toolroll 0.9.51 → 0.9.53

package/dist/store.d.ts

@@ -6,9 +6,9 @@ import { type Actor } from "./actor.js";
 import { type LiveActivityKind } from "./live.js";
 import { type TokenPurpose } from "./api-tokens.js";
 import { type CriterionMatrixRow, type CriterionJudgementWord } from "./proof.js";
-import { type ExecutionProfile, type ChainEntry, type UnattendedPermissionMode, type AcceptanceCriterion } from "./scope.js";
-import { type ProviderRoom, type CandidateTier, type TaskSize, type TaskSizing, type PhaseRoute, type PublicationAuthority, type RouteStamp, type ReadinessLookup, type ReadinessObservation, type RiskLevel, type RouteOverride } from "./phase-routing.js";
-import { type TerminalClass } from "./exhaustion.js";
+import { type ExecutionProfile, type UnattendedPermissionMode, type AcceptanceCriterion } from "./scope.js";
+import { type ProviderRoom, type CandidateTier, type TaskSize, type TaskSizing, type PhaseRoute, type PublicationAuthority, type RouteStamp, type ReadinessLookup, type ReadinessObservation, type RouteOverride } from "./phase-routing.js";
+import type { TerminalClass } from "./exhaustion.js";
 import { type ProviderId } from "./provider.js";
 import type { BoardFacts } from "./board.js";
 import type { BackendGrant, TaskOrigin } from "./grant.js";
@@ -152,7 +152,9 @@ export type SealedLedgerEntry = LedgerEntry & {
         hash: string;
     } | null;
 };
-export declare const SCHEMA_VERSION = 113;
+export declare const SCHEMA_VERSION = 115;
+/** v115: the tables migrateToV115 drops. */
+export declare const V115_DROPPED_TABLES: readonly string[];
 /**
  * The migrations `toolroll update` may carry a database through in place: each
  * one only adds (a table, a column, an accepted value) and leaves every saved row
@@ -166,6 +168,19 @@ export declare const SCHEMA_VERSION = 113;
  * api_token columns (project limit, rotation); existing tokens read as before.
  * v112 only adds the two request-budget tables.
  * v113 adds MCP sign-in tables and API-token purpose metadata.
+ * v114 is the one declared exception to "only adds", and the rehearsal checks
+ * it as such: a settled run's exited process witnesses become one summary row
+ * (rows removed equal the witnesses summarized), and notification drops its
+ * delivery columns only after every value moves into one legacy receipt per row
+ * (rows and ids carried whole; legacy receipts added equal the rows carried).
+ * v115 removes contests, held sessions, fallback chains and routines, and is
+ * checked under rules named for exactly that: the eleven removed tables may go
+ * whole, every kept flow and trigger row stays as it was, and the only rows
+ * added are one flow and one schedule trigger per saved routine (paused unless
+ * the routine was approved and running). Its other changes add a column or
+ * settle rows in place; a database whose removed features still held a hold
+ * to lift or place changes that table's rows and is refused, so it takes the
+ * separate procedure.
  */
 export declare const UPDATE_SAFE_MIGRATIONS: readonly number[];
 /** Whether a database settled at `version` reaches this build's schema through update-safe migrations alone. */
@@ -291,9 +306,7 @@ export type TaskRef = {
     /** What comes back (v34): a branch to publish, or a report to read.
      * Set at filing and never rewritten — a scout's strikes are the task's. */
     deliverable: "branch" | "report";
-    /** The standing order this task is an instance of; null for one-off work. */
-    routineId: number | null;
-    /** The pinned agent, when a fire transaction stamped one. Authoritative. */
+    /** The pinned agent, when an approved standing order stamped one. Authoritative. */
     agentProvider: string | null;
     agentModel: string | null;
     /** Durable per-task override. null means the installation default is used
@@ -303,9 +316,6 @@ export type TaskRef = {
     /** Durable per-task evidence-policy override. null inherits the
      * installation default when a scope is next written. */
     qualityMode?: QualityMode | null;
-    /** v47: the task's declared risk; null reads as routine when the next
-     * scope is filed. The scope stores the signed level. */
-    riskLevel?: RiskLevel | null;
     /** v47: the approver's per-phase route overrides, applied when the next
      * scope is filed and recorded in the sealed route. null = the stored
      * list is malformed; the next filing goes unresolved rather than routing
@@ -329,88 +339,11 @@ export type TaskRef = {
     origin: TaskOrigin;
 };
 /** A standing order: a pre-approved template whose instances build unattended. */
-export type TournamentTerms = {
-    id: number;
-    taskRef: number;
-    generation: number;
-    active: boolean;
-    /** v27: 'race' = dollar-capped tournament; 'comparison' = labeled
-     * cross-runtime comparison with no dollar terms. */
-    kind: "race" | "comparison";
-    raceDigest: string;
-    /** Ordered agents: exact model ids, resolved at filing. */
-    agents: {
-        provider: string;
-        model: string;
-        repairModel: string;
-        permissionMode?: UnattendedPermissionMode;
-    }[];
-    n: number;
-    perAgentBudgetMicrousd: number;
-    overrunReserveMicrousd: number;
-    totalBudgetMicrousd: number;
-    priceVersion: number;
-    retries: number;
-    publicationPolicy: string;
-    createdAt: string;
-    approvedAt: string | null;
-    approvedBy: string | null;
-    approvedDigest: string | null;
-};
-export type ContestState = "dispatching" | "racing" | "pick-wait" | "decision-wait" | "picked" | "abandoned" | "interrupted" | "exhausted";
-export type Contest = {
-    id: number;
-    taskRef: number;
-    terms: number;
-    generation: number;
-    state: ContestState;
-    scopeDigest: string;
-    raceDigest: string;
-    baseSha: string | null;
-    setupDigest: string | null;
-    currentLeaseId: string | null;
-    runner: string | null;
-    incarnation: string | null;
-    createdAt: string;
-    pickedAt: string | null;
-    pickedBy: string | null;
-    winnerContestant: number | null;
-    /** One escalation page per tournament, ever — set with the page. */
-    overduePaged: boolean;
-    /** v27: denormalized from the terms at admission. */
-    kind: "race" | "comparison";
-};
-export type ContestantState = "pending" | "ready" | "building" | "parked" | "built" | "failed" | "stopped";
-export type Contestant = {
-    /** v24: the contestant's own sealed execution profile. */
-    profile?: ExecutionProfile | null;
-    id: number;
-    contest: number;
-    ordinal: number;
-    provider: string;
-    model: string;
-    repairModel: string;
-    branch: string;
-    worktree: string | null;
-    generation: number;
-    state: ContestantState;
-    activeRun: number | null;
-    budgetMicrousd: number;
-    reserveMicrousd: number;
-    /** What the provider reported — monotonic, never guessed. */
-    measuredMicrousd: number;
-    /** What the ledger charges — the full reservation when unknowable. */
-    accountedMicrousd: number;
-    unknownSpend: boolean;
-    cleanup: "pending" | "done" | "attention" | null;
-    custody: string | null;
-};
 export type ExecutionSlot = {
     id: number;
     runner: string;
     state: "reserved" | "running" | "released";
     run: number | null;
-    contestant: number | null;
     incarnation: string | null;
     processGroup: number | null;
     reservedAt: string;
@@ -478,14 +411,6 @@ export type ChatSnapshot = {
         ageHours: number;
     }[];
     incidentsSaturated: boolean;
-    routines: {
-        repoIndex: number;
-        name: string;
-        schedule: string;
-        status: string;
-        lastFire: string | null;
-    }[];
-    routinesSaturated: boolean;
     publications: {
         repoIndex: number;
         pr: number | null;
@@ -879,76 +804,10 @@ export type MateTurn = {
     tokensOut: number | null;
     failureReason: string | null;
 };
-export type Routine = {
-    id: number;
-    name: string;
-    /** v102: who made it (its instances are filed as theirs); null before v102 or when no person is known. */
-    createdBy: string | null;
-    repo: string;
-    goal: string;
-    outOfScope: string | null;
-    touches: string[];
-    /** v39: the signed rubric every instance's scope copies forward. */
-    acceptance: AcceptanceCriterion[];
-    requirements: string[];
-    /** 'every:<minutes>', 'daily:<HH:MM>[@Zone]', or 'weekly:<0-6>:<HH:MM>[@Zone]' (UTC by default). */
-    schedule: string;
-    singleFlight: boolean;
-    /** Rolling 7-day dollar ceiling; null = none. Enforcement fails closed. */
-    costCeilingUsd: number | null;
-    /** Per-instance dollar cap (v16); copied into each instance's scope. */
-    budgetPerRunMicrousd: number | null;
-    paused: boolean;
-    /** Of every term above. Approval binds to this exact value. */
-    digest: string;
-    approvedAt: string | null;
-    approvedBy: string | null;
-    approvedDigest: string | null;
-    /** The next scheduled occurrence; null until approved. */
-    nextFireAt: string | null;
-    /** Immutable filing provenance (v12); null on rows from before it existed. */
-    filedVia: string | null;
-    createdAt: string;
-    updatedAt: string;
-    /** v24: the working execution profile and the approval's sealed snapshot. */
-    profile?: ExecutionProfile | null;
-    approvedProfile?: ExecutionProfile | null;
-    /** v48: the four-role agent route the digest binds, and the snapshot the
-     * approval sealed. Null on a routine filed before routing froze — such a
-     * routine cannot be approved or fired until it is filed again. A row
-     * carrying unreadable route bytes reads null too, and fails closed. */
-    route?: PhaseRoute | null;
-    approvedRoute?: PhaseRoute | null;
-    /** v48: true when the row CARRIES route or profile bytes that do not
-     * read back — a corrupt snapshot, as distinct from one never taken. Every
-     * surface says which, and both fail closed. */
-    routeUnreadable?: boolean;
-    approvedRouteUnreadable?: boolean;
-    approvedProfileUnreadable?: boolean;
-    /** THE RAW TERMS VERDICT (raw authority repair): null when every stored
-     * term the digest binds read back EXACTLY — touches and requirements as
-     * JSON lists of strings, the rubric as whole criteria with no unknown
-     * key, the flags as 0/1, the ceilings as numbers or null — and the words
-     * when one did not. The integrity projection reads it FIRST: a row whose
-     * terms cannot be read exactly is not approved, not live, not approvable,
-     * and not refreshable, so the lenient fields above can never become a
-     * firing's authority. Undefined on a hand-built routine. */
-    termsProblem?: string | null;
-};
-/** One scheduled slot's outcome, fired or skipped — never silent. */
-export type RoutineFire = {
-    id: number;
-    routineId: number;
-    scheduledFor: string;
-    outcome: "fired" | "skipped";
-    reason: string | null;
-    instanceTaskRef: number | null;
-    createdAt: string;
-};
 /** Who placed a hold — and therefore who alone may lift it. */
 /** 'stop' (v52) = the pause one exact attempt's operator stop placed — lifted
  * only by resuming THAT attempt, never by `unhold` or by answering a decision. */
-export type HoldOwner = "operator" | "decision" | "incident" | "backoff" | "contest" | "revision" | "stop";
+export type HoldOwner = "operator" | "decision" | "incident" | "backoff" | "revision" | "stop";
 export type Hold = {
     id: number;
     taskRef: number;
@@ -1030,19 +889,15 @@ export type Notification = {
     subject: string;
     body: string;
     createdAt: string;
-    attempts: number;
-    lastAttemptAt: string | null;
-    lastError: string | null;
-    deliveredAt: string | null;
-    receipt: string | null;
     /** The closed push attention class, or null = this fact never pushes. */
     pushClass: "decision" | "pick" | "merge" | "attention" | "progress" | null;
     /** The machine-minted console path a push may deep-link — never free text. */
     link: string | null;
     /**
      * When the fact stopped wanting a person — a decision answered, an incident
-     * resolved. Distinct from delivery, and it never deletes the row: receipts
-     * are the audit trail of what was actually sent.
+     * resolved. Distinct from delivery, and it never deletes the row: the
+     * per-destination receipts (notification_delivery) are the audit trail of
+     * what was actually sent.
      */
     resolvedAt: string | null;
     scope: "unknown" | "installation" | "project" | "task";
@@ -1051,6 +906,14 @@ export type Notification = {
     taskId: string | null;
     run: number | null;
 };
+/** One notification's delivery state at one destination (notification_delivery). */
+export type NotificationReceipt = Notification & {
+    attempts: number;
+    lastAttemptAt: string | null;
+    lastError: string | null;
+    deliveredAt: string | null;
+    receipt: string | null;
+};
 export type TelegramDelivery = Notification & {
     destination: string;
     claimGeneration: number;
@@ -1107,8 +970,9 @@ export type RunnerWorkRecovery = {
     requeued: string[];
 };
 /** How a stop's settlement was established (v52). `interrupted` = the
- * owning worker sealed the attempt after its processes ended; `held` = the
- * held-session supervisor fenced it; `recovered` = dead-incarnation
+ * owning worker sealed the attempt after its processes ended; `held`
+ * (v52-v114, history only) = the removed held-session supervisor fenced it;
+ * `recovered` = dead-incarnation
  * recovery settled a run whose worker is proven gone; `finished` = the
  * attempt reached another ending first (the stop was recorded, but the
  * run's own outcome stands — the words say which). */
@@ -1209,11 +1073,9 @@ export type Run = {
     branch: string | null;
     worktree: string | null;
     model: string | null;
-    /** 'interrupted' (v25) = a held attended session cut down mid-flight. */
+    /** 'interrupted' (v25–v114) = a held session cut down mid-flight; kept so old rows read. */
     outcome: "built" | "failed" | "refused" | "parked" | "no-change" | "interrupted" | null;
     reason: string | null;
-    /** The attended authorization this run consumed (v25); null = ordinary dispatch. */
-    attendedAuthorization?: string | null;
     committed: boolean | null;
     startedAt: string;
     finishedAt: string | null;
@@ -1229,24 +1091,12 @@ export type Run = {
     headRevision: string | null;
     /** The validated terminal handoff's conclusion. */
     handoff: string | null;
-    /** When racing: which tournament agent this run belongs to. */
-    contestant: number | null;
     /**
      * Where the machine is in ITS OWN state machine — stamped by the control
      * plane at boundaries it owns, never parsed from a provider stream (M5.4).
      * Meaningful while the run is open; the last value simply remains after.
      */
     phase: RunPhase | null;
-    /**
-     * The fallback-chain metadata (v30), NULL on every run outside a chain.
-     * `chainCycle`/`chainIndex`/`entryDigest` are stamped at admission (or at
-     * base-cycle open) and bind the run to exactly one entry of an immutable
-     * approved chain — the runtime re-derives authority from the snapshot,
-     * never from these, but reads them to know which entry ran.
-     */
-    chainCycle?: number | null;
-    chainIndex?: number | null;
-    entryDigest?: string | null;
     /**
      * How this attempt authenticated (v30) — 'subscription' or 'api-key' —
      * stamped by the gateway. Decides which exhaustion class a match yields.
@@ -1254,10 +1104,8 @@ export type Run = {
     authMode?: "subscription" | "api-key" | null;
     /**
      * The gateway's honest classification of how this attempt ENDED (v30),
-     * computed at disposal from the structural terminal + the authoritative
-     * version + auth mode (exhaustion.ts). Fail-closed: 'unknown' until a
-     * fixture-backed recognizer exists. NEVER an authority by itself — the
-     * dispatch's C8 gate re-checks hasRecognizer before any advance.
+     * computed where the structural terminal still exists (exhaustion.ts).
+     * `auth-expired` pauses its provider; every other class is a record.
      */
     terminalClass?: TerminalClass | null;
     /** v44 (adaptive execution plans): the exact plan revision this attempt's
@@ -1271,88 +1119,6 @@ export type Run = {
 /** The bounded activity vocabulary. Machine-authored — a model's prose never becomes one of these. */
 export declare const RUN_PHASES: readonly ["agent-running", "validating-handoff", "capturing-evidence", "committing", "verifying-proof", "correcting-proof"];
 export type RunPhase = (typeof RUN_PHASES)[number];
-/**
- * One person's signed authority for ONE watched attempt (ruling 12). The id
- * is a pre-minted UUID — it IS the attempt identity the dispatch proof
- * consumes. Consumed (attemptRun set) is NOT closed: the authorization
- * stays active across its held session; closure is explicit and terminal.
- */
-export type AttendedAuthorization = {
-    id: string;
-    taskRef: number;
-    approver: string;
-    runner: string;
-    runnerGeneration: number;
-    compositeDigest: string;
-    termsJson: string;
-    maxSessionTurns: number;
-    /** A STOP THRESHOLD, not a ceiling: the agent halts when its total crosses it. */
-    budgetMicrousd: number;
-    /** Continuation: the finished parent attempt, also inside the signed terms. */
-    parentRun: number | null;
-    followup: string | null;
-    createdAt: string;
-    absoluteExpiry: string;
-    lastBeatAt: string | null;
-    attemptRun: number | null;
-    consumedAt: string | null;
-    closedAt: string | null;
-    endReason: string | null;
-};
-/**
- * One stdin injection into a held session (ruling 15). Author is a verified
- * operator name for 'operator' turns ONLY — brief and repair turns are
- * machine-authored and say so with null. 'uncertain' is TERMINAL: written
- * (or accepted) but never proven settled; charged at its reservation and
- * NEVER reinjected.
- */
-export type SessionTurn = {
-    id: number;
-    run: number;
-    seq: number;
-    sourceKind: "brief" | "answer" | "operator" | "repair";
-    /** The decision id for 'answer' turns, the triggering decision for 'repair'. */
-    sourceId: number | null;
-    author: string | null;
-    text: string;
-    reservedMicrousd: number;
-    accountedMicrousd: number | null;
-    accountedAt: string | null;
-    recordedAt: string;
-    writtenAt: string | null;
-    acceptedAt: string | null;
-    settledAt: string | null;
-    /** Marginal delta from the held session's durable cumulative baseline. */
-    measuredMicrousd: number | null;
-    outputTokens: number | null;
-    state: "recorded" | "written" | "accepted" | "settled" | "uncertain" | "cancelled";
-};
-/**
- * Durable crash custody for one held session (ruling 15). The orphan
- * predicate is lease-based; 'fencing' is a helpable, leased state with
- * deadline takeover. cumulativeMicrousd is the settlement baseline the
- * provider's cumulative totals are diffed against.
- */
-export type HeldSession = {
-    run: number;
-    authorizationId: string;
-    runner: string;
-    leaseId: string;
-    upIncarnation: string;
-    cookie: string;
-    socketPath: string;
-    supervisorPid: number | null;
-    agentPgid: number | null;
-    cumulativeMicrousd: number;
-    cumulativeTokensOut: number;
-    state: "open" | "fencing";
-    fencer: string | null;
-    fencingDeadline: string | null;
-    startedAt: string;
-    endedAt: string | null;
-    endReason: string | null;
-};
-export type RecordTurnRefusal = "no-held-session" | "fenced" | "turn-cap" | "turn-open" | "budget-exhausted" | "decision-open" | "repair-exhausted" | "answer-delivered";
 /**
  * One operator steering note (arc 1, v22). Attached ≠ delivered: attachment
  * says which build the note rode toward; delivery settles only on the
@@ -1761,12 +1527,6 @@ export declare const DEFAULT_ACTOR = "operator";
 export declare class RunAdmissionRefused extends Error {
     constructor(message: string);
 }
-/** A present fallback-chain row carries this many entries after the base
- * (atomic authority closure) — the same bound `config set fallback`
- * enforces at the CLI, held again at the store's read and write so a row
- * outside it is a stated problem, never an empty chain. */
-export declare const FALLBACK_ENTRIES_MIN = 1;
-export declare const FALLBACK_ENTRIES_MAX = 3;
 /**
  * The subset of `node:sqlite` this module uses, named so the rest of the file
  * is not written against an `any` and so a test can substitute a handle.
@@ -1868,6 +1628,9 @@ export declare function openStoreNoMigrate(file: string, options?: OpenOptions):
  * retries. Correction children (the same-session structured-output
  * repairs) are not attempts; they continue one. */
 export declare const REVIEW_ROOT_ATTEMPTS = 3;
+/** The receipt v114 keeps a notification's old single-destination delivery under. No sender claims it: every real
+ * destination is a kind and a 64-character hash, or a Telegram binding. */
+export declare const LEGACY_NOTIFICATION_DESTINATION = "legacy:single-destination";
 /** v34: artifact.kind admits 'report'. A table already rebuilt to the v38
  * shape (migrate() runs unconditionally on every open, including a fresh
  * database created straight at the current shape) is a DONE shape too —
@@ -2038,7 +1801,7 @@ export declare class Store {
      * rank any still-dispatchable task holds, computed and written in ONE
      * transaction (two racing "next" calls get distinct ranks; the later
      * ask wins). Scheduling only: it refuses anything not plainly queued —
-     * building, finished, failed, cancelled, or racing a tournament — and
+     * building, finished, failed, or cancelled — and
      * never touches updated_at, which the board reads as the stall clock.
      */
     moveTaskNext(taskId: string, now: Date, mutation?: Mutation): {
@@ -2071,7 +1834,7 @@ export declare class Store {
      * One atomic queue move (queue-columns review, findings 3/9/13): the
      * revision CAS, every refusal, the assignment write, and the rerank of
      * BOTH affected columns are one transaction. The rerank member set is
-     * the FREE members only — anything live-claimed or racing a tournament
+     * the FREE members only — anything live-claimed
      * keeps its rank untouched, so a drag can never rewrite work being
      * taken (a setup-failure release rejoins with the rank the operator
      * last gave it — intent, not a bug). Scheduling, never authority.
@@ -2216,8 +1979,7 @@ export declare class Store {
      * Establish a mirror: the ONE act that makes a local task stand for a
      * tracker item. Identity and provenance are immutable after this row
      * (trigger-enforced); labels and titles may nominate work, only this
-     * establishes whose it is. Refuses tasks carrying race terms or an open
-     * tournament (D1 — external work does not race in this release).
+     * establishes whose it is.
      */
     establishMirror(mirror: {
         localTaskId: string;
@@ -2232,7 +1994,7 @@ export declare class Store {
         ok: true;
     } | {
         ok: false;
-        reason: "unknown-task" | "duplicate" | "racing";
+        reason: "unknown-task" | "duplicate";
     };
     mirrorByTask(taskId: string): ExternalMirror | null;
     mirrorByRemote(backend: string, remoteRepo: string, remoteId: string): ExternalMirror | null;
@@ -2251,7 +2013,7 @@ export declare class Store {
     /**
      * The reopen act (v3 §7 + findings 18/30): an authenticated CAS that
      * requires the tracker to have been SEEN open again after the close,
-     * and the task to be clean — no live claim, no open tournament, no
+     * and the task to be clean — no live claim, no
      * active hold, no open question, no unresolved incident. It reconciles
      * task state from any admitted state back to queued; the approved
      * scope is preserved (its digest never changed) — this act is the
@@ -2261,7 +2023,7 @@ export declare class Store {
         ok: true;
     } | {
         ok: false;
-        reason: "unknown-task" | "not-latched" | "not-seen-open" | "claimed" | "contest-open" | "held" | "question-open" | "incident-open" | "bad-state";
+        reason: "unknown-task" | "not-latched" | "not-seen-open" | "claimed" | "held" | "question-open" | "incident-open" | "bad-state";
     };
     /** The last COMPLETE sync pass for a tracker, or null — freshness's anchor. */
     lastCompleteSync(backend: string, remoteRepo: string): {
@@ -2300,7 +2062,7 @@ export declare class Store {
         why: "stale-mirror" | "external-closed" | "dispatch-revoked" | "plane-blocked";
     }[];
     /** Whether a fresh completion may stand as done (v4 §24) — read INSIDE
-     * completeFenced's transaction. Non-mirrors always complete. */
+     * finalize's complete-ending transaction. Non-mirrors always complete. */
     mirrorAllowsCompletion(taskId: string): boolean;
     /** Whether a stored acquire mutation exists — the replay marker's fact. */
     hasMutationRecord(mutation: Mutation): boolean;
@@ -2321,14 +2083,13 @@ export declare class Store {
     revokeGrant(repo: string, backend: string, mutation?: Mutation): boolean;
     saveScope(scope: Scope, mutation?: Mutation, options?: {
         profile?: ExecutionProfile;
-        /** v48: a FROZEN route — a routine firing's approved snapshot —
+        /** v48: a FROZEN route — an approved standing order's snapshot —
          * filed verbatim instead of being recommended afresh from today's
          * configuration. Requires an explicit profile, and the two must
          * agree exactly (the same belt every other road wears). */
         route?: PhaseRoute;
         permissionMode?: UnattendedPermissionMode;
         qualityMode?: QualityMode;
-        riskLevel?: RiskLevel;
         posture?: "escalated";
         proposedVia?: "mate" | "coordinator" | "scout" | null;
     }): void;
@@ -2489,8 +2250,16 @@ export declare class Store {
         fresh?: number;
     }): LedgerChainReport;
     /** A checkpoint of the chain as it stands: its head, recorded here and handed back to be copied off the machine.
-     * Never over a chain that doesn't verify: that would vouch for what broke it. */
-    ledgerCheckpoint(by: string, now: Date): {
+     * Never over a chain that doesn't verify: that would vouch for what broke it. `automatic` (before a backup, after
+     * a monitoring delivery): at the verified head, or at `head` (one that was sent) once the walk reached it, only past
+     * the newest checkpoint (null otherwise), and with no ledger entry of its own, so a checkpoint never makes new
+     * activity for the next backup or delivery to checkpoint again. */
+    ledgerCheckpoint(by: string, now: Date, automatic?: {
+        head?: {
+            through: number;
+            hash: string;
+        };
+    }): {
         through: number;
         hash: string;
     } | {
@@ -2796,8 +2565,8 @@ export declare class Store {
     /**
      * The revocation that actually severs (D7), one transaction: the stamp
      * plus a generation bump (live console sessions die at their next
-     * lookup; bearer credentials die at authenticateAccount), their open
-     * attended authorizations close, their unconsumed invites die, every
+     * lookup; bearer credentials die at authenticateAccount), their
+     * unconsumed invites die, every
      * mode THEY signed is revoked with the typed 'signer-revoked' event —
      * demoting its derived merge authority through the one reconciliation
      * road — and the derived-authority sweep clears Telegram and push.
@@ -2810,7 +2579,7 @@ export declare class Store {
      * invites, modes and everything mode-derived (their sealed filings
      * demote through the reconciliation road), Telegram, push. Standing
      * acts they completed WITH full ceremony — publication/backend/intake
-     * grants, worktree setups, approved routines, approved scopes sealed by
+     * grants, worktree setups, approved standing orders, approved scopes sealed by
      * password — deliberately survive: those are the instance's promises,
      * approved as themselves, and undoing history is not what revocation
      * means. An operator who distrusts those acts revokes them by their own
@@ -2819,18 +2588,11 @@ export declare class Store {
     revokeAccount(name: string, by: string, now: Date): {
         ok: true;
         modesRevoked: number;
-        authorizationsClosed: number;
         invitesRevoked: number;
     } | {
         ok: false;
         reason: "unknown" | "already-revoked" | "last-approver";
     };
-    /** One person's open attended sessions, for their People card. */
-    openAttendedOf(name: string): {
-        taskId: string;
-        createdAt: string;
-        lastBeatAt: string | null;
-    }[];
     /**
      * One person's recent consequential acts (U3), from the rows that were
      * ALREADY author-stamped — no new event kinds, just the ledger asked a
@@ -3146,321 +2908,6 @@ export declare class Store {
      * finds nothing to consume instead of minting a duplicate task.
      */
     consumeDiffComments(runId: number, ids: readonly number[], taskId: string): number;
-    /** The open cycle for a task, if one exists (the runtime's read). */
-    fallbackCycleFor(taskRef: number): FallbackCycle | null;
-    /** Open a fresh cycle at index 0 for a running base attempt. One live
-     * cycle per task — the SELECT-then-INSERT under BEGIN IMMEDIATE
-     * serializes writers, and the one_live_fallback_cycle_per_task partial
-     * unique index is the durable backstop (finding 5). A second refuses. */
-    openFallbackCycle(taskRef: number, chainDigest: string, tailRun: number | null, now: Date): {
-        ok: true;
-        id: number;
-    } | {
-        ok: false;
-    };
-    /**
-     * The task's IMMUTABLE approved chain — the runtime's single source of
-     * truth for chain length and per-entry authority (never mutable config).
-     * Returns the rehydrated entries when the approval sealed a chain and the
-     * snapshot still rehydrates strictly; null otherwise (a single-profile
-     * approval, or a snapshot that fails the strict rehydrator — fail closed,
-     * so a corrupt chain dispatches nothing).
-     */
-    approvedChainOf(taskId: string): ChainEntry[] | null;
-    /**
-     * The ONE chain-cycle resolver at a run's end (E3c/E3d): every concluded
-     * tail resolves its cycle — success closes it, an ordinary end closes it
-     * (the retry road runs the BASE entry under a FRESH cycle; a concluded
-     * tail can never be re-tagged, so leaving it open would only strand it),
-     * a parked tail is a PAUSED lineage and stays open for repair, and a
-     * recognized eligible exhaustion advances. Both the disposition hook and
-     * the crash reconciler call THIS method, so a crash between disposition
-     * and resolution re-derives the same answer from durable state.
-     *
-     * The advance is FAIL CLOSED at every gate:
-     *   - an OPEN cycle whose tail is exactly this finished run;
-     *   - the run genuinely finished (outcome + finished_at +
-     *     provider_started_at, same task) — never live custody;
-     *   - a fallback-ELIGIBLE class consistent with the run's auth mode;
-     *   - the C8 re-check: THIS build recognizes the exact class/auth for the
-     *     run's (provider, version) — a downgrade severs to incident;
-     *   - the LIVE signed mode's paid-fallback grant, re-read IN-transaction;
-     *   - a next entry in the IMMUTABLE approved chain (else exhausted-end).
-     * The fenced custody walk — sanitize, advance, release-to-pending — runs
-     * atomically inside ONE transaction; a lost inner CAS rolls the whole
-     * walk back. It NEVER dispatches: the admission pass creates the run.
-     */
-    resolveChainOnRunEnd(taskRef: number, taskId: string, repo: string | null, finishedRunId: number, now: Date): {
-        kind: "advanced";
-        toIndex: number;
-    } | {
-        kind: "exhausted-end";
-    } | {
-        kind: "closed";
-        reason: "succeeded" | "entry-ended";
-    } | {
-        kind: "blocked";
-        reason: "no-recognizer" | "grant-withheld" | "corrupt-chain" | "cycle-mismatch";
-    } | {
-        kind: "parked-tail";
-    } | {
-        kind: "no-cycle";
-    };
-    /**
-     * The crash reconciler's read (E3d, review finding 3): OPEN cycles whose
-     * tail run CONCLUDED (non-parked) but whose cycle was never resolved — the
-     * window a crash between disposition and resolveChainOnRunEnd leaves. The
-     * reconciler feeds each through the SAME resolver, so nothing is decided
-     * twice or differently.
-     */
-    strandedChainCycles(repo: string): {
-        cycleId: number;
-        taskRef: number;
-        taskId: string;
-        tailRun: number;
-    }[];
-    /**
-     * The chain reconciler in ONE callable piece (F+G review, finding 5): the
-     * EXACT code the tick runs each pass, so the fault tests drive the same
-     * road production does — deleting the tick's call would fail them.
-     * Resolves every open cycle whose tail concluded (non-parked) through the
-     * one resolver; returns how many it fed through.
-     */
-    reconcileStrandedChains(repo: string, now: Date): number;
-    /** Cycles awaiting their next entry's admission, for one repo — what the
-     * tick's chain admission pass walks. */
-    pendingChainAdmissions(repo: string): {
-        cycleId: number;
-        taskRef: number;
-        taskId: string;
-        cursor: number;
-    }[];
-    /**
-     * The PROVING admission (E3d): create the next entry's run from a
-     * pending-admission cycle, with EVERY authority re-derived inside one
-     * transaction — the approved chain must still stand and match the cycle's
-     * digest, the entry at the cursor must exist, the LIVE signed mode must
-     * still grant the paid fallback (revocation between advance and admission
-     * denies), and the exact unconsumed pending edge is consumed by the run
-     * it creates (admitFallback's single-use CAS). The caller carries only
-     * claim, worktree, and rail; nothing it asserts becomes authority.
-     */
-    admitNextChainEntry(cycleId: number, run: {
-        leaseId: string;
-        runner: string;
-        branch: string;
-        worktree: string;
-        recoveredFrom?: number;
-    }, now: Date): {
-        ok: true;
-        runId: number;
-        taskId: string;
-        provider: string;
-        model: string;
-    } | {
-        ok: false;
-        reason: "not-pending" | "stale-approval" | "grant-withheld" | "no-edge" | "raced" | "provider-unavailable";
-        detail?: string;
-    };
-    /**
-     * The PRE-SPAWN custody proof (Codex E3d review, finding 3): the LAST
-     * gate before a chain-bound run's provider process starts, coupled to the
-     * start stamp in ONE transaction so nothing can lapse between the proof
-     * and the money. Re-derives, from durable state only: the approved chain
-     * still stands (freshness + digest); the run's cycle is live and OPEN
-     * with THIS run as tail at THIS run's index; the entry digest and pinned
-     * auth mode still match; and — for any entry past the base — the LIVE
-     * signed mode still grants the paid fallback (a base entry is the
-     * ordinary approved work and needs no grant). Only when every fact stands
-     * is provider_started_at stamped (first-write, with the version when the
-     * gateway proved one). Returns false — and stamps NOTHING — otherwise.
-     */
-    proveChainCustodyForSpawn(runId: number, now: Date, providerVersion?: string): boolean;
-    /**
-     * open -> sanitizing (C7): a recognized ELIGIBLE exhaustion of the tail
-     * run begins the sanitizer. CAS proves exact state, generation, and tail
-     * run; a stale caller loses. Marks the cycle sanitizing so ordinary
-     * admission is blocked even if the claim later expires.
-     */
-    beginFallbackSanitize(cycleId: number, expectGeneration: number, tailRun: number, now: Date): boolean;
-    /**
-     * sanitizing -> awaiting-release (C2/C7): the durable one-step advance.
-     * ONE transaction: prove the cycle is sanitizing at this generation and
-     * cursor i with this tail run; insert the immutable transition (unique
-     * per (cycle, from_index)); advance the cursor to i+1; bump generation.
-     * The target index MUST be < chainLength (proven by the caller from the
-     * approved snapshot). Returns the new transition id, or null on a lost
-     * CAS or an already-recorded step.
-     */
-    advanceFallbackFenced(args: {
-        cycleId: number;
-        expectGeneration: number;
-        fromIndex: number;
-        chainLength: number;
-        predecessorRun: number;
-        terminalClass: string;
-        evidence: {
-            provider: string;
-            version: string | null;
-            authMode: string;
-            fp: string;
-        };
-    }, now: Date): {
-        ok: true;
-        transitionId: number;
-        toIndex: number;
-    } | {
-        ok: false;
-        reason: "raced" | "at-end" | "dup";
-    };
-    /** awaiting-release -> pending-admission (C7): the epoch-fenced custody
-     * release completed; the next entry is now admittable. */
-    releaseFallbackToPending(cycleId: number, expectGeneration: number, now: Date): boolean;
-    /**
-     * pending-admission -> open at the new index (C3): the SINGLE-USE
-     * admission. ONE transaction: prove pending at this generation, consume
-     * the transition (consumed_by set once — a replay finds it consumed and
-     * loses), and open the cycle at the new tail. Returns false on a lost
-     * CAS or an already-consumed transition.
-     */
-    /**
-     * THE FALLBACK ADMISSION (E3d; the ONE insert path for `fallback`
-     * provenance since the v48 integrity repair). Every run bound to a
-     * NON-primary entry of the approved chain — the entry's own admission
-     * from a pending edge, a parked tail's successor, a repair turn under
-     * the live tail — is created here and nowhere else; the generic
-     * admission refuses `fallback` outright.
-     *
-     * EVERYTHING the caller states is re-proved against durable state
-     * before any row exists, and one disagreement creates no run and
-     * consumes no edge: the cycle is the task's own and live; the approved
-     * chain still stands, is the cycle's, and its base entry is mirrored by
-     * the sealed profile exactly as the caller presents it; the cursor,
-     * the tail, the entry digest, the auth mode, the provider, the EXACT
-     * model (required, never defaulted), and the repair binding all equal
-     * the approved entry at the cursor; the presented stamp is `fallback`
-     * on exactly that entry for the phase this run spends as; and the
-     * kind-specific custody fact holds — an unconsumed pending edge at the
-     * cursor, a parked tail the cycle still names, or a live parent tail.
-     * The run is opened WITH its chain metadata (cycle, index, entry
-     * digest, auth mode) and its route in one body, so nothing downstream
-     * can substitute a foreign run.
-     */
-    admitFallback(args: {
-        run: {
-            taskRef: number;
-            leaseId: string;
-            runner: string;
-            branch: string;
-            worktree: string;
-            provider: string;
-            model: string;
-            sessionId?: string;
-            /** The interrupted attempt whose draft this entry or resume
-             * recovers (raw authority repair): proved this task's own run and
-             * written as the row's parent in this same insert — never stamped
-             * later. A repair turn's parent is its live tail; it recovers none. */
-            recoveredFrom?: number;
-        };
-        cycleId: number;
-        /** The cursor the caller understands the cycle to stand at — the
-         * entry index this run binds to. */
-        expectCursor: number;
-        /** The cycle's tail as the caller understands it: null for an entry
-         * admitted from a pending edge, the parked run for a resume, the
-         * live parent for a repair turn. */
-        expectTail: number | null;
-        entryDigest: string;
-        authMode: "subscription" | "api-key";
-        /** The entry's effective repair model as the caller understands it —
-         * `inherit` resolved to the build model — proved against the approved
-         * entry so a repair turn later spends as exactly what was approved. */
-        repairModel: string;
-        /** The approved authority as the caller holds it: the chain's digest
-         * and the FULL sealed-profile mirror (the chain's base entry). */
-        approved: {
-            chainDigest: string;
-            profile: ExecutionProfile;
-        };
-        /** The run's `fallback` route provenance, proved against the exact
-         * entry this admission binds (cursor + entry digest) BEFORE the row
-         * exists and written beside it. Required: nothing is dictated here. */
-        route: RouteStamp;
-    } & ({
-        kind: "entry";
-        expectGeneration: number;
-        transitionId: number;
-    } | {
-        kind: "resume";
-        parkedRun: number;
-    } | {
-        kind: "repair";
-        parentRun: number;
-    }), now: Date): {
-        ok: true;
-        runId: number;
-    } | {
-        ok: false;
-        reason: "refused" | "raced";
-        problem: string;
-    };
-    /**
-     * THE UNAVAILABLE-PRIMARY TRANSITION (v47): the approved chain's base
-     * entry runs a provider THIS runner has reported unavailable, so the
-     * task moves — before any claim, run, or spend — to the EXPLICITLY
-     * APPROVED next entry, and only that one: a fresh cycle opens at index 0
-     * with no tail and skips, one step, to pending-admission at index 1,
-     * citing the readiness observation as its evidence. The admission pass
-     * then re-proves everything (approved chain standing, live paid-fallback
-     * grant, the next entry's own readiness) before it runs. Every other
-     * case fails closed with the words: no approved chain, a live cycle
-     * already, a base that is not actually unavailable, no next entry, a
-     * next entry that is unavailable too, or no live grant — nothing
-     * substitutes outside the approved chain.
-     */
-    skipUnavailablePrimary(taskRef: number, taskId: string, repo: string | null, runner: string, now: Date): {
-        ok: true;
-        cycleId: number;
-        toIndex: number;
-        next: {
-            provider: string;
-            model: string;
-        };
-    } | {
-        ok: false;
-        reason: "no-chain" | "cycle-live" | "primary-available" | "at-end" | "next-unavailable" | "grant-withheld" | "raced";
-        detail: string;
-    };
-    /** open -> open at i+1 via a quota-skip (C7): index 0 (or any) already
-     * durably exhausted before dispatch is skipped, one step, recorded. */
-    quotaSkipFallback(args: {
-        cycleId: number;
-        expectGeneration: number;
-        fromIndex: number;
-        chainLength: number;
-        tailRun: number | null;
-        evidence?: {
-            provider: string;
-            fp: string;
-        };
-    }, now: Date): {
-        ok: true;
-        toIndex: number;
-        transitionId: number;
-    } | {
-        ok: false;
-        reason: "raced" | "at-end" | "dup";
-    };
-    /** Any nonterminal state -> incident (C8): a sanitizer failure, a
-     * severed grant, or a policy downgrade pages a human; never silent. */
-    /** Any nonterminal -> incident (C8): CAS on the exact generation so a
-     * STALE observer cannot terminate a cycle that has since advanced
-     * (Codex E1 review, finding 1). */
-    incidentFallback(cycleId: number, expectGeneration: number, reason: string, now: Date): boolean;
-    /** A cycle succeeds or exhausts its chain: closed, terminally — CAS on
-     * the exact generation (finding 1: a stale success observer cannot close
-     * after an advance + admit). */
-    closeFallbackCycle(cycleId: number, expectGeneration: number, reason: string, now: Date): boolean;
     /**
      * The bounded review-retry projection (v50): one source run's ROOT
      * reviewer attempts in ordinal order, its open request, and the ONE
@@ -3649,7 +3096,7 @@ export declare class Store {
      * exactly one wins; the loser refuses in words with zero rows.
      *
      * The child is filed UNAPPROVED, always: this method never stamps an
-     * approval, never mints an attended authorization, never touches a
+     * approval, never touches a
      * publication or merge grant. Only the normal approval roads — the
      * password ceremony, or a live mode's own filing coverage re-proved by
      * the caller inside its own transaction — can approve the child.
@@ -3975,12 +3422,10 @@ export declare class Store {
          * default when the scope is filed. */
         qualityMode?: QualityMode;
         /** The revision road's inherited declarations (contract handoff task
-         * 2): the source's declared risk, the approver's per-phase route
-         * overrides, and its build/plan pins — stamped on the ref BEFORE the
+         * 2): the approver's per-phase route overrides, and its build/plan pins — stamped on the ref BEFORE the
          * scope resolves, so the child's route is recommended over them
          * exactly as the source's was, never over the installation's
          * defaults of the day. */
-        riskLevel?: RiskLevel;
         /** How big the change is, sized at filing (v2 routing). */
         sizing?: TaskSizing;
         routeOverridesJson?: string | null;
@@ -4114,34 +3559,6 @@ export declare class Store {
     }[];
     /** Write one complete pair. Audited: who changed spend routing, and when. */
     setPhaseConfig(scope: string, phase: string, provider: string, model: string | null, by: string, now: Date): void;
-    /** The ordered FALLBACK entries after the base, for a scope's build
-     * phase (v30). Each entry: {provider, model, authMode, repairModel?}.
-     * Returns [] when none configured — a chain-of-one is the base alone. */
-    fallbackConfig(scope: string): {
-        provider: string;
-        model: string;
-        authMode: "subscription" | "api-key";
-        repairModel?: string;
-    }[];
-    /**
-     * The configured fallback entries, or the words for why the row on file
-     * cannot be read (v48): a row that EXISTS but is not a list of
-     * well-shaped entries — corrupt JSON, a non-list, an entry missing its
-     * provider, model, or auth mode — is a stated problem, never an empty
-     * list. Filing a scope under such a row refuses in these words rather
-     * than silently sealing a single-profile approval the operator did not
-     * configure; the chain the person believes they set never shrinks to
-     * nothing behind their back.
-     */
-    fallbackConfigProblem(scope: string): string | null;
-    private readFallbackConfig;
-    setFallbackConfig(scope: string, entries: {
-        provider: string;
-        model: string;
-        authMode: "subscription" | "api-key";
-        repairModel?: string;
-    }[], by: string, now: Date): void;
-    clearFallbackConfig(scope: string): boolean;
     clearPhaseConfig(scope: string, phase: string): boolean;
     /** The operator's named STRONG candidate for a phase at a scope, or null.
      * Read by the routing policy only — a phase_config row stays the routine
@@ -4189,7 +3606,7 @@ export declare class Store {
      * nothing. A signed routing input, read at filing. */
     publicationAuthorityOf(repo: string | null, now: Date): PublicationAuthority;
     /**
-     * THE ROUTE EDIT (v47): declare the task's risk, override one phase to an
+     * THE ROUTE EDIT (v47): set the task's size, override one phase to an
      * exact agent, or clear an override — ONE authenticated transaction that
      * re-proves the editor's authority, CAS-checks the scope digest the
      * editor saw (a string to match, null = "I saw no scope", undefined =
@@ -4199,7 +3616,7 @@ export declare class Store {
      * is recomputed and the prior approval goes stale by digest, and — when
      * a drafted plan came from the old planner — asks for a real re-plan.
      * No claimant can observe a half-updated authority: it is all or
-     * nothing, and refused under a live claim or tournament terms.
+     * nothing, and refused under a live claim.
      */
     editTaskRoute(taskRef: number, edit: {
         by: string;
@@ -4209,7 +3626,6 @@ export declare class Store {
             ok: false;
             reason: string;
         };
-        risk?: RiskLevel;
         /** v2: a person's size for the task — it outranks the classifier's. */
         size?: {
             size: TaskSize;
@@ -4238,7 +3654,7 @@ export declare class Store {
         overrides: RouteOverride[];
     } | {
         ok: false;
-        reason: "unauthenticated" | "no-task" | "live-claim" | "contest-open" | "changed" | "nothing" | "not-configured";
+        reason: "unauthenticated" | "no-task" | "live-claim" | "changed" | "nothing" | "not-configured";
         detail: string;
         choices?: {
             provider: string;
@@ -4247,9 +3663,8 @@ export declare class Store {
     };
     /** Store a task's size (v2 routing); the next scope filing routes by it. */
     writeSizing(taskRef: number, sizing: TaskSizing): void;
-    /** Planning follows the size and risk while nothing has run: a small
-     * change at routine risk drops a plan that is only requested; a large or
-     * risky one, or any task at elevated or high risk, asks for a plan. A
+    /** Planning follows the size while nothing has run: a small change drops
+     * a plan that is only requested; a large or risky one asks for a plan. A
      * drafted plan is never discarded. */
     private planToSizing;
     /**
@@ -4294,11 +3709,9 @@ export declare class Store {
      *     phase's exact leg. A planner may also run under the working
      *     proposed route, or — with no scope yet — the live recommendation,
      *     re-derived here from durable state. Nothing else.
-     *   fallback — the task's approved chain: the digest is the sealed
-     *     route's (or the chain's, when no route is sealed) and the pair is
-     *     a NON-primary entry of that chain (its repair model for a repair).
-     *   legacy — only a row proven to predate routing, a task with no scope,
-     *     a tournament lane, or an attended session; never a routed row.
+     *   fallback — never (fallback chains were removed in v115).
+     *   legacy — only a row proven to predate routing or a task with no
+     *     scope; never a routed row.
      */
     private routeAdmissionProblem;
     /**
@@ -4337,41 +3750,6 @@ export declare class Store {
     approvedRouteOf(taskId: string): PhaseRoute | null;
     /** Pin a task's agent — the fire transaction's stamp; flags never override it. */
     pinTaskAgent(taskRef: number, provider: string, model: string | null): void;
-    /**
-     * File a standing order, unapproved. The digest is computed by the caller
-     * (routineDigestOf) from exactly the terms stored here; approval later
-     * binds to it. Nothing fires until a person agrees to the template.
-     */
-    createRoutine(spec: {
-        name: string;
-        repo: string;
-        goal: string;
-        outOfScope: string | null;
-        touches: string[];
-        acceptance: AcceptanceCriterion[];
-        requirements: string[];
-        schedule: string;
-        singleFlight: boolean;
-        costCeilingUsd: number | null;
-        budgetPerRunMicrousd?: number | null;
-        digest: string;
-        /** Immutable provenance (v12), same contract as createConsoleTask's. */
-        filedVia?: string;
-        /** v102: who made it; its instances are filed as theirs. */
-        createdBy?: string | null;
-        /** v24: resolved at filing by the caller who computed the digest —
-         * stored verbatim so digest and profile can never disagree. */
-        profile?: ExecutionProfile;
-        /** v48: the four-role route the digest binds, computed by the same
-         * caller from the same configuration — stored verbatim. */
-        route?: PhaseRoute;
-    }, now: Date): {
-        ok: true;
-        id: number;
-    } | {
-        ok: false;
-        reason: "duplicate";
-    };
     /**
      * Set-once installation markers (v12). INSERT OR IGNORE is the whole
      * contract: the first write wins forever, there is no update and no
@@ -4385,151 +3763,22 @@ export declare class Store {
     isDemo(): boolean;
     setSpendDefaults(defaults: {
         buildPerRunMicrousd: number | null;
-        racePerAgentMicrousd: number | null;
-        raceTotalMicrousd: number | null;
-        raceAgents?: number | null;
     }, by: string, now: Date): void;
     getSpendDefaults(): {
         buildPerRunMicrousd: number | null;
-        racePerAgentMicrousd: number | null;
-        raceTotalMicrousd: number | null;
-        raceAgents: number | null;
         updatedBy: string;
     } | null;
-    /**
-     * File a new terms row: the previous active row (if any) deactivates in
-     * the same transaction — rows are immutable, the ACTIVE pointer moves.
-     * Approval lands later, by the same ceremony that approves the scope.
-     */
-    /** Withdraw the standing race: the row survives deactivated, exactly as
-     * a superseding filing would leave it — the task returns to the ordinary
-     * one-agent path. */
-    retractTournamentTerms(taskRef: number): boolean;
-    fileTournamentTerms(spec: {
-        taskRef: number;
-        /** v27: absent = 'race' (every historical caller). */
-        kind?: "race" | "comparison";
-        raceDigest: string;
-        agents: {
-            provider: string;
-            model: string;
-            repairModel: string;
-            permissionMode?: UnattendedPermissionMode;
-        }[];
-        perAgentBudgetMicrousd: number;
-        overrunReserveMicrousd: number;
-        totalBudgetMicrousd: number;
-        priceVersion: number;
-        publicationPolicy: string;
-    }, now: Date): number;
-    activeTournamentTerms(taskRef: number): TournamentTerms | null;
-    /** Approval persistence only — the restating ceremony wires in later. */
-    approveTournamentTerms(id: number, by: string, sawDigest: string, now: Date): boolean;
-    createContest(spec: {
-        taskRef: number;
-        terms: number;
-        scopeDigest: string;
-        raceDigest: string;
-        kind?: "race" | "comparison";
-    }, now: Date): number;
-    getContest(id: number): Contest | null;
-    /** The one non-finished tournament for a task, when one exists. */
-    /** The newest tournament still owed to an operator — open states plus
-     * the two that end with nothing pickable and wait for a human verdict. */
-    contestNeedingOperator(taskRef: number): Contest | null;
-    openContestFor(taskRef: number): Contest | null;
-    /**
-     * Every state change is a compare-and-swap on (state, generation): the
-     * caller proves what it believes, the write bumps the generation, and
-     * whichever of aggregation, reaping, or crash recovery loses the race
-     * changes nothing (finding 17/27).
-     */
-    casContestState(id: number, from: readonly ContestState[], to: ContestState, expectedGeneration: number): boolean;
-    stampContestLease(id: number, leaseId: string, runner: string, incarnation: string | null): void;
-    stampContestDispatch(id: number, baseSha: string, setupDigest: string | null): void;
-    createContestants(contest: number, agents: {
-        provider: string;
-        model: string;
-        repairModel: string;
-        permissionMode?: UnattendedPermissionMode;
-        branch: string;
-        budgetMicrousd: number;
-        reserveMicrousd: number;
-        unknownSpend?: boolean;
-    }[]): number[];
-    /** The lane's CUMULATIVE wall clock across its whole lineage — main
-     * attempt, resumes, and repair children (Phase 3 slice B, Codex
-     * finding 1): three sealed clocks bound a comparison lane. */
-    contestantCumulativeMs(contestantId: number): number;
-    /** The lane's money and tokens across its WHOLE lineage — main attempt,
-     * resumes, and repair children (Codex slice-B finding 6): a lane's cell
-     * that reads only the newest run under-reports every park cycle. */
-    contestantSpendRollup(contestantId: number): {
-        costMicrousd: number;
-        tokensIn: number;
-        tokensOut: number;
-        measuredRuns: number;
-        totalRuns: number;
-    };
-    contestants(contest: number): Contestant[];
-    getContestant(id: number): Contestant | null;
-    casContestantState(id: number, from: readonly ContestantState[], to: ContestantState, expectedGeneration: number): boolean;
-    /**
-     * The exact authority a contest lane PRESENTS at admission (raw
-     * authority repair): its race-approved profile's digest as a `legacy`
-     * stamp, with the pair the lane spends as for the phase — the same
-     * facts `startRun` re-proves against the lane before the row exists.
-     * Null for no such lane.
-     */
-    laneAuthorityFor(contestantId: number, phase?: "build" | "repair"): RouteStamp | null;
-    releaseContestantRun(id: number, runId: number): void;
-    setContestantWorktree(id: number, worktree: string): void;
-    /** The lineage meter (finding 25 + round-2 finding on repairs): each
-     * finished invocation settles ONCE, and the agent's total is the SUM
-     * across its whole lineage — a park's spend and its resume's spend are
-     * both real money. Accounted tracks at least the measured total. */
-    recordContestantSpend(id: number, invocationMicrousd: number): void;
-    /** A started invocation that never reported: the ledger charges the FULL
-     * reservation — never the remaining amount — and says the real figure is
-     * unknown (finding 25). Idempotent; never lowers a larger accounting. */
-    latchContestantUnknownSpend(id: number): void;
-    setContestantCustody(id: number, custody: string | null): void;
-    /** The cleanup queue (stage 6): agents of DECIDED tournaments whose
-     * checkouts still sit outside the pool. Terminal contest states only —
-     * an undecided tournament's evidence is never touched. */
-    contestantsForCleanup(): Contestant[];
-    /** Exactly-once overdue escalation: the mark rides the page (stage 6). */
-    markContestOverduePaged(contestId: number): boolean;
-    /** The pick, stamped: who chose, when, and which agent won. */
-    setContestWinner(contestId: number, contestantId: number, approver: string, now: Date): void;
-    setContestantCleanup(id: number, cleanup: "pending" | "done" | "attention"): void;
-    contestsInStates(states: readonly ContestState[]): Contest[];
     /** The still-live claim behind a lease id, or null — recovery's question.
      * The clock is INJECTED like everywhere else; SQL wall-clock time would
      * silently disagree with every test's fixed timestamps. */
     liveClaimByLease(leaseId: string, now: Date): {
         leaseId: string;
     } | null;
-    /**
-     * Close a racing agent's question WITHOUT answering it (the exclude
-     * ceremony, round-3 finding 28): typed closure, never a fake option.
-     * The caller owns authentication and the contestant's stop.
-     */
-    excludeDecision(id: number, by: string, now: Date): boolean;
-    /** A racing agent's answered-but-undelivered question, for the resume pass. */
-    answeredDecisionForContestant(contestantId: number): number | null;
-    /** A racing agent's one open (or expired-but-unanswered) question. */
-    openDecisionForContestant(contestantId: number): number | null;
-    /** Admission binds each reserved slot to its agent, so recovery can
-     * find and free every one of them (nothing reserved is ever orphaned). */
-    assignSlotContestant(slotId: number, contestantId: number): void;
-    releaseSlotsForContest(contestId: number, now: Date): number;
     reserveExecutionSlots(runner: string, count: number, now: Date): number[];
     /** reserved → running happens in the stamp-before-spawn moment, carrying
      * the process group so recovery can ask the OS before freeing capacity. */
     markSlotRunning(id: number, facts: {
         run: number;
-        contestant?: number | null;
         incarnation?: string | null;
         processGroup?: number | null;
     }, now: Date): boolean;
@@ -4537,7 +3786,6 @@ export declare class Store {
      * root attempt. It may refresh only that attempt's exact occupied slot. */
     refreshSlotProcess(id: number, facts: {
         run: number;
-        contestant?: number | null;
         incarnation?: string | null;
         processGroup: number;
     }): boolean;
@@ -4672,7 +3920,7 @@ export declare class Store {
         title: string;
         repo: string | null;
     }[];
-    /** Whether any work was ever filed — task or routine. */
+    /** Whether any work was ever filed. */
     hasAnyWork(): boolean;
     /** Which door filed a task; null for history from before v12. */
     /** The coordinator provenance label for a task — `mcp:<name>#<cid4>` —
@@ -4684,137 +3932,6 @@ export declare class Store {
         filedAt: string | null;
     } | null;
     filedViaOf(taskId: string): string | null;
-    getRoutine(id: number): Routine | null;
-    routineByName(name: string): Routine | null;
-    /** Every routine one view may see. NULL repo filter means "no filter". */
-    listRoutines(repo: string | null, admitted?: string[] | null): Routine[];
-    /**
-     * Rewrite a template's terms. The new digest rides along, and the old
-     * approval is kept — invalidated by the mismatch, exactly like a scope
-     * edit, so the refusal can say "approved, then edited" rather than
-     * "never approved". The firing transaction re-proves the match.
-     */
-    updateRoutineTerms(id: number, terms: {
-        goal: string;
-        outOfScope: string | null;
-        touches: string[];
-        /** v39: absent leaves the stored rubric untouched (a caller editing
-         * goal/touches without an opinion on acceptance); present REPLACES
-         * it — never merged, so the digest the caller computed from these
-         * exact terms is what ends up stored. */
-        acceptance?: AcceptanceCriterion[];
-        requirements: string[];
-        schedule: string;
-        costCeilingUsd: number | null;
-        digest: string;
-        /** v24: restatement carries the profile its digest binds. */
-        profile?: ExecutionProfile | null;
-        /** v48: restatement carries the route its digest binds; absent or
-         * null leaves the stored route untouched. */
-        route?: PhaseRoute | null;
-    }, now: Date): boolean;
-    /**
-     * The approval stamp, raw. Callers own the ceremony — credential,
-     * digest re-read, and the transaction — in approveRoutine (routine.ts).
-     */
-    stampRoutineApproval(id: number, by: string, digest: string, nextFireAt: string, now: Date): void;
-    /**
-     * WITHDRAW an approval that no longer verifies (v48 authority repair): the refresh road
-     * clears the approval's authority — its digest, its frozen snapshot, the
-     * armed schedule — so a corrupt or never-taken snapshot cannot keep
-     * reading as approved while the working agents happen to be unchanged.
-     * `approved_at`/`approved_by` stay as history: the page reads "approved,
-     * then refreshed — approve again", never "never approved".
-     */
-    withdrawRoutineApproval(id: number, now: Date): boolean;
-    /** Pausing is instant and needs no ceremony; resuming re-arms the schedule. */
-    setRoutinePaused(id: number, paused: boolean, now: Date): boolean;
-    /**
-     * Routines a pass should try to fire: approved (digest intact), unpaused,
-     * due, and placed in this pass's repository. Each candidate is re-proved
-     * inside fireRoutine's own transaction — this list only nominates.
-     */
-    dueRoutines(repo: string, now: Date): Routine[];
-    /** The last firings, newest first — the board's run-history strip. */
-    routineFires(routineId: number, limit?: number): (RoutineFire & {
-        instanceTaskId: string | null;
-        instanceState: string | null;
-    })[];
-    /**
-     * What one routine's instances actually cost in a window, and whether any
-     * paid run in it is unmeasured. NULL costs are counted, not summed over:
-     * a sum that silently omits them reads as headroom that may not exist
-     * (finding 5 — the arithmetic behind failing closed).
-     */
-    routineSpend(routineId: number, sinceIso: string): {
-        costUsd: number;
-        unmeasuredRuns: number;
-        totalRuns: number;
-    };
-    /**
-     * The single-flight question: the oldest instance not successfully
-     * completed nor explicitly abandoned — queued, running, held, parked,
-     * and failed instances all block (finding 9's definition, verbatim).
-     * A LIVE CLAIM blocks regardless of task state (Codex Phase C review,
-     * H2): a state string written over a running build — `task state <id>
-     * done` bypassing the guarded cancel — must not conjure a twin beside
-     * a provider that is still spending.
-     */
-    routineBlocker(routineId: number, now: Date): {
-        taskId: string;
-        state: string;
-    } | null;
-    /**
-     * Whether a slot is still unrecorded. Only sound inside the fire
-     * transaction — the IMMEDIATE lock is what makes read-then-insert atomic.
-     */
-    routineSlotOpen(routineId: number, scheduledFor: string): boolean;
-    /** Record one slot's outcome. False: the slot was already recorded — the caller lost the race. */
-    recordRoutineFire(fire: {
-        routineId: number;
-        scheduledFor: string;
-        outcome: "fired" | "skipped";
-        reason: string | null;
-        instanceTaskRef: number | null;
-    }, now: Date): boolean;
-    /** Advance the schedule. The fire transaction is the only caller. */
-    setRoutineNextFire(id: number, nextFireAt: string, now: Date): void;
-    /** Stamp which routine a task is an instance of. Set at spawn, never after. */
-    linkRoutineInstance(taskRef: number, routineId: number): void;
-    /**
-     * Page a blocked track once per EPISODE: an open episode under this
-     * prefix already nags, so nothing enqueues; a resolved one is history,
-     * and the fresh suffix keys a new row past the dedupe uniqueness — a
-     * recurrence after recovery pages again (Codex Phase C review, L1).
-     * Prefix matching is exact-bytes (substr), never LIKE — task ids may
-     * contain `_`, which LIKE would read as a wildcard.
-     */
-    enqueueRoutineEpisode(prefix: string, notification: Omit<NotificationInput, "dedupeKey">, suffix: string, now: Date): boolean;
-    /**
-     * Close every blocked-track episode for a routine — called when a firing
-     * succeeds, because success is the proof the blocker is gone (budget
-     * cleared, blocking instance finished). Receipts stay; only the "wants a
-     * person" bit resolves.
-     */
-    resolveRoutineEpisodes(routineId: number, now: Date): void;
-    /**
-     * Everything the board's track rows need, in one snapshot: each routine
-     * with its recent firings, its rolling-window spend, and the instance
-     * blocking it, if any. The caller applies the ceiling row by row.
-     */
-    routineTracks(repo: string | null, now: Date, admitted?: string[] | null): {
-        routine: Routine;
-        fires: ReturnType<Store["routineFires"]>;
-        spend: {
-            costUsd: number;
-            unmeasuredRuns: number;
-            totalRuns: number;
-        };
-        blocker: {
-            taskId: string;
-            state: string;
-        } | null;
-    }[];
     /** The latest saved line for one approved check. Corrupt rows stay absent. */
     checkProgress(run: number): CheckProgress | null;
     /**
@@ -4847,8 +3964,8 @@ export declare class Store {
      * not failed. Failures, refusals, parks, plans and reports already page
      * through their own producers (build-failed, stalled, commit-failure,
      * malformed-*, plan-ready, report-ready, fenced, external-closed) and are
-     * not repeated here. Contest lanes and repair/correction children are the
-     * attempt's own and say nothing on their own.
+     * not repeated here. Repair/correction children are the attempt's own
+     * and say nothing on their own.
      */
     private noteRunEnding;
     /** True if this is a new fact; false if the episode already knows.
@@ -4869,13 +3986,6 @@ export declare class Store {
     notificationById(id: number): Notification | null;
     notificationsAfter(id: number, limit?: number): Notification[];
     listNotifications(only?: "pending" | "all"): Notification[];
-    recordDelivery(id: number, outcome: {
-        ok: true;
-        receipt: string | null;
-    } | {
-        ok: false;
-        error: string;
-    }, now: Date): void;
     /**
      * Close a gap's notification episode. Called when its capability verifies:
      * the next failure is a *new* fact, and a dedupe key that suppressed it
@@ -4895,13 +4005,12 @@ export declare class Store {
      * mid-flight, visible the next morning instead of vanished.
      *
      * THE GENERIC ADMISSION (atomic authority closure) opens exactly four
-     * shapes: an ordinary builder (no parent, no lane, no open attended
-     * authorization on its task), a planner (optionally continuing its own
+     * shapes: an ordinary builder (no parent, no lane), a planner (optionally continuing its own
      * same-task planner run), a scout, and a ROOT reviewer answering an open
      * review request. Every other shape has its own admission that proves
      * and consumes or binds its exact authority in one transaction —
-     * `admitRepair`, `admitAttended`, `admitCorrection`, `admitContestLane`,
-     * `admitRecoveredBuilder`, `admitFallback` — and this road refuses it in
+     * `admitRepair`, `admitCorrection`,
+     * `admitRecoveredBuilder` — and this road refuses it in
      * words before any row exists. Every run PRESENTS its route authority: a
      * task with no scope presents the bare word `legacy` for the exact pair
      * it spends as; nothing opens unstamped anywhere.
@@ -4922,20 +4031,6 @@ export declare class Store {
          * a caller can spread the authority it resolved; absent at runtime
          * it refuses in words. */
         route?: RouteStamp;
-        /** v48 authority repair: how this run takes fallback-chain custody, proved and
-         * persisted in this same insert — `base` opens the task's cycle at
-         * the approved chain's first entry (inert without a chain approval),
-         * `resume` takes a parked BASE tail's custody through the proven
-         * transfer. A binding that cannot be proved rolls the insert back.
-         * Builder-only: no other role takes custody. Every run bound to a
-         * NON-primary entry — the entry's own admission, a parked tail's
-         * successor, a repair turn — is admitted by admitFallback alone. */
-        custody?: {
-            kind: "base";
-        } | {
-            kind: "resume";
-            parkedRun: number;
-        };
         now: Date;
     } & ({
         role?: "builder" | "planner" | "scout";
@@ -4963,12 +4058,7 @@ export declare class Store {
      * this task's, is a builder, is still open, and this turn runs under
      * the parent's own runner and lease — which must be the task's CURRENT
      * live claim, on the runner that claim names (repair custody closure:
-     * the same tuple invariant every fallback admission proves). An
-     * attended parent's authorization
-     * must have spent its one attempt on that parent; a racing lane's
-     * parent must be the lane's live run; a chain-bound parent must be the
-     * live base tail (a fallback entry's repair is admitFallback's). The
-     * stamp is the repair leg of the authority the parent spent under.
+     * the exact claim tuple). The stamp is the repair leg of the authority the parent spent under.
      * Value-shaped: a refusal names its reason and leaves zero rows.
      */
     admitRepair(run: {
@@ -4990,41 +4080,6 @@ export declare class Store {
         ok: false;
         problem: string;
     };
-    /**
-     * THE ATTENDED ADMISSION (atomic authority closure): one watched attempt
-     * opens under exactly ONE live authorization the caller names — open on
-     * this task, unexpired, unspent, minted for this runner at this
-     * generation, pinning a readable profile the stamp restates as its
-     * legacy authority; a continuation names the finished parent the
-     * authorization continues, nothing else names a parent. The insert
-     * binds the row to the authorization and CONSUMES its one attempt in
-     * the same transaction: `run.attended_authorization` and
-     * `authorization.attempt_run` move together or not at all.
-     */
-    admitAttended(run: {
-        taskRef: number;
-        leaseId: string;
-        runner: string;
-        branch: string;
-        worktree: string;
-        provider: string;
-        model?: string;
-        sessionId?: string;
-        parentRun?: number;
-        authorization: {
-            id: string;
-            runner: string;
-            generation: number;
-        };
-        route: RouteStamp;
-        now: Date;
-    }): {
-        ok: true;
-        runId: number;
-    } | {
-        ok: false;
-        problem: string;
-    };
     /**
      * THE CORRECTION ADMISSION (atomic authority closure): a reviewer
      * correction continues a LIVE root review in the SAME session — the
@@ -5051,37 +4106,6 @@ export declare class Store {
         ok: false;
         problem: string;
     };
-    /**
-     * THE CONTEST LANE ADMISSION (atomic authority closure): a racing agent's
-     * run opens on ITS lane, in a contest still dispatching or racing, under
-     * the contest's live custody — the caller's lease, runner, and watch
-     * incarnation are exactly the ones the contest was stamped with — and it
-     * presents the lane's STORED sealed profile as its legacy authority: no
-     * synthesized profile, no other digest. The lane's pointer moves to the
-     * row inside the insert (from free, or from the parked attempt this run
-     * resumes); a lane that moved rolls the row back.
-     */
-    admitContestLane(run: {
-        taskRef: number;
-        leaseId: string;
-        runner: string;
-        incarnation: string | null;
-        branch: string;
-        worktree: string;
-        provider: string;
-        model?: string;
-        sessionId?: string;
-        contestant: number;
-        parentRun?: number;
-        route: RouteStamp;
-        now: Date;
-    }): {
-        ok: true;
-        runId: number;
-    } | {
-        ok: false;
-        problem: string;
-    };
     /**
      * THE RECOVERED-DRAFT ADMISSION (atomic authority closure): a fresh
      * builder attempt that inherits an INTERRUPTED attempt's draft names it
@@ -5101,12 +4125,6 @@ export declare class Store {
         model?: string;
         sessionId?: string;
         recoveredFrom: number;
-        custody?: {
-            kind: "base";
-        } | {
-            kind: "resume";
-            parkedRun: number;
-        };
         route: RouteStamp;
         now: Date;
     }): {
@@ -5121,22 +4139,17 @@ export declare class Store {
     private admission;
     private admitRun;
     /**
-     * THE CURRENT CLAIM, exactly (final admission closure): every admission
-     * that changes fallback state — the base that opens a cycle, an entry
-     * admitted from a pending edge, a parked tail's resume, a repair turn
-     * under the live tail — proves in its own transaction that the run it
-     * opens is the task's, under the lease that holds the task RIGHT NOW,
-     * on the runner that claim names. A lease nobody holds, one released,
-     * expired, or superseded by a newer generation, or a claim another
-     * machine holds admits nothing: the words say which, and no cycle,
-     * edge, tail, or claim moves. Shared by the fallback road, the primary
-     * repair road, and the generic road's custody so all refuse in the
-     * same words.
+     * THE CURRENT CLAIM, exactly (final admission closure): a repair turn
+     * proves in its own transaction that the run it opens is the task's,
+     * under the lease that holds the task RIGHT NOW, on the runner that
+     * claim names. A lease nobody holds, one released, expired, or
+     * superseded by a newer generation, or a claim another machine holds
+     * admits nothing: the words say which.
      */
     private custodyClaimProblem;
     /**
      * THE ONE RECOVERY GRANT (final authority closure), shared by the
-     * recovered-draft admission and the fallback admission's `recoveredFrom`:
+     * recovered-draft admission's `recoveredFrom`:
      * the interrupted attempt whose draft a fresh run inherits is THIS
      * task's own builder or repair turn, left in this very worktree on this
      * branch, either ended as `failed` for `interrupted` (or `no-handoff`) or still open under
@@ -5146,25 +4159,15 @@ export declare class Store {
      * say which, and the caller opens nothing.
      */
     private recoveryGrantProblem;
-    /**
-     * Whether `holder` is the LIVE tail of its task's open fallback cycle
-     * under the approved chain — the words when it is not (v48 integrity).
-     * Re-derived from durable state only: the task's one live cycle is the
-     * holder's cycle, open, its cursor at the holder's index, the holder as
-     * its tail, its digest the approved chain's, and the approved entry at
-     * that index carrying exactly the holder's digest and auth mode.
-     */
-    private liveTailProblem;
     /**
      * THE WORKING PLAN AUTHORITY (final authority closure): the route a
      * planner runs under before any approval, believed only as the ONE strict
      * stored-scope projection proves it — exact raw terms (a proposed-via
      * marker this code never writes is a terms problem), a resolved profile,
-     * a whole fallback chain (an empty or malformed one is no chain), a
-     * readable route whose build and repair legs are the profile's exact
+     * a readable route whose build and repair legs are the profile's exact
      * pairs and whose signed risk and quality are the row's, the digest
      * re-derived from those very values, the operator's live auth mode read
-     * strictly and agreeing with a chain's pinned base mode, and no leg
+     * strictly, and no leg
      * stating a problem. The claim, the admission, and the invocation all
      * ask this same question; one disagreement is the words, and nothing
      * opens or spawns on it. A sealed route is not this road's business —
@@ -5195,8 +4198,7 @@ export declare class Store {
      * The exact route authority a task holds for one run, in the caller's
      * hands (v48 authority repair): the sealed route's leg for the run's phase when the
      * approval stands; the working proposed route's plan leg for a planner
-     * before any approval; for a run bound to a NON-primary chain entry, that
-     * entry's `fallback` provenance for its phase. The store never applies
+     * before any approval. The store never applies
      * this on a caller's behalf — `startRun` requires the caller to PRESENT
      * it and proves the presented stamp against the same durable state, so
      * a caller that holds no authority opens nothing. Null when the task is
@@ -5204,10 +4206,7 @@ export declare class Store {
      * scope — those roads stamp when they spend); the words when the task
      * is routed and nothing could govern the run.
      */
-    routeAuthorityFor(taskRef: number, role: Run["role"] | "scout", bound?: {
-        index: number;
-        entryDigest: string;
-    } | null, 
+    routeAuthorityFor(taskRef: number, role: Run["role"] | "scout", 
     /** What the run would spend as, for the roads no profile governs: the
      * bare word `legacy` on a task with no scope, and the plan/review
      * pair of a pre-routing row (its profile names only build and
@@ -5287,8 +4286,7 @@ export declare class Store {
         committed?: boolean;
         now: Date;
         /** v52: how this ending settles a pending operator stop on the run,
-         * when one stands. The fenced interruption seal and the held fence
-         * name their own word; every other road settles it as `finished` —
+         * when one stands. The fenced interruption seal names its own word; every other road settles it as `finished` —
          * the attempt reached this ending first, and its outcome stands. */
         stopSettlement?: StopSettlement;
     }): void;
@@ -5309,15 +4307,12 @@ export declare class Store {
      */
     stampProviderStart(id: number, now: Date, providerVersion?: string): void;
     /**
-     * The gateway's honest disposal record for the fallback taxonomy (E2):
-     * how this attempt authenticated, and the class its terminal fell into.
-     * Recorded where the evidence still exists — the gateway holds the
-     * structural terminal, the authoritative version, and the auth mode — and
-     * NEVER re-derived in disposal, by which time the structural signal is
-     * gone. Purely observational: the class is stamped on EVERY finished
-     * attempt (usually 'unknown'/'not-exhausted', since the recognizers ship
-     * empty), and it authorizes NOTHING on its own — the dispatch's C8 gate
-     * re-proves hasRecognizer before any advance ever reads it.
+     * The gateway's honest disposal record (E2): how this attempt
+     * authenticated, and the class its terminal fell into. Recorded where the
+     * evidence still exists — the gateway holds the structural terminal and
+     * the auth mode — and NEVER re-derived in disposal, by which time the
+     * structural signal is gone. `auth-expired` pauses its provider; every
+     * other class is observational.
      */
     stampTerminalClass(id: number, authMode: "subscription" | "api-key", terminalClass: TerminalClass): void;
     /** The race-refusal stamp (Phase 3 C5): the version that was REFUSED,
@@ -5363,14 +4358,12 @@ export declare class Store {
     setOrgPolicy(policy: OrgPolicy, by: string, now: Date): SavedPolicy;
     /** The policy's changes, newest first, from the action ledger. */
     policyHistory(limit?: number): LedgerEntry[];
-    /** Why the policy stops a task's approved terms (its profile, every fallback entry, every routed leg), or null. */
+    /** Why the policy stops a task's approved terms (its profile, every routed leg), or null. */
     scopePolicyRefusal(taskId: string): string | null;
     /** Why the policy stops an agent on a provider and model now, or null (chats, teammates, flow steps). */
     agentPolicyRefusal(provider: string, model: string | null): string | null;
     /** Why the policy stops a planner, scout or native coding session (no profile to lower) on a provider and model, or null. */
     sessionPolicyRefusal(provider: string, model: string | null, what: string): string | null;
-    /** Why the policy stops an attended session's signed profile, or null (it is never lowered: see policy.attendedRefusal). */
-    attendedPolicyRefusal(profile: ExecutionProfile): string | null;
     /** The policy's word on a profile about to run: refused, or what runs (lowered under the ceiling, with words). */
     runPolicy(profile: ExecutionProfile): ReturnType<typeof underCeiling>;
     /** The budgets in force. */
@@ -5526,8 +4519,6 @@ export declare class Store {
         recommendation: string;
         assignee?: string;
         deadline?: string;
-        /** Which racing agent asked (v14); absent = ordinary. */
-        contestant?: number;
     }, now: Date): number;
     getDecision(id: number): Decision | null;
     decisionForRun(run: number): Decision | null;
@@ -5665,223 +4656,21 @@ export declare class Store {
     attachAnswers(runId: number, taskRef: number): (Decision & {
         taskId: string;
     })[];
-    /**
-     * Mint one attended authorization. Expired predecessors are closed in the
-     * SAME transaction (end reason 'expired'); a live one refuses — revoke
-     * first, never silently supersede a signature.
-     */
-    mintAttendedAuthorization(input: {
-        id: string;
-        taskRef: number;
-        approver: string;
-        runner: string;
-        runnerGeneration: number;
-        compositeDigest: string;
-        termsJson: string;
-        maxSessionTurns: number;
-        budgetMicrousd: number;
-        parentRun?: number | null;
-        followup?: string | null;
-        absoluteExpiry: string;
-        /** Quick mint (C2/M4): the mode signature substitutes for the
-         * per-mint password — RE-PROVED here, in the mint transaction
-         * itself, never a pre-checked flag: the mode must be live, its
-         * digest exact, and the minting approver must BE the signer. */
-        basis?: {
-            kind: "mode";
-            digest: string;
-        };
-        now: Date;
-    }, mutation?: Mutation): {
-        ok: true;
-        authorization: AttendedAuthorization;
-    } | {
-        ok: false;
-        reason: "authorization-open" | "mode-ended" | "approval-rules";
-    };
-    /** Close every authorization past its absolute expiry (round-6 finding
-     * 8): the durable closure the gates and the partial unique rely on —
-     * an expired corpse must not keep a task locked to its named runner. */
-    sweepExpiredAuthorizations(now: Date): number;
-    readAuthorization(id: string): AttendedAuthorization | null;
-    /** Open continuation authorizations named to this runner (Phase 2E, A4):
-     * unconsumed, carrying a parent attempt — tick's continuation pass reads
-     * this; liveness is the caller's check, as everywhere. */
-    openContinuationAuthorizations(runner: string): AttendedAuthorization[];
-    /**
-     * Why a finished run cannot be continued right now, in words — or null.
-     * The ENUMERATED non-terminal publication states (round-3 R7 demanded
-     * the concrete list, not "open intents"): a publication still moving
-     * ('intended','pushed', or 'opened' with the remote not yet settled) and
-     * a merge intent still live ('pending','claimed') both block.
-     */
-    continuationBlockOf(runId: number): string | null;
-    /** The one OPEN authorization for a task, or null. */
-    openAuthorizationFor(taskRef: number): AttendedAuthorization | null;
-    /**
-     * One durable liveness beat. The DURABLE COLUMN IS THE AUTHORITATIVE
-     * CLOCK; the only suppressed writes are duplicate-tab beats landing
-     * within 5 seconds of the stored value, so observed grace never shrinks
-     * below 40 of the nominal 45 seconds.
-     */
-    beatAuthorization(id: string, now: Date): boolean;
-    /** Explicit terminal closure — run end, expiry, or revocation. CAS on open. */
-    closeAuthorization(id: string, endReason: string, now: Date): boolean;
-    /**
-     * Money already committed against an authorization: settled and uncertain
-     * turns at their accounted charge, plus the live reservation of any
-     * unsettled turn. The budget gate reads THIS, never run.cost_usd.
-     */
-    authorizationSpendMicrousd(id: string): number;
-    /**
-     * Record one turn — the gate where the cap, the single-flight rule, the
-     * budget reservation, the lease re-proof, and the open-decision rule all
-     * hold or refuse ATOMICALLY (v6 W6: a fenced coordinator fails inside
-     * this transaction, not at its next poll). For 'answer' turns the
-     * delivery-CAS on decision.delivered_turn happens here; run_decision
-     * attaches only at ACCEPTANCE (v6 W5).
-     */
-    recordSessionTurn(input: {
-        run: number;
-        sourceKind: SessionTurn["sourceKind"];
-        sourceId?: number | null;
-        author?: string | null;
-        text: string;
-        repairLimit?: number;
-        now: Date;
-    }): {
-        ok: true;
-        turn: SessionTurn;
-    } | {
-        ok: false;
-        reason: RecordTurnRefusal;
-    };
-    /** Answered decisions on a held run whose answer has not yet been
-     * injected — the coordinator's per-pulse scan (v3 R3). */
-    undeliveredDecisionsOf(run: number): Decision[];
-    readSessionTurn(id: number): SessionTurn | null;
-    sessionTurnsOf(run: number): SessionTurn[];
-    /** Bytes flushed to stdin. Write success is NOT acceptance (spike fact 5). */
-    markTurnWritten(id: number, now: Date): boolean;
-    /**
-     * Bind pending answers to the BRIEF turn (round-6 finding 2): a held
-     * build's brief carries every answered-but-undelivered decision, and the
-     * builder's ordinary pre-spawn attach would claim delivery the agent
-     * never proved. The pre-attached run_decision rows are WITHDRAWN here and
-     * each decision's delivery-CAS points at the brief turn — run_decision
-     * re-attaches only at that turn's acceptance, exactly like answer turns.
-     */
-    bindBriefDeliveries(runId: number, briefTurn: number, decisionIds: readonly number[]): void;
-    /**
-     * Acceptance — THIS turn's system/init (or its result, retroactively).
-     * This is also where run_decision attaches, for EVERY decision whose
-     * delivery-CAS points at this turn (answer turns claim one at recording;
-     * a brief turn claims every pending answer it carried): delivery is
-     * claimed only once the agent provably received the words (v6 W5).
-     */
-    markTurnAccepted(id: number, now: Date): boolean;
-    private attachDeliveriesOf;
-    /**
-     * Settle a turn from its result. The provider's totals are CUMULATIVE per
-     * process, so the measured charge is the marginal delta from the held
-     * session's durable baseline, advanced here atomically. A missing or
-     * regressing total is a TELEMETRY FAILURE: the turn settles uncertain at
-     * its reservation, the baseline stays, and the caller must end the hold.
-     * Run aggregates gain the same delta so attended spend never disappears
-     * from routine reporting (v3 R4).
-     */
-    settleTurn(id: number, result: {
-        cumulativeMicrousd: number | null;
-        outputTokens: number | null;
-        now: Date;
-    }): {
-        ok: true;
-        measuredMicrousd: number;
-    } | {
-        ok: false;
-        reason: "telemetry" | "not-unsettled";
-    };
-    /**
-     * Terminal conservative settlement on process exit (ruling 15).
-     * 'cancelled' = recorded but never written: charged zero. 'uncertain' =
-     * written or accepted but never proven settled: charged its reservation.
-     * A turn that never reached ACCEPTANCE reverts its delivery claim so the
-     * ordinary road can deliver the answer later (v6 W5); an accepted turn
-     * keeps its attach — acceptance is the proof.
-     */
-    settleTurnTerminal(id: number, terminal: "uncertain" | "cancelled", now: Date): boolean;
-    private chargeRunAggregates;
-    /**
-     * Custody intent — INSERTed in the final dispatch-proof transaction,
-     * before spawn. The run-held partial unique refuses a
-     * second hold typed, not by accident.
-     */
-    openHeldSession(input: {
-        run: number;
-        authorizationId: string;
-        runner: string;
-        leaseId: string;
-        upIncarnation: string;
-        cookie: string;
-        socketPath: string;
-        now: Date;
-    }): {
-        ok: true;
-    } | {
-        ok: false;
-        reason: "run-held";
-    };
-    /** Stamp pids after spawn. False = the row closed underneath the spawn — kill the child. */
-    stampHeldSession(run: number, supervisorPid: number, agentPgid: number): boolean;
-    heldSessionOf(run: number): HeldSession | null;
-    /** Every un-ended custody row — the fence sweep's and hard-stop's read. */
-    /** The durable session gauge (v28): open custody rows for this runner —
-     * a restarted `up` with orphans pending must count them, so the
-     * in-process map is never the truth. */
-    openHeldSessionCount(runner: string): number;
-    /** Every open authorization on this runner — the beat-all's worklist. */
-    openAuthorizationsOf(runner: string): AttendedAuthorization[];
-    openHeldSessions(): HeldSession[];
-    /** Ordinary close by the owning coordinator. CAS on un-ended. */
-    endHeldSession(run: number, endReason: string, now: Date): boolean;
-    /**
-     * SEIZE custody for fencing (v6, after v4 Q5): CAS open→fencing AND fence
-     * the recorded lease in ONE transaction, so a wedged owner's heartbeat
-     * revival and every later coordinator write fail before any kill happens.
-     */
-    seizeHeldSession(run: number, fencer: string, deadline: Date, now: Date): {
-        ok: true;
-        session: HeldSession;
-    } | {
-        ok: false;
-        reason: "not-open";
-    };
-    /**
-     * Take over a fencing operation whose owner went quiet (v5 P3): CAS on
-     * the EXPIRED deadline. A loser stops only while a live fencer owns it.
-     */
-    takeoverHeldFencing(run: number, fencer: string, deadline: Date, now: Date): boolean;
-    /** Re-arm the fencing deadline while the work continues. Owner-CASed. */
-    renewHeldFencing(run: number, fencer: string, deadline: Date): boolean;
-    /** Final close of a fenced session — owner-CASed, after kill + settlement. */
-    closeHeldFencing(run: number, fencer: string, endReason: string, now: Date): boolean;
     /**
      * File one steering note (arc 1). Validation is validateNote EXACTLY —
-     * no bespoke rule — and filing refuses on finished tasks and during open
-     * tournaments (contestants share a task; all-racer delivery is a future
-     * many-to-many, not a silent single-racer lie).
+     * no bespoke rule — and filing refuses on finished tasks.
      */
     fileSteerNote(taskId: string, author: VerifiedAuthor, note: string, now: Date, mutation?: Mutation): {
         ok: true;
         id: number;
     } | {
         ok: false;
-        reason: "unknown-task" | "task-finished" | "contest-open" | "invalid-note";
+        reason: "unknown-task" | "task-finished" | "invalid-note";
         problem?: string;
     };
     /** Every steering note of a task, filing order, delivery state included. */
     listSteerNotes(taskRef: number): SteerNote[];
-    /** Undelivered, unsuperseded notes — the admitContest refusal predicate. */
+    /** Undelivered, unsuperseded notes. */
     pendingSteerCount(taskRef: number): number;
     /**
      * The attach transaction (arc 1 finding 9): a DEDICATED pre-invocation
@@ -6866,10 +5655,30 @@ export declare class Store {
     flowTriggerCard(trigger: number, key: string): number | null;
     /** The active chat trigger a channel feeds (v89), if any: one per channel. */
     chatTriggerFor(app: string, installation: string, chat: string): FlowTriggerRow | null;
-    /** Record what a trigger did with one outside thing: the card it made, or why it made none. False when it was already recorded. */
-    recordFlowTriggerEvent(trigger: number, key: string, card: number | null, note: string | null, now: Date): boolean;
+    /**
+     * Record what a trigger did with one outside thing: the card it made, or why it made none, and (a standing order's
+     * firing) the task it filed. False when it was already recorded.
+     */
+    recordFlowTriggerEvent(trigger: number, key: string, card: number | null, note: string | null, now: Date, task?: string | null): boolean;
     /** The last card a trigger made, if any. */
     lastFlowTriggerCard(trigger: number): number | null;
+    /**
+     * One at a time (v115, from routines): the oldest task a standing order filed that has neither finished nor been
+     * cancelled — queued, running, held, parked and failed ones all count. A live claim counts whatever the task's state
+     * says, so a state written over a running build can't start a twin beside it.
+     */
+    standingOrderBlocker(trigger: number, routine: number | null, now: Date): {
+        taskId: string;
+        state: string;
+    } | null;
+    /**
+     * What a standing order's tasks spent since `sinceIso` (v115, from routines), anchored to when each provider started:
+     * a paid run whose cost never landed is counted as unmeasured, and a ceiling fails closed on it.
+     */
+    standingOrderSpend(trigger: number, routine: number | null, sinceIso: string): {
+        costUsd: number;
+        unmeasuredRuns: number;
+    };
     /** The tools a project's builds get now (active only), oldest first. */
     projectTools(repo: string): {
         id: number;
@@ -7335,9 +6144,8 @@ export declare class Store {
      * built-in task ids it returned to the queue — rather than a bare count.
      * Nothing here decides liveness: the caller proves the runner is gone (or
      * is taking its name over) inside the transaction that calls this. What it
-     * never does: touch a run that already has an outcome, a run under a live
-     * held session, another runner's rows, or a task some newer live lease
-     * owns. A second pass over the same runner settles nothing and says so.
+     * never does: touch a run that already has an outcome, another runner's
+     * rows, or a task some newer live lease owns. A second pass over the same runner settles nothing and says so.
      */
     recoverRunnerWork(runner: string, now: Date): RunnerWorkRecovery;
     /**
@@ -7388,8 +6196,7 @@ export declare class Store {
      * durably with who asked and when BEFORE any process is signalled. The
      * transaction proves the run is this task's, is still open, holds the
      * task's CURRENT live claim (a reviewer's synthetic lease counts through
-     * its open outcome alone), is not a racing lane (tournaments keep their
-     * own controls), and has admitted no publication — an external request
+     * its open outcome alone), and has admitted no publication — an external request
      * in flight is never recalled by a stop, and the words say so. The
      * stop's hold rides the same write, owned by this run, so nothing
      * automatic retries the task while it is paused; a repeated request
@@ -7406,7 +6213,7 @@ export declare class Store {
         repeated: boolean;
     } | {
         ok: false;
-        reason: "no-run" | "wrong-task" | "finished" | "not-live" | "tournament" | "publication";
+        reason: "no-run" | "wrong-task" | "finished" | "not-live" | "publication";
         detail: string;
     };
     /** Settle a stop — compare-and-set on the unsettled row. True when THIS
@@ -7448,6 +6255,12 @@ export declare class Store {
      * every finished run is visited, a batch at a time. Never signals. */
     recordFinishedRunExits(now: Date, batch?: number): number;
     finishUnspawnedProcess(witness: number, now: Date): void;
+    /** Settled custody, compacted (v114; compactSettledRunProcesses): a finished run whose witnesses all exited keeps
+     * one summary row. A settled stop, an approver's settlement and a recovery compact their run at once; the worker's
+     * reconcile pass (recordFinishedRunExits) compacts every other settled run, including one that settled at run end. */
+    compactRunProcesses(now: Date, only?: number): number;
+    /** Whether a run's witnesses were compacted into its summary: they existed, and all exited. */
+    processesSummarized(runId: number): boolean;
     /** The reconcile road for a pid-less witness a crash or a thrown spawn
      * left behind: once its run has finished, no live child is tracked for it
      * here, every other witness of the run has exited and none of the run's
@@ -7555,10 +6368,7 @@ export declare class Store {
     clearQuota(runner: string, provider: string, scope: string, authMode?: "subscription" | "api-key", credentialFp?: string): boolean;
     /**
      * Live claims this runner holds right now — the occupied slots of §8's
-     * capacity gate. A claim whose run is a HELD attended session is EXCLUDED
-     * (v6 W2): capacity governs unattended work; the attended bound is the
-     * session's own signed envelope (v28: any number of them), so watched
-     * conversations never freeze the runner's queue.
+     * capacity gate.
      */
     liveClaimCount(runner: string, now: Date): number;
     /** The same live claims as liveClaimCount, by the project their task is placed in. */
@@ -7739,24 +6549,8 @@ export declare class Store {
         error: string;
         retryAt?: string;
     }, now: Date): boolean;
-    /** Read receipts without changing the meaning of shell/webhook history. */
-    telegramDeliveries(binding: TelegramBinding): Notification[];
-    /**
-     * Claim pending notifications for one deliverer. Two deliverers — the
-     * bridge and `outbox deliver` — select-then-send-then-record, and without
-     * a claim both can send the same row in the gap. The claim is a short
-     * lease on the act of sending; a deliverer that dies mid-send leaves rows
-     * that unclaim themselves by expiry.
-     */
-    claimDeliveries(owner: string, ttlMs: number, now: Date, only?: "all" | "urgent"): Notification[];
-    /** Finalize only what this owner still holds. A lapsed claim writes nothing. */
-    finalizeDelivery(id: number, owner: string, outcome: {
-        ok: true;
-        receipt: string | null;
-    } | {
-        ok: false;
-        error: string;
-    }, now: Date): boolean;
+    /** The notifications this pairing holds, each with its delivery state there. */
+    telegramDeliveries(binding: TelegramBinding): NotificationReceipt[];
     /** The digest cadence: null everyMs = off. */
     telegramDigest(): TelegramDigest;
     /** Set (or clear, with null) the cadence. Turning it on starts the
@@ -7879,14 +6673,6 @@ export declare class Store {
     /** The message now showing this card, and what it shows. */
     setChatCardMessage(id: number, message: string, digest: string): void;
     markTelegramDigestSent(now: Date): void;
-    /** Every batched row finalized delivered AND the anchor moved, in ONE
-     * transaction (v4 review, finding 5): a digest is either recorded whole
-     * or not at all. Rows whose claim lapsed meanwhile are reported, not
-     * silently skipped. */
-    finalizeDigest(ids: readonly number[], owner: string, receipt: string | null, now: Date): {
-        finalized: number;
-        lapsed: number;
-    };
     /** Routine rows waiting for the next digest: pending, and not urgent.
      * A row the live pairing delivered, or skipped as pre-pairing history,
      * is settled and not waiting. */
@@ -8038,15 +6824,6 @@ export declare const TELEGRAM_HOLD_REASONS: Readonly<{
     order: "Earlier task notification is still undelivered";
     disabled: "Telegram delivery is disabled";
 }>;
-/**
- * Why a contest lane cannot present or accept authority (final authority
- * closure), or null when it can: the lane must be nonterminal, carry a
- * readable stored profile, and that profile's provider, model, and
- * effective repair model must BE the lane's own columns. A profile_json
- * copied from another agent beside stale provider/model columns is a row
- * two authorities wrote; nothing spends on it.
- */
-export declare function laneAuthorityProblem(lane: Contestant): string | null;
 export type WorktreeRow = {
     path: string;
     repo: string;
@@ -8079,16 +6856,6 @@ export type IntakeGrant = {
     revokedBy: string | null;
 };
 /** A review comment bound to the exact bytes of an immutable terminal diff. */
-export type FallbackCycle = {
-    id: number;
-    taskRef: number;
-    chainDigest: string;
-    cursor: number;
-    state: "open" | "sanitizing" | "awaiting-release" | "pending-admission" | "incident" | "closed";
-    transitionGeneration: number;
-    tailRun: number | null;
-    closedReason: string | null;
-};
 export type DiffComment = {
     id: number;
     artifact: number;
@@ -8197,21 +6964,19 @@ export type RevisionRefusal = "busy" | "source-task" | "source-run" | "stale-sou
  *   INHERITED, verbatim, from the source (declared requirements and
  *   constraints — never the installation's defaults of the day):
  *     goal (the child appends its explicitly described repair), exclusions,
- *     touches, the exact rubric, declared risk (never below the source's
- *     signed level or its durable task choice), quality mode (strict stays
+ *     touches, the exact rubric, quality mode (strict stays
  *     strict), permission posture (the source's durable choice, else the
  *     posture its sealed profile ran under — never wider), the per-attempt
  *     budget ceiling (never lifted; a mode's filing default may only
  *     tighten it), the approver's per-phase route overrides, and the
  *     build/plan agent pins.
  *   RE-RESOLVED at filing, then approved afresh: the phase route and its
- *     execution profile (recommended over the inherited risk, quality,
- *     overrides, and pins under today's configuration), the fallback
- *     chain (from the repository's configuration, never copied), and the
+ *     execution profile (recommended over the inherited quality,
+ *     overrides, and pins under today's configuration), and the
  *     auth mode. The child's digest binds what it resolved to; a yes on
  *     the source never covers it.
- *   NEVER INHERITED: the approval stamp and its basis, attended
- *     authorizations, publication and merge grants, the plan document and
+ *   NEVER INHERITED: the approval stamp and its basis,
+ *     publication and merge grants, the plan document and
  *     its revision ledger (a revision is planned afresh, if at all; the
  *     brief plus the source scope are its contract), strikes, holds.
  *   FRESH from a live mode, only when the caller re-proved coverage inside
@@ -8226,7 +6991,6 @@ export type RevisionTerms = {
     outOfScope: string | null;
     touches: string[];
     acceptance: AcceptanceCriterion[];
-    riskLevel: RiskLevel;
     qualityMode: QualityMode;
     permissionMode: UnattendedPermissionMode;
     budgetMicrousd: number | null;
@@ -8245,7 +7009,7 @@ export type RevisionTerms = {
 };
 /** The operator-facing posture a sealed profile actually ran under. */
 export declare function permissionModeOfProfile(profile: ExecutionProfile | null): UnattendedPermissionMode | null;
-export declare function revisionTermsOf(sourceRef: Pick<TaskRef, "riskLevel" | "qualityMode" | "permissionMode" | "routeOverrides" | "agentProvider" | "agentModel" | "planProvider" | "planModel">, sourceScope: Scope | null, coverage: {
+export declare function revisionTermsOf(sourceRef: Pick<TaskRef, "qualityMode" | "permissionMode" | "routeOverrides" | "agentProvider" | "agentModel" | "planProvider" | "planModel">, sourceScope: Scope | null, coverage: {
     defaultBudgetMicrousd: number | null;
     escalated: boolean;
 } | null, permissionDefault: UnattendedPermissionMode, qualityDefault: QualityMode): RevisionTerms;
@@ -8269,7 +7033,6 @@ export type RevisionLineage = {
     ancestors: string[];
     root: string;
     terms: {
-        riskLevel: RiskLevel;
         qualityMode: QualityMode;
         permissionMode: UnattendedPermissionMode;
         budgetMicrousd: number | null;
@@ -8310,9 +7073,6 @@ export type ProofAcceptanceRow = {
     note: string | null;
     acceptedAt: string;
 };
-/** A contestant's execution profile (v24): exact ids from the race terms,
- * effective limits from the same constants every dispatch uses. */
-export declare function contestantProfileOf(provider: string, model: string, repairModel: string, permissionMode?: UnattendedPermissionMode): ExecutionProfile;
 /**
  * The raw terms verdict for one stored scope row (raw authority repair):
  * every term the digest binds and every metadata word an authority reads,