toolroll 0.9.51 → 0.9.52

package/dist/process-recovery-settlement.js

@@ -123,6 +123,7 @@ export async function recoverPreparedObserverGap(store, input) {
             const actionId = store.recordAction({ at: new Date().toISOString(), actor: "system", repo: current.binding.run.repo,
                 taskId: current.binding.run.taskId, runId: receipt.targetRun, action: "process absence recovered",
                 outcome: digest, source: "work" });
+            store.compactRunProcesses(new Date(), receipt.targetRun);
             return { ok: true, recorded: true, ...result, actionId, certificatePath };
         }));
     }

package/dist/retention.js

@@ -1,3 +1,4 @@
+import { reclaimDatabase } from "./database-reclaim.js";
 /**
  * Retention (v105): how long Toolroll keeps run evidence and logs,
  * finished checkouts' records, chat messages and notifications. Until an
@@ -56,7 +57,7 @@ export const RETENTION_KINDS = [
     { kind: "evidence", label: "Run evidence and logs", detail: "Diffs, check logs, screenshots and reports saved for each run" },
     { kind: "checkouts", label: "Finished checkout records", detail: "Records of build checkouts that were let go and are no longer on disk" },
     { kind: "chat", label: "Chat messages", detail: "Messages in lead and team chats" },
-    { kind: "notifications", label: "Notifications", detail: "Delivered or dismissed notifications" },
+    { kind: "notifications", label: "Notifications", detail: "Resolved notifications" },
 ];
 /** The periods the page offers for each kind; the command line takes any number of days from 1 to 3650. */
 const LONG_CHOICES = [30, 90, 180, 365, 730, null];
@@ -183,12 +184,11 @@ export function retentionPlan(store, evidenceRoot, now, periods = store.retentio
         items.chat = rows.slice(0, SWEEP_BATCH).map(row => ({ id: Number(row["id"]), bytes: Number(row["bytes"]) }));
     }
     if (periods.notifications !== null) {
-        const rows = db.prepare(`SELECT n.id AS id, length(n.subject) + length(n.body) + COALESCE(length(n.receipt), 0) + COALESCE(length(n.last_error), 0) + 64 AS bytes FROM notification n
-      WHERE n.created_at < ? AND (n.resolved_at IS NOT NULL OR n.delivered_at IS NOT NULL)
-        AND NOT (n.claim_owner IS NOT NULL AND n.claim_expires_at > ?)
+        const rows = db.prepare(`SELECT n.id AS id, length(n.subject) + length(n.body) + 64 AS bytes FROM notification n
+      WHERE n.created_at < ? AND n.resolved_at IS NOT NULL
         AND NOT EXISTS (SELECT 1 FROM notification_delivery d WHERE d.notification = n.id AND d.claim_owner IS NOT NULL AND d.claim_expires_at > ?)
         AND NOT (n.resolved_at IS NULL AND n.task_ref IS NOT NULL AND NOT EXISTS (SELECT 1 FROM task_ref r WHERE r.id = n.task_ref AND ${finishedTask("r")}))
-      ORDER BY n.id LIMIT ?`).all(cutoff(now, periods.notifications), now.toISOString(), now.toISOString(), SWEEP_BATCH + 1);
+      ORDER BY n.id LIMIT ?`).all(cutoff(now, periods.notifications), now.toISOString(), SWEEP_BATCH + 1);
         more.notifications = rows.length > SWEEP_BATCH;
         items.notifications = rows.slice(0, SWEEP_BATCH).map(row => ({ id: Number(row["id"]), bytes: Number(row["bytes"]) }));
     }
@@ -297,6 +297,7 @@ export function sweepRetention(store, evidenceRoot, now, actor = "worker") {
     const counts = plan.counts.map(one => ({ ...one, count: done[one.kind].count, bytes: done[one.kind].bytes }));
     const freed = counts.reduce((sum, one) => sum + one.bytes, 0);
     const ledgerId = store.recordAction({ at: now.toISOString(), actor, repo: null, taskId: null, runId: null, action: "retention sweep", outcome: freed > 0 || counts.some(one => one.count > 0) ? "removed" : "nothing due", source: "policy", detail: sweepWords(counts, freed) });
+    reclaimDatabase(store.handle, "retention");
     return { at: now.toISOString(), counts, freed, ledgerId };
 }
 /** Whether a day has passed since the last sweep. */

package/dist/serve.js

@@ -429,7 +429,7 @@ export function createDecisionServer(options) {
     /** One-click connections on their way: the service's sign-in page and back, 15 minutes at most. */
     const connectVisits = new Map();
     /** Flows open in a browser (v88): who's here, and a nudge when one changes. */
-    // Live views push on write (live-bus.ts): the revision triggers move, the rooms hear it.
+    // Live views push on write (live-bus.ts): each commit moves the workspace revision, the rooms hear it.
     const liveBus = createLiveBus();
     const liveFollower = followWorkspace(store, () => workspaceRevision.current(), liveBus, { file: store.databaseFile() });
     const flowRooms = createFlowRooms(flow => flowFingerprint(store, flow), { bus: liveBus });

package/dist/server/settings.js

@@ -1111,6 +1111,8 @@ export function createSettingsHandlers(runtime) {
             if (who.via !== "cookie" || !store.isInstanceOperator(who.name) || databaseFile === null)
                 return refuse(response, who, 403, "An instance operator looks after backups.", "/settings");
             const made = await backupNow(store, databaseFile, "manual", clock);
+            if (made.ok && made.checkpoint !== null && "problem" in made.checkpoint)
+                return redirect(response, `/settings/backups?problem=${encodeURIComponent(`Backed up. The activity log failed its tamper check, so it was not anchored: ${made.checkpoint.problem}`)}`);
             return redirect(response, made.ok ? `/settings/backups?said=${encodeURIComponent("Backed up.")}` : `/settings/backups?problem=${encodeURIComponent(`The backup failed: ${made.error}`)}`);
         }
         // Sprint 8: change the backup schedule. A step-up; the ledger keeps before → after.
@@ -1978,7 +1980,7 @@ export function createSettingsHandlers(runtime) {
                 const existing = loadBotToken({}, options.telegramTokenFile);
                 const hasEnv = (envValue(process.env, "TELEGRAM_TOKEN") ?? "") !== "";
                 const csrf = who.via === "cookie" ? who.session.csrf : "";
-                return sendScreen(response, 400, settingsPage(chromeFor(who.via === "cookie" ? who.session.project : defaultProject, "settings"), existing, hasEnv, csrf, saved.message, null, null, null, null, {
+                return sendScreen(response, 400, settingsPage(chromeFor(who.via === "cookie" ? who.session.project : defaultProject, "settings"), existing, hasEnv, csrf, saved.message, options.configDir === undefined ? null : effectivePrimary(process.env, options.configDir, loadBotToken(process.env, options.telegramTokenFile) !== null), null, null, null, {
                     ...store.permissionDefault(),
                     canManage: who.role === "approver",
                 }));

package/dist/server/shared.d.ts

@@ -3138,6 +3138,7 @@ export declare function settingsPage(chrome: Chrome, existing: TokenSource | nul
     channel: string | null;
     implicit: boolean;
     configured: string[];
+    legacyWarning?: string;
 } | null, push?: {
     available: boolean;
     devices: PushSubscription[];

package/dist/server/shared.js

@@ -12313,6 +12313,7 @@ export function settingsPage(chrome, existing, hasEnv, csrf, problem, messaging
         kind: "settings",
         said: problem,
         groups: settingsGroups(messaging, telegramFailing),
+        ...(messaging?.legacyWarning ? { legacyWebhookWarning: messaging.legacyWarning } : {}),
         theme,
         accent: requestContext.getStore()?.accent ?? DEFAULT_ACCENT,
         accentPresets: ACCENT_PRESETS,
@@ -12346,6 +12347,7 @@ export function settingsPage(chrome, existing, hasEnv, csrf, problem, messaging
     };
     return screen("Settings", [
         "<h1>Settings</h1>",
+        messaging?.legacyWarning ? `<p data-legacy-webhooks>Legacy webhooks are deprecated. Connect <a href="/settings/slack" style="display:inline-flex;min-height:44px;align-items:center">Slack</a> or <a href="/settings/discord" style="display:inline-flex;min-height:44px;align-items:center">Discord</a> in Chat settings.</p>` : "",
         settingsTiles(view.groups),
         phone === null ? "" : phoneSetupHtml(phone),
         appearanceCard(csrf),

package/dist/store.d.ts

@@ -152,7 +152,7 @@ export type SealedLedgerEntry = LedgerEntry & {
         hash: string;
     } | null;
 };
-export declare const SCHEMA_VERSION = 113;
+export declare const SCHEMA_VERSION = 114;
 /**
  * The migrations `toolroll update` may carry a database through in place: each
  * one only adds (a table, a column, an accepted value) and leaves every saved row
@@ -166,6 +166,11 @@ export declare const SCHEMA_VERSION = 113;
  * api_token columns (project limit, rotation); existing tokens read as before.
  * v112 only adds the two request-budget tables.
  * v113 adds MCP sign-in tables and API-token purpose metadata.
+ * v114 is the one declared exception to "only adds", and the rehearsal checks
+ * it as such: a settled run's exited process witnesses become one summary row
+ * (rows removed equal the witnesses summarized), and notification drops its
+ * delivery columns only after every value moves into one legacy receipt per row
+ * (rows and ids carried whole; legacy receipts added equal the rows carried).
  */
 export declare const UPDATE_SAFE_MIGRATIONS: readonly number[];
 /** Whether a database settled at `version` reaches this build's schema through update-safe migrations alone. */
@@ -1030,19 +1035,15 @@ export type Notification = {
     subject: string;
     body: string;
     createdAt: string;
-    attempts: number;
-    lastAttemptAt: string | null;
-    lastError: string | null;
-    deliveredAt: string | null;
-    receipt: string | null;
     /** The closed push attention class, or null = this fact never pushes. */
     pushClass: "decision" | "pick" | "merge" | "attention" | "progress" | null;
     /** The machine-minted console path a push may deep-link — never free text. */
     link: string | null;
     /**
      * When the fact stopped wanting a person — a decision answered, an incident
-     * resolved. Distinct from delivery, and it never deletes the row: receipts
-     * are the audit trail of what was actually sent.
+     * resolved. Distinct from delivery, and it never deletes the row: the
+     * per-destination receipts (notification_delivery) are the audit trail of
+     * what was actually sent.
      */
     resolvedAt: string | null;
     scope: "unknown" | "installation" | "project" | "task";
@@ -1051,6 +1052,14 @@ export type Notification = {
     taskId: string | null;
     run: number | null;
 };
+/** One notification's delivery state at one destination (notification_delivery). */
+export type NotificationReceipt = Notification & {
+    attempts: number;
+    lastAttemptAt: string | null;
+    lastError: string | null;
+    deliveredAt: string | null;
+    receipt: string | null;
+};
 export type TelegramDelivery = Notification & {
     destination: string;
     claimGeneration: number;
@@ -1868,6 +1877,9 @@ export declare function openStoreNoMigrate(file: string, options?: OpenOptions):
  * retries. Correction children (the same-session structured-output
  * repairs) are not attempts; they continue one. */
 export declare const REVIEW_ROOT_ATTEMPTS = 3;
+/** The receipt v114 keeps a notification's old single-destination delivery under. No sender claims it: every real
+ * destination is a kind and a 64-character hash, or a Telegram binding. */
+export declare const LEGACY_NOTIFICATION_DESTINATION = "legacy:single-destination";
 /** v34: artifact.kind admits 'report'. A table already rebuilt to the v38
  * shape (migrate() runs unconditionally on every open, including a fresh
  * database created straight at the current shape) is a DONE shape too —
@@ -2489,8 +2501,16 @@ export declare class Store {
         fresh?: number;
     }): LedgerChainReport;
     /** A checkpoint of the chain as it stands: its head, recorded here and handed back to be copied off the machine.
-     * Never over a chain that doesn't verify: that would vouch for what broke it. */
-    ledgerCheckpoint(by: string, now: Date): {
+     * Never over a chain that doesn't verify: that would vouch for what broke it. `automatic` (before a backup, after
+     * a monitoring delivery): at the verified head, or at `head` (one that was sent) once the walk reached it, only past
+     * the newest checkpoint (null otherwise), and with no ledger entry of its own, so a checkpoint never makes new
+     * activity for the next backup or delivery to checkpoint again. */
+    ledgerCheckpoint(by: string, now: Date, automatic?: {
+        head?: {
+            through: number;
+            hash: string;
+        };
+    }): {
         through: number;
         hash: string;
     } | {
@@ -4869,13 +4889,6 @@ export declare class Store {
     notificationById(id: number): Notification | null;
     notificationsAfter(id: number, limit?: number): Notification[];
     listNotifications(only?: "pending" | "all"): Notification[];
-    recordDelivery(id: number, outcome: {
-        ok: true;
-        receipt: string | null;
-    } | {
-        ok: false;
-        error: string;
-    }, now: Date): void;
     /**
      * Close a gap's notification episode. Called when its capability verifies:
      * the next failure is a *new* fact, and a dedupe key that suppressed it
@@ -7448,6 +7461,12 @@ export declare class Store {
      * every finished run is visited, a batch at a time. Never signals. */
     recordFinishedRunExits(now: Date, batch?: number): number;
     finishUnspawnedProcess(witness: number, now: Date): void;
+    /** Settled custody, compacted (v114; compactSettledRunProcesses): a finished run whose witnesses all exited keeps
+     * one summary row. A settled stop, an approver's settlement and a recovery compact their run at once; the worker's
+     * reconcile pass (recordFinishedRunExits) compacts every other settled run, including one that settled at run end. */
+    compactRunProcesses(now: Date, only?: number): number;
+    /** Whether a run's witnesses were compacted into its summary: they existed, and all exited. */
+    processesSummarized(runId: number): boolean;
     /** The reconcile road for a pid-less witness a crash or a thrown spawn
      * left behind: once its run has finished, no live child is tracked for it
      * here, every other witness of the run has exited and none of the run's
@@ -7739,24 +7758,8 @@ export declare class Store {
         error: string;
         retryAt?: string;
     }, now: Date): boolean;
-    /** Read receipts without changing the meaning of shell/webhook history. */
-    telegramDeliveries(binding: TelegramBinding): Notification[];
-    /**
-     * Claim pending notifications for one deliverer. Two deliverers — the
-     * bridge and `outbox deliver` — select-then-send-then-record, and without
-     * a claim both can send the same row in the gap. The claim is a short
-     * lease on the act of sending; a deliverer that dies mid-send leaves rows
-     * that unclaim themselves by expiry.
-     */
-    claimDeliveries(owner: string, ttlMs: number, now: Date, only?: "all" | "urgent"): Notification[];
-    /** Finalize only what this owner still holds. A lapsed claim writes nothing. */
-    finalizeDelivery(id: number, owner: string, outcome: {
-        ok: true;
-        receipt: string | null;
-    } | {
-        ok: false;
-        error: string;
-    }, now: Date): boolean;
+    /** The notifications this pairing holds, each with its delivery state there. */
+    telegramDeliveries(binding: TelegramBinding): NotificationReceipt[];
     /** The digest cadence: null everyMs = off. */
     telegramDigest(): TelegramDigest;
     /** Set (or clear, with null) the cadence. Turning it on starts the
@@ -7879,14 +7882,6 @@ export declare class Store {
     /** The message now showing this card, and what it shows. */
     setChatCardMessage(id: number, message: string, digest: string): void;
     markTelegramDigestSent(now: Date): void;
-    /** Every batched row finalized delivered AND the anchor moved, in ONE
-     * transaction (v4 review, finding 5): a digest is either recorded whole
-     * or not at all. Rows whose claim lapsed meanwhile are reported, not
-     * silently skipped. */
-    finalizeDigest(ids: readonly number[], owner: string, receipt: string | null, now: Date): {
-        finalized: number;
-        lapsed: number;
-    };
     /** Routine rows waiting for the next digest: pending, and not urgent.
      * A row the live pairing delivered, or skipped as pre-pairing history,
      * is settled and not waiting. */