toolroll 0.9.52 → 0.9.54

package/dist/demo.js

@@ -33,8 +33,8 @@ import { addApprover, propose, approve } from "./scope.js";
 import { legOf, routeDigestOf } from "./phase-routing.js";
 import { acquire, release } from "./claim.js";
 import { register } from "./runner.js";
-import { approveRoutine, fireRoutine } from "./routine.js";
-import { fileTaskProposal, fileRoutineProposal } from "./proposal.js";
+import { createScheduledFlow } from "./flow-schedule.js";
+import { fileTaskProposal } from "./proposal.js";
 import { storeEvidence, budgetedStatJson, imageDimensions } from "./evidence.js";
 import { parseProof, adjudicate } from "./proof.js";
 import { sealVerificationReceipt } from "./verification-evidence.js";
@@ -58,7 +58,7 @@ const DEMO_PROFILE = {
 function presentedRoute(store, taskRef, role, spend = { provider: "claude", model: null }) {
     // A task with no scope presents the bare word `legacy` for the exact
     // pair it spends as (atomic authority closure) — nothing opens unstamped.
-    const authority = store.routeAuthorityFor(taskRef, role) ?? store.routeAuthorityFor(taskRef, role, null, spend);
+    const authority = store.routeAuthorityFor(taskRef, role) ?? store.routeAuthorityFor(taskRef, role, spend);
     if (authority === null || !authority.ok)
         throw new Error(`demo seed: ${authority === null ? "no task" : authority.problem}`);
     return { route: authority.stamp };
@@ -419,11 +419,11 @@ export function seedDemo(store, repos, evidenceRoot, now) {
     // --- needs-you: an approval waiting -----------------------------------
     const planned = task("rotate-log-format", "Rotate the request-log format to JSON lines", repos.web, "Switch the request logger to JSON lines so the collector stops parsing free text. Keep the human console formatter for local dev. Migrate the two dashboards that grep the old format.");
     const plannedRef = store.refFor("built-in", planned).id;
-    // An explainable route (v47): the operator declared elevated risk and
+    // An explainable route (v47): the operator sized the change large and
     // overrode the reviewer, so the ceremony shows a recommended leg, a
     // strong-tier leg, and an overridden leg side by side, with the runner's
     // readiness per provider.
-    store.editTaskRoute(plannedRef, { by: "demo", authenticate: () => ({ ok: true }), risk: "elevated" }, hoursAgo(3.5));
+    store.editTaskRoute(plannedRef, { by: "demo", authenticate: () => ({ ok: true }), size: { size: "large", risky: false } }, hoursAgo(3.5));
     store.editTaskRoute(plannedRef, { by: "demo", authenticate: () => ({ ok: true }), override: { phase: "review", provider: "claude", model: "opus" } }, hoursAgo(3.2));
     store.setPlanState(plannedRef, "drafted");
     const plannerRun = store.startRun({
@@ -948,28 +948,18 @@ export function seedDemo(store, repos, evidenceRoot, now) {
     store.cancelTask("design-tokens", hoursAgo(10), "the token package was superseded");
     const held = task("migrate-billing", "Migrate billing exports to the new vendor", repos.api);
     store.hold(store.refFor("built-in", held).id, "waiting on the vendor sandbox account", null, hoursAgo(12));
-    // --- a standing order with a track record ------------------------------
-    const routine = fileRoutineProposal(store, {
-        name: "nightly-deps",
-        repo: repos.api,
-        goal: "Refresh the lockfile within existing ranges, run the suite, summarize anything notable.",
-        outOfScope: "No major version bumps.",
-        touches: [],
-        acceptance: [
-            { id: "c1", statement: "The full test suite passes against the refreshed lockfile.", how: null, evidence: ["check"] },
-        ],
-        requirements: [],
-        schedule: "daily:03:30",
-        costCeilingUsd: null,
-        filedVia: "demo",
+    // --- a scheduled flow, waiting for someone to turn its schedule on -----
+    const nightly = createScheduledFlow(store, {
+        repo: realpathSync(repos.api), name: "Nightly dependency refresh", stem: "nightly-deps", schedule: "daily:03:30", by: "demo",
+        terms: {
+            goal: "Refresh the lockfile within existing ranges, run the suite, summarize anything notable.",
+            outOfScope: "No major version bumps.",
+            touches: [], requirements: [], budgetPerRunMicrousd: null, costCeilingUsd: null,
+            acceptance: [{ id: "c1", statement: "The full test suite passes against the refreshed lockfile.", how: null, evidence: ["check"] }],
+        },
     }, hoursAgo(70));
-    if (!routine.ok)
-        throw new Error(`seed routine: ${routine.reason}`);
-    approveRoutine(store, routine.id, "demo", hoursAgo(69), routine.digest, token);
-    // Two nightly slots since approval: one fires, the second records its
-    // single-flight skip honestly (the first instance is still open).
-    fireRoutine(store, routine.id, hoursAgo(45));
-    fireRoutine(store, routine.id, hoursAgo(21));
+    if (!nightly.ok)
+        throw new Error(`seed scheduled flow: ${nightly.message}`);
     // --- the outer loop: an opened PR with observed checks ----------------
     const pub = store.createPublicationIntent({
         run: doneRun,

package/dist/desktop-update-gate.js

@@ -61,7 +61,6 @@ export function activeUpdateWork(db) {
         runs: count("SELECT count(*) n FROM run WHERE outcome IS NULL"),
         claims: count("SELECT count(*) n FROM claim WHERE released_at IS NULL"),
         conversations: count("SELECT count(*) n FROM mate_turn WHERE state IN ('queued','running')") + count("SELECT count(*) n FROM chat_turn WHERE state IN ('queued','running')"),
-        sessions: count("SELECT count(*) n FROM held_session WHERE ended_at IS NULL"),
         stopping: count("SELECT count(*) n FROM run_stop WHERE settled_at IS NULL"),
         ...activeCodingUpdateWork(db),
     };

package/dist/desktop-update.js

@@ -295,8 +295,6 @@ export function plainLingering(fallbackRun, problem) {
         return { run, on: `Run #${run} finished, but Toolroll can't check whether its folder is still in use`, action: null };
     if (/may still be running|owned subprocess/.test(problem))
         return { run, on: `Run #${run} finished, but ${pid ? `its process ${pid}` : "one of its processes"} is still running`, action: null };
-    if (/held supervisor/.test(problem))
-        return { run, on: `Run #${run} is still shutting down`, action: null };
     if (/still open/.test(problem))
         return { run, on: `Run #${run} is still running`, action: null };
     return { run, on: `Run #${run} hasn't finished shutting down`, action: null };
@@ -844,7 +842,7 @@ export async function runDesktopUpdate(stateDir, hooks = {}) {
                 if (j.waiting && now().getTime() - Date.parse(j.waiting.since) >= LINGERING_LIMIT_MS)
                     stuck = lingering;
                 else
-                    save(j, "draining", lingering ? `New work is paused. Waiting for run #${lingering.run}: ${lingeringWords(lingering)} No process is being killed.` : `Waiting for current work: ${active.runs} runs, ${active.claims} leases, ${active.conversations} chat requests, ${active.sessions} sessions, ${active.stopping} shutdowns, ${active.coding} coding sessions, ${active.codingDeliveries} unconfirmed messages. Nothing is being cancelled.`);
+                    save(j, "draining", lingering ? `New work is paused. Waiting for run #${lingering.run}: ${lingeringWords(lingering)} No process is being killed.` : `Waiting for current work: ${active.runs} runs, ${active.claims} leases, ${active.conversations} chat requests, ${active.stopping} shutdowns, ${active.coding} coding sessions, ${active.codingDeliveries} unconfirmed messages. Nothing is being cancelled.`);
             }
             finally {
                 checking.close();

package/dist/discord-chat.js

@@ -190,17 +190,13 @@ export async function deliverDiscordPart(options) {
     if (!options.current() ||
         !state.owns(identity.installation, options.owner, now))
         return false;
-    const row = state
-        .prepare("SELECT p.* FROM chat_part p JOIN chat_event e ON e.id=p.event WHERE e.installation=? AND p.state='pending' AND (e.kind!='notice' OR ?=1) AND (p.next_at IS NULL OR p.next_at<=?) ORDER BY p.id LIMIT 1")
-        .get(identity.installation, options.canNotify?.() === false ? 0 : 1, now.toISOString());
+    const row = state.nextPart(identity.installation, options.canNotify?.() !== false, now);
     if (!row)
         return false;
     const event = state.event(row.event), binding = event.binding === null ? null : state.bindingById(event.binding);
     if (!binding ||
         new Date(row.created).getTime() + 86_400_000 < now.getTime()) {
-        state
-            .prepare("UPDATE chat_part SET state='dropped',problem='Delivery expired or access changed; open the saved chat' WHERE id=?")
-            .run(row.id);
+        state.dropPart(row.id, "Delivery expired or access changed; open the saved chat");
         return true;
     }
     try {
@@ -214,16 +210,16 @@ export async function deliverDiscordPart(options) {
             throw new DiscordError("Connected projects changed");
         let text = content.text, buttons = [], file;
         if (content.image && content.shot && resultShotsPruned(options.evidenceRoot, content.image.run)) {
-            state.prepare("UPDATE chat_part SET state='dropped',problem='Removed by retention' WHERE id=?").run(row.id);
+            state.dropPart(row.id, "Removed by retention");
             return true;
         }
         // A screenshot sent with a result replies to that result's message once it is placed, and waits until then.
-        const result = content.shot?.follows == null ? undefined : state.prepare("SELECT message,state,next_at FROM chat_part WHERE id=?").get(content.shot.follows);
-        if (result !== undefined && !discordId(result["message"]) && result["state"] === "pending") {
-            state.prepare("UPDATE chat_part SET next_at=? WHERE id=?").run(shotWaitsUntil(result["next_at"], now), row.id);
+        const result = content.shot?.follows == null ? null : state.part(content.shot.follows);
+        if (result !== null && !discordId(result.message) && result.state === "pending") {
+            state.holdPart(row.id, shotWaitsUntil(result.next_at, now));
             return true;
         }
-        const follows = result?.["message"];
+        const follows = result?.message;
         const thread = discordId(follows) ? String(follows) : event.thread;
         if (content.image) {
             const image = verifyResultImage(store, options.evidenceRoot, repos, content.image);
@@ -260,8 +256,7 @@ export async function deliverDiscordPart(options) {
                     preview.text.length <= 3400 &&
                     discordPlain(text).length <= 3900) {
                     buttons = state
-                        .prepare("SELECT token,phase FROM chat_action WHERE part=? AND consumed IS NULL AND expires>? ORDER BY rowid")
-                        .all(row.id, now.toISOString())
+                        .partTokens(row.id, now)
                         .map((action) => ({
                         type: 2,
                         style: action.phase === "yes" ? 4 : action.phase === "confirm" ? 1 : 2,
@@ -317,6 +312,10 @@ export async function deliverDiscordPart(options) {
                         custom_id: `so_${one.token}`,
                     }))
                     : []),
+                // A result's, plan's, failure's or pull request's own buttons (chat-decide.ts): its acts, then its links.
+                ...(content.decide?.rows.flat() ?? []).flatMap((one, index) => "token" in one
+                    ? [{ type: 2, style: index === 0 ? 1 : 2, label: one.label.slice(0, 80), custom_id: `so_${one.token}` }]
+                    : link(options.origin(), one.link)),
                 ...link(options.origin(), content.link),
                 ...(content.also ?? []).flatMap(one => link(options.origin(), one)),
             ];
@@ -355,13 +354,7 @@ export async function deliverDiscordPart(options) {
                     // Preserve the original remote attachment; never upload it again on an edit.
                     file = undefined;
                 }
-                state
-                    .prepare("UPDATE chat_part SET message=?,uploaded=? WHERE id=?")
-                    .run(target, content.image &&
-                    Array.isArray(found.attachments) &&
-                    found.attachments.length
-                    ? 1
-                    : 0, row.id);
+                state.setPartFile(row.id, null, Boolean(content.image && Array.isArray(found.attachments) && found.attachments.length), target);
             }
         }
         await channelAccess(shared, binding, session?.ceilingDigest);
@@ -396,17 +389,13 @@ export async function deliverDiscordPart(options) {
                     !answer.attachments.some((v) => object(v).filename === file.name &&
                         Number(object(v).size) === file.bytes.length))))
             throw new DiscordError("Discord did not confirm the message and file identity", 15_000, true);
-        state
-            .prepare("UPDATE chat_part SET state='sent',message=?,attempts=attempts+1,problem=NULL,next_at=NULL WHERE id=?")
-            .run(answer.id, row.id);
-        state
-            .prepare("UPDATE chat_runtime SET problem=NULL WHERE installation=? AND owner=?")
-            .run(identity.installation, options.owner);
+        state.partSent(row.id, String(answer.id), options.clock?.() ?? new Date());
+        state.setProblem(identity.installation, options.owner, null);
         return true;
     }
     catch (error) {
         if (error instanceof ChatDeliveryError && error.permanent) {
-            state.prepare("UPDATE chat_part SET state='dropped',next_at=NULL,problem=? WHERE id=?").run(error.message, row.id);
+            state.dropPart(row.id, error.message);
             return true;
         }
         // No permission to attach files here: one plain line instead of the result's screenshots.
@@ -420,18 +409,10 @@ export async function deliverDiscordPart(options) {
             : new DiscordError("Discord delivery is waiting to retry", 15_000, true);
         const until = new Date((options.clock?.() ?? new Date()).getTime() +
             Math.max(problem.retryMs, [5000, 15000, 60000, 300000][Math.min(row.attempts, 3)])).toISOString();
-        state
-            .prepare("UPDATE chat_part SET attempts=attempts+1,uncertain=uncertain+?,next_at=?,problem=? WHERE id=?")
-            .run(problem.uncertain ? 1 : 0, until, problem.message, row.id);
-        state
-            .prepare("UPDATE chat_runtime SET problem=? WHERE installation=? AND owner=?")
-            .run(problem.code === "ratelimited"
-            ? "Discord asked us to wait. Saved replies will retry."
-            : problem.message, identity.installation, options.owner);
+        state.partFailed(row.id, { problem: problem.message, until, uncertain: problem.uncertain });
+        state.setProblem(identity.installation, options.owner, problem.code === "ratelimited" ? "Discord asked us to wait. Saved replies will retry." : problem.message);
         if (problem.code === "ratelimited")
-            state
-                .prepare("UPDATE chat_runtime SET retry_at=? WHERE installation=?")
-                .run(until, identity.installation);
+            state.deferUntil(identity.installation, until);
         return true;
     }
 }

package/dist/discord-settings.js

@@ -9,14 +9,10 @@ const escape = (text) => text
     .replaceAll("'", "'");
 export function discordSettingsHtml(store, dir, csrf, options = {}) {
     const credentials = loadDiscordCredentials(dir), state = new ChatState(store, "discord"), bindings = credentials ? state.bindings(credentials.installation).filter(one => state.live(one)) : [], binding = options.who === undefined ? null : bindings.find(one => one.approver === options.who) ?? null, others = bindings.length - (binding === null ? 0 : 1);
-    const runtime = credentials
-        ? state.db
-            .prepare("SELECT connected,problem,lease_until FROM discord_runtime WHERE installation=?")
-            .get(credentials.installation)
-        : null;
+    const runtime = credentials ? state.runtime(credentials.installation) : null;
     const now = options.now ?? new Date(), live = runtime &&
-        typeof runtime.lease_until === "string" &&
-        runtime.lease_until > now.toISOString() &&
+        runtime.leaseUntil !== null &&
+        runtime.leaseUntil > now.toISOString() &&
         runtime.connected;
     const hidden = `<input type="hidden" name="csrf" value="${escape(csrf)}">`;
     const password = '<label>Your Toolroll password<input style="min-height:44px" type="password" name="password" autocomplete="current-password" required></label>';
@@ -44,12 +40,7 @@ export function discordSettingsHtml(store, dir, csrf, options = {}) {
                     '<a class="button-link" style="min-height:44px;white-space:nowrap" href="/settings/discord">Check connection</a>';
         }
         else if (binding && state.live(binding)) {
-            const pending = Number(state.db
-                .prepare("SELECT count(*) n FROM discord_part p JOIN discord_event e ON e.id=p.event WHERE e.binding=? AND p.state='pending'")
-                .get(binding.id)?.n ?? 0);
-            const failed = Number(state.db
-                .prepare("SELECT count(*) n FROM discord_part p JOIN discord_event e ON e.id=p.event WHERE e.binding=? AND p.state='dropped'")
-                .get(binding.id)?.n ?? 0);
+            const { pending, dropped: failed } = state.partCounts(binding.id);
             content +=
                 `<p>Your Discord account is paired.${others ? ` ${others} teammate${others === 1 ? " is" : "s are"} paired too.` : ""}${pending ? ` ${pending} replies waiting to send.` : ""}${failed ? ` ${failed} replies could not be delivered. Open the saved chat to recover them.` : ""}</p>` +
                     "<p>Try “What needs my attention?” or “Show the evidence for the latest result.”</p>" +

package/dist/discord.js

@@ -37,9 +37,7 @@ export async function followDiscord(options) {
                 current.botToken === credentials.botToken &&
                 state.owns(credentials.installation, owner));
         };
-        const problem = (message) => state
-            .prepare("UPDATE chat_runtime SET problem=? WHERE installation=? AND owner=?")
-            .run(message, credentials.installation, owner);
+        const problem = (message) => state.setProblem(credentials.installation, owner, message);
         const api = discordApi(credentials.botToken);
         const client = new Client({
             // Guild messages and their content are needed for rooms; the Message
@@ -63,9 +61,7 @@ export async function followDiscord(options) {
             if (!same() || !validated)
                 return;
             connected = true;
-            state
-                .prepare("UPDATE chat_runtime SET connected=?,problem=NULL WHERE installation=? AND owner=?")
-                .run(new Date().toISOString(), credentials.installation, owner);
+            state.setConnected(credentials.installation, owner, new Date());
         };
         client.on("shardReady", online);
         client.on("shardResume", online);
@@ -133,11 +129,7 @@ export async function followDiscord(options) {
         try {
             await client.login(credentials.botToken);
             while (same()) {
-                const retry = state
-                    .prepare("SELECT retry_at FROM chat_runtime WHERE installation=?")
-                    .get(credentials.installation)?.retry_at;
-                if (!connected ||
-                    (typeof retry === "string" && retry > new Date().toISOString())) {
+                if (!connected || state.retryAt(credentials.installation) > new Date().toISOString()) {
                     await pause(1000);
                     continue;
                 }
@@ -160,9 +152,7 @@ export async function followDiscord(options) {
             alive = false;
             options.signal.removeEventListener("abort", stop);
             await client.destroy().catch(() => { });
-            state
-                .prepare("UPDATE chat_runtime SET owner=NULL,lease_until=NULL,connected=NULL WHERE installation=? AND owner=?")
-                .run(credentials.installation, owner);
+            state.stop(credentials.installation, owner);
         }
         await pause(5000);
     }

package/dist/dispatch.d.ts

@@ -90,7 +90,7 @@ export declare function taskReadinessBlocker(store: Store, taskRef: number, now:
  * mode still stand. */
 export declare function scopeApprovedForDispatch(store: Store, taskRef: number, now: Date): boolean;
 /** The phase the ordinary dispatch loop would choose before it resolves an
- * agent. Attended authorization is deliberately outside this ordinary path. */
+ * agent. */
 export declare function dispatchRoleFor(store: Store, taskRef: number, now: Date): "builder" | "planner" | "scout";
 /** The first requirement this task fails, in words, or null. */
 export declare function missingCapability(store: Store, taskRef: number, dispatchRepo: string | null, now: Date): string | null;

package/dist/dispatch.js

@@ -85,7 +85,7 @@ export function scopeApprovedForDispatch(store, taskRef, now) {
     return row !== undefined;
 }
 /** The phase the ordinary dispatch loop would choose before it resolves an
- * agent. Attended authorization is deliberately outside this ordinary path. */
+ * agent. */
 export function dispatchRoleFor(store, taskRef, now) {
     const ref = store.refForId(taskRef);
     const approved = scopeApprovedForDispatch(store, taskRef, now);

package/dist/dispose.d.ts

@@ -6,10 +6,9 @@ import { type ProofVerdict } from "./proof.js";
  * Which road is disposing. 'tick' = the unattended loop: full task
  * completion, strikes, quota, publication. 'standalone' = the one-off
  * `build` command: run records only — no task state, no strikes, no
- * publication (its historical shape). The held road reuses 'tick' —
- * an attended session is still the task's real attempt.
+ * publication (its historical shape).
  */
-export type DisposePolicy = "tick" | "standalone" | "continuation";
+export type DisposePolicy = "tick" | "standalone";
 export type DisposeContext = {
     store: Store;
     policy: DisposePolicy;

package/dist/dispose.js

@@ -5,16 +5,15 @@ import { originalTaskBase, focusedTestCommandSupported } from "./observations.js
  * operations that actually END an attempt — sealing parks, accepting
  * completions behind the completion fence, recording failures with their
  * strikes and holds, opening publication intents — extracted from tick's
- * and the standalone build command's finalizers into ONE place, so the
- * held-session coordinator can end a run through exactly the machinery
- * every other road uses. The two historical roads differ deliberately
+ * and the standalone build command's finalizers into ONE place. The two
+ * historical roads differ deliberately
  * (the standalone command completes no task, strikes nothing, publishes
  * nothing), and the policy record says so explicitly instead of forking
  * the logic: behavior on both is byte-identical to what the callers
  * inlined before.
  */
 import { createHash } from "node:crypto";
-import { completeFenced, finalizeFailureFenced, finalizeHandBackFenced, finalizeMalformedFenced, finalizeParkFenced, interruptIfStopped, release, } from "./claim.js";
+import { interruptIfStopped, release, finalize, } from "./claim.js";
 import { bodyHashOf, publicationBody } from "./publish.js";
 import { modeTermsFromJson } from "./modes.js";
 import { evidenceRoot, readVerifiedArtifact, writeEvidenceFile } from "./evidence.js";
@@ -101,8 +100,8 @@ function disposeBuildOutcomeLocked(context, result) {
     if (result.ok && result.parked !== undefined) {
         if (leaseId === undefined)
             return { kind: "park-fenced" };
-        const sealed = finalizeParkFenced(store, {
-            leaseId,
+        const sealed = finalize(store, leaseId, {
+            kind: "park",
             runId,
             taskId,
             decision: result.parked.decision,
@@ -118,57 +117,6 @@ function disposeBuildOutcomeLocked(context, result) {
         return { kind: "parked", decisionId: sealed.decisionId };
     }
     if (result.ok) {
-        if (policy === "continuation") {
-            // The taskless success (v4 Q7 + v5 P5): run finished, claim released,
-            // publication intent under the SAME completion latch the ordinary
-            // road holds — and the parent task untouched in state, strikes,
-            // holds, and derived stats. All one transaction.
-            const sealed = store.transact(() => {
-                const latchOpen = store.mirrorAllowsCompletion(taskId);
-                store.finishRun(runId, {
-                    outcome: result.noChange === true ? "no-change" : "built",
-                    ...(result.noChange === true ? { reason: "handoff" } : {}),
-                    committed: result.committed,
-                    now: clock(),
-                });
-                if (leaseId !== undefined)
-                    release(store, leaseId, clock());
-                if (!latchOpen)
-                    return { disowned: true };
-                if (result.noChange !== true && result.committed) {
-                    const grant = store.publicationGrantFor(repo);
-                    const headSha = store.getRun(runId)?.headRevision ?? null;
-                    if (grant !== null &&
-                        grant.publishOn !== "complete" &&
-                        headSha !== null &&
-                        headWithin(branch, grant.headPrefix) &&
-                        (grant.selector === "all" || origin === "ours")) {
-                        const intentId = store.createPublicationIntent({
-                            run: runId,
-                            taskRef,
-                            githubRepo: grant.githubRepo,
-                            remote: grant.remote,
-                            base: grant.base,
-                            head: branch,
-                            headSha,
-                            bodyHash: "",
-                            draft: grant.draft,
-                        }, clock());
-                        const publication = store.publicationForRun(runId);
-                        if (publication !== null) {
-                            store.handle
-                                .prepare("UPDATE publication SET body_hash = ? WHERE id = ?")
-                                .run(bodyHashOf(publicationBody(store, publication)), intentId);
-                        }
-                    }
-                }
-                return { disowned: false };
-            });
-            store.clearQuota(runner, provider, model ?? "");
-            if (sealed.disowned)
-                return { kind: "disowned" };
-            return { kind: "built", committed: result.committed, noChange: result.noChange === true };
-        }
         if (policy === "standalone") {
             store.finishRun(runId, {
                 outcome: result.noChange === true ? "no-change" : "built",
@@ -184,7 +132,7 @@ function disposeBuildOutcomeLocked(context, result) {
         // around the fenced release, the run's outcome, and the publication
         // intent, so "done" and "this must reach a PR" cannot come apart.
         const sealed = store.transact(() => {
-            const fence = completeFenced(store, leaseId, "done", clock());
+            const fence = finalize(store, leaseId, { kind: "complete", state: "done", now: clock() });
             if (!fence.ok)
                 return fence;
             // The disowned arm (external dispatch, v4 §24): the tracker closed
@@ -264,14 +212,14 @@ function disposeBuildOutcomeLocked(context, result) {
     // THE ALREADY-SEALED ENDINGS (adaptive execution plans). Every other arm
     // below ends the attempt itself — releases the claim, writes the run's
     // outcome, counts what it costs. These two arrive with all of that
-    // already done: `finalizeRevisionFenced` released the lease, appended the
+    // already done: `finalize` (a `revision` ending) released the lease, appended the
     // ledger row, placed the hold when one was owed, finished the run, and
     // paged, all inside ONE fenced transaction — the planner road's shape,
     // where claim.ts owns the ending and dispose only reports it.
     //
     // So this branch exists to do NOTHING, deliberately, and it is placed
-    // above the policy arms so that every road — tick, standalone, held,
-    // continuation — skips them alike.
+    // above the policy arms so that every road — tick and standalone —
+    // skips them alike.
     //
     // Falling through instead would be wrong twice over. `release()` would
     // survive it (an already-released lease whose `released_by` is
@@ -284,20 +232,10 @@ function disposeBuildOutcomeLocked(context, result) {
     if (result.reason === "plan-revised" || result.reason === "plan-revision-blocked") {
         return { kind: "skipped", reason: result.reason };
     }
-    if (policy === "continuation") {
-        // The taskless failure (v4 Q7): the run says what happened, the claim
-        // releases — NO strikes, NO holds, NO done→failed demotion; three
-        // failed continuations still leave the parent exactly as it finished.
-        const outcome = result.reason === "fenced" ? "refused" : "failed";
-        store.finishRun(runId, { outcome, reason: result.reason, now: clock() });
-        if (leaseId !== undefined)
-            release(store, leaseId, clock());
-        return { kind: "recorded", outcome };
-    }
     if (policy === "standalone") {
         if (result.reason === "malformed-decision" && leaseId !== undefined) {
-            const sealed = finalizeMalformedFenced(store, {
-                leaseId,
+            const sealed = finalize(store, leaseId, {
+                kind: "malformed",
                 runId,
                 taskId,
                 problems: result.problems ?? [],
@@ -309,19 +247,6 @@ function disposeBuildOutcomeLocked(context, result) {
         store.finishRun(runId, { outcome, reason: result.reason, now: clock() });
         return { kind: "recorded", outcome };
     }
-    // The attended refusal family (v28 sweep): typed, no strike, release and
-    // move on — the pre-claim gates make every one a rare race, and the
-    // invariant arm they used to fall through is for BUGS, not races.
-    if (result.reason === "attended-only" ||
-        result.reason === "attended-held" ||
-        result.reason === "stale-authorization" ||
-        result.reason === "session-cap" ||
-        result.reason === "run-held") {
-        if (leaseId !== undefined)
-            release(store, leaseId, clock());
-        store.finishRun(runId, { outcome: "refused", reason: result.reason, now: clock() });
-        return { kind: "skipped", reason: result.reason };
-    }
     if (result.reason === "unapproved" || result.reason === "scope-changed") {
         // Approval drifted between the prefilter and the builder's own gate.
         if (leaseId !== undefined)
@@ -337,8 +262,8 @@ function disposeBuildOutcomeLocked(context, result) {
     if (result.reason === "malformed-decision") {
         if (leaseId === undefined)
             return { kind: "malformed", sealed: false };
-        const sealed = finalizeMalformedFenced(store, {
-            leaseId,
+        const sealed = finalize(store, leaseId, {
+            kind: "malformed",
             runId,
             taskId,
             problems: result.problems ?? [],
@@ -349,7 +274,7 @@ function disposeBuildOutcomeLocked(context, result) {
     // A stop no operator asked for is the SERVICE stopping (the fence above
     // already settled every task stop): hand the attempt back, never strike it.
     if (result.reason === "stopped" && policy === "tick" && leaseId !== undefined && store.getRun(runId)?.role === "builder") {
-        const handed = finalizeHandBackFenced(store, { leaseId, runId, taskId, message: result.message, now: clock() });
+        const handed = finalize(store, leaseId, { kind: "hand-back", runId, taskId, message: result.message, now: clock() });
         return { kind: "handed-back", requeued: handed.requeued };
     }
     if (TICK_FAILURE_REASONS.has(result.reason)) {
@@ -376,8 +301,8 @@ function disposeBuildOutcomeLocked(context, result) {
             store.finishRun(runId, { outcome: "failed", reason: result.reason, now: clock() });
             return { kind: "failed", failureClass, disposition: null, strikes: null, sealed: false };
         }
-        const sealed = finalizeFailureFenced(store, {
-            leaseId,
+        const sealed = finalize(store, leaseId, {
+            kind: "failure",
             runId,
             taskId,
             failureClass,
@@ -531,7 +456,7 @@ export function regateTask(store, taskId, now, approval) {
     return store.transact(() => {
         const proposed = propose(store, {
             taskId, goal: scope.goal, outOfScope: scope.outOfScope, touches: scope.touches, budgetMicrousd: scope.budgetMicrousd,
-            acceptance: scope.acceptance, qualityMode: scope.qualityMode ?? "default", riskLevel: scope.riskLevel ?? "routine",
+            acceptance: scope.acceptance, qualityMode: scope.qualityMode ?? "default",
             candidate: head, now,
         });
         let sealed = false;

package/dist/envelope.js

@@ -55,12 +55,9 @@ export const DOCUMENTED_REASONS = [
     "unapproved", //        no person has agreed to the scope yet
     "reserved", //          the task belongs to another worker's queue
     "external", //          a tracker mirror is not dispatchable (see detail)
-    "contest-open", //      a tournament is running; a person picks
-    "all-lanes-raceable", // every compared agent could hold a real budget — race them instead
     "provider-unattested", // the provider binary is outside its attested range
     "daily-runs", //        the active mode's daily run cap is spent
     "daily-dollars", //     the active mode's daily measured-spend rail is reached
-    "steering-pending", //  a steering note is waiting; contests refuse
     "not-ready", //         blocked, held, or otherwise not dispatchable
     "not-leased", //        the lease does not exist or already ended
     "not-yours", //         held or reserved by someone else

package/dist/exec.d.ts

@@ -226,67 +226,3 @@ export declare function runStreamJsonl(file: string, args: readonly string[], op
  */
 export declare function runGeminiStreamJsonl(file: string, args: readonly string[], options?: RunOptions): Promise<ExecResult>;
 export declare function runClaudeStreamJsonl(file: string, args: readonly string[], options?: RunOptions): Promise<ExecResult>;
-/**
- * Where the supervisor script lives: a plain-.mjs sibling of this module in
- * BOTH layouts (src/ under tsx, dist/ after build — postbuild copies it).
- */
-export declare function supervisorPath(): string;
-/**
- * Darwin's sun_path is 104 bytes including the terminator; Linux allows a
- * hair more. Refusing at spawn beats failing inside bind() with a raw
- * ENAMETOOLONG after custody was already recorded.
- */
-export declare const HELD_SOCKET_PATH_LIMIT = 103;
-export declare function heldSocketPathProblem(path: string): string | null;
-export type HeldSessionEvents = {
-    /** The nth system/init observed (1-based) — acceptance of the nth written turn. */
-    onTurnInit?: (seq: number) => void;
-    /** The nth primary-origin result (1-based) — settlement material for the nth turn. */
-    onTurnResult?: (seq: number, event: Record<string, unknown>) => void;
-    /** Every parsed stream event, arc-1 isolation rules unchanged. */
-    onStreamEvent?: (event: Record<string, unknown>) => void;
-    onSessionId?: (id: string) => void;
-    /** The supervisor exited: the hold is over, however it ended. */
-    onExit?: (info: {
-        code: number | null;
-    }) => void;
-};
-export type HeldSessionHandle = {
-    supervisorPid: number | null;
-    agentPgid: number | null;
-    /** One turn as a stream-json line. False = the pipe is gone; nothing was written. */
-    writeTurn(json: string): boolean;
-    /** The EOF road: the supervisor fences (EOF → grace → group kill) on its own. */
-    endInput(): void;
-    /** SIGTERM the supervisor — the same fence, for expiry/revocation/lapse. */
-    terminate(): void;
-    /** Last resort only: SIGKILL the supervisor itself (can orphan the agent). */
-    killHard(): void;
-    exited: Promise<{
-        code: number | null;
-    }>;
-};
-export type HeldSessionStart = {
-    ok: true;
-    handle: HeldSessionHandle;
-} | {
-    ok: false;
-    reason: "socket-path" | "spawn-failed" | "ready-timeout";
-    message: string;
-};
-/**
- * Hold one claude process open across stream-json turns, under a
- * supervisor whose parenthood makes the eventual kill provable. Returns
- * once the supervisor's control frame settles the spawn either way.
- *
- * No timers live here: the per-turn wall deadline, liveness lapse, and
- * absolute expiry are the coordinator's exact timers (v2 S1d) — this
- * transport only moves bytes and counts the protocol's own marks.
- */
-export declare function startClaudeHeldSession(file: string, args: readonly string[], options: RunOptions & {
-    socketPath: string;
-    cookie: string;
-    graceMs?: number;
-    events?: HeldSessionEvents;
-    readyTimeoutMs?: number;
-}): Promise<HeldSessionStart>;