case "record":
+            child(def["keyType"], `${at}{key}`);
+            child(def["valueType"], `${at}{}`);
+            break;
+        case "lazy":
+            child(def["getter"](), at);
+            break;
+    }
+}
+/**
+ * The JSON Schema a model gets for `schema` (Claude's `--json-schema`). Throws when the schema uses refine,
+ * superRefine, transform or preprocess anywhere: what a model is told must be everything the schema checks.
+ */
+export function toModelSchema(schema) {
+    assertModelFacing(schema, "", new Set());
+    const { $schema: _dialect, ...json } = z.toJSONSchema(schema, { target: "draft-2020-12", unrepresentable: "throw" });
+    return json;
+}

package/dist/contracts/plan.d.ts

@@ -0,0 +1,58 @@
+/**
+ * The planner's handoff: one schema for the file a planner writes, the JSON Schema it is given (`--json-schema`) and
+ * the parser that reads it back (`parsePlan` in plan.ts). The rules JSON Schema cannot state — the plan document's
+ * sections, UTF-8 byte limits, control characters, duplicate criterion ids, the Proof naming every criterion and the
+ * silent-amendment contract check — run in plain code after parsing, each with a named error.
+ */
+import { z } from "zod";
+import { type ContractResult } from "./contract.js";
+/** How many paths a plan may say it touches. */
+export declare const PLAN_TOUCHES = 32;
+/** One acceptance criterion: the scope's own shape (scope.ts `AcceptanceCriterion`), `how` advisory and unsigned. */
+export declare const acceptanceCriterionSchema: z.ZodObject<{
+    id: z.ZodString;
+    statement: z.ZodString;
+    how: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    evidence: z.ZodArray<z.ZodEnum<{
+        "changed-path": "changed-path";
+        check: "check";
+        "manual-review": "manual-review";
+        screenshot: "screenshot";
+    }>>;
+}, z.core.$strict>;
+export declare const PLAN_VERSION = 1;
+export declare const planSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    goal: z.ZodString;
+    outOfScope: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    touches: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    acceptance: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        statement: z.ZodString;
+        how: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        evidence: z.ZodArray<z.ZodEnum<{
+            "changed-path": "changed-path";
+            check: "check";
+            "manual-review": "manual-review";
+            screenshot: "screenshot";
+        }>>;
+    }, z.core.$strict>>;
+    plan: z.ZodString;
+    amendment: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strict>;
+export type PlanPayload = z.infer<typeof planSchema>;
+/** What the planner's `--json-schema` is: the plan schema, exactly. */
+export declare const PLAN_MODEL_SCHEMA: Readonly<Record<string, unknown>>;
+/**
+ * A plan written before plans carried `version` (every plan through 0.9.33), as version 1. The old parser read only
+ * the fields it knew and ignored any others, read a null goal, plan or acceptance as missing and null touches as
+ * none; this keeps exactly that, so every plan that parsed then parses now. Values themselves are never rewritten.
+ */
+export declare function upgradeUnversionedPlan(body: Record<string, unknown>): Record<string, unknown>;
+export declare const PLAN_UPGRADES: {
+    readonly 0: typeof upgradeUnversionedPlan;
+};
+/** The payload as version 1, upgraded when it was saved unversioned; null for anything that is not an object. */
+export declare function planPayloadBody(input: unknown): Record<string, unknown> | null;
+/** Read a plan payload: version 1 as itself, an unversioned one upgraded, a newer one refused plainly. */
+export declare function readPlanPayload(input: unknown): ContractResult<PlanPayload>;

package/dist/contracts/plan.js

@@ -0,0 +1,67 @@
+/**
+ * The planner's handoff: one schema for the file a planner writes, the JSON Schema it is given (`--json-schema`) and
+ * the parser that reads it back (`parsePlan` in plan.ts). The rules JSON Schema cannot state — the plan document's
+ * sections, UTF-8 byte limits, control characters, duplicate criterion ids, the Proof naming every criterion and the
+ * silent-amendment contract check — run in plain code after parsing, each with a named error.
+ */
+import { z } from "zod";
+import { ACCEPTANCE_LIMITS, EVIDENCE_KINDS } from "../scope.js";
+import { limited, readVersioned, toModelSchema, versioned } from "./contract.js";
+/** How many paths a plan may say it touches. */
+export const PLAN_TOUCHES = 32;
+/** One acceptance criterion: the scope's own shape (scope.ts `AcceptanceCriterion`), `how` advisory and unsigned. */
+export const acceptanceCriterionSchema = z.strictObject({
+    id: limited("acceptance id", "acceptanceIdBytes").min(1),
+    statement: limited("acceptance statement", "acceptanceStatementBytes").min(1),
+    how: limited("acceptance how", "acceptanceHowBytes").nullable().optional(),
+    evidence: z.array(z.enum(EVIDENCE_KINDS)).min(1).max(EVIDENCE_KINDS.length),
+});
+export const PLAN_VERSION = 1;
+export const planSchema = versioned(PLAN_VERSION, {
+    goal: limited("goal", "goal").min(1),
+    outOfScope: limited("outOfScope", "goal").nullable().optional(),
+    touches: z.array(limited("touch", "planTouch").min(1)).max(PLAN_TOUCHES).optional(),
+    acceptance: z.array(acceptanceCriterionSchema).min(1).max(ACCEPTANCE_LIMITS.criteria),
+    plan: limited("plan", "planDocumentBytes").min(1),
+    amendment: limited("amendment", "planAmendment").nullable().optional(),
+});
+/** What the planner's `--json-schema` is: the plan schema, exactly. */
+export const PLAN_MODEL_SCHEMA = toModelSchema(planSchema);
+const PLAN_FIELDS = ["goal", "outOfScope", "touches", "acceptance", "plan", "amendment"];
+const CRITERION_FIELDS = ["id", "statement", "how", "evidence"];
+function pick(body, fields) {
+    const out = {};
+    for (const field of fields) {
+        if (Object.prototype.hasOwnProperty.call(body, field) && body[field] !== undefined)
+            out[field] = body[field];
+    }
+    return out;
+}
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/**
+ * A plan written before plans carried `version` (every plan through 0.9.33), as version 1. The old parser read only
+ * the fields it knew and ignored any others, read a null goal, plan or acceptance as missing and null touches as
+ * none; this keeps exactly that, so every plan that parsed then parses now. Values themselves are never rewritten.
+ */
+export function upgradeUnversionedPlan(body) {
+    const out = { version: PLAN_VERSION, ...pick(body, PLAN_FIELDS) };
+    for (const field of ["goal", "plan", "touches", "acceptance"]) {
+        if (out[field] === null)
+            delete out[field];
+    }
+    if (Array.isArray(out["acceptance"])) {
+        out["acceptance"] = out["acceptance"].map(criterion => (isRecord(criterion) ? pick(criterion, CRITERION_FIELDS) : criterion));
+    }
+    return out;
+}
+export const PLAN_UPGRADES = { 0: upgradeUnversionedPlan };
+/** The payload as version 1, upgraded when it was saved unversioned; null for anything that is not an object. */
+export function planPayloadBody(input) {
+    if (!isRecord(input))
+        return null;
+    return Object.prototype.hasOwnProperty.call(input, "version") ? input : upgradeUnversionedPlan(input);
+}
+/** Read a plan payload: version 1 as itself, an unversioned one upgraded, a newer one refused plainly. */
+export function readPlanPayload(input) {
+    return readVersioned(planSchema, input, PLAN_UPGRADES);
+}

package/dist/desktop-update.d.ts

@@ -125,13 +125,13 @@ export declare function prepareDesktopUpdate(stateDir: string, installed: string
 export declare function sqliteLock(file: string, busyTimeoutMs?: number): DatabaseSync | null;
 export declare const installationLock: (j: UpdateJournal) => DatabaseSync | null;
 export declare function desktopUpdateStatus(stateDir: string): {
+    error?: never;
     active: boolean;
     phase: string;
     detail: string;
     running: boolean;
     canResume: boolean;
     canCancel: boolean;
-    error?: never;
     automaticRecovery?: never;
     recoveryAttempts?: never;
     recoveryRepairs?: never;

package/dist/evidence.js

@@ -18,7 +18,7 @@ import { closeSync, existsSync, constants, fstatSync, mkdirSync, openSync, readd
 import { join, sep } from "node:path";
 import { namedPath } from "./names.js";
 import { LIMITS } from "./decision.js";
-import { PLAN_LIMITS } from "./plan.js";
+import { TEXT_LIMITS } from "./text-limits.js";
 import { parseReport, REPORT_LIMITS } from "./scout-report.js";
 import { parseProof, PROOF_LIMITS } from "./proof.js";
 import { encodeBaseTreeSnapshot, parseBaseTreeSnapshot } from "./peek.js";
@@ -84,7 +84,7 @@ export const EVIDENCE_CAPS = {
     diff: 256 * 1024,
     status: 64 * 1024,
     "park-payload": LIMITS.payload,
-    plan: PLAN_LIMITS.document,
+    plan: TEXT_LIMITS.planDocumentBytes,
     "terminal-diff": 256 * 1024,
     "diff-stat": 32 * 1024,
     // The enveloped base snapshot (live peek): 20k entries of path+sha+size.

package/dist/operate.js

@@ -93,6 +93,7 @@ import { pushPass } from "./push.js";
 import { chmodSync, closeSync, constants as fsConstants, existsSync, fstatSync, fsyncSync, openSync, readFileSync, readSync, realpathSync, renameSync, unlinkSync, writeSync, writeFileSync, mkdirSync } from "node:fs";
 import { BRANCH_PREFIX, envTwins, envValue, existingOrFirst, namedPath, taskBranches } from "./names.js";
 import { claimActor, currentActor, parseLeadToken, withActor } from "./actor.js";
+import { admissionRecorded, admitProject, commandLineActor } from "./project-admission.js";
 import { leadClaim, leadSay, noteLeadWork } from "./lead-voice.js";
 import { createServer as createNetServer } from "node:net";
 import { spawn as spawnChild } from "node:child_process";
@@ -162,7 +163,7 @@ import { attendedLivenessState } from "./liveness.js";
 import { HeldSessionCoordinator, sweepHeldOrphans } from "./held.js";
 import { proposeGrant, describeGrant, describeWithheld, permits, MUTATION_CLASSES, DEFAULT_MUTATIONS, } from "./grant.js";
 import { builtIn, guarded } from "./backend.js";
-import { register, authenticate, heartbeat as heartbeatRunner, isAlive, recoverDead, recoveredAnything, acquireWatchLeaseAuthed, heartbeatWatchLeaseAuthed, addRunnerReposAuthed, registerRunnerIfIdle, retireRunnerIfCurrent, normalizeRunnerName, validRunnerName, canonicalRepos, RUNNER_NAME_MAX, RUNNER_CAPACITY_MAX, parseRunnerCapacity, } from "./runner.js";
+import { register, authenticate, heartbeat as heartbeatRunner, isAlive, recoverDead, recoveredAnything, acquireWatchLeaseAuthed, heartbeatWatchLeaseAuthed, addRunnerReposAuthed, removeRunnerRepoAuthed, registerRunnerIfIdle, retireRunnerIfCurrent, normalizeRunnerName, validRunnerName, canonicalRepos, RUNNER_NAME_MAX, RUNNER_CAPACITY_MAX, parseRunnerCapacity, } from "./runner.js";
 import { mintCoordinator, revokeCoordinator, listCoordinators } from "./coordinator.js";
 import { serveMcp } from "./mcp.js";
 import { createInterface } from "node:readline";
@@ -4934,6 +4935,7 @@ async function startConsole(options) {
         ...(options.repos === undefined ? {} : { repos: options.repos }),
         ...(options.projectRoots === undefined ? {} : { projectRoots: options.projectRoots }),
         ...(options.currentRepos === undefined ? {} : { currentRepos: options.currentRepos }),
+        ...(options.admittedRepos === undefined ? {} : { admittedRepos: options.admittedRepos }),
         ...(options.publicUrl === undefined ? {} : { publicUrl: options.publicUrl }),
         ...(options.registryPath === undefined ? {} : { registryPath: options.registryPath }),
         ...(options.upConsole === undefined ? {} : { upConsole: options.upConsole }),
@@ -8360,12 +8362,15 @@ async function onboardCommand(flags, context) {
             return !("error" in registry) && registry.repos.includes(repo);
         },
         enroll: async (repo) => {
+            // The same admission as `repos add` and the console's Add a project.
+            const actor = commandLineActor(store, { databaseFile: context.databaseFile });
+            if ("ok" in actor)
+                return { ok: false, message: actor.message };
             const before = await loadProjectRegistry(registryPath);
-            const enrolled = await updateRepos(registryPath, repos => addRepos(repos, [repo]));
-            if (!enrolled.ok)
-                return { ok: false, message: enrolled.message };
-            store.upsertProject(repo, projectName(repo), clock());
-            return { ok: true, added: "error" in before || !before.repos.includes(repo) };
+            const admitted = await admitProject(store, { registryFile: registryPath, path: repo, actor, now: clock() });
+            if (!admitted.ok)
+                return { ok: false, message: admitted.message };
+            return { ok: true, added: "error" in before || !before.repos.includes(admitted.repo) };
         },
         checkConnection: seams.checkConnection ?? (agent => checker(agent)),
         pullRequests: seams.pullRequests ?? (async (repo) => {
@@ -8495,6 +8500,9 @@ async function upCommand(flags, context) {
         }
     }
     const explicitRepos = context.repoList ?? [];
+    // Repositories this start was told to serve stay served while it runs: removing one from the saved list takes
+    // effect at the next start, never under the process that was pinned to it.
+    const pinnedRepos = new Set();
     if (explicitRepos.length > 0) {
         for (const input of explicitRepos) {
             const root = await proveRepo(input);
@@ -8503,12 +8511,15 @@ async function upCommand(flags, context) {
             }
             if (!repos.includes(root))
                 repos.push(root);
+            pinnedRepos.add(root);
         }
     }
     else if (context.inferProjectFromCwd !== false) {
         const cwdRepo = await proveRepo(process.cwd());
         if (cwdRepo !== null && !repos.includes(cwdRepo))
             repos.push(cwdRepo);
+        if (cwdRepo !== null)
+            pinnedRepos.add(cwdRepo);
     }
     if (repos.length === 0 && projectRoots.length === 0) {
         return fail(write, json, "up", "no-projects", "choose where your projects live once: `toolroll up --project-root <dir>`", EXIT.refused);
@@ -8660,6 +8671,7 @@ async function upCommand(flags, context) {
             poolRoot: pool,
             repos,
             currentRepos: () => [...activeRepos],
+            admittedRepos: () => [...activeRepos],
             upConsole: true,
             attended: {
                 runner: runnerName,
@@ -8752,6 +8764,8 @@ async function upCommand(flags, context) {
     // One record of project passes for the whole service: fair scheduling
     // across its projects (project-concurrency.ts).
     const projectPasses = new ProjectPasses();
+    // Projects removed while running: each one's watch stops admitting work, finishes what it holds, then lets go.
+    const releasedRepos = new Set();
     const launchRepo = async (repo, bind) => {
         if (loopResults.has(repo) || stopping)
             return;
@@ -8776,7 +8790,7 @@ async function upCommand(flags, context) {
             token: runnerToken,
             repo,
             progress: line => progress(`${prefix(repo)}${line}`),
-            isStopping: () => stopping,
+            isStopping: () => stopping || releasedRepos.has(repo),
             onFollowController: controller => followControllers.push(controller),
             containmentLines,
             passes: projectPasses,
@@ -8789,6 +8803,19 @@ async function upCommand(flags, context) {
         }).then(result => ({ repo, result }), error => ({ repo, result: { ok: false, reason: "loop-failed", detail: describe(error), ticks: 0, built: 0, broke: 0 } }));
         loopResults.set(repo, loop);
         void loop.then(({ repo: endedRepo, result }) => {
+            if (releasedRepos.has(endedRepo) && !stopping) {
+                // A removed project's watch has stopped: only now does the builder let go of it.
+                const unbound = removeRunnerRepoAuthed(store, { name: runnerName, token: runnerToken, repo: endedRepo }, clock());
+                if (!unbound.ok) {
+                    fatal = `the builder identity changed while removing ${endedRepo} (${unbound.reason})`;
+                    stop();
+                }
+                loopResults.delete(endedRepo);
+                releasedRepos.delete(endedRepo);
+                progress(`project removed — ${projectName(endedRepo)} is no longer built here`);
+                markReady();
+                return;
+            }
             // A loop that dies while its siblings live must not leave a partial
             // cockpit standing silently (finding 5).
             if (!result.ok && !stopping) {
@@ -8842,19 +8869,34 @@ async function upCommand(flags, context) {
                 stop();
                 break;
             }
+            // Removed from the saved list: stop building it and take it out of the console. A pinned start keeps its own.
+            const saved = new Set(loaded.repos.map(one => canonicalProject(one) ?? one));
+            for (const repo of [...activeRepos]) {
+                if (stopping || pinnedRepos.has(repo) || saved.has(repo))
+                    continue;
+                activeRepos.delete(repo);
+                releasedRepos.add(repo);
+                if (!loopResults.has(repo))
+                    releasedRepos.delete(repo);
+            }
             for (const candidate of loaded.repos) {
                 if (stopping)
                     break;
                 const canonical = canonicalProject(candidate);
-                if (canonical !== null && activeRepos.has(canonical))
+                // Still letting go of an earlier removal: it rejoins on the next pass after its watch has stopped.
+                if (canonical !== null && (activeRepos.has(canonical) || releasedRepos.has(canonical)))
                     continue;
                 const approvedAdditions = context.additionalProjectRepos?.() ?? [];
                 const admittedCeiling = resolveCeiling([...dynamicCeiling.repos, ...approvedAdditions], dynamicCeiling.roots).ceiling;
-                const allowed = canonical !== null && (await authorizedProject(admittedCeiling, canonical)) && (await proveRepo(canonical)) === canonical;
+                // A project added after this start (`repos add`, the lead, the console) carries its recorded admission; a
+                // registry line alone is not authority. Either way the folder is proved to be that Git checkout again.
+                const allowed = canonical !== null &&
+                    ((await authorizedProject(admittedCeiling, canonical)) || admissionRecorded(store, canonical)) &&
+                    (await proveRepo(canonical)) === canonical;
                 if (!allowed) {
                     if (!rejected.has(candidate)) {
                         rejected.add(candidate);
-                        progress(`project not connected — ${candidate} is not a Git repository inside a saved projects folder`);
+                        progress(`project not connected — ${candidate} isn't a Git repository added with \`toolroll repos add\` or the console`);
                     }
                     continue;
                 }

package/dist/plan.d.ts

@@ -6,6 +6,7 @@
  * the scope proposal is authority-bearing, so it gets the park discipline).
  */
 import { type AcceptanceCriterion } from "./scope.js";
+import type { ContractIssue } from "./contracts/contract.js";
 export type PlanProblem = {
     reason: string;
     message: string;
@@ -69,18 +70,17 @@ export type PlanParseResult = {
     ok: false;
     problems: PlanProblem[];
 };
-/** Caps matching the scope ritual's fields, plus the document itself. The goal and out-of-scope text share the
- * task's own limit: a plan reproduces the filed contract exactly, so a lower cap here would refuse every plan for a
- * long goal. */
-export declare const PLAN_LIMITS: {
-    readonly payload: number;
-    readonly goal: 8000;
-    readonly outOfScope: 8000;
-    readonly touch: 200;
-    readonly touches: 32;
-    readonly document: number;
-    readonly amendment: 1000;
-};
+/**
+ * A contract issue as a plan problem: the path-named line is the message, and the reason keeps the codes the rest of
+ * the code relies on — `missing-goal`, `bad-touches`, `plan-too-long`, `amendment-too-long`, `acceptance-too-many` —
+ * so repair eligibility (document-only problems) and durable outcomes read the same as before the contract.
+ */
+export declare function planProblemOf(issue: ContractIssue): PlanProblem;
+/**
+ * The planner's handoff, read against the plan contract (src/contracts/plan.ts): fail closed, every problem at once,
+ * each one naming its path (`acceptance[0].evidence[0]: must be one of ...`). A plan saved before plans carried
+ * `version` reads as it always did.
+ */
 export declare function parsePlan(raw: string): PlanParseResult;
 export type MilestoneState = "pending" | "current" | "completed" | "blocked";
 export type Milestone = {