toolroll 0.9.52 → 0.9.54

package/dist/mate-tools.js

@@ -43,7 +43,7 @@ import { parseAcceptanceCriteria } from "./scope.js";
 import { diagnoseTaskDispatch, withDispatchDiagnoses } from "./dispatch.js";
 import { agentChoicesFor, routeOfTask, INSTALLATION_SCOPE } from "./agentconfig.js";
 import { isNewModel, modelWords, priceWords, runtimeStates, seenModels } from "./model-catalog.js";
-import { agentsSummary, chosenWords, PHASES, postureWords, RISK_CHOICES, riskConsequence, riskTitle, routeProblems, sameSpec, sizeSourceWords, sizeWords, specWords } from "./phase-routing.js";
+import { agentsSummary, chosenWords, PHASES, postureWords, routeProblems, sameSpec, sizeSourceWords, sizeWords, specWords } from "./phase-routing.js";
 import { TOOL_CATALOG, discoverTools, projectToolsOf, secretsSetFor, toolCommandLine, toolStanding } from "./project-tools.js";
 import { deciderOf, durationWords, FLOW_KIND_WORDS, FLOW_TEMPLATES, flowFromSteps, stepsFor, withKeptSteps } from "./flows.js";
 import { parseContract, toModelSchema } from "./contracts/contract.js";
@@ -320,8 +320,8 @@ function scopeStandingOf(store, taskId) {
 const ROLE_WORD = { plan: "planner", build: "builder", repair: "repair", review: "reviewer" };
 const ROLE_OF_WORD = { planner: "plan", plan: "plan", builder: "build", build: "build", repair: "repair", reviewer: "review", review: "review" };
 /**
- * THE AGENTS A TASK RUNS UNDER, as chat reads them (v48): the declared
- * risk and what it means, the same one-line summary the task page and CLI
+ * THE AGENTS A TASK RUNS UNDER, as chat reads them (v48): the task's size,
+ * the same one-line summary the task page and CLI
  * print, each role's exact agent with its reasons, the standing of those
  * agents (approved / awaiting approval / recommended), and — for a
  * proposal — only the configured, role-valid choices an operator could
@@ -334,14 +334,11 @@ export function agentsOver(store, taskId, now) {
         return null;
     const routed = routeOfTask(store, taskId, ref, now);
     const scope = store.getScope(taskId);
-    const risk = ref.riskLevel ?? scope?.riskLevel ?? "routine";
-    const editable = !store.hasLiveClaim(ref.id, now) && store.activeTournamentTerms(ref.id) === null;
-    const editableWhy = store.hasLiveClaim(ref.id, now) ? "this task is running — its agents cannot change under a live claim" : store.activeTournamentTerms(ref.id) !== null ? "tournament terms decide the agents while the contest is open" : null;
+    const editable = !store.hasLiveClaim(ref.id, now);
+    const editableWhy = store.hasLiveClaim(ref.id, now) ? "this task is running — its agents cannot change under a live claim" : null;
     const base = {
         task: taskId,
-        risk: { level: risk, title: riskTitle(risk), consequence: riskConsequence(risk) },
         size: ref.sizing == null ? null : { size: ref.sizing.size, risky: ref.sizing.risky, reason: ref.sizing.reason, source: sizeSourceWords(ref.sizing.source) },
-        riskChoices: RISK_CHOICES.map(one => ({ risk: one.risk, title: one.title, consequence: one.consequence })),
         editable,
         editableWhy,
         approval: scope === null ? "none" : scopeStandingOf(store, taskId),
@@ -497,7 +494,7 @@ const MATE_TOOL_HANDLERS = {
         description: "When the owner asks to approve one thing (a plan waiting on them, or a flow card waiting at a Person decides step), send that item's own Approve and Send back buttons to their paired chat right away. Their tap there is the approval (two taps, as on any decision card); you never approve. Give task for a plan, or card for a flow card (its number from get_flows). When it can't be approved in chat, the answer says why: say that in one line and open show_control approval (a plan) or the flow, never that you can't approve.",
         handle: (ctx, args) => {
             const pairedHere = ctx.channel === "telegram";
-            const paired = ctx.store.handle.prepare("SELECT 1 FROM telegram_binding WHERE approver = ? AND approver_generation = ? AND revoked_at IS NULL LIMIT 1")
+            const paired = ctx.store.handle.prepare("SELECT 1 FROM chat_binding WHERE provider = 'telegram' AND approver = ? AND generation = ? AND revoked IS NULL LIMIT 1")
                 .get(ctx.who.name, ctx.store.accountOf(ctx.who.name)?.generation ?? -1) !== undefined;
             const stamp = ctx.now.getTime();
             if (args["card"] !== undefined) {
@@ -523,7 +520,8 @@ const MATE_TOOL_HANDLERS = {
             if (task === null || admittedRef(ctx, task) === null)
                 return notFound();
             const current = ctx.store.taskFamilyOf(task, ctx.who.repos, false)?.current.id ?? task;
-            const plan = planInChat(ctx.store, current, ctx.who.name, ctx.now, ctx.evidenceRoot);
+            // Its buttons go to the paired Telegram chat (pairedHere), so it is that chat's authority that counts.
+            const plan = planInChat(ctx.store, current, ctx.who.name, ctx.now, "telegram", ctx.evidenceRoot);
             if (!plan.ok)
                 return { ok: true, body: { offered: false, task: current, why: plan.why, control: "approval" } };
             if (!pairedHere || !paired)
@@ -1536,7 +1534,7 @@ const MATE_TOOL_HANDLERS = {
         },
     },
     get_agents: {
-        description: "Read current roles, risk, approval, configured alternatives and the organisation policy (allowed providers, models, tools, permission ceiling; changed only on Settings → Policy) before propose_agents.",
+        description: "Read current roles, size, approval, configured alternatives and the organisation policy (allowed providers, models, tools, permission ceiling; changed only on Settings → Policy) before propose_agents.",
         handle: (ctx, args) => {
             const taskId = taskIdOf(args);
             if (taskId === null)
@@ -1697,8 +1695,6 @@ const MATE_TOOL_HANDLERS = {
                 return { ok: false, message: `guidance is plain text up to ${LIMITS.note} characters` };
             if (task.state === "done" || task.state === "cancelled")
                 return { ok: false, message: "that task is finished, so guidance has no next attempt to reach" };
-            if (ctx.store.openContestFor(ref.id) !== null)
-                return { ok: false, message: "agents are racing on that task — wait until the comparison finishes" };
             const id = ctx.draft("steer", { task: taskId, taskTitle: task.title, repoId: ref.repoId, note: args["note"] });
             if (id === null)
                 return tooMany();
@@ -1790,14 +1786,13 @@ const MATE_TOOL_HANDLERS = {
         },
     },
     propose_agents: {
-        description: "Read get_agents. Change risk, size (small: fast model, no plan; large or risky: strongest agents), configured role model, or clear override; stales approval, refuses running work.",
+        description: "Read get_agents. Change size (small: fast model, no plan; large or risky: strongest agents), configured role model, or clear override; stales approval, refuses running work.",
         handle: (ctx, args) => {
             const taskId = taskIdOf(args);
             const ref = taskId === null ? null : admittedRef(ctx, taskId);
             const task = taskId === null ? null : ctx.store.getTask(taskId);
             if (taskId === null || ref === null || task === null)
                 return notFound();
-            const risk = args["risk"];
             const roleWord = args["role"];
             const phase = roleWord === undefined ? null : typeof roleWord === "string" ? ROLE_OF_WORD[roleWord] ?? null : null;
             if (roleWord !== undefined && (phase === null || phase === "review"))
@@ -1808,8 +1803,8 @@ const MATE_TOOL_HANDLERS = {
             const risky = args["risky"];
             const sized = ctx.store.refForId(ref.id)?.sizing ?? null;
             const sizeChange = size === undefined && risky === undefined ? null : { size: size ?? sized?.size ?? "medium", risky: risky ?? sized?.risky ?? false };
-            if (risk === undefined && phase === null && sizeChange === null)
-                return { ok: false, message: "say what changes: a risk, a size, or a role with an agent (or clear: true)" };
+            if (phase === null && sizeChange === null)
+                return { ok: false, message: "say what changes: a size, or a role with an agent (or clear: true)" };
             if (phase !== null && !clear && (agent === null || typeof agent !== "object"))
                 return { ok: false, message: "a role change names an agent from get_agents, or clear: true" };
             if (phase === null && (clear || agent !== undefined))
@@ -1818,8 +1813,6 @@ const MATE_TOOL_HANDLERS = {
                 return { ok: false, message: "why is plain text ≤400" };
             if (ctx.store.hasLiveClaim(ref.id, ctx.now))
                 return { ok: false, message: "a worker is building that task right now — its agents cannot change under it" };
-            if (ctx.store.activeTournamentTerms(ref.id) !== null)
-                return { ok: false, message: "tournament terms decide this task's agents while the contest is open" };
             const view = agentsOver(ctx.store, taskId, ctx.now);
             if (view === null)
                 return notFound();
@@ -1840,19 +1833,16 @@ const MATE_TOOL_HANDLERS = {
                 }
                 chosen = { provider: match.provider, model: match.model };
                 const currentLeg = view["agents"].find(one => one.role === ROLE_WORD[phase]);
-                if (currentLeg !== undefined && sameSpec(currentLeg, chosen) && risk === undefined)
+                if (currentLeg !== undefined && sameSpec(currentLeg, chosen))
                     return { ok: false, message: `${specWords(chosen)} already runs the ${ROLE_WORD[phase]} role` };
             }
             if (phase !== null && clear && !(current?.routeOverrides ?? []).some(one => one.phase === phase)) {
                 return { ok: false, message: `nobody chose a ${ROLE_WORD[phase]} for this task by hand — there is nothing to clear` };
             }
-            if (risk !== undefined && phase === null && risk === view["risk"].level)
-                return { ok: false, message: `this task is already declared ${riskTitle(risk).toLowerCase()}` };
             const id = ctx.draft("agents", {
                 task: taskId,
                 taskTitle: task.title,
                 repoId: ref.repoId,
-                ...(risk === undefined ? {} : { risk, riskConsequence: riskConsequence(risk) }),
                 ...(sizeChange === null ? {} : { size: sizeChange.size, risky: sizeChange.risky }),
                 ...(phase === null ? {} : { phase, role: ROLE_WORD[phase] }),
                 ...(chosen === null ? {} : { provider: chosen.provider, model: chosen.model }),
@@ -1870,7 +1860,6 @@ const MATE_TOOL_HANDLERS = {
                     proposal: id,
                     kind: "agents",
                     task: taskId,
-                    ...(risk === undefined ? {} : { risk }),
                     ...(sizeChange === null ? {} : { size: sizeChange.size, risky: sizeChange.risky }),
                     ...(phase === null ? {} : { role: ROLE_WORD[phase], ...(chosen === null ? { clear: true } : { agent: chosen }) }),
                     awaiting: view["approval"] === "approved" ? "the operator's confirmation — the current approval will then need renewing" : "the operator's confirmation",

package/dist/modes.d.ts

@@ -13,6 +13,7 @@
  * owns the transactions; the tick owns the rails; serve owns the
  * ceremony screens.
  */
+import { type ChatProvider } from "./contracts/chat-tables.js";
 export type ModeName = "standard" | "hands-off";
 export type ModeTerms = {
     name: ModeName;
@@ -27,7 +28,8 @@ export type ModeTerms = {
     /** Explicit opt-in: a verified planner may approve a plan that preserves
      * the signer's pre-authorized filed contract and execution terms exactly. */
     planAuto: boolean;
-    /** Attended mint without the per-mint password — signer only (D8). */
+    /** Historical signed field (watched sessions without a per-session
+     * password, removed in v115); new modes leave it false and nothing reads it. */
     quickMint: boolean;
     /** Historical signed field; new modes leave it false and no worker consumes
      * it. Automatic review is the project's review switch (review-switch.ts),
@@ -47,15 +49,13 @@ export type ModeTerms = {
      * "automerge" = the mode's signature substitutes for the per-merge
      * human authorization, through the grant machinery only (D1/E1). */
     publication: "notify" | "automerge";
-    /** Whether this mode AUTHORIZES automatic PAID fallback (a
-     * subscription->api-key or api-key->api-key switch that spends). v30,
-     * fallback chains R8: legacy modes default FALSE — a paid substitution
-     * must be an explicit, freshly-signed grant. A subscription->subscription
-     * fallback is not "paid" and needs no grant. */
+    /** Historical signed term (v30-v114: a grant for automatic paid
+     * fallback; fallback chains were removed in v115). Always false on new
+     * modes; retained for digest and audit compatibility. */
     allowPaidFallback: boolean;
     /** Whether this mode AUTHORIZES the bounded repair loop to draft AND
      * auto-approve its own repair attempts (v40, evidence-review-v1) — the
-     * allowPaidFallback precedent, verbatim: legacy modes default FALSE, a
+     * same precedent as the old paid-fallback grant: legacy modes default FALSE, a
      * new authority is never inherited, only freshly signed. Without it, a
      * short/refuted run with named unresolved criteria still gets exactly
      * one drafted repair — it simply waits unapproved. */
@@ -65,12 +65,16 @@ export type ModeTerms = {
      * `repairAuto` is also true — a mode may sign a cap without signing the
      * authority, but never the reverse. */
     repairMaxAttempts: number;
-    /** Explicit opt-in: the signer's paired Telegram chat may approve this
+    /** Explicit opt-in: the signer's paired chat may approve this
      * repository's plans and merge its ready pull requests with two taps,
      * for the mode's lifetime. A plan that widens permissions, exceeds the
      * per-attempt budget or touches protected paths still opens Toolroll.
      * Legacy modes read FALSE — never inherited, only freshly signed. */
     chatApprove: boolean;
+    /** The chat apps `chatApprove` names, signed with it. Absent on a mode signed before chat apps other than Telegram
+     * could approve: its words said "your paired Telegram chat", so it stays Telegram only (chatApproveChatsOf). A wider
+     * grant is only ever a fresh signature naming the apps. */
+    chatApproveChats?: readonly ChatProvider[];
     absoluteExpiry: string;
 };
 export declare const MODE_MAX_DAYS = 7;
@@ -83,6 +87,13 @@ export declare function modeTermsJson(terms: ModeTerms): string;
 export declare function modeDigestOf(terms: ModeTerms): string;
 /** Strict rehydration — anything unexpected is null, never a guess. */
 export declare function modeTermsFromJson(json: string | null): ModeTerms | null;
+/** The chat apps a mode lets its signer approve from: none without chatApprove; Telegram alone for a grant signed
+ * before it named its apps (that is what its words said); otherwise exactly the apps it names. */
+export declare function chatApproveChatsOf(terms: Pick<ModeTerms, "chatApprove" | "chatApproveChats">): readonly ChatProvider[];
+/** What a new chatApprove signature names: every chat app, said in its words. */
+export declare const CHAT_APPROVE_ALL: readonly ChatProvider[];
+/** "Telegram", "Telegram or Slack", "Telegram, Slack, Discord or Teams". */
+export declare const chatNames: (chats: readonly ChatProvider[]) => string;
 /** Every term in words — what the ceremony renders and the password
  * signs. The reversal sentence is verbatim from the chain (C1). */
 export declare function modeWords(terms: ModeTerms): string[];

package/dist/modes.js

@@ -14,6 +14,7 @@
  * ceremony screens.
  */
 import { createHash } from "node:crypto";
+import { CHAT_PROVIDERS, isChatProvider } from "./contracts/chat-tables.js";
 export const MODE_MAX_DAYS = 7;
 /** The presets are STARTING POINTS the ceremony renders in full — the
  * signature always covers the resolved terms, never a label. */
@@ -24,7 +25,7 @@ export function presetTerms(name, absoluteExpiry) {
             permissionDefault: "safe",
             autoApproveFiling: false,
             planAuto: false,
-            quickMint: true,
+            quickMint: false,
             reviewAuto: false,
             reviewRetryAuto: false,
             perAttemptBudgetMicrousd: null,
@@ -42,7 +43,7 @@ export function presetTerms(name, absoluteExpiry) {
             permissionDefault: "escalated",
             autoApproveFiling: true,
             planAuto: false,
-            quickMint: true,
+            quickMint: false,
             reviewAuto: false,
             reviewRetryAuto: false,
             perAttemptBudgetMicrousd: null,
@@ -108,10 +109,8 @@ export function modeTermsFromJson(json) {
         measured !== undefined &&
         runs !== undefined &&
         (t["publication"] === "notify" || t["publication"] === "automerge") &&
-        // allowPaidFallback: a legacy mode has NO such field — that MUST read
-        // as false (R8: a paid substitution is only ever an explicit,
-        // freshly-signed grant). A present value must be a strict boolean;
-        // anything else is a bad envelope, null.
+        // allowPaidFallback (historical): absent reads as false; a present
+        // value must be a strict boolean, anything else is a bad envelope.
         (t["allowPaidFallback"] === undefined || typeof t["allowPaidFallback"] === "boolean") &&
         // repairAuto/repairMaxAttempts: the SAME precedent, verbatim (v40). A
         // legacy mode has NO such fields — that MUST read as false/0, never
@@ -122,6 +121,10 @@ export function modeTermsFromJson(json) {
         (t["repairMaxAttempts"] === undefined ||
             (typeof t["repairMaxAttempts"] === "number" && Number.isInteger(t["repairMaxAttempts"]) && t["repairMaxAttempts"] >= 0 && t["repairMaxAttempts"] <= 3)) &&
         (t["chatApprove"] === undefined || typeof t["chatApprove"] === "boolean") &&
+        // chatApproveChats: absent (a Telegram-only grant, or none), or the apps a chatApprove term names, each once.
+        (t["chatApproveChats"] === undefined ||
+            (t["chatApprove"] === true && Array.isArray(t["chatApproveChats"]) && t["chatApproveChats"].length > 0 &&
+                t["chatApproveChats"].every(isChatProvider) && new Set(t["chatApproveChats"]).size === t["chatApproveChats"].length)) &&
         typeof t["absoluteExpiry"] === "string" &&
         !Number.isNaN(Date.parse(t["absoluteExpiry"]))) {
         return {
@@ -140,11 +143,22 @@ export function modeTermsFromJson(json) {
             repairAuto: t["repairAuto"] === true,
             repairMaxAttempts: typeof t["repairMaxAttempts"] === "number" ? t["repairMaxAttempts"] : 0,
             chatApprove: t["chatApprove"] === true,
+            ...(Array.isArray(t["chatApproveChats"]) ? { chatApproveChats: [...t["chatApproveChats"]] } : {}),
             absoluteExpiry: t["absoluteExpiry"],
         };
     }
     return null;
 }
+/** The chat apps a mode lets its signer approve from: none without chatApprove; Telegram alone for a grant signed
+ * before it named its apps (that is what its words said); otherwise exactly the apps it names. */
+export function chatApproveChatsOf(terms) {
+    return !terms.chatApprove ? [] : terms.chatApproveChats ?? ["telegram"];
+}
+/** What a new chatApprove signature names: every chat app, said in its words. */
+export const CHAT_APPROVE_ALL = CHAT_PROVIDERS;
+const CHAT_NAMES = { telegram: "Telegram", slack: "Slack", discord: "Discord", teams: "Teams" };
+/** "Telegram", "Telegram or Slack", "Telegram, Slack, Discord or Teams". */
+export const chatNames = (chats) => chats.length <= 1 ? chats.map(one => CHAT_NAMES[one]).join("") : `${chats.slice(0, -1).map(one => CHAT_NAMES[one]).join(", ")} or ${CHAT_NAMES[chats[chats.length - 1]]}`;
 /** Every term in words — what the ceremony renders and the password
  * signs. The reversal sentence is verbatim from the chain (C1). */
 export function modeWords(terms) {
@@ -155,11 +169,8 @@ export function modeWords(terms) {
         terms.autoApproveFiling
             ? "every scope YOU file — signed-in console or credentialed CLI — is approved the moment you file it; while this mode is active, your signed-in browser session becomes a spend credential for this repository"
             : "filings still wait for their own approval ceremony",
-        terms.quickMint
-            ? "you start watched sessions without re-typing your password — the confirm screen still shows every term"
-            : "watched sessions keep the per-session password",
         terms.planAuto
-            ? "plans for your pre-authorized filings auto-approve only when the goal, exclusions, paths, acceptance criteria, risk, budget, and agent route remain exactly unchanged; provide a goal, paths and acceptance criteria upfront; amendments and unresolved questions still wait for you"
+            ? "plans for your pre-authorized filings auto-approve only when the goal, exclusions, paths, acceptance criteria, budget, and agent route remain exactly unchanged; provide a goal, paths and acceptance criteria upfront; amendments and unresolved questions still wait for you"
             : "planner-generated plans wait for your approval",
         terms.name === "hands-off"
             ? "automatic review is on for this project unless you turn it off (`toolroll review off --repo <path>`): each finished build whose check passes (or that finishes, with checks Off) gets one read-only review by the project's review agent; a HIGH finding sends it back once as a revision filed under this mode, a HIGH on that revision comes to you, MEDIUM and LOW findings come to you as suggested follow-ups, and a review that fails or times out never holds the work — it reaches you marked not reviewed"
@@ -178,13 +189,12 @@ export function modeWords(terms) {
         terms.publication === "automerge"
             ? "pull requests merge THEMSELVES when CI is seen green on the exact commit — you are told afterwards (requires a merge-capable publication grant)"
             : "merges wait for you — even where a grant could merge on its own, while this mode is active",
-        terms.allowPaidFallback
-            ? "when a subscription is exhausted mid-build, an approved fallback that spends (an API key) may run automatically — spend moves to that account"
-            : "automatic fallback never switches to a paid API key on its own; a subscription that runs out stops and waits for you",
+        ...(terms.allowPaidFallback
+            ? ["a historical paid-fallback grant is retained on record but no longer used"] : []),
         ...(terms.repairAuto
             ? ["historical automatic repair grants are retained on record but no longer schedule work"] : []),
         ...(terms.chatApprove
-            ? ["your paired Telegram chat may approve this repository's plans and merge its ready pull requests, two taps each, without your password; a plan that widens permissions, exceeds the per-attempt cap above or touches protected paths still opens Toolroll"] : []),
+            ? [`your paired ${chatNames(chatApproveChatsOf(terms))} chat may approve this repository's plans and merge its ready pull requests, two taps each, without your password; a plan that widens permissions, exceeds the per-attempt cap above or touches protected paths still opens Toolroll`] : []),
         `everything above ends at ${terms.absoluteExpiry.slice(0, 16).replace("T", " ")} — revoking it earlier is one click, and every act it covered falls back to its own ceremony`,
     ];
 }

package/dist/notification-rows.d.ts

@@ -0,0 +1,30 @@
+/** Saved notifications, read and told apart without a store: the row readers, the lifecycle key and the predicates
+ * the store and the chat core (chat-messages.ts) share. A leaf: it imports types only. */
+import type { MateProposal, Notification, NotificationReceipt } from "./store.js";
+/** The one task a card is about: a task its confirmation created (a new
+ * task, a revision), else the task it names (and, for feedback on a result,
+ * that result). Null for a card about no single task. A pointer for
+ * replies, never an authority. */
+export declare function proposalTaskOf(proposal: MateProposal | null): {
+    task: string;
+    run: number | null;
+} | null;
+/** Every lifecycle dedupe key starts here: `life:<kind>:<identity>:<ordinal>`. */
+export declare const LIFECYCLE_KEY_PREFIX = "life:";
+/**
+ * Task lifecycle updates (Telegram task updates, 2026-09-16): the CLOSED
+ * vocabulary of routine progress facts the shared mutations record beside
+ * the change that made them true. None carries a push class — they are
+ * digest-eligible progress, never a page — and every one is project-bound
+ * through the task it names. A decision, incident, gap, stall, publication
+ * or merge page keeps its own producer; nothing here repeats one.
+ */
+export declare const LIFECYCLE_KINDS: readonly ["task-filed", "scope-approved", "approval-withdrawn", "task-held", "task-released", "task-queued", "task-requeued", "task-cancelled", "run-started", "run-phase", "check-progress", "run-finished", "run-stopping", "run-stopped", "run-resumed", "review-requested", "review-finished", "acceptance-evidence", "acceptance-ready"];
+export type LifecycleKind = (typeof LIFECYCLE_KINDS)[number];
+/** A progress fact, told apart by its durable key — never by display text. */
+export declare function isLifecycleNotification(row: Pick<Notification, "dedupeKey">): boolean;
+/** Only known progress producers can repaint a card. Decisions and urgent
+ * incidents keep their own alerts; a routine retry updates its saved attempt. */
+export declare function isTelegramProgressNotification(row: Pick<Notification, "dedupeKey" | "kind" | "pushClass" | "run">): boolean;
+export declare function readNotification(row: Record<string, unknown>): Notification;
+export declare function readNotificationReceipt(row: Record<string, unknown>): NotificationReceipt;

package/dist/notification-rows.js

@@ -0,0 +1,102 @@
+/** The one task a card is about: a task its confirmation created (a new
+ * task, a revision), else the task it names (and, for feedback on a result,
+ * that result). Null for a card about no single task. A pointer for
+ * replies, never an authority. */
+export function proposalTaskOf(proposal) {
+    if (proposal === null)
+        return null;
+    const named = typeof proposal.payload["task"] === "string" && proposal.payload["task"] !== "" ? proposal.payload["task"] : null;
+    const creates = proposal.kind === "task" || (proposal.kind === "review" && proposal.payload["operation"] === "revise");
+    const made = creates && proposal.state === "confirmed" ? proposal.outcome?.["taskId"] : undefined;
+    if (typeof made === "string" && made !== "" && made !== named)
+        return { task: made, run: null };
+    if (named === null)
+        return null;
+    const run = proposal.kind === "review" ? proposal.payload["run"] : null;
+    return { task: named, run: typeof run === "number" && Number.isSafeInteger(run) ? run : null };
+}
+/** Every lifecycle dedupe key starts here: `life:<kind>:<identity>:<ordinal>`. */
+export const LIFECYCLE_KEY_PREFIX = "life:";
+/**
+ * Task lifecycle updates (Telegram task updates, 2026-09-16): the CLOSED
+ * vocabulary of routine progress facts the shared mutations record beside
+ * the change that made them true. None carries a push class — they are
+ * digest-eligible progress, never a page — and every one is project-bound
+ * through the task it names. A decision, incident, gap, stall, publication
+ * or merge page keeps its own producer; nothing here repeats one.
+ */
+export const LIFECYCLE_KINDS = [
+    "task-filed",
+    "scope-approved",
+    "approval-withdrawn",
+    "task-held",
+    "task-released",
+    "task-queued",
+    "task-requeued",
+    "task-cancelled",
+    "run-started",
+    "run-phase",
+    "check-progress",
+    "run-finished",
+    "run-stopping",
+    "run-stopped",
+    "run-resumed",
+    "review-requested",
+    "review-finished",
+    "acceptance-evidence",
+    "acceptance-ready",
+];
+/** A progress fact, told apart by its durable key — never by display text. */
+export function isLifecycleNotification(row) {
+    return row.dedupeKey.startsWith(LIFECYCLE_KEY_PREFIX);
+}
+/** Only known progress producers can repaint a card. Decisions and urgent
+ * incidents keep their own alerts; a routine retry updates its saved attempt. */
+export function isTelegramProgressNotification(row) {
+    if (row.kind === "check-progress" && row.pushClass === "progress" && row.run !== null)
+        return isLifecycleNotification(row);
+    if (row.pushClass !== null)
+        return false;
+    if (row.kind === "build-failed" && row.run !== null && row.dedupeKey === `run:${row.run}:failed`)
+        return true;
+    // The owner's lead took the attempt on, or let it lapse (lead-voice.ts): its card repaints in place.
+    if ((row.kind === "lead-on-it" || row.kind === "lead-lapsed") && row.run !== null)
+        return true;
+    return isLifecycleNotification(row) &&
+        ["run-started", "run-phase", "run-finished", "review-requested", "review-finished", "run-stopping", "run-stopped", "run-resumed", "task-held", "task-released"].includes(row.kind);
+}
+export function readNotification(row) {
+    return {
+        id: Number(row["id"]),
+        recipient: row["recipient"] == null ? null : String(row["recipient"]),
+        dedupeKey: String(row["dedupe_key"]),
+        scope: row["provenance_scope"],
+        project: row["project"] == null ? null : String(row["project"]),
+        taskRef: row["task_ref"] == null ? null : Number(row["task_ref"]),
+        taskId: row["task_id"] == null ? null : String(row["task_id"]),
+        run: row["source_run"] == null ? null : Number(row["source_run"]),
+        kind: String(row["kind"]),
+        subject: String(row["subject"]),
+        body: String(row["body"]),
+        createdAt: String(row["created_at"]),
+        resolvedAt: row["resolved_at"] === null || row["resolved_at"] === undefined
+            ? null
+            : String(row["resolved_at"]),
+        pushClass: (row["push_class"] === null || row["push_class"] === undefined) && String(row["kind"]) === "check-progress"
+            ? "progress"
+            : row["push_class"] === null || row["push_class"] === undefined
+                ? null
+                : String(row["push_class"]),
+        link: row["link"] === null || row["link"] === undefined ? null : String(row["link"]),
+    };
+}
+export function readNotificationReceipt(row) {
+    return {
+        ...readNotification(row),
+        attempts: Number(row["attempts"]),
+        lastAttemptAt: row["last_attempt_at"] == null ? null : String(row["last_attempt_at"]),
+        lastError: row["last_error"] == null ? null : String(row["last_error"]),
+        deliveredAt: row["delivered_at"] == null ? null : String(row["delivered_at"]),
+        receipt: row["receipt"] == null ? null : String(row["receipt"]),
+    };
+}

package/dist/operate-remote-arguments.js

@@ -10,7 +10,7 @@ const args = (positionals = '', values = '', references = {}) => ({
  * digest. Neither dereferences a conversation, task or proposal. Creation IDs are never looked up. */
 export const REMOTE_ARGUMENTS = new Map([
     ...['status', 'ready', 'grants', 'gaps', 'sync', 'runner list', 'coordinator list', 'incident list',
-        'routine list', 'intake show', 'intake run', 'template list', 'webhook status', 'review show',
+        'intake show', 'intake run', 'template list', 'webhook status', 'review show',
         'chat-approval show', 'chat-approval off'].map(row => [row, args()]),
     ['integrations', args('', 'saved')],
     // --person and --token-name are names compared inside the reader's own view; --token stays a refused credential.
@@ -31,7 +31,7 @@ export const REMOTE_ARGUMENTS = new Map([
     ['task next', args('id:task', 'key undo')],
     ['task steer', args('id:task', 'note')],
     ['task assign', args('id:task', 'key runner anyone')],
-    ['task scope', args('id:task', 'key goal not touches budget-usd risk acceptance candidate compare model provider race race-count race-per-usd race-total-usd repair-model')],
+    ['task scope', args('id:task', 'key goal not touches budget-usd risk acceptance candidate model provider repair-model')],
     ['task plan', args('id:task', 'key provider model')],
     ['task hold', args('id:task', 'key reason until')],
     ['task unhold', args('id:task', 'key')],
@@ -47,13 +47,9 @@ export const REMOTE_ARGUMENTS = new Map([
     ['cap list', args()], ['cap add', args('name', 'kind probe expires')],
     // These objects are installation-scoped at the outer boundary; only an all-project principal reaches them.
     ['incident resolve', args('incident')],
-    ['routine show', args('id')],
-    ['routine add', args('name', 'goal schedule acceptance ceiling budget-usd not touches require')],
-    ...['refresh', 'pause', 'resume', 'run-now'].map(action => [`routine ${action}`, args('name')]),
     ['config show', args('phase?')], ['verify show', args()],
     ['intake preview', args()], ['intake pr-comments', args('', 'limit')],
     ['template show', args('name')],
-    ['contest show', args('id')], ['contest exclude', args('contest ordinal')],
     ...['search', 'impact'].map(action => [`knowledge ${action}`, args('query', 'base')]),
     ['knowledge refresh', args('', 'base')],
     // Decision reads and supersession are already project-bound in project-memory.ts. Proposal IDs are

package/dist/operate-remote.js

@@ -43,10 +43,9 @@ export const REMOTE_SCOPES = new Map([
     ["task list", listing],
     ["runner list", installation], ["coordinator list", installation], ["outbox list", installation], ["incident list", installation], ["incident resolve", installation],
     ["cap list", repo], ["cap add", repo],
-    ...["list", "show", "add", "refresh", "pause", "resume", "run-now"].map(action => [`routine ${action}`, installation]),
     ["config show", installation], ["verify show", repo], ["intake show", installation], ["intake run", installation], ["intake preview", installation],
-    ["intake pr-comments", installation], ["template list", installation], ["template show", installation], ["contest show", installation],
-    ["contest exclude", installation], ["webhook status", installation], ["review show", installation],
+    ["intake pr-comments", installation], ["template list", installation], ["template show", installation],
+    ["webhook status", installation], ["review show", installation],
     ["chat-approval show", self], ["chat-approval off", self],
     // The person's own remote actions, or everyone's within their projects for an approver (remote-audit.ts).
     ["audit", self],
@@ -63,11 +62,11 @@ export const REMOTE_SCOPES = new Map([
  */
 export const REMOTE_ALL_PROJECTS_ONLY = new Map([
     // Settings, connections and acts that belong to the installation as a whole, not to any one project.
-    ...["integrations", "grants", "sync", "incident resolve", "routine add", "routine refresh", "routine pause", "routine resume", "routine run-now",
-        "config show", "intake run", "contest exclude", "webhook status"].map(row => [row, "installation-wide"]),
+    ...["integrations", "grants", "sync", "incident resolve",
+        "config show", "intake run", "webhook status"].map(row => [row, "installation-wide"]),
     // Cross-project lists and reads a limited person is still refused; scoping them is later work.
-    ...["runner list", "coordinator list", "outbox list", "incident list", "routine list", "routine show", "intake show", "intake preview",
-        "intake pr-comments", "template list", "template show", "contest show", "review show"].map(row => [row, "not yet scoped"]),
+    ...["runner list", "coordinator list", "outbox list", "incident list", "intake show", "intake preview",
+        "intake pr-comments", "template list", "template show", "review show"].map(row => [row, "not yet scoped"]),
 ]);
 /** The projects a listing or task reference may disclose: null for someone with access to all of them. */
 export function remoteLensOf(store, scope, allows) {

package/dist/operate.d.ts

@@ -73,10 +73,6 @@ export type OperateOptions = {
     integrationIo?: Partial<IntegrationIo>;
     /** Injected by tests: the mate's provider fetch, key environment, and stdin lines. */
     mateSeams?: MateCliSeams;
-    /** Injected by tests: a held-session coordinator, so a `tick` exercises
-     * the attended road exactly as a co-located `up` would (production wires
-     * one only inside `up`). */
-    heldCoordinator?: import("./held.js").HeldSessionCoordinator;
     /** Test seam for the short indexed wait loop. */
     waitSleep?: (milliseconds: number) => Promise<void>;
     /** Injected by tests: `onboard`'s home folder, terminal and probes. */
@@ -110,8 +106,6 @@ export declare const TASK_ACTIONS: readonly ["add", "list", "show", "wait", "sta
 export declare const PUBLISH_ACTIONS: readonly ["setup", "grant", "revoke", "status", "unblock", "rearm", "merge", "refire"];
 export declare const CONFIG_ACTIONS: readonly ["show", "set", "clear"];
 export declare const APPROVER_ACTIONS: readonly ["list", "add"];
-export declare const ROUTINE_ACTIONS: readonly ["list", "add", "show", "approve", "refresh", "pause", "resume", "run-now"];
-export declare const CONTEST_ACTIONS: readonly ["show", "exclude"];
 export declare const PEOPLE_ACTIONS: readonly ["list", "invite", "projects", "revoke"];
 export declare const KEYS_ACTIONS: readonly ["status", "set", "clear", "verify", "auth"];
 /**