toolroll 0.9.51 → 0.9.52

package/dist/browser-workspace.d.ts

@@ -227,6 +227,7 @@ export type BrowserSettingsView = {
         mode: 'subscription' | 'api-key';
         set: boolean;
     }[] | null;
+    legacyWebhookWarning?: string;
     services: {
         configured: string[];
         channel: string | null;

package/dist/database-reclaim.d.ts

@@ -0,0 +1,4 @@
+import type { Database } from "./store.js";
+/** Reclaim whole free pages on databases created without auto_vacuum. Call only after committing writes.
+ * A migration needs at least 1 MiB to justify the I/O; retention reclaims whenever more than 25% is free. */
+export declare function reclaimDatabase(db: Database, reason: "migration" | "retention"): boolean;

package/dist/database-reclaim.js

@@ -0,0 +1,13 @@
+/** Reclaim whole free pages on databases created without auto_vacuum. Call only after committing writes.
+ * A migration needs at least 1 MiB to justify the I/O; retention reclaims whenever more than 25% is free. */
+export function reclaimDatabase(db, reason) {
+    const free = Number(db.prepare("PRAGMA freelist_count").get()["freelist_count"]);
+    const pages = Number(db.prepare("PRAGMA page_count").get()["page_count"]);
+    const size = Number(db.prepare("PRAGMA page_size").get()["page_size"]);
+    if (reason === "migration" ? free * size < 1024 * 1024 : free * 4 <= pages)
+        return false;
+    db.exec("VACUUM");
+    // VACUUM writes through WAL too: checkpoint so the main file (and its backups) shrinks now.
+    db.exec("PRAGMA wal_checkpoint(TRUNCATE)");
+    return true;
+}

package/dist/demo.d.ts

@@ -8,7 +8,7 @@
  *   - The database is stamped `demo` BEFORE any row exists — an append-only
  *     installation fact with no unset API. Every spending or external-effect
  *     command (tick, watch, build, publish, reconcile, daemon, bridge,
- *     outbox deliver, intake) fails closed on the stamp, so a kept sandbox
+ *     intake) fails closed on the stamp, so a kept sandbox
  *     can never be mistaken for real work by a worker pointed at it later.
  *     The console banner is decoration; the fence is enforcement.
  *   - The seeded history is SYNTHETIC and does not pretend otherwise: runs

package/dist/demo.js

@@ -8,7 +8,7 @@
  *   - The database is stamped `demo` BEFORE any row exists — an append-only
  *     installation fact with no unset API. Every spending or external-effect
  *     command (tick, watch, build, publish, reconcile, daemon, bridge,
- *     outbox deliver, intake) fails closed on the stamp, so a kept sandbox
+ *     intake) fails closed on the stamp, so a kept sandbox
  *     can never be mistaken for real work by a worker pointed at it later.
  *     The console banner is decoration; the fence is enforcement.
  *   - The seeded history is SYNTHETIC and does not pretend otherwise: runs

package/dist/desktop-update.d.ts

@@ -94,13 +94,13 @@ export declare function prepareDesktopUpdate(stateDir: string, installed: string
 export declare function sqliteLock(file: string, busyTimeoutMs?: number): DatabaseSync | null;
 export declare const installationLock: (j: UpdateJournal) => DatabaseSync | null;
 export declare function desktopUpdateStatus(stateDir: string): {
-    error?: never;
     active: boolean;
     phase: string;
     detail: string;
     running: boolean;
     canResume: boolean;
     canCancel: boolean;
+    error?: never;
     automaticRecovery?: never;
     recoveryAttempts?: never;
     recoveryRepairs?: never;

package/dist/live-bus.d.ts

@@ -1,8 +1,8 @@
 /**
  * Live views push on write. Nothing here polls once a second.
  *
- * - The bus. The database's own revision triggers (workspace-revision.ts)
- *   move one counter on every meaningful write. After each in-process
+ * - The bus. Every connection's write wrapper (workspace-revision.ts)
+ *   moves one counter per committed meaningful write. After each in-process
  *   transact() COMMIT, and whenever another process (the worker, the CLI)
  *   writes the database's write-ahead log, the revision is read once; when
  *   it moved, every subscriber hears `{ revision }`. A rolled-back or quiet
@@ -20,7 +20,7 @@
  *   gets one `reload` and ends so its EventSource can reconnect.
  *
  * Transport seam: a future WebSocket (live cursors) subscribes to the same
- * LiveBus beside these SSE rooms; nothing in the Store or the triggers changes.
+ * LiveBus beside these SSE rooms; nothing in the Store or its write wrapper changes.
  */
 import { type FSWatcher } from "node:fs";
 import type { ServerResponse } from "node:http";

package/dist/live-bus.js

@@ -1,8 +1,8 @@
 /**
  * Live views push on write. Nothing here polls once a second.
  *
- * - The bus. The database's own revision triggers (workspace-revision.ts)
- *   move one counter on every meaningful write. After each in-process
+ * - The bus. Every connection's write wrapper (workspace-revision.ts)
+ *   moves one counter per committed meaningful write. After each in-process
  *   transact() COMMIT, and whenever another process (the worker, the CLI)
  *   writes the database's write-ahead log, the revision is read once; when
  *   it moved, every subscriber hears `{ revision }`. A rolled-back or quiet
@@ -20,7 +20,7 @@
  *   gets one `reload` and ends so its EventSource can reconnect.
  *
  * Transport seam: a future WebSocket (live cursors) subscribes to the same
- * LiveBus beside these SSE rooms; nothing in the Store or the triggers changes.
+ * LiveBus beside these SSE rooms; nothing in the Store or its write wrapper changes.
  */
 import { watch } from "node:fs";
 import { WORKSPACE_REVISION_KEY } from "./workspace-revision.js";

package/dist/monitoring.js

@@ -24,6 +24,7 @@ export const SIGNATURE_HEADER = "x-standing-orders-signature";
 const BATCH = 200;
 const LEASE_MS = 60_000;
 const TIMEOUT_MS = 10_000;
+const CHECKPOINT_EVERY_MS = 60 * 60_000;
 /** An audit event: the ledger entry and its seal, as the stream sends it. */
 export function auditEvent(entry, instance) {
     return {
@@ -41,15 +42,34 @@ const nanos = (at) => `${BigInt(Date.parse(at)) * 1000000n}`;
 /** One pass over every destination that's set up. Returns what it sent, per destination. */
 export async function monitoringPass(store, settings, deps) {
     const sent = {};
+    const heads = [];
+    const audit = (delivered) => { if (delivered.head !== null)
+        heads.push(delivered.head); return delivered.count; };
     // A new destination gets the whole audit history; traces start from now.
     if (settings.webhook !== null)
-        sent.webhook = await deliver(store, "webhook", targetOf(settings.webhook.url), () => 0, deps, entries => postSigned(settings.webhook, entries, store, deps));
+        sent.webhook = audit(await deliver(store, "webhook", targetOf(settings.webhook.url), () => 0, deps, entries => postSigned(settings.webhook, entries, store, deps)));
     if (settings.folder !== null)
-        sent.folder = await deliver(store, "folder", targetOf(settings.folder.path), () => 0, deps, async (entries) => { appendFolder(settings.folder.path, entries, deps.instance); return entries.length; });
+        sent.folder = audit(await deliver(store, "folder", targetOf(settings.folder.path), () => 0, deps, async (entries) => { appendFolder(settings.folder.path, entries, deps.instance); return entries.length; }));
     if (settings.traces !== null)
-        sent.traces = await deliver(store, "traces", targetOf(settings.traces.endpoint), () => store.ledgerHeadId(), deps, entries => postTraces(settings.traces, entries, store, deps));
+        sent.traces = (await deliver(store, "traces", targetOf(settings.traces.endpoint), () => store.ledgerHeadId(), deps, entries => postTraces(settings.traces, entries, store, deps))).count;
+    checkpointSent(store, heads, (deps.now ?? (() => new Date()))());
     return sent;
 }
+/** The furthest head the audit stream delivered, kept as an automatic checkpoint once the whole chain verifies.
+ * Automatic checkpoints write no ledger entry, so recording one gives the stream nothing new to send (and checkpoint)
+ * next pass. At most one an hour, so a busy stream neither floods the table nor walks the whole chain every pass. */
+function checkpointSent(store, heads, now) {
+    const head = heads.reduce((best, one) => best === null || (one !== null && one.through > best.through) ? one : best, null);
+    if (head === null)
+        return;
+    const newest = store.ledgerCheckpoints(1)[0];
+    if (newest !== undefined && (newest.through >= head.through || now.getTime() - Date.parse(newest.at) < CHECKPOINT_EVERY_MS))
+        return;
+    try {
+        store.ledgerCheckpoint("system", now, { head });
+    }
+    catch { /* a busy database: the next delivery tries again */ }
+}
 /** A destination's name in its status row: a digest of its address (the address itself may carry a key). */
 export const targetOf = (address) => hex(`standing-orders/monitoring/${address}`, 16);
 /** Send what's due to one destination: hold it, start it over if it now points elsewhere, read after its cursor,
@@ -57,26 +77,30 @@ export const targetOf = (address) => hex(`standing-orders/monitoring/${address}`
 async function deliver(store, sink, target, start, deps, send) {
     const now = deps.now ?? (() => new Date());
     const at = now();
+    const none = { count: 0, head: null };
     if (!store.holdMonitoring(sink, deps.holder, at, new Date(at.getTime() + LEASE_MS)))
-        return 0;
+        return none;
     let status = store.monitoringStatus(sink)[0];
     if (status === undefined || status.target !== target) {
         store.resetMonitoring(sink, target, start());
         status = store.monitoringStatus(sink)[0];
     }
     if (status.nextTryAt != null && Date.parse(status.nextTryAt) > at.getTime())
-        return 0;
+        return none;
     const from = status.through;
     const entries = store.sealedAfter(from, BATCH);
     if (entries.length === 0)
-        return 0;
+        return none;
+    const last = entries[entries.length - 1];
     try {
         const count = await send(entries);
-        return store.monitoringDelivered(sink, deps.holder, target, from, entries[entries.length - 1].id, count, now()) ? count : 0;
+        if (!store.monitoringDelivered(sink, deps.holder, target, from, last.id, count, now()))
+            return none;
+        return { count, head: last.seal === null ? null : { through: last.id, hash: last.seal.hash } };
     }
     catch (error) {
         store.monitoringFailed(sink, deps.holder, target, error instanceof Error ? error.message : String(error), now(), new Date(now().getTime() + backoff(status.failures + 1)));
-        return 0;
+        return none;
     }
 }
 async function post(url, body, headers, deps) {

package/dist/notification-delivery.d.ts

@@ -0,0 +1,19 @@
+import type { Notification, Store } from "./store.js";
+type Claim = Notification & {
+    destination: string;
+    generation: number;
+};
+/** URLs and shell commands can contain secrets. Only a destination hash enters saved receipts. */
+export declare function notificationDestination(kind: string, target: string): string;
+/** One-release compatibility for operator-configured, installation-wide senders. Personal notifications never leave here. */
+export declare function claimNotifications(store: Store, destination: string, owner: string, now: Date): Claim[];
+export declare function finalizeNotification(store: Store, row: Claim, owner: string, outcome: {
+    ok: true;
+    receipt: string | null;
+} | {
+    ok: false;
+    error: string;
+}, now: Date): boolean;
+/** Recheck after earlier network sends: expiry or resolution must stop this send, not just its receipt. */
+export declare function notificationClaimHeld(store: Store, row: Claim, owner: string, now: Date): boolean;
+export {};

package/dist/notification-delivery.js

@@ -0,0 +1,37 @@
+import { createHash } from "node:crypto";
+/** URLs and shell commands can contain secrets. Only a destination hash enters saved receipts. */
+export function notificationDestination(kind, target) {
+    return `${kind}:${createHash("sha256").update(target).digest("hex")}`;
+}
+/** One-release compatibility for operator-configured, installation-wide senders. Personal notifications never leave here. */
+export function claimNotifications(store, destination, owner, now) {
+    return store.transact(() => {
+        const db = store.handle, stamp = now.toISOString();
+        db.prepare(`INSERT OR IGNORE INTO notification_delivery(notification, destination)
+      SELECT id, ? FROM notification WHERE resolved_at IS NULL AND recipient IS NULL`).run(destination);
+        const claims = db.prepare(`SELECT d.notification, d.claim_generation FROM notification_delivery d
+      JOIN notification n ON n.id = d.notification WHERE d.destination = ? AND n.resolved_at IS NULL AND n.recipient IS NULL
+      AND d.delivered_at IS NULL AND (d.receipt IS NULL OR d.receipt NOT LIKE 'skipped:%')
+      AND (d.claim_owner IS NULL OR d.claim_expires_at <= ?) ORDER BY n.id`).all(destination, stamp);
+        return claims.map(raw => {
+            const id = Number(raw["notification"]), generation = Number(raw["claim_generation"]) + 1;
+            db.prepare(`UPDATE notification_delivery SET claim_owner = ?, claim_expires_at = ?, claim_generation = ?
+        WHERE notification = ? AND destination = ?`).run(owner, new Date(now.getTime() + 60_000).toISOString(), generation, id, destination);
+            return { ...store.notificationById(id), destination, generation };
+        });
+    });
+}
+export function finalizeNotification(store, row, owner, outcome, now) {
+    const skipped = outcome.ok && outcome.receipt?.startsWith("skipped:");
+    return Number(store.handle.prepare(`UPDATE notification_delivery SET attempts = attempts + 1, last_attempt_at = ?,
+    delivered_at = ?, receipt = ?, last_error = ?, claim_owner = NULL, claim_expires_at = NULL
+    WHERE notification = ? AND destination = ? AND claim_owner = ? AND claim_generation = ?
+      AND claim_expires_at > ? AND delivered_at IS NULL`).run(now.toISOString(), outcome.ok && !skipped ? now.toISOString() : null, outcome.ok ? outcome.receipt : null, outcome.ok ? null : outcome.error, row.id, row.destination, owner, row.generation, now.toISOString()).changes) === 1;
+}
+/** Recheck after earlier network sends: expiry or resolution must stop this send, not just its receipt. */
+export function notificationClaimHeld(store, row, owner, now) {
+    return store.handle.prepare(`SELECT 1 FROM notification_delivery d JOIN notification n ON n.id = d.notification
+    WHERE d.notification = ? AND d.destination = ? AND d.claim_owner = ? AND d.claim_generation = ?
+    AND d.claim_expires_at > ? AND d.delivered_at IS NULL AND n.resolved_at IS NULL AND n.recipient IS NULL`)
+        .get(row.id, row.destination, owner, row.generation, now.toISOString()) !== undefined;
+}

package/dist/operate-remote-arguments.js

@@ -10,7 +10,7 @@ const args = (positionals = '', values = '', references = {}) => ({
  * digest. Neither dereferences a conversation, task or proposal. Creation IDs are never looked up. */
 export const REMOTE_ARGUMENTS = new Map([
     ...['status', 'ready', 'grants', 'gaps', 'sync', 'runner list', 'coordinator list', 'incident list',
-        'routine list', 'intake show', 'intake run', 'template list', 'webhook status', 'webhook test', 'review show',
+        'routine list', 'intake show', 'intake run', 'template list', 'webhook status', 'review show',
         'chat-approval show', 'chat-approval off'].map(row => [row, args()]),
     ['integrations', args('', 'saved')],
     // --person and --token-name are names compared inside the reader's own view; --token stays a refused credential.

package/dist/operate-remote.js

@@ -46,7 +46,7 @@ export const REMOTE_SCOPES = new Map([
     ...["list", "show", "add", "refresh", "pause", "resume", "run-now"].map(action => [`routine ${action}`, installation]),
     ["config show", installation], ["verify show", repo], ["intake show", installation], ["intake run", installation], ["intake preview", installation],
     ["intake pr-comments", installation], ["template list", installation], ["template show", installation], ["contest show", installation],
-    ["contest exclude", installation], ["webhook status", installation], ["webhook test", installation], ["review show", installation],
+    ["contest exclude", installation], ["webhook status", installation], ["review show", installation],
     ["chat-approval show", self], ["chat-approval off", self],
     // The person's own remote actions, or everyone's within their projects for an approver (remote-audit.ts).
     ["audit", self],
@@ -64,7 +64,7 @@ export const REMOTE_SCOPES = new Map([
 export const REMOTE_ALL_PROJECTS_ONLY = new Map([
     // Settings, connections and acts that belong to the installation as a whole, not to any one project.
     ...["integrations", "grants", "sync", "incident resolve", "routine add", "routine refresh", "routine pause", "routine resume", "routine run-now",
-        "config show", "intake run", "contest exclude", "webhook status", "webhook test"].map(row => [row, "installation-wide"]),
+        "config show", "intake run", "contest exclude", "webhook status"].map(row => [row, "installation-wide"]),
     // Cross-project lists and reads a limited person is still refused; scoping them is later work.
     ...["runner list", "coordinator list", "outbox list", "incident list", "routine list", "routine show", "intake show", "intake preview",
         "intake pr-comments", "template list", "template show", "contest show", "review show"].map(row => [row, "not yet scoped"]),

package/dist/operate.js

@@ -1,3 +1,4 @@
+import { notificationClaimHeld, claimNotifications, finalizeNotification, notificationDestination } from "./notification-delivery.js";
 import { adapterPolicy } from "./server/route-policy.js";
 import { UNSENT_REPLY_MS } from "./telegram-settings.js";
 import { checkPublicCommand } from "./public-check.js";
@@ -47,8 +48,6 @@ import { runRequestedUndos, sendTeammateWeeklies } from "./teammate-week.js";
 import { refreshConnections } from "./mcp-connect.js";
 import { followDiscord } from "./discord.js";
 import { followTeams } from "./teams.js";
-import { loadDiscordCredentials } from "./discord-api.js";
-import { loadSlackCredentials } from "./slack-api.js";
 import { followSlack } from "./slack.js";
 import { validateScopeText } from "./task-text.js";
 import { runMemoryCommand } from "./memory-cli.js";
@@ -197,7 +196,7 @@ import { isRiskLevel, isTaskSize, legOf, projectRoute, riskConsequence, routeDig
 import { observeProviderReadiness, reportProviderReadinessAuthed } from "./runner.js";
 import { parseDemoUrl, projectDemoUrl, saveProjectDemo } from "./project-demo.js";
 import { effectiveConcurrency, maySlotTake, parseProjectConcurrency, PROJECT_CONCURRENCY_DEFAULT, ProjectPasses, projectConcurrency, saveProjectConcurrency, savedProjectConcurrency } from "./project-concurrency.js";
-import { clearWebhook, effectivePrimary, isMessagingChannel, loadConsoleUrl, loadPrimary, loadWebhookTargets, phoneOrigin, saveConsoleUrl, savePrimary, saveWebhook, webhookPass, SLACK_ENV, DISCORD_ENV } from "./webhooks.js";
+import { activeWebhookTargets, webhookPass, LEGACY_WEBHOOK_WARNING, loadWebhookTargets, effectivePrimary, isMessagingChannel, loadConsoleUrl, phoneOrigin, saveConsoleUrl, savePrimary } from "./webhooks.js";
 import { auditOf, inspectionOf, isProviderId, MONEY_CAPABILITIES, PROVIDER_IDS, validModelId, validateSpec, ALL_CREDENTIAL_ENV } from "./provider.js";
 import { attestProvider, attestationOf, versionInRange } from "./attest.js";
 import { recognizesEligible } from "./exhaustion.js";
@@ -575,21 +574,14 @@ Agents — which provider and model each phase runs on
                                         says REVIEW was not read)
 
 The outbox — facts that want a person, durably
-  toolroll webhook set slack|discord <url>
-                                        UI-only chat mirrors: every page a
-                                        message with a console link; acting
-                                        stays in the console. Delivers when
-                                        Telegram is not configured.
   toolroll webhook set console-url <http://host:port>
   toolroll webhook primary telegram|slack|discord
                                         which service receives alerts when
                                         several are connected (asked once,
                                         the first time you add a second)
-  toolroll webhook status | test | clear slack|discord
-  toolroll outbox list [--all]
-  toolroll outbox deliver --cmd <c>  runs once per pending row, reading
-                                        $TOOLROLL_KIND / _SUBJECT / _BODY;
-                                        exit 0 delivered receipts, 1 any fail
+  toolroll webhook status
+  toolroll outbox list [--all]          pending facts (--all: resolved too)
+  toolroll outbox deliver --cmd <cmd>   deliver through an operator command
 
 Runners — the machines that may be given work
   toolroll runner register <name> [--capacity <n>] [--token-file <path>]
@@ -1063,8 +1055,8 @@ function telegramConversation(context, options = {}) {
         evidenceRoot: context.evidenceRoot,
         ...(context.mateSeams?.subscriptionRunner === undefined ? {} : { subscriptionRunner: context.mateSeams.subscriptionRunner }),
         ...(context.heldCoordinator === undefined ? {} : { held: context.heldCoordinator }),
-        // Re-read on every card and every `/task`: the same console-url the
-        // mirrors use, held to an https origin, and — inside `up`, where this
+        // Re-read on every card and every `/task`: the same console-url chat
+        // links use, held to an https origin, and — inside `up`, where this
         // process also serves the console — equal to that console's own
         // `--public-url`, or no link at all.
         phoneOrigin: () => phoneOrigin(process.env, dirname(context.databaseFile), { serverOrigin: options.serverOrigin ?? null }),
@@ -4922,7 +4914,7 @@ async function briefCommand(flags, context) {
             lines.push(`      #${pull.number}  ${pull.title}`);
     }
     if (pending.length > 0) {
-        lines.push(`  ▸ OUTBOX     ${pending.length} undelivered — toolroll outbox deliver --cmd …`);
+        lines.push(`  ▸ OUTBOX     ${pending.length} undelivered — toolroll outbox list`);
     }
     if (decisions.length > 0) {
         const overdue = decisions.filter(one => one.state === "expired").length;
@@ -5429,18 +5421,16 @@ async function incidentCommand(positional, flags, context) {
     ]);
 }
 /**
- * `toolroll webhook …` — Slack and Discord as UI-ONLY mirrors: every
- * page is a message with a console link; acting stays in the console
- * behind its own authentication. The URL is a credential: 0600 file
- * beside the database, or the environment, never anywhere else.
+ * `toolroll webhook status|primary|set console-url` — messaging settings:
+ * which connected chat service receives alerts, and the console address
+ * chat links open.
  */
-async function webhookCommand(positional, flags, context) {
-    const { store, write, json, clock } = context;
+async function webhookCommand(positional, _flags, context) {
+    const { write, json } = context;
     const dir = dirname(context.databaseFile);
     const [action, which, value] = positional;
     const telegramConfigured = loadBotToken(process.env, context.telegramTokenFile) !== null;
     if (action === undefined || action === "status") {
-        const targets = loadWebhookTargets(process.env, dir);
         const consoleUrl = loadConsoleUrl(process.env, dir);
         const primary = effectivePrimary(process.env, dir, telegramConfigured);
         if (json) {
@@ -5456,29 +5446,8 @@ async function webhookCommand(positional, flags, context) {
             write(`    Choose: toolroll webhook primary telegram|slack|discord`);
         }
         write(`  links    ${consoleUrl ?? "NOT SET — messages will carry no console link; toolroll webhook set console-url http://host:port"}`);
-        if (targets.length === 0) {
-            write("");
-            write("  toolroll webhook set slack https://hooks.slack.com/services/…");
-            write("  toolroll webhook set discord https://discord.com/api/webhooks/…");
-            write(`  (or export ${SLACK_ENV} / ${DISCORD_ENV})`);
-        }
-        write("");
-        write("  Mirrors deliver when Telegram is not configured; with a paired Telegram");
-        write("  chat, Telegram carries the page (it can hold buttons) and mirrors stay quiet.");
         return EXIT.ok;
     }
-    if (action === "test") {
-        const targets = loadWebhookTargets(process.env, dir);
-        if (targets.length === 0) {
-            return fail(write, json, "webhook test", "unconfigured", "no webhook configured — `toolroll webhook set slack|discord <url>`", EXIT.refused);
-        }
-        store.enqueueNotification({ source: { installation: true }, dedupeKey: `webhook-test:${clock().getTime()}`, kind: "test", subject: "toolroll webhook test", body: "If you can read this, the mirror works. Acting happens in the console." }, clock());
-        const report = await webhookPass(store, { targets, consoleUrl: loadConsoleUrl(process.env, dir), clock });
-        if (report.problems.length > 0) {
-            return fail(write, json, "webhook test", "delivery", report.problems.join("; "), EXIT.failed);
-        }
-        return succeed(write, json, "webhook test", { sent: report.sent }, () => [`Sent ${report.sent} message(s). Check the channel.`]);
-    }
     if (action === "primary") {
         if (which === undefined || !isMessagingChannel(which)) {
             return fail(write, json, "webhook primary", "usage", "primary is one of telegram, slack, discord", EXIT.usage);
@@ -5492,46 +5461,13 @@ async function webhookCommand(positional, flags, context) {
             `Alerts now go to ${which}. ${which === "telegram" ? "Buttons and replies work there as always." : "Telegram (if configured) still accepts taps and replies — it just stops sending alerts."}`,
         ]);
     }
-    if (action === "clear" && (which === "slack" || which === "discord")) {
-        clearWebhook(dir, which);
-        return succeed(write, json, "webhook clear", { which }, () => [`${which} mirror cleared.`]);
+    if (action !== "set" || which !== "console-url" || value === undefined) {
+        return fail(write, json, "webhook", "usage", "`toolroll webhook [status|primary <service>|set console-url <url>]`", EXIT.usage);
     }
-    if (action !== "set" || which === undefined || value === undefined) {
-        return fail(write, json, "webhook", "usage", "`toolroll webhook [status|test|set slack|discord|console-url <value>|clear slack|discord]`", EXIT.usage);
-    }
-    if (which === "console-url") {
-        const saved = saveConsoleUrl(dir, value);
-        if (!saved.ok)
-            return fail(write, json, "webhook set", "invalid", saved.message, EXIT.usage);
-        return succeed(write, json, "webhook set", { which }, () => [`Console links will open ${value.replace(/\/+$/, "")}.`]);
-    }
-    if (which !== "slack" && which !== "discord") {
-        return fail(write, json, "webhook set", "usage", "set what? slack, discord, or console-url", EXIT.usage);
-    }
-    const saved = saveWebhook(dir, which, value);
+    const saved = saveConsoleUrl(dir, value);
     if (!saved.ok)
         return fail(write, json, "webhook set", "invalid", saved.message, EXIT.usage);
-    // The first moment more than one service exists is the moment to ask
-    // which one pages — once, right here, not at 3am when both fire.
-    const after = effectivePrimary(process.env, dir, telegramConfigured);
-    let chosen = null;
-    if (after.implicit && loadPrimary(process.env, dir) === null && after.configured.length > 1 && interactive() && !json) {
-        write(`You now have ${after.configured.join(" and ")} connected.`);
-        const answer = (await ask(`Which service should receive alerts? [${after.configured.join("/")}] `)).trim().toLowerCase();
-        if (isMessagingChannel(answer) && after.configured.includes(answer)) {
-            savePrimary(dir, answer);
-            chosen = answer;
-        }
-        else {
-            write(`Left unchosen — ${after.channel} receives alerts by default. Decide any time: toolroll webhook primary <service>`);
-        }
-    }
-    return succeed(write, json, "webhook set", { which, ...(chosen === null ? {} : { primary: chosen }) }, () => [
-        `${which} mirror configured — the URL lives in a private file beside the database.`,
-        ...(chosen === null ? [] : [`${chosen} carries the pages.`]),
-        ...(after.implicit && chosen === null && !interactive() ? [`Several services are configured — choose the pager: toolroll webhook primary <service>`] : []),
-        `Send yourself a proof: toolroll webhook test`,
-    ]);
+    return succeed(write, json, "webhook set", { which }, () => [`Console links will open ${value.replace(/\/+$/, "")}.`]);
 }
 /**
  * `toolroll providers resume <provider>` — a person says the sign-in works
@@ -7865,6 +7801,7 @@ async function runWatchLoop(args) {
     let lastTick = 0;
     let lastBridge = 0;
     let lastPush = 0;
+    let lastWebhook = 0;
     let ticks = 0;
     let built = 0;
     let brokeCount = 0;
@@ -8160,6 +8097,14 @@ async function runWatchLoop(args) {
                     // Push is additive; a broken pass never stops the watch.
                 }
             }
+            if (now - lastWebhook >= bridgeEveryMs) {
+                lastWebhook = now;
+                const dir = dirname(context.databaseFile);
+                const primary = effectivePrimary(process.env, dir, loadBotToken(process.env, context.telegramTokenFile) !== null);
+                const targets = activeWebhookTargets(process.env, dir, primary.channel);
+                if (targets.length > 0)
+                    await webhookPass(store, { targets, consoleUrl: loadConsoleUrl(process.env, dir), clock: context.clock });
+            }
             // The embedded follower owns the wire while it lives; the timer-driven
             // pass is the fallback shape for a watch started before a token existed.
             if (follower === null && now - lastBridge >= bridgeEveryMs) {
@@ -8175,12 +8120,6 @@ async function runWatchLoop(args) {
                     quiet.length = 0;
                     await bridgeCommand(["telegram"], passFlags(primary.channel === "telegram" ? {} : { "inbound-only": "1" }), quietContext);
                 }
-                if (primary.channel !== null && primary.channel !== "telegram") {
-                    const targets = loadWebhookTargets(process.env, dir).filter(one => one.kind === primary.channel && (one.kind !== "slack" || loadSlackCredentials(dir) === null) && (one.kind !== "discord" || loadDiscordCredentials(dir) === null));
-                    if (targets.length > 0) {
-                        await webhookPass(store, { targets, consoleUrl: loadConsoleUrl(process.env, dir), clock: context.clock });
-                    }
-                }
             }
             // Work-conserving: if the world moved while we worked — or we just
             // finished something that may have freed a dependent — go again now.
@@ -8194,7 +8133,7 @@ async function runWatchLoop(args) {
             // due, a signal lands, or the trial window (--for) ends. Reading one
             // integer from SQLite twice a second is the entire idle cost — no
             // token has anywhere to be spent from here.
-            const idleUntil = Math.min(lastTick + tickEveryMs, lastBridge + bridgeEveryMs, deadline ?? Number.MAX_SAFE_INTEGER) - Date.now();
+            const idleUntil = Math.min(lastTick + tickEveryMs, lastBridge + bridgeEveryMs, lastWebhook + bridgeEveryMs, deadline ?? Number.MAX_SAFE_INTEGER) - Date.now();
             // Doze for the WHOLE idle window, waking early only for a signal or a
             // sequence move — not for one 500ms step and then another pass
             // (2026-09-05: that read as two ticks a second, all night, with
@@ -9804,18 +9743,6 @@ async function publishCommand(positional, flags, context) {
     return succeed(write, json, "publish", { report }, lines);
 }
 // ---- the outbox -----------------------------------------------------------
-/**
- * `toolroll outbox list|deliver` — reading and draining the durable
- * outbox. Delivery runs an operator-supplied command once per pending row;
- * the notification's text reaches it as environment variables, never
- * substituted into the command line, because subjects and bodies quote
- * things agents and repositories said and a shell must not meet those.
- *
- *   toolroll outbox deliver --cmd 'curl -d "$TOOLROLL_SUBJECT" ntfy.sh/mine'
- *
- * Exit 0 when everything pending delivered (or nothing was pending);
- * 1 when any delivery failed — a broken channel is breakage, not a "no".
- */
 /**
  * `toolroll peek [<run>] [--tmux] [--lines <n>]` — watch live agents
  * in the terminal: one pane per open run with its stage and transcript
@@ -9865,6 +9792,11 @@ async function peekCommand(positional, flags, context) {
     }
     return runPeek(store, context.evidenceRoot, { ...(runId === undefined ? {} : { runId }), io: { stdout: process.stdout, stdin: process.stdin }, clock });
 }
+/**
+ * `toolroll outbox list [--all]` — read the durable outbox: the facts that
+ * want a person, pending until resolved. An operator command can also deliver
+ * them with its own destination receipts.
+ */
 async function outboxCommand(positional, flags, context) {
     const { store, write, json, clock } = context;
     const [action] = positional;
@@ -9876,17 +9808,12 @@ async function outboxCommand(positional, flags, context) {
             return EXIT.ok;
         }
         if (notifications.length === 0) {
-            write(wanted === "pending" ? "Nothing waiting to be delivered." : "The outbox is empty.");
+            write(wanted === "pending" ? "Nothing pending." : "The outbox is empty.");
             return EXIT.ok;
         }
         for (const one of notifications) {
-            const state = one.deliveredAt !== null
-                ? `delivered ${one.deliveredAt}`
-                : one.attempts > 0
-                    ? `pending, ${one.attempts} failed attempt(s): ${one.lastError ?? ""}`
-                    : "pending";
             write(`  #${one.id} ${one.kind.padEnd(18)} ${one.subject}`);
-            write(`      ${state}`);
+            write(`      ${one.resolvedAt === null ? "pending" : `resolved ${one.resolvedAt}`}`);
         }
         return EXIT.ok;
     }
@@ -9898,14 +9825,9 @@ async function outboxCommand(positional, flags, context) {
         if (command === undefined) {
             return fail(write, json, "outbox deliver", "usage", "--cmd says how: it runs once per notification, reading $TOOLROLL_KIND, $TOOLROLL_SUBJECT, $TOOLROLL_BODY", EXIT.usage);
         }
-        // Claimed, not merely listed: the Telegram bridge drains this same
-        // outbox, and select-then-send-then-record from two deliverers pages a
-        // person twice. The claim is a short lease on the act of sending; a
-        // deliverer that dies mid-send leaves rows that unclaim by expiry.
+        // The exact command owns a leased destination receipt, including across concurrent CLI invocations.
         const owner = `outbox-${randomUUID()}`;
-        // Push first, independently (arc 3 finding 8): its pair ledger does not
-        // depend on globally-undelivered notifications — Telegram or a webhook
-        // may already have stamped delivered_at.
+        // Push delivery has independent receipts and must keep working if this command fails.
         let pushed = 0;
         try {
             pushed = (await pushPass(store, { configDir: dirname(context.databaseFile), clock })).accepted;
@@ -9913,7 +9835,7 @@ async function outboxCommand(positional, flags, context) {
         catch {
             // additive; the shell delivery below still runs
         }
-        const pending = store.claimDeliveries(owner, 2 * 60_000, clock());
+        const pending = claimNotifications(store, notificationDestination("command", command), owner, clock());
         if (pending.length === 0) {
             return succeed(write, json, "outbox deliver", { delivered: 0, failed: 0, pushed }, () => [
                 pushed > 0 ? `Nothing for the shell command; ${pushed} push(es) accepted.` : "Nothing waiting to be delivered.",
@@ -9922,6 +9844,10 @@ async function outboxCommand(positional, flags, context) {
         let delivered = 0;
         let failed = 0;
         for (const one of pending) {
+            if (!notificationClaimHeld(store, one, owner, clock())) {
+                failed++;
+                continue;
+            }
             const sent = await run("sh", ["-lc", command], {
                 timeoutMs: 30_000,
                 env: {
@@ -9933,14 +9859,16 @@ async function outboxCommand(positional, flags, context) {
             });
             if (sent.code === 0) {
                 const receipt = sent.stdout.split("\n")[0]?.trim() ?? "";
-                store.finalizeDelivery(one.id, owner, { ok: true, receipt: receipt === "" ? null : receipt }, clock());
-                delivered++;
+                if (finalizeNotification(store, one, owner, { ok: true, receipt: receipt === "" ? null : receipt }, clock()))
+                    delivered++;
+                else
+                    failed++;
             }
             else {
                 const error = sent.timedOut
                     ? "timed out"
                     : sent.stderr.split("\n")[0]?.trim() || `exit ${sent.code}`;
-                store.finalizeDelivery(one.id, owner, { ok: false, error }, clock());
+                finalizeNotification(store, one, owner, { ok: false, error }, clock());
                 failed++;
             }
         }
@@ -10171,6 +10099,7 @@ async function statusCommand(positional, flags, context) {
     // An update waiting, on what, and the action: before anything else, as it holds up new work.
     const waiting = waitingUpdate(context.databaseFile, run => context.store.stopQuiescenceProblem(run) !== null, context.clock());
     const updateWaiting = waiting === null ? {} : { updateWaiting: { app: waiting.app, version: waiting.version, stopped: waiting.stopped, run: waiting.run, on: waiting.on, action: waiting.action } };
+    const legacyWebhookWarning = loadWebhookTargets(process.env, dirname(context.databaseFile)).length > 0 ? LEGACY_WEBHOOK_WARNING : null;
     const projects = projectBuildsStatus(context);
     const projectsLine = projects.length === 0 ? null
         : `Builds by project: ${projects.slice(0, 8).map(one => `${one.name} ${one.running} of ${one.limit}`).join(", ")}${projects.length > 8 ? ", …" : ""}`;
@@ -10178,7 +10107,7 @@ async function statusCommand(positional, flags, context) {
     const unsent = context.store.unsentTelegramReplies(null, null, new Date(context.clock().getTime() - UNSENT_REPLY_MS));
     const unsentLine = unsentRepliesLine(unsent);
     const unsentReplies = unsent.length === 0 ? {} : { unsentReplies: unsent.map(one => ({ ...one, retry: "toolroll bridge telegram retry" })) };
-    return succeed(context.write, context.json, command, { ...status, projects, ...update, ...integrations, ...updateWaiting, ...unsentReplies }, () => [...(waiting === null ? [] : [waiting.words]), ...(unsentLine === null ? [] : [unsentLine]), ...renderInstallationStatus(status), ...(projectsLine === null ? [] : [projectsLine]), ...(line === null ? [] : [line]), ...(brokenLine === null ? [] : [brokenLine])]);
+    return succeed(context.write, context.json, command, { ...status, projects, ...update, ...integrations, ...updateWaiting, ...unsentReplies, ...(legacyWebhookWarning === null ? {} : { legacyWebhookWarning }) }, () => [...(waiting === null ? [] : [waiting.words]), ...(unsentLine === null ? [] : [unsentLine]), ...renderInstallationStatus(status), ...(projectsLine === null ? [] : [projectsLine]), ...(line === null ? [] : [line]), ...(brokenLine === null ? [] : [brokenLine]), ...(legacyWebhookWarning === null ? [] : [legacyWebhookWarning])]);
 }
 function unsentRepliesLine(unsent) {
     if (unsent.length === 0)
@@ -12829,6 +12758,7 @@ async function backupCommand(positional, flags, context) {
             return fail(context.write, context.json, command, "failed", `The backup failed: ${made.error}`, EXIT.failed, { backup: made.id });
         return succeed(context.write, context.json, command, { backup: made }, () => [
             `Backed up to ${made.file} (${bytesWords(made.bytes)}).${made.removed === 0 ? "" : ` Removed ${made.removed} older ${made.removed === 1 ? "backup" : "backups"}.`}`,
+            ...(made.checkpoint !== null && "problem" in made.checkpoint ? [`The activity log failed its tamper check, so it was not anchored: ${made.checkpoint.problem}`] : []),
         ]);
     }
     const settings = store.backupSettings();