toolroll 0.9.51 → 0.9.52

package/dist/toolroll-update.js

@@ -315,28 +315,115 @@ export function durableRename(temp, target) {
     if (process.platform !== "win32")
         fsyncPath(dirname(target));
 }
-function tableDigest(db, name, columns) {
-    const rows = db.prepare("SELECT " + columns.map(quote).join(",") + " FROM " + quote(name)).all().map(r => JSON.stringify(r)).sort();
-    return { count: rows.length, hash: sha(rows.join("\n")) };
-}
-/** Every historical row, table by table (deploy-browser's rehearsal check). */
+// ---- database: snapshot, rehearse, restore --------------------------------
+/** How a rehearsed migration may change each saved table. An unlisted table keeps every column, its row count and
+ * its last rowid (a WITHOUT ROWID table, all small, keeps the hash of its rows). `appendOnly`: every row through the
+ * last one before hashes the same, in rowid order; new rows may follow. `dropped`: columns the new schema may remove
+ * only when every saved value is null, or, with `carried`, when the receiving table gained exactly one receipt under
+ * that destination per row holding a value, and as many non-null values per column as the dropped columns held.
+ * `receives`: the only rows the table may gain are those receipts. `compacted`: rows may go only into summary rows,
+ * whose `sum` grows by exactly as many. */
+const LEGACY_DESTINATION = "legacy:single-destination";
+const HISTORY_RULES = {
+    action_ledger: { appendOnly: true }, ledger_seal: { appendOnly: true }, ledger_checkpoint: { appendOnly: true },
+    // v114: a finished run whose process witnesses have all exited keeps one summary row in place of them.
+    run_process: { compacted: { into: "run_process_summary", sum: "witnesses" } }, run_process_summary: { appendOnly: true },
+    // v114: single-destination delivery columns may be dropped only once their values are legacy receipts.
+    notification: { dropped: ["attempts", "last_attempt_at", "last_error", "delivered_at", "receipt", "claim_owner", "claim_expires_at"], carried: { into: "notification_delivery", destination: LEGACY_DESTINATION } },
+    notification_delivery: { receives: LEGACY_DESTINATION },
+};
+const tableColumns = (db, name) => db.prepare("PRAGMA table_info(" + quote(name) + ")").all().map(r => String(r["name"]));
+const plainValue = (_, v) => v instanceof Uint8Array ? Buffer.from(v).toString("hex") : typeof v === "bigint" ? String(v) : v;
+/** Rows streamed into a sha256, never held together: through a rowid in rowid order, or a WITHOUT ROWID table whole. */
+function rowsHash(db, name, columns, through) {
+    const select = "SELECT " + (through === undefined ? "" : 'rowid AS "rowid:", ') + columns.map(quote).join(",") + " FROM " + quote(name);
+    const key = () => db.prepare("SELECT name FROM pragma_table_info(?) WHERE pk > 0 ORDER BY pk").all(name).map(r => quote(String(r["name"]))).join(",");
+    const rows = through === undefined ? db.prepare(select + " ORDER BY " + key()).iterate() : db.prepare(select + " WHERE rowid <= ? ORDER BY rowid").iterate(through);
+    const hash = createHash("sha256");
+    let count = 0;
+    for (const row of rows) {
+        hash.update(JSON.stringify(Object.values(row), plainValue) + "\n");
+        count++;
+    }
+    return { count, hash: hash.digest("hex") };
+}
+/** Rows under one receipt destination, and each column's non-null values among them: counted, never read. */
+function receipts(db, name, destination, columns) {
+    const r = db.prepare("SELECT count(*) AS n" + columns.map(column => ",count(" + quote(column) + ") AS " + quote(column)).join("") + " FROM " + quote(name) + " WHERE destination = ?").get(destination);
+    return { count: Number(r["n"]), nonNull: Object.fromEntries(columns.map(column => [column, Number(r[column])])) };
+}
+const summed = (db, into) => db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name=?").get(into.into) ? Number(db.prepare("SELECT coalesce(sum(" + quote(into.sum) + "),0) AS n FROM " + quote(into.into)).get()["n"]) : 0;
+/** Each saved table's columns, row count and last rowid; the append-only ones hashed (deploy-browser's rehearsal check).
+ * Bounded: only the ledger and small tables are read row by row. */
 export function historySnapshot(db) {
-    return db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' AND name <> 'schema_version' ORDER BY name").all()
-        .map(row => String(row["name"])).map(name => {
-        const columns = db.prepare("PRAGMA table_info(" + quote(name) + ")").all().map(r => String(r["name"]));
-        return { name, columns, ...tableDigest(db, name, columns) };
+    return db.prepare("SELECT name, wr FROM pragma_table_list WHERE schema='main' AND type IN ('table','shadow') AND name NOT LIKE 'sqlite_%' AND name <> 'schema_version' ORDER BY name").all()
+        .map(row => {
+        const name = String(row["name"]), rowid = row["wr"] === 0, columns = tableColumns(db, name), rule = HISTORY_RULES[name];
+        if (!rowid)
+            return { name, columns, rowid, last: 0, ...rowsHash(db, name, columns) };
+        const r = db.prepare("SELECT count(*) AS n, coalesce(max(rowid),0) AS last FROM " + quote(name)).get();
+        const t = { name, columns, rowid, count: Number(r["n"]), last: Number(r["last"]) };
+        const droppable = columns.filter(column => rule?.dropped?.includes(column));
+        if (droppable.length > 0) {
+            const occupancy = db.prepare("SELECT " + droppable.map(column => "count(" + quote(column) + ") AS " + quote(column)).join(",") + " FROM " + quote(name)).get();
+            t.nonNull = Object.fromEntries(droppable.map(column => [column, Number(occupancy[column])]));
+            t.carry = Number(db.prepare("SELECT count(*) AS n FROM " + quote(name) + " WHERE " + droppable.map(column => quote(column) + " IS NOT NULL").join(" OR ")).get()["n"]);
+        }
+        if (rule?.receives)
+            t.received = receipts(db, name, rule.receives, columns.filter(column => column !== "notification" && column !== "destination"));
+        if (rule?.appendOnly)
+            t.hash = rowsHash(db, name, columns, t.last).hash;
+        if (rule?.compacted)
+            t.summed = summed(db, rule.compacted);
+        return t;
     });
 }
+/** The tables whose saved history the migration changed beyond what HISTORY_RULES declares. */
 export function changedHistory(db, before) {
     const tables = new Set(db.prepare("SELECT name FROM sqlite_master WHERE type='table'").all().map(r => String(r["name"])));
+    // Receipts each receiving table gained, and the dropped values a carrying table owes it.
+    const gained = new Map(), owed = new Map();
+    for (const t of before) {
+        if (t.received && tables.has(t.name)) {
+            const after = receipts(db, t.name, HISTORY_RULES[t.name].receives, Object.keys(t.received.nonNull));
+            gained.set(t.name, { count: after.count - t.received.count, nonNull: Object.fromEntries(Object.entries(after.nonNull).map(([c, n]) => [c, n - (t.received.nonNull[c] ?? 0)])) });
+        }
+        const carried = HISTORY_RULES[t.name]?.carried;
+        if (carried && t.carry && tables.has(t.name)) {
+            const present = new Set(tableColumns(db, t.name)), lost = t.columns.filter(c => !present.has(c) && HISTORY_RULES[t.name].dropped.includes(c));
+            if (lost.length > 0)
+                owed.set(carried.into, { count: t.carry, nonNull: Object.fromEntries(lost.map(c => [c, t.nonNull[c]])) });
+        }
+    }
+    const accounted = (rule, t) => {
+        if (!rule?.carried)
+            return false;
+        const got = gained.get(rule.carried.into), want = owed.get(rule.carried.into);
+        return got !== undefined && want !== undefined && got.count === want.count && Object.entries(want.nonNull).every(([c, n]) => got.nonNull[c] === n) && t.carry === want.count;
+    };
     return before.filter(t => {
         if (!tables.has(t.name))
             return true;
-        const present = new Set(db.prepare("PRAGMA table_info(" + quote(t.name) + ")").all().map(r => String(r["name"])));
-        if (t.columns.some(c => !present.has(c)))
+        const rule = HISTORY_RULES[t.name], present = new Set(tableColumns(db, t.name));
+        if (t.columns.some(c => !present.has(c) && (!rule?.dropped?.includes(c) || (t.nonNull?.[c] !== 0 && !accounted(rule, t)))))
             return true;
-        const after = tableDigest(db, t.name, t.columns);
-        return after.count !== t.count || after.hash !== t.hash;
+        const columns = t.columns.filter(c => present.has(c));
+        if (!t.rowid) {
+            const after = rowsHash(db, t.name, columns);
+            return after.count !== t.count || after.hash !== t.hash;
+        }
+        if (rule?.appendOnly) {
+            const after = rowsHash(db, t.name, columns, t.last);
+            return after.count !== t.count || after.hash !== t.hash;
+        }
+        const r = db.prepare("SELECT count(*) AS n, coalesce(max(rowid),0) AS last FROM " + quote(t.name)).get(), count = Number(r["n"]), last = Number(r["last"]);
+        if (rule?.compacted)
+            return count > t.count || last > t.last || t.count - count !== summed(db, rule.compacted) - (t.summed ?? 0);
+        if (rule?.receives) {
+            const added = gained.get(t.name)?.count ?? 0;
+            return count - t.count !== added || (added > 0 && added !== owed.get(t.name)?.count) || last < t.last;
+        }
+        return count !== t.count || last !== t.last;
     }).map(t => t.name);
 }
 async function rehearse(j, system, source) {
@@ -345,7 +432,9 @@ async function rehearse(j, system, source) {
     chmodSync(copy, 0o600);
     try {
         let db = new (sqlite().DatabaseSync)(copy, { readOnly: true });
-        const before = historySnapshot(db);
+        // Rows already pointing nowhere before the update are the install's own; only ones the migration makes refuse.
+        const orphans = () => new Set([...db.prepare("PRAGMA foreign_key_check").iterate()].map(row => JSON.stringify(row)));
+        const before = historySnapshot(db), orphaned = orphans();
         db.close();
         await system.rehearse(j.to.dist, copy);
         db = new (sqlite().DatabaseSync)(copy, { readOnly: true });
@@ -355,6 +444,8 @@ async function rehearse(j, system, source) {
                 throw new Refusal(`Toolroll ${j.to.version} would change saved history in ${changed.slice(0, 4).join(", ")}${changed.length > 4 ? ` and ${changed.length - 4} more` : ""}. Nothing was changed.`);
             if (db.prepare("PRAGMA integrity_check").get()?.["integrity_check"] !== "ok")
                 throw new Refusal(`The rehearsed database failed its integrity check under ${j.to.version}. Nothing was changed.`);
+            if ([...orphans()].some(row => !orphaned.has(row)))
+                throw new Refusal(`The rehearsed database has rows pointing at missing rows under ${j.to.version}. Nothing was changed.`);
         }
         finally {
             db.close();

package/dist/webhooks.d.ts

@@ -1,23 +1,15 @@
 import type { Notification, Store } from "./store.js";
-export declare const SLACK_ENV = "TOOLROLL_SLACK_WEBHOOK";
-export declare const DISCORD_ENV = "TOOLROLL_DISCORD_WEBHOOK";
-export declare const CONSOLE_URL_ENV = "TOOLROLL_CONSOLE_URL";
-export declare const PRIMARY_ENV = "TOOLROLL_MESSAGING_PRIMARY";
 export type WebhookKind = "slack" | "discord";
 export type WebhookTarget = {
     kind: WebhookKind;
     url: string;
 };
+export declare const LEGACY_WEBHOOK_WARNING = "Legacy webhooks are deprecated. Connect Slack or Discord in Chat settings.";
+export declare const CONSOLE_URL_ENV = "TOOLROLL_CONSOLE_URL";
+export declare const PRIMARY_ENV = "TOOLROLL_MESSAGING_PRIMARY";
 export type MessagingChannel = "telegram" | "slack" | "discord" | "teams";
 export declare const MESSAGING_CHANNELS: readonly MessagingChannel[];
 export declare function isMessagingChannel(value: string): value is MessagingChannel;
-export declare function saveWebhook(dir: string, kind: WebhookKind, url: string): {
-    ok: true;
-} | {
-    ok: false;
-    message: string;
-};
-export declare function clearWebhook(dir: string, kind: WebhookKind): void;
 export declare function saveConsoleUrl(dir: string, url: string): {
     ok: true;
 } | {
@@ -34,20 +26,21 @@ export declare function loadPrimary(env: Record<string, string | undefined>, dir
  * merely fell out of what happens to be configured. Explicit choice wins
  * WHEN its channel is actually configured (a primary pointing at nothing
  * falls through rather than silencing every page); otherwise Telegram if
- * present (it can hold buttons), else the mirrors. `implicit` is the flag
+ * present (it can hold buttons), else the first other connected service. `implicit` is the flag
  * every status surface uses to say "you have several — pick one".
  */
 export declare function effectivePrimary(env: Record<string, string | undefined>, dir: string, telegramConfigured: boolean): {
     channel: MessagingChannel | null;
     implicit: boolean;
     configured: MessagingChannel[];
+    legacyWarning?: string;
 };
 export declare function loadConsoleUrl(env: Record<string, string | undefined>, dir: string): string | null;
 /**
  * The origin a phone link may open, or null. The SAME console-url setting
- * the mirrors use — read again on every call, never cached, so a changed or
+ * chat links use — read again on every call, never cached, so a changed or
  * removed setting stops the next link — held to a stricter shape than a
- * mirror link: exactly an https origin (no credentials, path, query,
+ * desktop link: exactly an https origin (no credentials, path, query,
  * fragment), not loopback, and, when the console this process co-hosts
  * states its own `--public-url`, exactly that origin. A model, a Host
  * header or a proposal field never supplies it, and nothing here probes
@@ -74,14 +67,9 @@ export type WebhookReport = {
     sent: number;
     problems: string[];
 };
-/**
- * Deliver every pending notification to every configured mirror, through
- * the SAME claim/finalize discipline as every other deliverer — so a
- * webhook pass and a Telegram bridge can never both own one row. This
- * pass runs when Telegram is NOT configured; with a paired Telegram chat,
- * Telegram remains the delivery channel (it can carry buttons) and these
- * mirrors stay silent rather than double-paging every phone.
- */
+/** Only the chosen service sends; an interactive adapter suppresses its old mirror. */
+export declare function activeWebhookTargets(env: Record<string, string | undefined>, dir: string, channel: MessagingChannel | null): WebhookTarget[];
+/** Each destination owns its claim and receipt; a successful one never hides another's retry. */
 export declare function webhookPass(store: Store, options: {
     targets: WebhookTarget[];
     consoleUrl: string | null;

package/dist/webhooks.js

@@ -1,58 +1,29 @@
+import { randomUUID } from "node:crypto";
+import { notificationClaimHeld, claimNotifications, finalizeNotification, notificationDestination } from "./notification-delivery.js";
 import { loadDiscordCredentials } from "./discord-api.js";
 import { loadTeamsCredentials } from "./teams-api.js";
 import { loadSlackCredentials } from "./slack-api.js";
 /**
- * Legacy notification-only webhooks. Interactive Slack and Discord adapters
- * have their own paired identities and reuse the shared action engine.
- * A configured interactive adapter suppresses its legacy webhook delivery.
- *
- * The webhook URL is a CREDENTIAL (anyone holding it can post to the
- * channel): it lives in a 0600 file beside the database or in the
- * environment, is never a database column, and never appears in logs or
- * errors — the same rules as the bot token, for the same reasons.
+ * Messaging settings beside the database: which connected chat service
+ * receives alerts (the primary), and the console URL that links in chats
+ * and phone pushes open. The chat services themselves — Telegram and the
+ * interactive Slack, Discord and Teams adapters — keep their own
+ * credentials; this file only reads whether they are configured.
  */
-import { readFileSync, writeFileSync, chmodSync, rmSync } from "node:fs";
+import { readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { envValue } from "./names.js";
-export const SLACK_ENV = "TOOLROLL_SLACK_WEBHOOK";
-export const DISCORD_ENV = "TOOLROLL_DISCORD_WEBHOOK";
+const FILE_OF = { slack: "slack-webhook", discord: "discord-webhook" };
+const POST_TIMEOUT_MS = 10_000;
+export const LEGACY_WEBHOOK_WARNING = "Legacy webhooks are deprecated. Connect Slack or Discord in Chat settings.";
 export const CONSOLE_URL_ENV = "TOOLROLL_CONSOLE_URL";
 export const PRIMARY_ENV = "TOOLROLL_MESSAGING_PRIMARY";
-/** How long one delivery claim protects a row from a second sender. */
-const DELIVERY_CLAIM_MS = 60_000;
-const POST_TIMEOUT_MS = 10_000;
-const FILE_OF = {
-    slack: "slack-webhook",
-    discord: "discord-webhook",
-};
 const CONSOLE_FILE = "console-url";
 const PRIMARY_FILE = "messaging-primary";
 export const MESSAGING_CHANNELS = ["telegram", "slack", "discord", "teams"];
 export function isMessagingChannel(value) {
     return MESSAGING_CHANNELS.includes(value);
 }
-/** The shapes each platform hands out; anything else is probably a paste error. */
-const URL_SHAPE = {
-    slack: /^https:\/\/hooks\.slack\.com\/\S+$/,
-    discord: /^https:\/\/(canary\.|ptb\.)?discord\.com\/api\/webhooks\/\S+$/,
-};
-export function saveWebhook(dir, kind, url) {
-    if (!URL_SHAPE[kind].test(url.trim())) {
-        return { ok: false, message: `that does not look like a ${kind} webhook URL — paste it exactly as the platform issued it` };
-    }
-    const file = join(dir, FILE_OF[kind]);
-    writeFileSync(file, `${url.trim()}\n`, { mode: 0o600 });
-    chmodSync(file, 0o600);
-    return { ok: true };
-}
-export function clearWebhook(dir, kind) {
-    try {
-        rmSync(join(dir, FILE_OF[kind]));
-    }
-    catch {
-        // Already absent is cleared.
-    }
-}
 export function saveConsoleUrl(dir, url) {
     // Parsed, not pattern-matched (attended review, finding 11): the stored
     // value becomes every deep link's base, so userinfo, queries, and
@@ -111,26 +82,27 @@ export function loadPrimary(env, dir) {
  * merely fell out of what happens to be configured. Explicit choice wins
  * WHEN its channel is actually configured (a primary pointing at nothing
  * falls through rather than silencing every page); otherwise Telegram if
- * present (it can hold buttons), else the mirrors. `implicit` is the flag
+ * present (it can hold buttons), else the first other connected service. `implicit` is the flag
  * every status surface uses to say "you have several — pick one".
  */
 export function effectivePrimary(env, dir, telegramConfigured) {
     const targets = loadWebhookTargets(env, dir);
+    const warning = targets.length ? { legacyWarning: LEGACY_WEBHOOK_WARNING } : {};
     const configured = [
         ...(telegramConfigured ? ["telegram"] : []),
         ...(loadSlackCredentials(dir) !== null ? ["slack"] : []),
         ...(loadDiscordCredentials(dir) !== null ? ["discord"] : []),
         ...(loadTeamsCredentials(dir) !== null ? ["teams"] : []),
-        ...targets.map(one => one.kind).filter(kind => (kind !== "slack" || loadSlackCredentials(dir) === null) && (kind !== "discord" || loadDiscordCredentials(dir) === null)),
+        ...targets.map(one => one.kind).filter(kind => kind === "slack" ? loadSlackCredentials(dir) === null : loadDiscordCredentials(dir) === null),
     ];
     const chosen = loadPrimary(env, dir);
     if (chosen !== null && configured.includes(chosen)) {
-        return { channel: chosen, implicit: false, configured };
+        return { channel: chosen, implicit: false, configured, ...warning };
     }
     if (telegramConfigured)
-        return { channel: "telegram", implicit: configured.length > 1, configured };
+        return { channel: "telegram", implicit: configured.length > 1, configured, ...warning };
     const fallback = configured[0] ?? null;
-    return { channel: fallback, implicit: configured.length > 1, configured };
+    return { channel: fallback, implicit: configured.length > 1, configured, ...warning };
 }
 export function loadConsoleUrl(env, dir) {
     const configured = envValue(env, "CONSOLE_URL") ?? readTrimmed(join(dir, CONSOLE_FILE));
@@ -161,9 +133,9 @@ function isLoopbackHost(hostname) {
 }
 /**
  * The origin a phone link may open, or null. The SAME console-url setting
- * the mirrors use — read again on every call, never cached, so a changed or
+ * chat links use — read again on every call, never cached, so a changed or
  * removed setting stops the next link — held to a stricter shape than a
- * mirror link: exactly an https origin (no credentials, path, query,
+ * desktop link: exactly an https origin (no credentials, path, query,
  * fragment), not loopback, and, when the console this process co-hosts
  * states its own `--public-url`, exactly that origin. A model, a Host
  * header or a proposal field never supplies it, and nothing here probes
@@ -216,7 +188,6 @@ export function linkFor(consoleUrl, notification) {
  * message is a mirror and the UI is the instrument.
  */
 export async function postWebhook(target, notification, link, fetcher = fetch) {
-    const lines = [notification.subject, "", notification.body];
     const body = target.kind === "slack"
         ? {
             text: [
@@ -232,7 +203,6 @@ export async function postWebhook(target, notification, link, fetcher = fetch) {
                 ...(link === null ? [] : [link]),
             ].join("\n").slice(0, 1900),
         };
-    void lines;
     try {
         const response = await fetcher(target.url, {
             method: "POST",
@@ -246,43 +216,35 @@ export async function postWebhook(target, notification, link, fetcher = fetch) {
         }
         return { ok: true };
     }
-    catch (error) {
-        const said = error instanceof Error ? error.name : "failed";
-        return { ok: false, error: `${target.kind} delivery ${said}` };
+    catch {
+        return { ok: false, error: `${target.kind} delivery failed` };
     }
 }
-/**
- * Deliver every pending notification to every configured mirror, through
- * the SAME claim/finalize discipline as every other deliverer — so a
- * webhook pass and a Telegram bridge can never both own one row. This
- * pass runs when Telegram is NOT configured; with a paired Telegram chat,
- * Telegram remains the delivery channel (it can carry buttons) and these
- * mirrors stay silent rather than double-paging every phone.
- */
+/** Only the chosen service sends; an interactive adapter suppresses its old mirror. */
+export function activeWebhookTargets(env, dir, channel) {
+    return loadWebhookTargets(env, dir).filter(one => one.kind === channel && (one.kind === "slack" ? loadSlackCredentials(dir) === null : loadDiscordCredentials(dir) === null));
+}
+/** Each destination owns its claim and receipt; a successful one never hides another's retry. */
 export async function webhookPass(store, options) {
-    const clock = options.clock ?? (() => new Date());
-    const owner = options.owner ?? `webhooks-${Math.floor(clock().getTime() / 1000)}`;
+    const clock = options.clock ?? (() => new Date()), owner = options.owner ?? `webhooks-${randomUUID()}`;
     const report = { sent: 0, problems: [] };
-    if (options.targets.length === 0)
-        return report;
-    const claimed = store.claimDeliveries(owner, DELIVERY_CLAIM_MS, clock());
-    for (const row of claimed) {
-        // The lead's own work posts to no channel; the console keeps it.
-        if (store.leadQuiet(row)) {
-            store.finalizeDelivery(row.id, owner, { ok: true, receipt: "skipped:quiet" }, clock());
-            continue;
+    for (const target of options.targets) {
+        const destination = notificationDestination(`webhook:${target.kind}`, target.url);
+        for (const row of claimNotifications(store, destination, owner, clock())) {
+            if (!notificationClaimHeld(store, row, owner, clock())) {
+                report.problems.push(`notification ${row.id}: claim expired or notification resolved`);
+                continue;
+            }
+            const outcome = store.leadQuiet(row) ? { ok: true, receipt: "skipped:quiet" }
+                : await postWebhook(target, row, linkFor(options.consoleUrl, row), options.fetcher);
+            const finalized = finalizeNotification(store, row, owner, outcome.ok ? { ok: true, receipt: "receipt" in outcome ? outcome.receipt : target.kind } : outcome, clock());
+            if (outcome.ok && finalized && !("receipt" in outcome))
+                report.sent++;
+            if (outcome.ok && !finalized)
+                report.problems.push(`notification ${row.id}: delivery receipt claim expired`);
+            if (!outcome.ok)
+                report.problems.push(`notification ${row.id}: ${outcome.error}`);
         }
-        const link = linkFor(options.consoleUrl, row);
-        const outcomes = await Promise.all(options.targets.map(target => postWebhook(target, row, link, options.fetcher ?? fetch)));
-        const failed = outcomes.filter(one => !one.ok);
-        const outcome = failed.length === 0
-            ? { ok: true, receipt: options.targets.map(one => one.kind).join("+") }
-            : { ok: false, error: failed.map(one => (one.ok ? "" : one.error)).join("; ") };
-        const finalized = store.finalizeDelivery(row.id, owner, outcome, clock());
-        if (outcome.ok && finalized)
-            report.sent++;
-        if (!outcome.ok)
-            report.problems.push(`notification ${row.id}: ${outcome.error}`);
     }
     return report;
 }

package/dist/work-index.js

@@ -75,7 +75,7 @@ const PROJECTION = `WITH RECURSIVE admitted AS MATERIALIZED (
   SELECT r.task_ref FROM held_session h JOIN run r ON r.id=h.run JOIN admitted a ON a.ref_id=r.task_ref WHERE h.ended_at IS NULL
   UNION
   SELECT r.task_ref FROM run r INDEXED BY work_spawned_run JOIN admitted a ON a.ref_id=r.task_ref
-    WHERE r.provider_started_at IS NOT NULL AND NOT EXISTS(SELECT 1 FROM run_process p WHERE p.run=r.id)
+    WHERE r.provider_started_at IS NOT NULL AND NOT EXISTS(SELECT 1 FROM run_process p WHERE p.run=r.id) AND NOT EXISTS(SELECT 1 FROM run_process_summary s WHERE s.run=r.id)
   UNION
   SELECT r.task_ref FROM run_process p INDEXED BY work_unsettled_custody JOIN run r ON r.id=p.run JOIN admitted a ON a.ref_id=r.task_ref
     WHERE p.exited_at IS NULL AND p.container_empty_at IS NULL
@@ -290,7 +290,7 @@ function registerValidators(store) {
  * there, which only the store can read (a held or unreadable workspace). */
 function custodyReadings(store) {
     const refs = store.handle.prepare(`SELECT r.task_ref FROM held_session h JOIN run r ON r.id=h.run WHERE h.ended_at IS NULL
-    UNION SELECT r.task_ref FROM run r WHERE r.provider_started_at IS NOT NULL AND NOT EXISTS(SELECT 1 FROM run_process p WHERE p.run=r.id)
+    UNION SELECT r.task_ref FROM run r WHERE r.provider_started_at IS NOT NULL AND NOT EXISTS(SELECT 1 FROM run_process p WHERE p.run=r.id) AND NOT EXISTS(SELECT 1 FROM run_process_summary s WHERE s.run=r.id)
     UNION SELECT r.task_ref FROM run_process p JOIN run r ON r.id=p.run WHERE p.exited_at IS NULL AND p.container_empty_at IS NULL`).all().map(row => Number(row['task_ref']));
     const noted = store.handle.prepare(`SELECT r.task_ref,r.worktree FROM task t JOIN task_ref tr ON tr.external_id=t.id
     JOIN run r ON r.id=(SELECT MAX(id) FROM run WHERE task_ref=tr.id AND role IN ('builder','scout') AND finished_at IS NOT NULL)

package/dist/workspace-revision.d.ts

@@ -1,6 +1,33 @@
+/** Durable invalidation for authenticated workspace reads. This is cache
+ * metadata only: it never grants access or certifies task/process state.
+ *
+ * The revision is one service_cursor row. Every Toolroll connection is wrapped
+ * (trackWorkspaceWrites, from the Store) and moves it once per committed
+ * meaningful write: inside a transaction at its outer COMMIT (a rollback, or a
+ * savepoint rolled back to, moves nothing), and right after an autocommit
+ * statement. Quiet writes (heartbeats, cursors, receipts) move nothing; a beat
+ * after a liveness or lease gap is a revival and does. Readers in another
+ * process see the commit through PRAGMA data_version. No trigger is installed:
+ * the schema stays the schema (v114 dropped the 801 per-table triggers). */
+import type { Database } from './store.js';
 import type { Store } from './store.js';
-/** The service_cursor row the revision triggers move (live-bus.ts listens for it). */
+/** The service_cursor row every meaningful commit moves (live-bus.ts listens for it). */
 export declare const WORKSPACE_REVISION_KEY = "workspace-content:v1";
+/** What one statement does to the workspace: a transaction boundary, a write to a table (quiet or not), or nothing. */
+type Effect = {
+    kind: 'begin' | 'commit' | 'rollback' | 'none';
+} | {
+    kind: 'savepoint' | 'rollback-to' | 'release';
+    name: string;
+} | {
+    kind: 'write';
+    table: string;
+    quiet: boolean;
+};
+export declare function statementEffect(sql: string): Effect;
+/** Wrap one connection so each committed meaningful write moves the workspace revision exactly once. Native
+ * extensions (scalar functions, isTransaction) pass through; a test spy on prepare/exec replaces only the facade's. */
+export declare function trackWorkspaceWrites(db: Database): Database;
 export type WorkspaceRevision = {
     current(): string;
     expiresAt(now: Date): number;