toolroll 0.9.52 → 0.9.54

package/dist/store.d.ts

@@ -1,3 +1,6 @@
+import { type ChatBinding } from "./chat-core.js";
+import { ChatMessages, TELEGRAM_HOLD_REASONS, TELEGRAM_SKIPPED_ELSEWHERE, TELEGRAM_SKIPPED_OTHER_CHAT, TELEGRAM_SKIPPED_QUIET } from "./chat-messages.js";
+import { isLifecycleNotification, isTelegramProgressNotification, LIFECYCLE_KEY_PREFIX, LIFECYCLE_KINDS, proposalTaskOf, type LifecycleKind } from "./notification-rows.js";
 import { ServerTelemetry } from "./server-telemetry.js";
 import type { DecisionOption } from "./contracts/decision.js";
 import { type SavedToolAction, type SavedToolRule } from "./contracts/store-json.js";
@@ -6,9 +9,9 @@ import { type Actor } from "./actor.js";
 import { type LiveActivityKind } from "./live.js";
 import { type TokenPurpose } from "./api-tokens.js";
 import { type CriterionMatrixRow, type CriterionJudgementWord } from "./proof.js";
-import { type ExecutionProfile, type ChainEntry, type UnattendedPermissionMode, type AcceptanceCriterion } from "./scope.js";
-import { type ProviderRoom, type CandidateTier, type TaskSize, type TaskSizing, type PhaseRoute, type PublicationAuthority, type RouteStamp, type ReadinessLookup, type ReadinessObservation, type RiskLevel, type RouteOverride } from "./phase-routing.js";
-import { type TerminalClass } from "./exhaustion.js";
+import { type ExecutionProfile, type UnattendedPermissionMode, type AcceptanceCriterion } from "./scope.js";
+import { type ProviderRoom, type CandidateTier, type TaskSize, type TaskSizing, type PhaseRoute, type PublicationAuthority, type RouteStamp, type ReadinessLookup, type ReadinessObservation, type RouteOverride } from "./phase-routing.js";
+import type { TerminalClass } from "./exhaustion.js";
 import { type ProviderId } from "./provider.js";
 import type { BoardFacts } from "./board.js";
 import type { BackendGrant, TaskOrigin } from "./grant.js";
@@ -67,7 +70,7 @@ export declare const MATE_ASK_SCHEMA = "\nCREATE TABLE IF NOT EXISTS mate_ask (\
  * person (shown on the card, and read again by every chat app that delivers it); telegram_flow_choice is one opaque button
  * per option for one visit of one card, placed on the message it rides. A reply to that message is the note
  * (telegram_flow_prompt, mode send-back). The chat apps keep their buttons beside their messages (chat-delivery-state.ts). */
-export declare const FLOW_SEND_SCHEMA = "\nCREATE TABLE IF NOT EXISTS flow_send (\n  card         INTEGER NOT NULL REFERENCES flow_card(id),\n  entry        INTEGER NOT NULL,\n  stage        TEXT NOT NULL,\n  person       TEXT NOT NULL,\n  content_json TEXT NOT NULL,\n  created_at   TEXT NOT NULL,\n  PRIMARY KEY (card, entry)\n);\nCREATE TABLE IF NOT EXISTS telegram_flow_choice (\n  token       TEXT PRIMARY KEY,\n  binding     INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  card        INTEGER NOT NULL REFERENCES flow_card(id),\n  entry       INTEGER NOT NULL,\n  choice      INTEGER NOT NULL,\n  label       TEXT NOT NULL,\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT,\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT\n);\nCREATE INDEX IF NOT EXISTS telegram_flow_choice_visit ON telegram_flow_choice (card, entry);\n";
+export declare const FLOW_SEND_SCHEMA = "\nCREATE TABLE IF NOT EXISTS flow_send (\n  card         INTEGER NOT NULL REFERENCES flow_card(id),\n  entry        INTEGER NOT NULL,\n  stage        TEXT NOT NULL,\n  person       TEXT NOT NULL,\n  content_json TEXT NOT NULL,\n  created_at   TEXT NOT NULL,\n  PRIMARY KEY (card, entry)\n);\n";
 /** An owner's lasting choice to approve plans and merges from their paired chat (chat-approval.ts), for all their
  * projects (scope '*') or one (its path), with the limits they agreed to. Off unless a row says on; a project's own row
  * outranks the all-projects one. `generation` is the account's at the change: a reset password ends it. */
@@ -76,9 +79,6 @@ export declare const FLOW_SEND_SCHEMA = "\nCREATE TABLE IF NOT EXISTS flow_send
  * a finished run's row goes with the live log's own retention (sweepRunActivity). */
 export declare const RUN_ACTIVITY_SCHEMA = "\nCREATE TABLE IF NOT EXISTS run_activity (\n  run  INTEGER PRIMARY KEY REFERENCES run(id) ON DELETE CASCADE,\n  kind TEXT NOT NULL CHECK (kind IN ('session','message','edit','command','read','search','lookup','plan','delegate','tool')),\n  at   TEXT NOT NULL\n);\n";
 export declare const CHAT_APPROVAL_SCHEMA = "\nCREATE TABLE IF NOT EXISTS chat_approval_setting (\n  approver             TEXT NOT NULL,\n  scope                TEXT NOT NULL,\n  enabled              INTEGER NOT NULL CHECK (enabled IN (0,1)),\n  full_access          INTEGER NOT NULL DEFAULT 0 CHECK (full_access IN (0,1)),\n  attempt_cap_microusd INTEGER CHECK (attempt_cap_microusd IS NULL OR attempt_cap_microusd >= 0),\n  generation           INTEGER NOT NULL,\n  digest               TEXT NOT NULL,\n  updated_by           TEXT NOT NULL,\n  updated_at           TEXT NOT NULL,\n  PRIMARY KEY (approver, scope)\n);\n";
-/** The second tap on a flow decision in Telegram (telegram-flow.ts): Approve arms Yes and Cancel, bound to the binding,
- * chat, message and exact visit of the card; Yes decides it once. */
-export declare const TELEGRAM_FLOW_CONFIRM_SCHEMA = "\nCREATE TABLE IF NOT EXISTS telegram_flow_confirm (\n  token       TEXT PRIMARY KEY,\n  binding     INTEGER NOT NULL,\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT NOT NULL,\n  card        INTEGER NOT NULL,\n  entry       INTEGER NOT NULL,\n  phase       TEXT NOT NULL CHECK (phase IN ('yes','cancel')),\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT\n);\nCREATE INDEX IF NOT EXISTS telegram_flow_confirm_visit ON telegram_flow_confirm (card, entry);\n";
 export declare const CHAT_DECIDE_SCHEMA = "\nCREATE TABLE IF NOT EXISTS chat_decide_action (\n  token       TEXT PRIMARY KEY,\n  channel     TEXT NOT NULL,\n  binding     INTEGER NOT NULL,\n  chat        TEXT NOT NULL,\n  message     TEXT,\n  act         TEXT NOT NULL CHECK (act IN ('accept','changes','retry','approve','not-now','merge')),\n  phase       TEXT NOT NULL CHECK (phase IN ('offer','yes','cancel')),\n  task_id     TEXT NOT NULL,\n  run         INTEGER,\n  digest      TEXT NOT NULL,\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT\n);\nCREATE INDEX IF NOT EXISTS chat_decide_action_message ON chat_decide_action (channel, chat, message);\nCREATE TABLE IF NOT EXISTS chat_decide_prompt (\n  id          INTEGER PRIMARY KEY AUTOINCREMENT,\n  channel     TEXT NOT NULL,\n  binding     INTEGER NOT NULL,\n  chat        TEXT NOT NULL,\n  task_id     TEXT NOT NULL,\n  run         INTEGER NOT NULL,\n  digest      TEXT NOT NULL,\n  message     TEXT,\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT\n);\nCREATE INDEX IF NOT EXISTS chat_decide_prompt_open ON chat_decide_prompt (channel, binding, consumed_at);\n";
 export type MateAsk = {
     turn: number;
@@ -152,7 +152,9 @@ export type SealedLedgerEntry = LedgerEntry & {
         hash: string;
     } | null;
 };
-export declare const SCHEMA_VERSION = 114;
+export declare const SCHEMA_VERSION = 116;
+/** v115: the tables migrateToV115 drops. */
+export declare const V115_DROPPED_TABLES: readonly string[];
 /**
  * The migrations `toolroll update` may carry a database through in place: each
  * one only adds (a table, a column, an accepted value) and leaves every saved row
@@ -171,6 +173,17 @@ export declare const SCHEMA_VERSION = 114;
  * (rows removed equal the witnesses summarized), and notification drops its
  * delivery columns only after every value moves into one legacy receipt per row
  * (rows and ids carried whole; legacy receipts added equal the rows carried).
+ * v115 removes contests, held sessions, fallback chains and routines, and is
+ * checked under rules named for exactly that: the eleven removed tables may go
+ * whole, every kept flow and trigger row stays as it was, and the only rows
+ * added are one flow and one schedule trigger per saved routine (paused unless
+ * the routine was approved and running). Its other changes add a column or
+ * settle rows in place; a database whose removed features still held a hold
+ * to lift or place changes that table's rows and is refused, so it takes the
+ * separate procedure. v116 is the next declared exception: every row of the 70 old
+ * per-app chat tables moves into the shared chat tables keyed by provider, in one
+ * transaction that checks each count before the old tables are dropped; the
+ * rehearsal checks each moved table's rows arrived (HISTORY_RULES).
  */
 export declare const UPDATE_SAFE_MIGRATIONS: readonly number[];
 /** Whether a database settled at `version` reaches this build's schema through update-safe migrations alone. */
@@ -296,9 +309,7 @@ export type TaskRef = {
     /** What comes back (v34): a branch to publish, or a report to read.
      * Set at filing and never rewritten — a scout's strikes are the task's. */
     deliverable: "branch" | "report";
-    /** The standing order this task is an instance of; null for one-off work. */
-    routineId: number | null;
-    /** The pinned agent, when a fire transaction stamped one. Authoritative. */
+    /** The pinned agent, when an approved standing order stamped one. Authoritative. */
     agentProvider: string | null;
     agentModel: string | null;
     /** Durable per-task override. null means the installation default is used
@@ -308,9 +319,6 @@ export type TaskRef = {
     /** Durable per-task evidence-policy override. null inherits the
      * installation default when a scope is next written. */
     qualityMode?: QualityMode | null;
-    /** v47: the task's declared risk; null reads as routine when the next
-     * scope is filed. The scope stores the signed level. */
-    riskLevel?: RiskLevel | null;
     /** v47: the approver's per-phase route overrides, applied when the next
      * scope is filed and recorded in the sealed route. null = the stored
      * list is malformed; the next filing goes unresolved rather than routing
@@ -334,88 +342,11 @@ export type TaskRef = {
     origin: TaskOrigin;
 };
 /** A standing order: a pre-approved template whose instances build unattended. */
-export type TournamentTerms = {
-    id: number;
-    taskRef: number;
-    generation: number;
-    active: boolean;
-    /** v27: 'race' = dollar-capped tournament; 'comparison' = labeled
-     * cross-runtime comparison with no dollar terms. */
-    kind: "race" | "comparison";
-    raceDigest: string;
-    /** Ordered agents: exact model ids, resolved at filing. */
-    agents: {
-        provider: string;
-        model: string;
-        repairModel: string;
-        permissionMode?: UnattendedPermissionMode;
-    }[];
-    n: number;
-    perAgentBudgetMicrousd: number;
-    overrunReserveMicrousd: number;
-    totalBudgetMicrousd: number;
-    priceVersion: number;
-    retries: number;
-    publicationPolicy: string;
-    createdAt: string;
-    approvedAt: string | null;
-    approvedBy: string | null;
-    approvedDigest: string | null;
-};
-export type ContestState = "dispatching" | "racing" | "pick-wait" | "decision-wait" | "picked" | "abandoned" | "interrupted" | "exhausted";
-export type Contest = {
-    id: number;
-    taskRef: number;
-    terms: number;
-    generation: number;
-    state: ContestState;
-    scopeDigest: string;
-    raceDigest: string;
-    baseSha: string | null;
-    setupDigest: string | null;
-    currentLeaseId: string | null;
-    runner: string | null;
-    incarnation: string | null;
-    createdAt: string;
-    pickedAt: string | null;
-    pickedBy: string | null;
-    winnerContestant: number | null;
-    /** One escalation page per tournament, ever — set with the page. */
-    overduePaged: boolean;
-    /** v27: denormalized from the terms at admission. */
-    kind: "race" | "comparison";
-};
-export type ContestantState = "pending" | "ready" | "building" | "parked" | "built" | "failed" | "stopped";
-export type Contestant = {
-    /** v24: the contestant's own sealed execution profile. */
-    profile?: ExecutionProfile | null;
-    id: number;
-    contest: number;
-    ordinal: number;
-    provider: string;
-    model: string;
-    repairModel: string;
-    branch: string;
-    worktree: string | null;
-    generation: number;
-    state: ContestantState;
-    activeRun: number | null;
-    budgetMicrousd: number;
-    reserveMicrousd: number;
-    /** What the provider reported — monotonic, never guessed. */
-    measuredMicrousd: number;
-    /** What the ledger charges — the full reservation when unknowable. */
-    accountedMicrousd: number;
-    unknownSpend: boolean;
-    cleanup: "pending" | "done" | "attention" | null;
-    custody: string | null;
-};
 export type ExecutionSlot = {
     id: number;
     runner: string;
     state: "reserved" | "running" | "released";
     run: number | null;
-    contestant: number | null;
     incarnation: string | null;
     processGroup: number | null;
     reservedAt: string;
@@ -483,14 +414,6 @@ export type ChatSnapshot = {
         ageHours: number;
     }[];
     incidentsSaturated: boolean;
-    routines: {
-        repoIndex: number;
-        name: string;
-        schedule: string;
-        status: string;
-        lastFire: string | null;
-    }[];
-    routinesSaturated: boolean;
     publications: {
         repoIndex: number;
         pr: number | null;
@@ -858,14 +781,6 @@ export type FlowTriggerRow = {
     updatedAt: string;
 };
 export type FlowEventOutcome = "created" | "ok" | "fail" | "moved" | "approved" | "sent-back" | "cancelled";
-/** The one task a card is about: a task its confirmation created (a new
- * task, a revision), else the task it names (and, for feedback on a result,
- * that result). Null for a card about no single task. A pointer for
- * replies, never an authority. */
-export declare function proposalTaskOf(proposal: MateProposal | null): {
-    task: string;
-    run: number | null;
-} | null;
 export type MateTurn = {
     id: number;
     approver: string;
@@ -884,76 +799,10 @@ export type MateTurn = {
     tokensOut: number | null;
     failureReason: string | null;
 };
-export type Routine = {
-    id: number;
-    name: string;
-    /** v102: who made it (its instances are filed as theirs); null before v102 or when no person is known. */
-    createdBy: string | null;
-    repo: string;
-    goal: string;
-    outOfScope: string | null;
-    touches: string[];
-    /** v39: the signed rubric every instance's scope copies forward. */
-    acceptance: AcceptanceCriterion[];
-    requirements: string[];
-    /** 'every:<minutes>', 'daily:<HH:MM>[@Zone]', or 'weekly:<0-6>:<HH:MM>[@Zone]' (UTC by default). */
-    schedule: string;
-    singleFlight: boolean;
-    /** Rolling 7-day dollar ceiling; null = none. Enforcement fails closed. */
-    costCeilingUsd: number | null;
-    /** Per-instance dollar cap (v16); copied into each instance's scope. */
-    budgetPerRunMicrousd: number | null;
-    paused: boolean;
-    /** Of every term above. Approval binds to this exact value. */
-    digest: string;
-    approvedAt: string | null;
-    approvedBy: string | null;
-    approvedDigest: string | null;
-    /** The next scheduled occurrence; null until approved. */
-    nextFireAt: string | null;
-    /** Immutable filing provenance (v12); null on rows from before it existed. */
-    filedVia: string | null;
-    createdAt: string;
-    updatedAt: string;
-    /** v24: the working execution profile and the approval's sealed snapshot. */
-    profile?: ExecutionProfile | null;
-    approvedProfile?: ExecutionProfile | null;
-    /** v48: the four-role agent route the digest binds, and the snapshot the
-     * approval sealed. Null on a routine filed before routing froze — such a
-     * routine cannot be approved or fired until it is filed again. A row
-     * carrying unreadable route bytes reads null too, and fails closed. */
-    route?: PhaseRoute | null;
-    approvedRoute?: PhaseRoute | null;
-    /** v48: true when the row CARRIES route or profile bytes that do not
-     * read back — a corrupt snapshot, as distinct from one never taken. Every
-     * surface says which, and both fail closed. */
-    routeUnreadable?: boolean;
-    approvedRouteUnreadable?: boolean;
-    approvedProfileUnreadable?: boolean;
-    /** THE RAW TERMS VERDICT (raw authority repair): null when every stored
-     * term the digest binds read back EXACTLY — touches and requirements as
-     * JSON lists of strings, the rubric as whole criteria with no unknown
-     * key, the flags as 0/1, the ceilings as numbers or null — and the words
-     * when one did not. The integrity projection reads it FIRST: a row whose
-     * terms cannot be read exactly is not approved, not live, not approvable,
-     * and not refreshable, so the lenient fields above can never become a
-     * firing's authority. Undefined on a hand-built routine. */
-    termsProblem?: string | null;
-};
-/** One scheduled slot's outcome, fired or skipped — never silent. */
-export type RoutineFire = {
-    id: number;
-    routineId: number;
-    scheduledFor: string;
-    outcome: "fired" | "skipped";
-    reason: string | null;
-    instanceTaskRef: number | null;
-    createdAt: string;
-};
 /** Who placed a hold — and therefore who alone may lift it. */
 /** 'stop' (v52) = the pause one exact attempt's operator stop placed — lifted
  * only by resuming THAT attempt, never by `unhold` or by answering a decision. */
-export type HoldOwner = "operator" | "decision" | "incident" | "backoff" | "contest" | "revision" | "stop";
+export type HoldOwner = "operator" | "decision" | "incident" | "backoff" | "revision" | "stop";
 export type Hold = {
     id: number;
     taskRef: number;
@@ -1008,23 +857,6 @@ type NotificationInput = {
     /** v83: one person's notification — only their own phone, chats and browsers get it; no channel-wide webhook does. */
     recipient?: string;
 };
-/**
- * Task lifecycle updates (Telegram task updates, 2026-09-16): the CLOSED
- * vocabulary of routine progress facts the shared mutations record beside
- * the change that made them true. None carries a push class — they are
- * digest-eligible progress, never a page — and every one is project-bound
- * through the task it names. A decision, incident, gap, stall, publication
- * or merge page keeps its own producer; nothing here repeats one.
- */
-export declare const LIFECYCLE_KINDS: readonly ["task-filed", "scope-approved", "approval-withdrawn", "task-held", "task-released", "task-queued", "task-requeued", "task-cancelled", "run-started", "run-phase", "check-progress", "run-finished", "run-stopping", "run-stopped", "run-resumed", "review-requested", "review-finished", "acceptance-evidence", "acceptance-ready"];
-export type LifecycleKind = (typeof LIFECYCLE_KINDS)[number];
-/** Every lifecycle dedupe key starts here: `life:<kind>:<identity>:<ordinal>`. */
-export declare const LIFECYCLE_KEY_PREFIX = "life:";
-/** A progress fact, told apart by its durable key — never by display text. */
-export declare function isLifecycleNotification(row: Pick<Notification, "dedupeKey">): boolean;
-/** Only known progress producers can repaint a card. Decisions and urgent
- * incidents keep their own alerts; a routine retry updates its saved attempt. */
-export declare function isTelegramProgressNotification(row: Pick<Notification, "dedupeKey" | "kind" | "pushClass" | "run">): boolean;
 /** A fact that wants a person, durably. */
 export type Notification = {
     id: number;
@@ -1116,8 +948,9 @@ export type RunnerWorkRecovery = {
     requeued: string[];
 };
 /** How a stop's settlement was established (v52). `interrupted` = the
- * owning worker sealed the attempt after its processes ended; `held` = the
- * held-session supervisor fenced it; `recovered` = dead-incarnation
+ * owning worker sealed the attempt after its processes ended; `held`
+ * (v52-v114, history only) = the removed held-session supervisor fenced it;
+ * `recovered` = dead-incarnation
  * recovery settled a run whose worker is proven gone; `finished` = the
  * attempt reached another ending first (the stop was recorded, but the
  * run's own outcome stands — the words say which). */
@@ -1218,11 +1051,9 @@ export type Run = {
     branch: string | null;
     worktree: string | null;
     model: string | null;
-    /** 'interrupted' (v25) = a held attended session cut down mid-flight. */
+    /** 'interrupted' (v25–v114) = a held session cut down mid-flight; kept so old rows read. */
     outcome: "built" | "failed" | "refused" | "parked" | "no-change" | "interrupted" | null;
     reason: string | null;
-    /** The attended authorization this run consumed (v25); null = ordinary dispatch. */
-    attendedAuthorization?: string | null;
     committed: boolean | null;
     startedAt: string;
     finishedAt: string | null;
@@ -1238,24 +1069,12 @@ export type Run = {
     headRevision: string | null;
     /** The validated terminal handoff's conclusion. */
     handoff: string | null;
-    /** When racing: which tournament agent this run belongs to. */
-    contestant: number | null;
     /**
      * Where the machine is in ITS OWN state machine — stamped by the control
      * plane at boundaries it owns, never parsed from a provider stream (M5.4).
      * Meaningful while the run is open; the last value simply remains after.
      */
     phase: RunPhase | null;
-    /**
-     * The fallback-chain metadata (v30), NULL on every run outside a chain.
-     * `chainCycle`/`chainIndex`/`entryDigest` are stamped at admission (or at
-     * base-cycle open) and bind the run to exactly one entry of an immutable
-     * approved chain — the runtime re-derives authority from the snapshot,
-     * never from these, but reads them to know which entry ran.
-     */
-    chainCycle?: number | null;
-    chainIndex?: number | null;
-    entryDigest?: string | null;
     /**
      * How this attempt authenticated (v30) — 'subscription' or 'api-key' —
      * stamped by the gateway. Decides which exhaustion class a match yields.
@@ -1263,10 +1082,8 @@ export type Run = {
     authMode?: "subscription" | "api-key" | null;
     /**
      * The gateway's honest classification of how this attempt ENDED (v30),
-     * computed at disposal from the structural terminal + the authoritative
-     * version + auth mode (exhaustion.ts). Fail-closed: 'unknown' until a
-     * fixture-backed recognizer exists. NEVER an authority by itself — the
-     * dispatch's C8 gate re-checks hasRecognizer before any advance.
+     * computed where the structural terminal still exists (exhaustion.ts).
+     * `auth-expired` pauses its provider; every other class is a record.
      */
     terminalClass?: TerminalClass | null;
     /** v44 (adaptive execution plans): the exact plan revision this attempt's
@@ -1280,88 +1097,6 @@ export type Run = {
 /** The bounded activity vocabulary. Machine-authored — a model's prose never becomes one of these. */
 export declare const RUN_PHASES: readonly ["agent-running", "validating-handoff", "capturing-evidence", "committing", "verifying-proof", "correcting-proof"];
 export type RunPhase = (typeof RUN_PHASES)[number];
-/**
- * One person's signed authority for ONE watched attempt (ruling 12). The id
- * is a pre-minted UUID — it IS the attempt identity the dispatch proof
- * consumes. Consumed (attemptRun set) is NOT closed: the authorization
- * stays active across its held session; closure is explicit and terminal.
- */
-export type AttendedAuthorization = {
-    id: string;
-    taskRef: number;
-    approver: string;
-    runner: string;
-    runnerGeneration: number;
-    compositeDigest: string;
-    termsJson: string;
-    maxSessionTurns: number;
-    /** A STOP THRESHOLD, not a ceiling: the agent halts when its total crosses it. */
-    budgetMicrousd: number;
-    /** Continuation: the finished parent attempt, also inside the signed terms. */
-    parentRun: number | null;
-    followup: string | null;
-    createdAt: string;
-    absoluteExpiry: string;
-    lastBeatAt: string | null;
-    attemptRun: number | null;
-    consumedAt: string | null;
-    closedAt: string | null;
-    endReason: string | null;
-};
-/**
- * One stdin injection into a held session (ruling 15). Author is a verified
- * operator name for 'operator' turns ONLY — brief and repair turns are
- * machine-authored and say so with null. 'uncertain' is TERMINAL: written
- * (or accepted) but never proven settled; charged at its reservation and
- * NEVER reinjected.
- */
-export type SessionTurn = {
-    id: number;
-    run: number;
-    seq: number;
-    sourceKind: "brief" | "answer" | "operator" | "repair";
-    /** The decision id for 'answer' turns, the triggering decision for 'repair'. */
-    sourceId: number | null;
-    author: string | null;
-    text: string;
-    reservedMicrousd: number;
-    accountedMicrousd: number | null;
-    accountedAt: string | null;
-    recordedAt: string;
-    writtenAt: string | null;
-    acceptedAt: string | null;
-    settledAt: string | null;
-    /** Marginal delta from the held session's durable cumulative baseline. */
-    measuredMicrousd: number | null;
-    outputTokens: number | null;
-    state: "recorded" | "written" | "accepted" | "settled" | "uncertain" | "cancelled";
-};
-/**
- * Durable crash custody for one held session (ruling 15). The orphan
- * predicate is lease-based; 'fencing' is a helpable, leased state with
- * deadline takeover. cumulativeMicrousd is the settlement baseline the
- * provider's cumulative totals are diffed against.
- */
-export type HeldSession = {
-    run: number;
-    authorizationId: string;
-    runner: string;
-    leaseId: string;
-    upIncarnation: string;
-    cookie: string;
-    socketPath: string;
-    supervisorPid: number | null;
-    agentPgid: number | null;
-    cumulativeMicrousd: number;
-    cumulativeTokensOut: number;
-    state: "open" | "fencing";
-    fencer: string | null;
-    fencingDeadline: string | null;
-    startedAt: string;
-    endedAt: string | null;
-    endReason: string | null;
-};
-export type RecordTurnRefusal = "no-held-session" | "fenced" | "turn-cap" | "turn-open" | "budget-exhausted" | "decision-open" | "repair-exhausted" | "answer-delivered";
 /**
  * One operator steering note (arc 1, v22). Attached ≠ delivered: attachment
  * says which build the note rode toward; delivery settles only on the
@@ -1770,12 +1505,6 @@ export declare const DEFAULT_ACTOR = "operator";
 export declare class RunAdmissionRefused extends Error {
     constructor(message: string);
 }
-/** A present fallback-chain row carries this many entries after the base
- * (atomic authority closure) — the same bound `config set fallback`
- * enforces at the CLI, held again at the store's read and write so a row
- * outside it is a stated problem, never an empty chain. */
-export declare const FALLBACK_ENTRIES_MIN = 1;
-export declare const FALLBACK_ENTRIES_MAX = 3;
 /**
  * The subset of `node:sqlite` this module uses, named so the rest of the file
  * is not written against an `any` and so a test can substitute a handle.
@@ -2050,7 +1779,7 @@ export declare class Store {
      * rank any still-dispatchable task holds, computed and written in ONE
      * transaction (two racing "next" calls get distinct ranks; the later
      * ask wins). Scheduling only: it refuses anything not plainly queued —
-     * building, finished, failed, cancelled, or racing a tournament — and
+     * building, finished, failed, or cancelled — and
      * never touches updated_at, which the board reads as the stall clock.
      */
     moveTaskNext(taskId: string, now: Date, mutation?: Mutation): {
@@ -2083,7 +1812,7 @@ export declare class Store {
      * One atomic queue move (queue-columns review, findings 3/9/13): the
      * revision CAS, every refusal, the assignment write, and the rerank of
      * BOTH affected columns are one transaction. The rerank member set is
-     * the FREE members only — anything live-claimed or racing a tournament
+     * the FREE members only — anything live-claimed
      * keeps its rank untouched, so a drag can never rewrite work being
      * taken (a setup-failure release rejoins with the rank the operator
      * last gave it — intent, not a bug). Scheduling, never authority.
@@ -2228,8 +1957,7 @@ export declare class Store {
      * Establish a mirror: the ONE act that makes a local task stand for a
      * tracker item. Identity and provenance are immutable after this row
      * (trigger-enforced); labels and titles may nominate work, only this
-     * establishes whose it is. Refuses tasks carrying race terms or an open
-     * tournament (D1 — external work does not race in this release).
+     * establishes whose it is.
      */
     establishMirror(mirror: {
         localTaskId: string;
@@ -2244,7 +1972,7 @@ export declare class Store {
         ok: true;
     } | {
         ok: false;
-        reason: "unknown-task" | "duplicate" | "racing";
+        reason: "unknown-task" | "duplicate";
     };
     mirrorByTask(taskId: string): ExternalMirror | null;
     mirrorByRemote(backend: string, remoteRepo: string, remoteId: string): ExternalMirror | null;
@@ -2263,7 +1991,7 @@ export declare class Store {
     /**
      * The reopen act (v3 §7 + findings 18/30): an authenticated CAS that
      * requires the tracker to have been SEEN open again after the close,
-     * and the task to be clean — no live claim, no open tournament, no
+     * and the task to be clean — no live claim, no
      * active hold, no open question, no unresolved incident. It reconciles
      * task state from any admitted state back to queued; the approved
      * scope is preserved (its digest never changed) — this act is the
@@ -2273,7 +2001,7 @@ export declare class Store {
         ok: true;
     } | {
         ok: false;
-        reason: "unknown-task" | "not-latched" | "not-seen-open" | "claimed" | "contest-open" | "held" | "question-open" | "incident-open" | "bad-state";
+        reason: "unknown-task" | "not-latched" | "not-seen-open" | "claimed" | "held" | "question-open" | "incident-open" | "bad-state";
     };
     /** The last COMPLETE sync pass for a tracker, or null — freshness's anchor. */
     lastCompleteSync(backend: string, remoteRepo: string): {
@@ -2312,7 +2040,7 @@ export declare class Store {
         why: "stale-mirror" | "external-closed" | "dispatch-revoked" | "plane-blocked";
     }[];
     /** Whether a fresh completion may stand as done (v4 §24) — read INSIDE
-     * completeFenced's transaction. Non-mirrors always complete. */
+     * finalize's complete-ending transaction. Non-mirrors always complete. */
     mirrorAllowsCompletion(taskId: string): boolean;
     /** Whether a stored acquire mutation exists — the replay marker's fact. */
     hasMutationRecord(mutation: Mutation): boolean;
@@ -2333,14 +2061,13 @@ export declare class Store {
     revokeGrant(repo: string, backend: string, mutation?: Mutation): boolean;
     saveScope(scope: Scope, mutation?: Mutation, options?: {
         profile?: ExecutionProfile;
-        /** v48: a FROZEN route — a routine firing's approved snapshot —
+        /** v48: a FROZEN route — an approved standing order's snapshot —
          * filed verbatim instead of being recommended afresh from today's
          * configuration. Requires an explicit profile, and the two must
          * agree exactly (the same belt every other road wears). */
         route?: PhaseRoute;
         permissionMode?: UnattendedPermissionMode;
         qualityMode?: QualityMode;
-        riskLevel?: RiskLevel;
         posture?: "escalated";
         proposedVia?: "mate" | "coordinator" | "scout" | null;
     }): void;
@@ -2816,8 +2543,8 @@ export declare class Store {
     /**
      * The revocation that actually severs (D7), one transaction: the stamp
      * plus a generation bump (live console sessions die at their next
-     * lookup; bearer credentials die at authenticateAccount), their open
-     * attended authorizations close, their unconsumed invites die, every
+     * lookup; bearer credentials die at authenticateAccount), their
+     * unconsumed invites die, every
      * mode THEY signed is revoked with the typed 'signer-revoked' event —
      * demoting its derived merge authority through the one reconciliation
      * road — and the derived-authority sweep clears Telegram and push.
@@ -2830,7 +2557,7 @@ export declare class Store {
      * invites, modes and everything mode-derived (their sealed filings
      * demote through the reconciliation road), Telegram, push. Standing
      * acts they completed WITH full ceremony — publication/backend/intake
-     * grants, worktree setups, approved routines, approved scopes sealed by
+     * grants, worktree setups, approved standing orders, approved scopes sealed by
      * password — deliberately survive: those are the instance's promises,
      * approved as themselves, and undoing history is not what revocation
      * means. An operator who distrusts those acts revokes them by their own
@@ -2839,18 +2566,11 @@ export declare class Store {
     revokeAccount(name: string, by: string, now: Date): {
         ok: true;
         modesRevoked: number;
-        authorizationsClosed: number;
         invitesRevoked: number;
     } | {
         ok: false;
         reason: "unknown" | "already-revoked" | "last-approver";
     };
-    /** One person's open attended sessions, for their People card. */
-    openAttendedOf(name: string): {
-        taskId: string;
-        createdAt: string;
-        lastBeatAt: string | null;
-    }[];
     /**
      * One person's recent consequential acts (U3), from the rows that were
      * ALREADY author-stamped — no new event kinds, just the ledger asked a
@@ -3166,321 +2886,6 @@ export declare class Store {
      * finds nothing to consume instead of minting a duplicate task.
      */
     consumeDiffComments(runId: number, ids: readonly number[], taskId: string): number;
-    /** The open cycle for a task, if one exists (the runtime's read). */
-    fallbackCycleFor(taskRef: number): FallbackCycle | null;
-    /** Open a fresh cycle at index 0 for a running base attempt. One live
-     * cycle per task — the SELECT-then-INSERT under BEGIN IMMEDIATE
-     * serializes writers, and the one_live_fallback_cycle_per_task partial
-     * unique index is the durable backstop (finding 5). A second refuses. */
-    openFallbackCycle(taskRef: number, chainDigest: string, tailRun: number | null, now: Date): {
-        ok: true;
-        id: number;
-    } | {
-        ok: false;
-    };
-    /**
-     * The task's IMMUTABLE approved chain — the runtime's single source of
-     * truth for chain length and per-entry authority (never mutable config).
-     * Returns the rehydrated entries when the approval sealed a chain and the
-     * snapshot still rehydrates strictly; null otherwise (a single-profile
-     * approval, or a snapshot that fails the strict rehydrator — fail closed,
-     * so a corrupt chain dispatches nothing).
-     */
-    approvedChainOf(taskId: string): ChainEntry[] | null;
-    /**
-     * The ONE chain-cycle resolver at a run's end (E3c/E3d): every concluded
-     * tail resolves its cycle — success closes it, an ordinary end closes it
-     * (the retry road runs the BASE entry under a FRESH cycle; a concluded
-     * tail can never be re-tagged, so leaving it open would only strand it),
-     * a parked tail is a PAUSED lineage and stays open for repair, and a
-     * recognized eligible exhaustion advances. Both the disposition hook and
-     * the crash reconciler call THIS method, so a crash between disposition
-     * and resolution re-derives the same answer from durable state.
-     *
-     * The advance is FAIL CLOSED at every gate:
-     *   - an OPEN cycle whose tail is exactly this finished run;
-     *   - the run genuinely finished (outcome + finished_at +
-     *     provider_started_at, same task) — never live custody;
-     *   - a fallback-ELIGIBLE class consistent with the run's auth mode;
-     *   - the C8 re-check: THIS build recognizes the exact class/auth for the
-     *     run's (provider, version) — a downgrade severs to incident;
-     *   - the LIVE signed mode's paid-fallback grant, re-read IN-transaction;
-     *   - a next entry in the IMMUTABLE approved chain (else exhausted-end).
-     * The fenced custody walk — sanitize, advance, release-to-pending — runs
-     * atomically inside ONE transaction; a lost inner CAS rolls the whole
-     * walk back. It NEVER dispatches: the admission pass creates the run.
-     */
-    resolveChainOnRunEnd(taskRef: number, taskId: string, repo: string | null, finishedRunId: number, now: Date): {
-        kind: "advanced";
-        toIndex: number;
-    } | {
-        kind: "exhausted-end";
-    } | {
-        kind: "closed";
-        reason: "succeeded" | "entry-ended";
-    } | {
-        kind: "blocked";
-        reason: "no-recognizer" | "grant-withheld" | "corrupt-chain" | "cycle-mismatch";
-    } | {
-        kind: "parked-tail";
-    } | {
-        kind: "no-cycle";
-    };
-    /**
-     * The crash reconciler's read (E3d, review finding 3): OPEN cycles whose
-     * tail run CONCLUDED (non-parked) but whose cycle was never resolved — the
-     * window a crash between disposition and resolveChainOnRunEnd leaves. The
-     * reconciler feeds each through the SAME resolver, so nothing is decided
-     * twice or differently.
-     */
-    strandedChainCycles(repo: string): {
-        cycleId: number;
-        taskRef: number;
-        taskId: string;
-        tailRun: number;
-    }[];
-    /**
-     * The chain reconciler in ONE callable piece (F+G review, finding 5): the
-     * EXACT code the tick runs each pass, so the fault tests drive the same
-     * road production does — deleting the tick's call would fail them.
-     * Resolves every open cycle whose tail concluded (non-parked) through the
-     * one resolver; returns how many it fed through.
-     */
-    reconcileStrandedChains(repo: string, now: Date): number;
-    /** Cycles awaiting their next entry's admission, for one repo — what the
-     * tick's chain admission pass walks. */
-    pendingChainAdmissions(repo: string): {
-        cycleId: number;
-        taskRef: number;
-        taskId: string;
-        cursor: number;
-    }[];
-    /**
-     * The PROVING admission (E3d): create the next entry's run from a
-     * pending-admission cycle, with EVERY authority re-derived inside one
-     * transaction — the approved chain must still stand and match the cycle's
-     * digest, the entry at the cursor must exist, the LIVE signed mode must
-     * still grant the paid fallback (revocation between advance and admission
-     * denies), and the exact unconsumed pending edge is consumed by the run
-     * it creates (admitFallback's single-use CAS). The caller carries only
-     * claim, worktree, and rail; nothing it asserts becomes authority.
-     */
-    admitNextChainEntry(cycleId: number, run: {
-        leaseId: string;
-        runner: string;
-        branch: string;
-        worktree: string;
-        recoveredFrom?: number;
-    }, now: Date): {
-        ok: true;
-        runId: number;
-        taskId: string;
-        provider: string;
-        model: string;
-    } | {
-        ok: false;
-        reason: "not-pending" | "stale-approval" | "grant-withheld" | "no-edge" | "raced" | "provider-unavailable";
-        detail?: string;
-    };
-    /**
-     * The PRE-SPAWN custody proof (Codex E3d review, finding 3): the LAST
-     * gate before a chain-bound run's provider process starts, coupled to the
-     * start stamp in ONE transaction so nothing can lapse between the proof
-     * and the money. Re-derives, from durable state only: the approved chain
-     * still stands (freshness + digest); the run's cycle is live and OPEN
-     * with THIS run as tail at THIS run's index; the entry digest and pinned
-     * auth mode still match; and — for any entry past the base — the LIVE
-     * signed mode still grants the paid fallback (a base entry is the
-     * ordinary approved work and needs no grant). Only when every fact stands
-     * is provider_started_at stamped (first-write, with the version when the
-     * gateway proved one). Returns false — and stamps NOTHING — otherwise.
-     */
-    proveChainCustodyForSpawn(runId: number, now: Date, providerVersion?: string): boolean;
-    /**
-     * open -> sanitizing (C7): a recognized ELIGIBLE exhaustion of the tail
-     * run begins the sanitizer. CAS proves exact state, generation, and tail
-     * run; a stale caller loses. Marks the cycle sanitizing so ordinary
-     * admission is blocked even if the claim later expires.
-     */
-    beginFallbackSanitize(cycleId: number, expectGeneration: number, tailRun: number, now: Date): boolean;
-    /**
-     * sanitizing -> awaiting-release (C2/C7): the durable one-step advance.
-     * ONE transaction: prove the cycle is sanitizing at this generation and
-     * cursor i with this tail run; insert the immutable transition (unique
-     * per (cycle, from_index)); advance the cursor to i+1; bump generation.
-     * The target index MUST be < chainLength (proven by the caller from the
-     * approved snapshot). Returns the new transition id, or null on a lost
-     * CAS or an already-recorded step.
-     */
-    advanceFallbackFenced(args: {
-        cycleId: number;
-        expectGeneration: number;
-        fromIndex: number;
-        chainLength: number;
-        predecessorRun: number;
-        terminalClass: string;
-        evidence: {
-            provider: string;
-            version: string | null;
-            authMode: string;
-            fp: string;
-        };
-    }, now: Date): {
-        ok: true;
-        transitionId: number;
-        toIndex: number;
-    } | {
-        ok: false;
-        reason: "raced" | "at-end" | "dup";
-    };
-    /** awaiting-release -> pending-admission (C7): the epoch-fenced custody
-     * release completed; the next entry is now admittable. */
-    releaseFallbackToPending(cycleId: number, expectGeneration: number, now: Date): boolean;
-    /**
-     * pending-admission -> open at the new index (C3): the SINGLE-USE
-     * admission. ONE transaction: prove pending at this generation, consume
-     * the transition (consumed_by set once — a replay finds it consumed and
-     * loses), and open the cycle at the new tail. Returns false on a lost
-     * CAS or an already-consumed transition.
-     */
-    /**
-     * THE FALLBACK ADMISSION (E3d; the ONE insert path for `fallback`
-     * provenance since the v48 integrity repair). Every run bound to a
-     * NON-primary entry of the approved chain — the entry's own admission
-     * from a pending edge, a parked tail's successor, a repair turn under
-     * the live tail — is created here and nowhere else; the generic
-     * admission refuses `fallback` outright.
-     *
-     * EVERYTHING the caller states is re-proved against durable state
-     * before any row exists, and one disagreement creates no run and
-     * consumes no edge: the cycle is the task's own and live; the approved
-     * chain still stands, is the cycle's, and its base entry is mirrored by
-     * the sealed profile exactly as the caller presents it; the cursor,
-     * the tail, the entry digest, the auth mode, the provider, the EXACT
-     * model (required, never defaulted), and the repair binding all equal
-     * the approved entry at the cursor; the presented stamp is `fallback`
-     * on exactly that entry for the phase this run spends as; and the
-     * kind-specific custody fact holds — an unconsumed pending edge at the
-     * cursor, a parked tail the cycle still names, or a live parent tail.
-     * The run is opened WITH its chain metadata (cycle, index, entry
-     * digest, auth mode) and its route in one body, so nothing downstream
-     * can substitute a foreign run.
-     */
-    admitFallback(args: {
-        run: {
-            taskRef: number;
-            leaseId: string;
-            runner: string;
-            branch: string;
-            worktree: string;
-            provider: string;
-            model: string;
-            sessionId?: string;
-            /** The interrupted attempt whose draft this entry or resume
-             * recovers (raw authority repair): proved this task's own run and
-             * written as the row's parent in this same insert — never stamped
-             * later. A repair turn's parent is its live tail; it recovers none. */
-            recoveredFrom?: number;
-        };
-        cycleId: number;
-        /** The cursor the caller understands the cycle to stand at — the
-         * entry index this run binds to. */
-        expectCursor: number;
-        /** The cycle's tail as the caller understands it: null for an entry
-         * admitted from a pending edge, the parked run for a resume, the
-         * live parent for a repair turn. */
-        expectTail: number | null;
-        entryDigest: string;
-        authMode: "subscription" | "api-key";
-        /** The entry's effective repair model as the caller understands it —
-         * `inherit` resolved to the build model — proved against the approved
-         * entry so a repair turn later spends as exactly what was approved. */
-        repairModel: string;
-        /** The approved authority as the caller holds it: the chain's digest
-         * and the FULL sealed-profile mirror (the chain's base entry). */
-        approved: {
-            chainDigest: string;
-            profile: ExecutionProfile;
-        };
-        /** The run's `fallback` route provenance, proved against the exact
-         * entry this admission binds (cursor + entry digest) BEFORE the row
-         * exists and written beside it. Required: nothing is dictated here. */
-        route: RouteStamp;
-    } & ({
-        kind: "entry";
-        expectGeneration: number;
-        transitionId: number;
-    } | {
-        kind: "resume";
-        parkedRun: number;
-    } | {
-        kind: "repair";
-        parentRun: number;
-    }), now: Date): {
-        ok: true;
-        runId: number;
-    } | {
-        ok: false;
-        reason: "refused" | "raced";
-        problem: string;
-    };
-    /**
-     * THE UNAVAILABLE-PRIMARY TRANSITION (v47): the approved chain's base
-     * entry runs a provider THIS runner has reported unavailable, so the
-     * task moves — before any claim, run, or spend — to the EXPLICITLY
-     * APPROVED next entry, and only that one: a fresh cycle opens at index 0
-     * with no tail and skips, one step, to pending-admission at index 1,
-     * citing the readiness observation as its evidence. The admission pass
-     * then re-proves everything (approved chain standing, live paid-fallback
-     * grant, the next entry's own readiness) before it runs. Every other
-     * case fails closed with the words: no approved chain, a live cycle
-     * already, a base that is not actually unavailable, no next entry, a
-     * next entry that is unavailable too, or no live grant — nothing
-     * substitutes outside the approved chain.
-     */
-    skipUnavailablePrimary(taskRef: number, taskId: string, repo: string | null, runner: string, now: Date): {
-        ok: true;
-        cycleId: number;
-        toIndex: number;
-        next: {
-            provider: string;
-            model: string;
-        };
-    } | {
-        ok: false;
-        reason: "no-chain" | "cycle-live" | "primary-available" | "at-end" | "next-unavailable" | "grant-withheld" | "raced";
-        detail: string;
-    };
-    /** open -> open at i+1 via a quota-skip (C7): index 0 (or any) already
-     * durably exhausted before dispatch is skipped, one step, recorded. */
-    quotaSkipFallback(args: {
-        cycleId: number;
-        expectGeneration: number;
-        fromIndex: number;
-        chainLength: number;
-        tailRun: number | null;
-        evidence?: {
-            provider: string;
-            fp: string;
-        };
-    }, now: Date): {
-        ok: true;
-        toIndex: number;
-        transitionId: number;
-    } | {
-        ok: false;
-        reason: "raced" | "at-end" | "dup";
-    };
-    /** Any nonterminal state -> incident (C8): a sanitizer failure, a
-     * severed grant, or a policy downgrade pages a human; never silent. */
-    /** Any nonterminal -> incident (C8): CAS on the exact generation so a
-     * STALE observer cannot terminate a cycle that has since advanced
-     * (Codex E1 review, finding 1). */
-    incidentFallback(cycleId: number, expectGeneration: number, reason: string, now: Date): boolean;
-    /** A cycle succeeds or exhausts its chain: closed, terminally — CAS on
-     * the exact generation (finding 1: a stale success observer cannot close
-     * after an advance + admit). */
-    closeFallbackCycle(cycleId: number, expectGeneration: number, reason: string, now: Date): boolean;
     /**
      * The bounded review-retry projection (v50): one source run's ROOT
      * reviewer attempts in ordinal order, its open request, and the ONE
@@ -3669,7 +3074,7 @@ export declare class Store {
      * exactly one wins; the loser refuses in words with zero rows.
      *
      * The child is filed UNAPPROVED, always: this method never stamps an
-     * approval, never mints an attended authorization, never touches a
+     * approval, never touches a
      * publication or merge grant. Only the normal approval roads — the
      * password ceremony, or a live mode's own filing coverage re-proved by
      * the caller inside its own transaction — can approve the child.
@@ -3995,12 +3400,10 @@ export declare class Store {
          * default when the scope is filed. */
         qualityMode?: QualityMode;
         /** The revision road's inherited declarations (contract handoff task
-         * 2): the source's declared risk, the approver's per-phase route
-         * overrides, and its build/plan pins — stamped on the ref BEFORE the
+         * 2): the approver's per-phase route overrides, and its build/plan pins — stamped on the ref BEFORE the
          * scope resolves, so the child's route is recommended over them
          * exactly as the source's was, never over the installation's
          * defaults of the day. */
-        riskLevel?: RiskLevel;
         /** How big the change is, sized at filing (v2 routing). */
         sizing?: TaskSizing;
         routeOverridesJson?: string | null;
@@ -4134,34 +3537,6 @@ export declare class Store {
     }[];
     /** Write one complete pair. Audited: who changed spend routing, and when. */
     setPhaseConfig(scope: string, phase: string, provider: string, model: string | null, by: string, now: Date): void;
-    /** The ordered FALLBACK entries after the base, for a scope's build
-     * phase (v30). Each entry: {provider, model, authMode, repairModel?}.
-     * Returns [] when none configured — a chain-of-one is the base alone. */
-    fallbackConfig(scope: string): {
-        provider: string;
-        model: string;
-        authMode: "subscription" | "api-key";
-        repairModel?: string;
-    }[];
-    /**
-     * The configured fallback entries, or the words for why the row on file
-     * cannot be read (v48): a row that EXISTS but is not a list of
-     * well-shaped entries — corrupt JSON, a non-list, an entry missing its
-     * provider, model, or auth mode — is a stated problem, never an empty
-     * list. Filing a scope under such a row refuses in these words rather
-     * than silently sealing a single-profile approval the operator did not
-     * configure; the chain the person believes they set never shrinks to
-     * nothing behind their back.
-     */
-    fallbackConfigProblem(scope: string): string | null;
-    private readFallbackConfig;
-    setFallbackConfig(scope: string, entries: {
-        provider: string;
-        model: string;
-        authMode: "subscription" | "api-key";
-        repairModel?: string;
-    }[], by: string, now: Date): void;
-    clearFallbackConfig(scope: string): boolean;
     clearPhaseConfig(scope: string, phase: string): boolean;
     /** The operator's named STRONG candidate for a phase at a scope, or null.
      * Read by the routing policy only — a phase_config row stays the routine
@@ -4209,7 +3584,7 @@ export declare class Store {
      * nothing. A signed routing input, read at filing. */
     publicationAuthorityOf(repo: string | null, now: Date): PublicationAuthority;
     /**
-     * THE ROUTE EDIT (v47): declare the task's risk, override one phase to an
+     * THE ROUTE EDIT (v47): set the task's size, override one phase to an
      * exact agent, or clear an override — ONE authenticated transaction that
      * re-proves the editor's authority, CAS-checks the scope digest the
      * editor saw (a string to match, null = "I saw no scope", undefined =
@@ -4219,7 +3594,7 @@ export declare class Store {
      * is recomputed and the prior approval goes stale by digest, and — when
      * a drafted plan came from the old planner — asks for a real re-plan.
      * No claimant can observe a half-updated authority: it is all or
-     * nothing, and refused under a live claim or tournament terms.
+     * nothing, and refused under a live claim.
      */
     editTaskRoute(taskRef: number, edit: {
         by: string;
@@ -4229,7 +3604,6 @@ export declare class Store {
             ok: false;
             reason: string;
         };
-        risk?: RiskLevel;
         /** v2: a person's size for the task — it outranks the classifier's. */
         size?: {
             size: TaskSize;
@@ -4258,7 +3632,7 @@ export declare class Store {
         overrides: RouteOverride[];
     } | {
         ok: false;
-        reason: "unauthenticated" | "no-task" | "live-claim" | "contest-open" | "changed" | "nothing" | "not-configured";
+        reason: "unauthenticated" | "no-task" | "live-claim" | "changed" | "nothing" | "not-configured";
         detail: string;
         choices?: {
             provider: string;
@@ -4267,9 +3641,8 @@ export declare class Store {
     };
     /** Store a task's size (v2 routing); the next scope filing routes by it. */
     writeSizing(taskRef: number, sizing: TaskSizing): void;
-    /** Planning follows the size and risk while nothing has run: a small
-     * change at routine risk drops a plan that is only requested; a large or
-     * risky one, or any task at elevated or high risk, asks for a plan. A
+    /** Planning follows the size while nothing has run: a small change drops
+     * a plan that is only requested; a large or risky one asks for a plan. A
      * drafted plan is never discarded. */
     private planToSizing;
     /**
@@ -4314,11 +3687,9 @@ export declare class Store {
      *     phase's exact leg. A planner may also run under the working
      *     proposed route, or — with no scope yet — the live recommendation,
      *     re-derived here from durable state. Nothing else.
-     *   fallback — the task's approved chain: the digest is the sealed
-     *     route's (or the chain's, when no route is sealed) and the pair is
-     *     a NON-primary entry of that chain (its repair model for a repair).
-     *   legacy — only a row proven to predate routing, a task with no scope,
-     *     a tournament lane, or an attended session; never a routed row.
+     *   fallback — never (fallback chains were removed in v115).
+     *   legacy — only a row proven to predate routing or a task with no
+     *     scope; never a routed row.
      */
     private routeAdmissionProblem;
     /**
@@ -4357,41 +3728,6 @@ export declare class Store {
     approvedRouteOf(taskId: string): PhaseRoute | null;
     /** Pin a task's agent — the fire transaction's stamp; flags never override it. */
     pinTaskAgent(taskRef: number, provider: string, model: string | null): void;
-    /**
-     * File a standing order, unapproved. The digest is computed by the caller
-     * (routineDigestOf) from exactly the terms stored here; approval later
-     * binds to it. Nothing fires until a person agrees to the template.
-     */
-    createRoutine(spec: {
-        name: string;
-        repo: string;
-        goal: string;
-        outOfScope: string | null;
-        touches: string[];
-        acceptance: AcceptanceCriterion[];
-        requirements: string[];
-        schedule: string;
-        singleFlight: boolean;
-        costCeilingUsd: number | null;
-        budgetPerRunMicrousd?: number | null;
-        digest: string;
-        /** Immutable provenance (v12), same contract as createConsoleTask's. */
-        filedVia?: string;
-        /** v102: who made it; its instances are filed as theirs. */
-        createdBy?: string | null;
-        /** v24: resolved at filing by the caller who computed the digest —
-         * stored verbatim so digest and profile can never disagree. */
-        profile?: ExecutionProfile;
-        /** v48: the four-role route the digest binds, computed by the same
-         * caller from the same configuration — stored verbatim. */
-        route?: PhaseRoute;
-    }, now: Date): {
-        ok: true;
-        id: number;
-    } | {
-        ok: false;
-        reason: "duplicate";
-    };
     /**
      * Set-once installation markers (v12). INSERT OR IGNORE is the whole
      * contract: the first write wins forever, there is no update and no
@@ -4405,151 +3741,22 @@ export declare class Store {
     isDemo(): boolean;
     setSpendDefaults(defaults: {
         buildPerRunMicrousd: number | null;
-        racePerAgentMicrousd: number | null;
-        raceTotalMicrousd: number | null;
-        raceAgents?: number | null;
     }, by: string, now: Date): void;
     getSpendDefaults(): {
         buildPerRunMicrousd: number | null;
-        racePerAgentMicrousd: number | null;
-        raceTotalMicrousd: number | null;
-        raceAgents: number | null;
         updatedBy: string;
     } | null;
-    /**
-     * File a new terms row: the previous active row (if any) deactivates in
-     * the same transaction — rows are immutable, the ACTIVE pointer moves.
-     * Approval lands later, by the same ceremony that approves the scope.
-     */
-    /** Withdraw the standing race: the row survives deactivated, exactly as
-     * a superseding filing would leave it — the task returns to the ordinary
-     * one-agent path. */
-    retractTournamentTerms(taskRef: number): boolean;
-    fileTournamentTerms(spec: {
-        taskRef: number;
-        /** v27: absent = 'race' (every historical caller). */
-        kind?: "race" | "comparison";
-        raceDigest: string;
-        agents: {
-            provider: string;
-            model: string;
-            repairModel: string;
-            permissionMode?: UnattendedPermissionMode;
-        }[];
-        perAgentBudgetMicrousd: number;
-        overrunReserveMicrousd: number;
-        totalBudgetMicrousd: number;
-        priceVersion: number;
-        publicationPolicy: string;
-    }, now: Date): number;
-    activeTournamentTerms(taskRef: number): TournamentTerms | null;
-    /** Approval persistence only — the restating ceremony wires in later. */
-    approveTournamentTerms(id: number, by: string, sawDigest: string, now: Date): boolean;
-    createContest(spec: {
-        taskRef: number;
-        terms: number;
-        scopeDigest: string;
-        raceDigest: string;
-        kind?: "race" | "comparison";
-    }, now: Date): number;
-    getContest(id: number): Contest | null;
-    /** The one non-finished tournament for a task, when one exists. */
-    /** The newest tournament still owed to an operator — open states plus
-     * the two that end with nothing pickable and wait for a human verdict. */
-    contestNeedingOperator(taskRef: number): Contest | null;
-    openContestFor(taskRef: number): Contest | null;
-    /**
-     * Every state change is a compare-and-swap on (state, generation): the
-     * caller proves what it believes, the write bumps the generation, and
-     * whichever of aggregation, reaping, or crash recovery loses the race
-     * changes nothing (finding 17/27).
-     */
-    casContestState(id: number, from: readonly ContestState[], to: ContestState, expectedGeneration: number): boolean;
-    stampContestLease(id: number, leaseId: string, runner: string, incarnation: string | null): void;
-    stampContestDispatch(id: number, baseSha: string, setupDigest: string | null): void;
-    createContestants(contest: number, agents: {
-        provider: string;
-        model: string;
-        repairModel: string;
-        permissionMode?: UnattendedPermissionMode;
-        branch: string;
-        budgetMicrousd: number;
-        reserveMicrousd: number;
-        unknownSpend?: boolean;
-    }[]): number[];
-    /** The lane's CUMULATIVE wall clock across its whole lineage — main
-     * attempt, resumes, and repair children (Phase 3 slice B, Codex
-     * finding 1): three sealed clocks bound a comparison lane. */
-    contestantCumulativeMs(contestantId: number): number;
-    /** The lane's money and tokens across its WHOLE lineage — main attempt,
-     * resumes, and repair children (Codex slice-B finding 6): a lane's cell
-     * that reads only the newest run under-reports every park cycle. */
-    contestantSpendRollup(contestantId: number): {
-        costMicrousd: number;
-        tokensIn: number;
-        tokensOut: number;
-        measuredRuns: number;
-        totalRuns: number;
-    };
-    contestants(contest: number): Contestant[];
-    getContestant(id: number): Contestant | null;
-    casContestantState(id: number, from: readonly ContestantState[], to: ContestantState, expectedGeneration: number): boolean;
-    /**
-     * The exact authority a contest lane PRESENTS at admission (raw
-     * authority repair): its race-approved profile's digest as a `legacy`
-     * stamp, with the pair the lane spends as for the phase — the same
-     * facts `startRun` re-proves against the lane before the row exists.
-     * Null for no such lane.
-     */
-    laneAuthorityFor(contestantId: number, phase?: "build" | "repair"): RouteStamp | null;
-    releaseContestantRun(id: number, runId: number): void;
-    setContestantWorktree(id: number, worktree: string): void;
-    /** The lineage meter (finding 25 + round-2 finding on repairs): each
-     * finished invocation settles ONCE, and the agent's total is the SUM
-     * across its whole lineage — a park's spend and its resume's spend are
-     * both real money. Accounted tracks at least the measured total. */
-    recordContestantSpend(id: number, invocationMicrousd: number): void;
-    /** A started invocation that never reported: the ledger charges the FULL
-     * reservation — never the remaining amount — and says the real figure is
-     * unknown (finding 25). Idempotent; never lowers a larger accounting. */
-    latchContestantUnknownSpend(id: number): void;
-    setContestantCustody(id: number, custody: string | null): void;
-    /** The cleanup queue (stage 6): agents of DECIDED tournaments whose
-     * checkouts still sit outside the pool. Terminal contest states only —
-     * an undecided tournament's evidence is never touched. */
-    contestantsForCleanup(): Contestant[];
-    /** Exactly-once overdue escalation: the mark rides the page (stage 6). */
-    markContestOverduePaged(contestId: number): boolean;
-    /** The pick, stamped: who chose, when, and which agent won. */
-    setContestWinner(contestId: number, contestantId: number, approver: string, now: Date): void;
-    setContestantCleanup(id: number, cleanup: "pending" | "done" | "attention"): void;
-    contestsInStates(states: readonly ContestState[]): Contest[];
     /** The still-live claim behind a lease id, or null — recovery's question.
      * The clock is INJECTED like everywhere else; SQL wall-clock time would
      * silently disagree with every test's fixed timestamps. */
     liveClaimByLease(leaseId: string, now: Date): {
         leaseId: string;
     } | null;
-    /**
-     * Close a racing agent's question WITHOUT answering it (the exclude
-     * ceremony, round-3 finding 28): typed closure, never a fake option.
-     * The caller owns authentication and the contestant's stop.
-     */
-    excludeDecision(id: number, by: string, now: Date): boolean;
-    /** A racing agent's answered-but-undelivered question, for the resume pass. */
-    answeredDecisionForContestant(contestantId: number): number | null;
-    /** A racing agent's one open (or expired-but-unanswered) question. */
-    openDecisionForContestant(contestantId: number): number | null;
-    /** Admission binds each reserved slot to its agent, so recovery can
-     * find and free every one of them (nothing reserved is ever orphaned). */
-    assignSlotContestant(slotId: number, contestantId: number): void;
-    releaseSlotsForContest(contestId: number, now: Date): number;
     reserveExecutionSlots(runner: string, count: number, now: Date): number[];
     /** reserved → running happens in the stamp-before-spawn moment, carrying
      * the process group so recovery can ask the OS before freeing capacity. */
     markSlotRunning(id: number, facts: {
         run: number;
-        contestant?: number | null;
         incarnation?: string | null;
         processGroup?: number | null;
     }, now: Date): boolean;
@@ -4557,7 +3764,6 @@ export declare class Store {
      * root attempt. It may refresh only that attempt's exact occupied slot. */
     refreshSlotProcess(id: number, facts: {
         run: number;
-        contestant?: number | null;
         incarnation?: string | null;
         processGroup: number;
     }): boolean;
@@ -4692,7 +3898,7 @@ export declare class Store {
         title: string;
         repo: string | null;
     }[];
-    /** Whether any work was ever filed — task or routine. */
+    /** Whether any work was ever filed. */
     hasAnyWork(): boolean;
     /** Which door filed a task; null for history from before v12. */
     /** The coordinator provenance label for a task — `mcp:<name>#<cid4>` —
@@ -4704,137 +3910,6 @@ export declare class Store {
         filedAt: string | null;
     } | null;
     filedViaOf(taskId: string): string | null;
-    getRoutine(id: number): Routine | null;
-    routineByName(name: string): Routine | null;
-    /** Every routine one view may see. NULL repo filter means "no filter". */
-    listRoutines(repo: string | null, admitted?: string[] | null): Routine[];
-    /**
-     * Rewrite a template's terms. The new digest rides along, and the old
-     * approval is kept — invalidated by the mismatch, exactly like a scope
-     * edit, so the refusal can say "approved, then edited" rather than
-     * "never approved". The firing transaction re-proves the match.
-     */
-    updateRoutineTerms(id: number, terms: {
-        goal: string;
-        outOfScope: string | null;
-        touches: string[];
-        /** v39: absent leaves the stored rubric untouched (a caller editing
-         * goal/touches without an opinion on acceptance); present REPLACES
-         * it — never merged, so the digest the caller computed from these
-         * exact terms is what ends up stored. */
-        acceptance?: AcceptanceCriterion[];
-        requirements: string[];
-        schedule: string;
-        costCeilingUsd: number | null;
-        digest: string;
-        /** v24: restatement carries the profile its digest binds. */
-        profile?: ExecutionProfile | null;
-        /** v48: restatement carries the route its digest binds; absent or
-         * null leaves the stored route untouched. */
-        route?: PhaseRoute | null;
-    }, now: Date): boolean;
-    /**
-     * The approval stamp, raw. Callers own the ceremony — credential,
-     * digest re-read, and the transaction — in approveRoutine (routine.ts).
-     */
-    stampRoutineApproval(id: number, by: string, digest: string, nextFireAt: string, now: Date): void;
-    /**
-     * WITHDRAW an approval that no longer verifies (v48 authority repair): the refresh road
-     * clears the approval's authority — its digest, its frozen snapshot, the
-     * armed schedule — so a corrupt or never-taken snapshot cannot keep
-     * reading as approved while the working agents happen to be unchanged.
-     * `approved_at`/`approved_by` stay as history: the page reads "approved,
-     * then refreshed — approve again", never "never approved".
-     */
-    withdrawRoutineApproval(id: number, now: Date): boolean;
-    /** Pausing is instant and needs no ceremony; resuming re-arms the schedule. */
-    setRoutinePaused(id: number, paused: boolean, now: Date): boolean;
-    /**
-     * Routines a pass should try to fire: approved (digest intact), unpaused,
-     * due, and placed in this pass's repository. Each candidate is re-proved
-     * inside fireRoutine's own transaction — this list only nominates.
-     */
-    dueRoutines(repo: string, now: Date): Routine[];
-    /** The last firings, newest first — the board's run-history strip. */
-    routineFires(routineId: number, limit?: number): (RoutineFire & {
-        instanceTaskId: string | null;
-        instanceState: string | null;
-    })[];
-    /**
-     * What one routine's instances actually cost in a window, and whether any
-     * paid run in it is unmeasured. NULL costs are counted, not summed over:
-     * a sum that silently omits them reads as headroom that may not exist
-     * (finding 5 — the arithmetic behind failing closed).
-     */
-    routineSpend(routineId: number, sinceIso: string): {
-        costUsd: number;
-        unmeasuredRuns: number;
-        totalRuns: number;
-    };
-    /**
-     * The single-flight question: the oldest instance not successfully
-     * completed nor explicitly abandoned — queued, running, held, parked,
-     * and failed instances all block (finding 9's definition, verbatim).
-     * A LIVE CLAIM blocks regardless of task state (Codex Phase C review,
-     * H2): a state string written over a running build — `task state <id>
-     * done` bypassing the guarded cancel — must not conjure a twin beside
-     * a provider that is still spending.
-     */
-    routineBlocker(routineId: number, now: Date): {
-        taskId: string;
-        state: string;
-    } | null;
-    /**
-     * Whether a slot is still unrecorded. Only sound inside the fire
-     * transaction — the IMMEDIATE lock is what makes read-then-insert atomic.
-     */
-    routineSlotOpen(routineId: number, scheduledFor: string): boolean;
-    /** Record one slot's outcome. False: the slot was already recorded — the caller lost the race. */
-    recordRoutineFire(fire: {
-        routineId: number;
-        scheduledFor: string;
-        outcome: "fired" | "skipped";
-        reason: string | null;
-        instanceTaskRef: number | null;
-    }, now: Date): boolean;
-    /** Advance the schedule. The fire transaction is the only caller. */
-    setRoutineNextFire(id: number, nextFireAt: string, now: Date): void;
-    /** Stamp which routine a task is an instance of. Set at spawn, never after. */
-    linkRoutineInstance(taskRef: number, routineId: number): void;
-    /**
-     * Page a blocked track once per EPISODE: an open episode under this
-     * prefix already nags, so nothing enqueues; a resolved one is history,
-     * and the fresh suffix keys a new row past the dedupe uniqueness — a
-     * recurrence after recovery pages again (Codex Phase C review, L1).
-     * Prefix matching is exact-bytes (substr), never LIKE — task ids may
-     * contain `_`, which LIKE would read as a wildcard.
-     */
-    enqueueRoutineEpisode(prefix: string, notification: Omit<NotificationInput, "dedupeKey">, suffix: string, now: Date): boolean;
-    /**
-     * Close every blocked-track episode for a routine — called when a firing
-     * succeeds, because success is the proof the blocker is gone (budget
-     * cleared, blocking instance finished). Receipts stay; only the "wants a
-     * person" bit resolves.
-     */
-    resolveRoutineEpisodes(routineId: number, now: Date): void;
-    /**
-     * Everything the board's track rows need, in one snapshot: each routine
-     * with its recent firings, its rolling-window spend, and the instance
-     * blocking it, if any. The caller applies the ceiling row by row.
-     */
-    routineTracks(repo: string | null, now: Date, admitted?: string[] | null): {
-        routine: Routine;
-        fires: ReturnType<Store["routineFires"]>;
-        spend: {
-            costUsd: number;
-            unmeasuredRuns: number;
-            totalRuns: number;
-        };
-        blocker: {
-            taskId: string;
-            state: string;
-        } | null;
-    }[];
     /** The latest saved line for one approved check. Corrupt rows stay absent. */
     checkProgress(run: number): CheckProgress | null;
     /**
@@ -4867,8 +3942,8 @@ export declare class Store {
      * not failed. Failures, refusals, parks, plans and reports already page
      * through their own producers (build-failed, stalled, commit-failure,
      * malformed-*, plan-ready, report-ready, fenced, external-closed) and are
-     * not repeated here. Contest lanes and repair/correction children are the
-     * attempt's own and say nothing on their own.
+     * not repeated here. Repair/correction children are the attempt's own
+     * and say nothing on their own.
      */
     private noteRunEnding;
     /** True if this is a new fact; false if the episode already knows.
@@ -4888,6 +3963,8 @@ export declare class Store {
     resolveEpisodes(prefix: string, now: Date): number;
     notificationById(id: number): Notification | null;
     notificationsAfter(id: number, limit?: number): Notification[];
+    /** What landed before a pairing (and at or before `through`) and still wants that person (WANTED_BEFORE_PAIRING). */
+    notificationsWantedBefore(created: string, through: number, limit?: number): Notification[];
     listNotifications(only?: "pending" | "all"): Notification[];
     /**
      * Close a gap's notification episode. Called when its capability verifies:
@@ -4908,13 +3985,12 @@ export declare class Store {
      * mid-flight, visible the next morning instead of vanished.
      *
      * THE GENERIC ADMISSION (atomic authority closure) opens exactly four
-     * shapes: an ordinary builder (no parent, no lane, no open attended
-     * authorization on its task), a planner (optionally continuing its own
+     * shapes: an ordinary builder (no parent, no lane), a planner (optionally continuing its own
      * same-task planner run), a scout, and a ROOT reviewer answering an open
      * review request. Every other shape has its own admission that proves
      * and consumes or binds its exact authority in one transaction —
-     * `admitRepair`, `admitAttended`, `admitCorrection`, `admitContestLane`,
-     * `admitRecoveredBuilder`, `admitFallback` — and this road refuses it in
+     * `admitRepair`, `admitCorrection`,
+     * `admitRecoveredBuilder` — and this road refuses it in
      * words before any row exists. Every run PRESENTS its route authority: a
      * task with no scope presents the bare word `legacy` for the exact pair
      * it spends as; nothing opens unstamped anywhere.
@@ -4935,20 +4011,6 @@ export declare class Store {
          * a caller can spread the authority it resolved; absent at runtime
          * it refuses in words. */
         route?: RouteStamp;
-        /** v48 authority repair: how this run takes fallback-chain custody, proved and
-         * persisted in this same insert — `base` opens the task's cycle at
-         * the approved chain's first entry (inert without a chain approval),
-         * `resume` takes a parked BASE tail's custody through the proven
-         * transfer. A binding that cannot be proved rolls the insert back.
-         * Builder-only: no other role takes custody. Every run bound to a
-         * NON-primary entry — the entry's own admission, a parked tail's
-         * successor, a repair turn — is admitted by admitFallback alone. */
-        custody?: {
-            kind: "base";
-        } | {
-            kind: "resume";
-            parkedRun: number;
-        };
         now: Date;
     } & ({
         role?: "builder" | "planner" | "scout";
@@ -4976,12 +4038,7 @@ export declare class Store {
      * this task's, is a builder, is still open, and this turn runs under
      * the parent's own runner and lease — which must be the task's CURRENT
      * live claim, on the runner that claim names (repair custody closure:
-     * the same tuple invariant every fallback admission proves). An
-     * attended parent's authorization
-     * must have spent its one attempt on that parent; a racing lane's
-     * parent must be the lane's live run; a chain-bound parent must be the
-     * live base tail (a fallback entry's repair is admitFallback's). The
-     * stamp is the repair leg of the authority the parent spent under.
+     * the exact claim tuple). The stamp is the repair leg of the authority the parent spent under.
      * Value-shaped: a refusal names its reason and leaves zero rows.
      */
     admitRepair(run: {
@@ -5003,41 +4060,6 @@ export declare class Store {
         ok: false;
         problem: string;
     };
-    /**
-     * THE ATTENDED ADMISSION (atomic authority closure): one watched attempt
-     * opens under exactly ONE live authorization the caller names — open on
-     * this task, unexpired, unspent, minted for this runner at this
-     * generation, pinning a readable profile the stamp restates as its
-     * legacy authority; a continuation names the finished parent the
-     * authorization continues, nothing else names a parent. The insert
-     * binds the row to the authorization and CONSUMES its one attempt in
-     * the same transaction: `run.attended_authorization` and
-     * `authorization.attempt_run` move together or not at all.
-     */
-    admitAttended(run: {
-        taskRef: number;
-        leaseId: string;
-        runner: string;
-        branch: string;
-        worktree: string;
-        provider: string;
-        model?: string;
-        sessionId?: string;
-        parentRun?: number;
-        authorization: {
-            id: string;
-            runner: string;
-            generation: number;
-        };
-        route: RouteStamp;
-        now: Date;
-    }): {
-        ok: true;
-        runId: number;
-    } | {
-        ok: false;
-        problem: string;
-    };
     /**
      * THE CORRECTION ADMISSION (atomic authority closure): a reviewer
      * correction continues a LIVE root review in the SAME session — the
@@ -5064,37 +4086,6 @@ export declare class Store {
         ok: false;
         problem: string;
     };
-    /**
-     * THE CONTEST LANE ADMISSION (atomic authority closure): a racing agent's
-     * run opens on ITS lane, in a contest still dispatching or racing, under
-     * the contest's live custody — the caller's lease, runner, and watch
-     * incarnation are exactly the ones the contest was stamped with — and it
-     * presents the lane's STORED sealed profile as its legacy authority: no
-     * synthesized profile, no other digest. The lane's pointer moves to the
-     * row inside the insert (from free, or from the parked attempt this run
-     * resumes); a lane that moved rolls the row back.
-     */
-    admitContestLane(run: {
-        taskRef: number;
-        leaseId: string;
-        runner: string;
-        incarnation: string | null;
-        branch: string;
-        worktree: string;
-        provider: string;
-        model?: string;
-        sessionId?: string;
-        contestant: number;
-        parentRun?: number;
-        route: RouteStamp;
-        now: Date;
-    }): {
-        ok: true;
-        runId: number;
-    } | {
-        ok: false;
-        problem: string;
-    };
     /**
      * THE RECOVERED-DRAFT ADMISSION (atomic authority closure): a fresh
      * builder attempt that inherits an INTERRUPTED attempt's draft names it
@@ -5114,12 +4105,6 @@ export declare class Store {
         model?: string;
         sessionId?: string;
         recoveredFrom: number;
-        custody?: {
-            kind: "base";
-        } | {
-            kind: "resume";
-            parkedRun: number;
-        };
         route: RouteStamp;
         now: Date;
     }): {
@@ -5134,22 +4119,17 @@ export declare class Store {
     private admission;
     private admitRun;
     /**
-     * THE CURRENT CLAIM, exactly (final admission closure): every admission
-     * that changes fallback state — the base that opens a cycle, an entry
-     * admitted from a pending edge, a parked tail's resume, a repair turn
-     * under the live tail — proves in its own transaction that the run it
-     * opens is the task's, under the lease that holds the task RIGHT NOW,
-     * on the runner that claim names. A lease nobody holds, one released,
-     * expired, or superseded by a newer generation, or a claim another
-     * machine holds admits nothing: the words say which, and no cycle,
-     * edge, tail, or claim moves. Shared by the fallback road, the primary
-     * repair road, and the generic road's custody so all refuse in the
-     * same words.
+     * THE CURRENT CLAIM, exactly (final admission closure): a repair turn
+     * proves in its own transaction that the run it opens is the task's,
+     * under the lease that holds the task RIGHT NOW, on the runner that
+     * claim names. A lease nobody holds, one released, expired, or
+     * superseded by a newer generation, or a claim another machine holds
+     * admits nothing: the words say which.
      */
     private custodyClaimProblem;
     /**
      * THE ONE RECOVERY GRANT (final authority closure), shared by the
-     * recovered-draft admission and the fallback admission's `recoveredFrom`:
+     * recovered-draft admission's `recoveredFrom`:
      * the interrupted attempt whose draft a fresh run inherits is THIS
      * task's own builder or repair turn, left in this very worktree on this
      * branch, either ended as `failed` for `interrupted` (or `no-handoff`) or still open under
@@ -5159,25 +4139,15 @@ export declare class Store {
      * say which, and the caller opens nothing.
      */
     private recoveryGrantProblem;
-    /**
-     * Whether `holder` is the LIVE tail of its task's open fallback cycle
-     * under the approved chain — the words when it is not (v48 integrity).
-     * Re-derived from durable state only: the task's one live cycle is the
-     * holder's cycle, open, its cursor at the holder's index, the holder as
-     * its tail, its digest the approved chain's, and the approved entry at
-     * that index carrying exactly the holder's digest and auth mode.
-     */
-    private liveTailProblem;
     /**
      * THE WORKING PLAN AUTHORITY (final authority closure): the route a
      * planner runs under before any approval, believed only as the ONE strict
      * stored-scope projection proves it — exact raw terms (a proposed-via
      * marker this code never writes is a terms problem), a resolved profile,
-     * a whole fallback chain (an empty or malformed one is no chain), a
-     * readable route whose build and repair legs are the profile's exact
+     * a readable route whose build and repair legs are the profile's exact
      * pairs and whose signed risk and quality are the row's, the digest
      * re-derived from those very values, the operator's live auth mode read
-     * strictly and agreeing with a chain's pinned base mode, and no leg
+     * strictly, and no leg
      * stating a problem. The claim, the admission, and the invocation all
      * ask this same question; one disagreement is the words, and nothing
      * opens or spawns on it. A sealed route is not this road's business —
@@ -5208,8 +4178,7 @@ export declare class Store {
      * The exact route authority a task holds for one run, in the caller's
      * hands (v48 authority repair): the sealed route's leg for the run's phase when the
      * approval stands; the working proposed route's plan leg for a planner
-     * before any approval; for a run bound to a NON-primary chain entry, that
-     * entry's `fallback` provenance for its phase. The store never applies
+     * before any approval. The store never applies
      * this on a caller's behalf — `startRun` requires the caller to PRESENT
      * it and proves the presented stamp against the same durable state, so
      * a caller that holds no authority opens nothing. Null when the task is
@@ -5217,10 +4186,7 @@ export declare class Store {
      * scope — those roads stamp when they spend); the words when the task
      * is routed and nothing could govern the run.
      */
-    routeAuthorityFor(taskRef: number, role: Run["role"] | "scout", bound?: {
-        index: number;
-        entryDigest: string;
-    } | null, 
+    routeAuthorityFor(taskRef: number, role: Run["role"] | "scout", 
     /** What the run would spend as, for the roads no profile governs: the
      * bare word `legacy` on a task with no scope, and the plan/review
      * pair of a pre-routing row (its profile names only build and
@@ -5300,8 +4266,7 @@ export declare class Store {
         committed?: boolean;
         now: Date;
         /** v52: how this ending settles a pending operator stop on the run,
-         * when one stands. The fenced interruption seal and the held fence
-         * name their own word; every other road settles it as `finished` —
+         * when one stands. The fenced interruption seal names its own word; every other road settles it as `finished` —
          * the attempt reached this ending first, and its outcome stands. */
         stopSettlement?: StopSettlement;
     }): void;
@@ -5322,15 +4287,12 @@ export declare class Store {
      */
     stampProviderStart(id: number, now: Date, providerVersion?: string): void;
     /**
-     * The gateway's honest disposal record for the fallback taxonomy (E2):
-     * how this attempt authenticated, and the class its terminal fell into.
-     * Recorded where the evidence still exists — the gateway holds the
-     * structural terminal, the authoritative version, and the auth mode — and
-     * NEVER re-derived in disposal, by which time the structural signal is
-     * gone. Purely observational: the class is stamped on EVERY finished
-     * attempt (usually 'unknown'/'not-exhausted', since the recognizers ship
-     * empty), and it authorizes NOTHING on its own — the dispatch's C8 gate
-     * re-proves hasRecognizer before any advance ever reads it.
+     * The gateway's honest disposal record (E2): how this attempt
+     * authenticated, and the class its terminal fell into. Recorded where the
+     * evidence still exists — the gateway holds the structural terminal and
+     * the auth mode — and NEVER re-derived in disposal, by which time the
+     * structural signal is gone. `auth-expired` pauses its provider; every
+     * other class is observational.
      */
     stampTerminalClass(id: number, authMode: "subscription" | "api-key", terminalClass: TerminalClass): void;
     /** The race-refusal stamp (Phase 3 C5): the version that was REFUSED,
@@ -5376,14 +4338,12 @@ export declare class Store {
     setOrgPolicy(policy: OrgPolicy, by: string, now: Date): SavedPolicy;
     /** The policy's changes, newest first, from the action ledger. */
     policyHistory(limit?: number): LedgerEntry[];
-    /** Why the policy stops a task's approved terms (its profile, every fallback entry, every routed leg), or null. */
+    /** Why the policy stops a task's approved terms (its profile, every routed leg), or null. */
     scopePolicyRefusal(taskId: string): string | null;
     /** Why the policy stops an agent on a provider and model now, or null (chats, teammates, flow steps). */
     agentPolicyRefusal(provider: string, model: string | null): string | null;
     /** Why the policy stops a planner, scout or native coding session (no profile to lower) on a provider and model, or null. */
     sessionPolicyRefusal(provider: string, model: string | null, what: string): string | null;
-    /** Why the policy stops an attended session's signed profile, or null (it is never lowered: see policy.attendedRefusal). */
-    attendedPolicyRefusal(profile: ExecutionProfile): string | null;
     /** The policy's word on a profile about to run: refused, or what runs (lowered under the ceiling, with words). */
     runPolicy(profile: ExecutionProfile): ReturnType<typeof underCeiling>;
     /** The budgets in force. */
@@ -5539,8 +4499,6 @@ export declare class Store {
         recommendation: string;
         assignee?: string;
         deadline?: string;
-        /** Which racing agent asked (v14); absent = ordinary. */
-        contestant?: number;
     }, now: Date): number;
     getDecision(id: number): Decision | null;
     decisionForRun(run: number): Decision | null;
@@ -5678,223 +4636,21 @@ export declare class Store {
     attachAnswers(runId: number, taskRef: number): (Decision & {
         taskId: string;
     })[];
-    /**
-     * Mint one attended authorization. Expired predecessors are closed in the
-     * SAME transaction (end reason 'expired'); a live one refuses — revoke
-     * first, never silently supersede a signature.
-     */
-    mintAttendedAuthorization(input: {
-        id: string;
-        taskRef: number;
-        approver: string;
-        runner: string;
-        runnerGeneration: number;
-        compositeDigest: string;
-        termsJson: string;
-        maxSessionTurns: number;
-        budgetMicrousd: number;
-        parentRun?: number | null;
-        followup?: string | null;
-        absoluteExpiry: string;
-        /** Quick mint (C2/M4): the mode signature substitutes for the
-         * per-mint password — RE-PROVED here, in the mint transaction
-         * itself, never a pre-checked flag: the mode must be live, its
-         * digest exact, and the minting approver must BE the signer. */
-        basis?: {
-            kind: "mode";
-            digest: string;
-        };
-        now: Date;
-    }, mutation?: Mutation): {
-        ok: true;
-        authorization: AttendedAuthorization;
-    } | {
-        ok: false;
-        reason: "authorization-open" | "mode-ended" | "approval-rules";
-    };
-    /** Close every authorization past its absolute expiry (round-6 finding
-     * 8): the durable closure the gates and the partial unique rely on —
-     * an expired corpse must not keep a task locked to its named runner. */
-    sweepExpiredAuthorizations(now: Date): number;
-    readAuthorization(id: string): AttendedAuthorization | null;
-    /** Open continuation authorizations named to this runner (Phase 2E, A4):
-     * unconsumed, carrying a parent attempt — tick's continuation pass reads
-     * this; liveness is the caller's check, as everywhere. */
-    openContinuationAuthorizations(runner: string): AttendedAuthorization[];
-    /**
-     * Why a finished run cannot be continued right now, in words — or null.
-     * The ENUMERATED non-terminal publication states (round-3 R7 demanded
-     * the concrete list, not "open intents"): a publication still moving
-     * ('intended','pushed', or 'opened' with the remote not yet settled) and
-     * a merge intent still live ('pending','claimed') both block.
-     */
-    continuationBlockOf(runId: number): string | null;
-    /** The one OPEN authorization for a task, or null. */
-    openAuthorizationFor(taskRef: number): AttendedAuthorization | null;
-    /**
-     * One durable liveness beat. The DURABLE COLUMN IS THE AUTHORITATIVE
-     * CLOCK; the only suppressed writes are duplicate-tab beats landing
-     * within 5 seconds of the stored value, so observed grace never shrinks
-     * below 40 of the nominal 45 seconds.
-     */
-    beatAuthorization(id: string, now: Date): boolean;
-    /** Explicit terminal closure — run end, expiry, or revocation. CAS on open. */
-    closeAuthorization(id: string, endReason: string, now: Date): boolean;
-    /**
-     * Money already committed against an authorization: settled and uncertain
-     * turns at their accounted charge, plus the live reservation of any
-     * unsettled turn. The budget gate reads THIS, never run.cost_usd.
-     */
-    authorizationSpendMicrousd(id: string): number;
-    /**
-     * Record one turn — the gate where the cap, the single-flight rule, the
-     * budget reservation, the lease re-proof, and the open-decision rule all
-     * hold or refuse ATOMICALLY (v6 W6: a fenced coordinator fails inside
-     * this transaction, not at its next poll). For 'answer' turns the
-     * delivery-CAS on decision.delivered_turn happens here; run_decision
-     * attaches only at ACCEPTANCE (v6 W5).
-     */
-    recordSessionTurn(input: {
-        run: number;
-        sourceKind: SessionTurn["sourceKind"];
-        sourceId?: number | null;
-        author?: string | null;
-        text: string;
-        repairLimit?: number;
-        now: Date;
-    }): {
-        ok: true;
-        turn: SessionTurn;
-    } | {
-        ok: false;
-        reason: RecordTurnRefusal;
-    };
-    /** Answered decisions on a held run whose answer has not yet been
-     * injected — the coordinator's per-pulse scan (v3 R3). */
-    undeliveredDecisionsOf(run: number): Decision[];
-    readSessionTurn(id: number): SessionTurn | null;
-    sessionTurnsOf(run: number): SessionTurn[];
-    /** Bytes flushed to stdin. Write success is NOT acceptance (spike fact 5). */
-    markTurnWritten(id: number, now: Date): boolean;
-    /**
-     * Bind pending answers to the BRIEF turn (round-6 finding 2): a held
-     * build's brief carries every answered-but-undelivered decision, and the
-     * builder's ordinary pre-spawn attach would claim delivery the agent
-     * never proved. The pre-attached run_decision rows are WITHDRAWN here and
-     * each decision's delivery-CAS points at the brief turn — run_decision
-     * re-attaches only at that turn's acceptance, exactly like answer turns.
-     */
-    bindBriefDeliveries(runId: number, briefTurn: number, decisionIds: readonly number[]): void;
-    /**
-     * Acceptance — THIS turn's system/init (or its result, retroactively).
-     * This is also where run_decision attaches, for EVERY decision whose
-     * delivery-CAS points at this turn (answer turns claim one at recording;
-     * a brief turn claims every pending answer it carried): delivery is
-     * claimed only once the agent provably received the words (v6 W5).
-     */
-    markTurnAccepted(id: number, now: Date): boolean;
-    private attachDeliveriesOf;
-    /**
-     * Settle a turn from its result. The provider's totals are CUMULATIVE per
-     * process, so the measured charge is the marginal delta from the held
-     * session's durable baseline, advanced here atomically. A missing or
-     * regressing total is a TELEMETRY FAILURE: the turn settles uncertain at
-     * its reservation, the baseline stays, and the caller must end the hold.
-     * Run aggregates gain the same delta so attended spend never disappears
-     * from routine reporting (v3 R4).
-     */
-    settleTurn(id: number, result: {
-        cumulativeMicrousd: number | null;
-        outputTokens: number | null;
-        now: Date;
-    }): {
-        ok: true;
-        measuredMicrousd: number;
-    } | {
-        ok: false;
-        reason: "telemetry" | "not-unsettled";
-    };
-    /**
-     * Terminal conservative settlement on process exit (ruling 15).
-     * 'cancelled' = recorded but never written: charged zero. 'uncertain' =
-     * written or accepted but never proven settled: charged its reservation.
-     * A turn that never reached ACCEPTANCE reverts its delivery claim so the
-     * ordinary road can deliver the answer later (v6 W5); an accepted turn
-     * keeps its attach — acceptance is the proof.
-     */
-    settleTurnTerminal(id: number, terminal: "uncertain" | "cancelled", now: Date): boolean;
-    private chargeRunAggregates;
-    /**
-     * Custody intent — INSERTed in the final dispatch-proof transaction,
-     * before spawn. The run-held partial unique refuses a
-     * second hold typed, not by accident.
-     */
-    openHeldSession(input: {
-        run: number;
-        authorizationId: string;
-        runner: string;
-        leaseId: string;
-        upIncarnation: string;
-        cookie: string;
-        socketPath: string;
-        now: Date;
-    }): {
-        ok: true;
-    } | {
-        ok: false;
-        reason: "run-held";
-    };
-    /** Stamp pids after spawn. False = the row closed underneath the spawn — kill the child. */
-    stampHeldSession(run: number, supervisorPid: number, agentPgid: number): boolean;
-    heldSessionOf(run: number): HeldSession | null;
-    /** Every un-ended custody row — the fence sweep's and hard-stop's read. */
-    /** The durable session gauge (v28): open custody rows for this runner —
-     * a restarted `up` with orphans pending must count them, so the
-     * in-process map is never the truth. */
-    openHeldSessionCount(runner: string): number;
-    /** Every open authorization on this runner — the beat-all's worklist. */
-    openAuthorizationsOf(runner: string): AttendedAuthorization[];
-    openHeldSessions(): HeldSession[];
-    /** Ordinary close by the owning coordinator. CAS on un-ended. */
-    endHeldSession(run: number, endReason: string, now: Date): boolean;
-    /**
-     * SEIZE custody for fencing (v6, after v4 Q5): CAS open→fencing AND fence
-     * the recorded lease in ONE transaction, so a wedged owner's heartbeat
-     * revival and every later coordinator write fail before any kill happens.
-     */
-    seizeHeldSession(run: number, fencer: string, deadline: Date, now: Date): {
-        ok: true;
-        session: HeldSession;
-    } | {
-        ok: false;
-        reason: "not-open";
-    };
-    /**
-     * Take over a fencing operation whose owner went quiet (v5 P3): CAS on
-     * the EXPIRED deadline. A loser stops only while a live fencer owns it.
-     */
-    takeoverHeldFencing(run: number, fencer: string, deadline: Date, now: Date): boolean;
-    /** Re-arm the fencing deadline while the work continues. Owner-CASed. */
-    renewHeldFencing(run: number, fencer: string, deadline: Date): boolean;
-    /** Final close of a fenced session — owner-CASed, after kill + settlement. */
-    closeHeldFencing(run: number, fencer: string, endReason: string, now: Date): boolean;
     /**
      * File one steering note (arc 1). Validation is validateNote EXACTLY —
-     * no bespoke rule — and filing refuses on finished tasks and during open
-     * tournaments (contestants share a task; all-racer delivery is a future
-     * many-to-many, not a silent single-racer lie).
+     * no bespoke rule — and filing refuses on finished tasks.
      */
     fileSteerNote(taskId: string, author: VerifiedAuthor, note: string, now: Date, mutation?: Mutation): {
         ok: true;
         id: number;
     } | {
         ok: false;
-        reason: "unknown-task" | "task-finished" | "contest-open" | "invalid-note";
+        reason: "unknown-task" | "task-finished" | "invalid-note";
         problem?: string;
     };
     /** Every steering note of a task, filing order, delivery state included. */
     listSteerNotes(taskRef: number): SteerNote[];
-    /** Undelivered, unsuperseded notes — the admitContest refusal predicate. */
+    /** Undelivered, unsuperseded notes. */
     pendingSteerCount(taskRef: number): number;
     /**
      * The attach transaction (arc 1 finding 9): a DEDICATED pre-invocation
@@ -6015,7 +4771,9 @@ export declare class Store {
     resolveIncident(id: number, by: string, now: Date): boolean;
     /** The body, for callers already holding the transaction (requeueTask). */
     private resolveIncidentLocked;
-    /** Mint a pairing code's record. The code itself was shown once; this is its hash. */
+    /** The shared chat core, bound to Telegram: the same pairing, rooms and worker rules every chat app keeps. */
+    telegramChat(): ChatMessages;
+    /** Mint a pairing code's record. The code itself was shown once; this is its hash. A Telegram code works on its bot. */
     createTelegramPairing(pairing: {
         codeHash: string;
         approver: string;
@@ -6023,14 +4781,15 @@ export declare class Store {
         ttlMs: number;
     }, now: Date): void;
     /**
-     * Consume a pairing code and create the binding, as one transaction.
+     * Consume a pairing code and create the binding, as one transaction, by the rules every chat app shares
+     * (ChatCore.consumePairing): a replay of the very update that paired finds its finished binding.
      *
-     * The conditional UPDATE is the consumption: exactly one caller ever sees
-     * `changes = 1`, however many pollers race. A replay of the very update
-     * that paired (Telegram redelivers) recognizes the finished binding
-     * instead of failing. Success invalidates every other outstanding code —
-     * a code that was minted and superseded must not still open a door — and
-     * the partial unique index enforces one live binding per bot.
+     * A person's FIRST pairing starts from now (Telegram task updates): every ROUTINE fact already in the outbox is
+     * history for this destination — settled here, in the pairing's own transaction, with a receipt that says it was
+     * skipped, never sent as a backlog to a phone that just arrived. The skip is explicit: no delivered_at, no attempt,
+     * only the `skipped:` receipt — a message no phone received is never reported as delivered (see TELEGRAM_UNSETTLED).
+     * An open decision or an attention-class fact still wants a person and stays pending. A re-pairing after a
+     * revocation keeps the older promise instead: what no phone ever received still waits for whenever pairing happens.
      */
     consumeTelegramPairing(attempt: {
         codeHash: string;
@@ -6049,13 +4808,7 @@ export declare class Store {
     /** The live team-conversation row for one chat, group or private. */
     telegramTeamChat(botId: string, chatId: string): TelegramTeamChat | null;
     listTelegramTeamChats(botId: string): TelegramTeamChat[];
-    /**
-     * Point a chat at a team conversation: an earlier choice for the same chat
-     * is revoked in the same transaction, and delivery starts from now — the
-     * conversation's history is read in the console, never replayed into a
-     * chat that just arrived. A group already following another conversation
-     * elsewhere, or a conversation already followed by another group, refuses.
-     */
+    /** Point a chat at a team conversation (ChatCore.bindRoom: the same rule in every chat app). */
     bindTelegramTeamChat(args: {
         botId: string;
         chatId: string;
@@ -6074,11 +4827,9 @@ export declare class Store {
     /** Forward only: a cursor never moves back, and a revoked row keeps its last position. */
     advanceTelegramTeamCursor(id: number, messageId: number): boolean;
     /**
-     * Every live binding for a bot, oldest first — and only while each
-     * approver's credential generation still matches. A rotation that
-     * somehow missed the sweep reads as no binding at all, which is the
-     * failure direction that fails closed. Several teammates may each hold
-     * one (v72); nothing here ranks them.
+     * Every live binding for a bot, oldest first — and only while each approver's credential generation still matches.
+     * A rotation that somehow missed the sweep reads as no binding at all, which is the failure direction that fails
+     * closed. Several teammates may each hold one (v72); nothing here ranks them.
      */
     liveTelegramBindings(botId: string): TelegramBinding[];
     /** The live binding one Telegram user holds with a bot, if any. */
@@ -6092,130 +4843,41 @@ export declare class Store {
     /** Revoke every live binding one person holds with a bot, and everything
      * those chats could still do. Teammates' bindings are untouched. */
     unpairTelegram(botId: string, by: string, now: Date): boolean;
-    createTelegramAction(action: {
-        token: string;
-        binding: number;
-        decision: number;
-        optionId: string;
-        phase: "choose" | "confirm" | "cancel";
-        chatId: string;
-        messageId?: string;
-        ttlMs?: number;
-        /** Binds an irreversible confirmation to the EXACT note it showed. */
-        noteDigest?: string;
-    }, now: Date): void;
-    /** Which decision an outbound Telegram message carried. Recorded after the
-     * send returns its id; a send whose record was lost routes nothing. */
-    recordTelegramDecisionMessage(binding: number, chatId: string, messageId: string, decision: number, now: Date): void;
-    /** The decision behind an exact replied-to message, or nothing. Never "the latest". */
-    decisionForTelegramMessage(binding: number, chatId: string, messageId: string): number | null;
-    /** The one live, unexpired draft for a decision, if any. */
-    liveNoteDraft(binding: number, decision: number, now: Date): {
-        id: number;
-        note: string;
-        updateId: number;
-        state: string;
-    } | null;
-    /**
-     * Persist a validated note as the live draft. A newer update SUPERSEDES
-     * the old draft — drafts are immutable, and only a GREATER update_id may
-     * replace one, so out-of-order delivery cannot resurrect an older note
-     * (Codex free-text review, state machine). Returns false when an older
-     * or equal update tried.
-     */
-    saveNoteDraft(draft: {
-        binding: number;
-        decision: number;
-        updateId: number;
-        messageId: string;
-        replyTo: string;
-        note: string;
-    }, now: Date, ttlMs?: number): boolean;
-    /** Move a draft between states; the caller owns the transaction story. */
-    setNoteDraftState(id: number, state: "pending" | "armed" | "superseded" | "consumed" | "discarded"): void;
-    createTelegramFlowActions(at: {
-        binding: number;
-        chatId: string;
-        card: number;
-        entry: number;
-    }, actions: readonly {
-        token: string;
-        action: TelegramFlowAction["action"];
-    }[], now: Date, days?: number): void;
-    getTelegramFlowAction(token: string): TelegramFlowAction | null;
-    placeTelegramFlowActions(tokens: readonly string[], messageId: string): void;
-    /** Retire every button (and prompt) for one visit of a card: it was decided, or its draft replaced. */
-    retireTelegramFlowVisit(card: number, entry: number, now: Date): void;
-    recordTelegramFlowPrompt(prompt: TelegramFlowPrompt, now: Date, hours?: number): void;
-    /** The live prompt a message replies to, if any. */
-    telegramFlowPrompt(chatId: string, messageId: string, now: Date): TelegramFlowPrompt | null;
+    createTelegramAction(...args: Parameters<ChatMessages["createDecisionAction"]>): ReturnType<ChatMessages["createDecisionAction"]>;
+    recordTelegramDecisionMessage(...args: Parameters<ChatMessages["recordDecisionMessage"]>): ReturnType<ChatMessages["recordDecisionMessage"]>;
+    decisionForTelegramMessage(...args: Parameters<ChatMessages["decisionForMessage"]>): ReturnType<ChatMessages["decisionForMessage"]>;
+    liveNoteDraft(...args: Parameters<ChatMessages["liveNoteDraft"]>): ReturnType<ChatMessages["liveNoteDraft"]>;
+    saveNoteDraft(...args: Parameters<ChatMessages["saveNoteDraft"]>): ReturnType<ChatMessages["saveNoteDraft"]>;
+    setNoteDraftState(...args: Parameters<ChatMessages["setNoteDraftState"]>): ReturnType<ChatMessages["setNoteDraftState"]>;
+    createTelegramFlowActions(...args: Parameters<ChatMessages["createFlowActions"]>): ReturnType<ChatMessages["createFlowActions"]>;
+    getTelegramFlowAction(...args: Parameters<ChatMessages["flowAction"]>): ReturnType<ChatMessages["flowAction"]>;
+    placeTelegramFlowActions(...args: Parameters<ChatMessages["placeFlowActions"]>): ReturnType<ChatMessages["placeFlowActions"]>;
+    retireTelegramFlowVisit(...args: Parameters<ChatMessages["retireFlowVisit"]>): ReturnType<ChatMessages["retireFlowVisit"]>;
+    recordTelegramFlowPrompt(...args: Parameters<ChatMessages["recordFlowPrompt"]>): ReturnType<ChatMessages["recordFlowPrompt"]>;
+    telegramFlowPrompt(...args: Parameters<ChatMessages["flowPrompt"]>): ReturnType<ChatMessages["flowPrompt"]>;
     /** What one visit sent: recorded once, the first time (a later pass finds it kept). */
     recordFlowSend(row: Omit<FlowSendRow, "createdAt">, now: Date): boolean;
     flowSend(card: number, entry: number): FlowSendRow | null;
     /** Every visit's send for a card, newest first: what the card shows it sent. */
     flowSends(card: number): FlowSendRow[];
-    createTelegramFlowChoices(at: {
-        binding: number;
-        chatId: string;
-        card: number;
-        entry: number;
-    }, choices: readonly {
-        token: string;
-        choice: number;
-        label: string;
-    }[], now: Date, days?: number): void;
-    getTelegramFlowChoice(token: string): TelegramFlowChoice | null;
-    placeTelegramFlowChoices(tokens: readonly string[], messageId: string): void;
-    /** Retire every choice button for one visit of a card (and its reply prompt): it was chosen, or the card moved on. */
+    createTelegramFlowChoices(...args: Parameters<ChatMessages["createFlowChoices"]>): ReturnType<ChatMessages["createFlowChoices"]>;
+    getTelegramFlowChoice(...args: Parameters<ChatMessages["flowChoice"]>): ReturnType<ChatMessages["flowChoice"]>;
+    placeTelegramFlowChoices(...args: Parameters<ChatMessages["placeFlowChoices"]>): ReturnType<ChatMessages["placeFlowChoices"]>;
     /** A choice was made (or the card moved on): every option button, reply prompt and "Use this as your note?" for that
-     * visit is spent, in Telegram and in every other chat app, whichever place it was made in. */
+     * visit is spent, in every chat app, whichever place it was made in. */
     retireFlowChoices(card: number, entry: number, now: Date): void;
-    createTelegramQuestionActions(at: {
-        binding: number;
-        chatId: string;
-        question: number;
-    }, choices: readonly {
-        token: string;
-        choice: string | null;
-    }[], now: Date, days?: number): void;
-    getTelegramQuestionAction(token: string): {
-        token: string;
-        binding: number;
-        question: number;
-        choice: string | null;
-        chatId: string;
-        messageId: string | null;
-        expiresAt: string;
-        consumedAt: string | null;
-    } | null;
-    placeTelegramQuestionActions(tokens: readonly string[], messageId: string): void;
-    /** Retire every button and prompt for a question: it was answered (anywhere). */
-    retireTelegramQuestion(question: number, now: Date): void;
-    recordTelegramQuestionPrompt(prompt: {
-        chatId: string;
-        messageId: string;
-        binding: number;
-        question: number;
-    }, now: Date, hours?: number): void;
-    telegramQuestionPrompt(chatId: string, messageId: string, now: Date): {
-        chatId: string;
-        messageId: string;
-        binding: number;
-        question: number;
-    } | null;
-    getTelegramAction(token: string): TelegramAction | null;
-    /**
-     * Kill every live confirm/cancel challenge on a decision. Cancel means
-     * cancelled: a confirm that survived its own cancellation would be an
-     * irreversible choice still armed after the person said stop.
-     */
-    consumeTelegramChallenges(decision: number, now: Date): void;
-    /** Consume once. False means somebody already did, or it expired — either way, no. */
-    consumeTelegramAction(token: string, now: Date): boolean;
-    /** Stamp the message a choose-action's keyboard actually landed on. */
-    placeTelegramActions(tokens: readonly string[], messageId: string): void;
-    /**
-     * Take or renew the bridge's poll lease. One live poller per bot: cron
+    createTelegramQuestionActions(...args: Parameters<ChatMessages["createQuestionActions"]>): ReturnType<ChatMessages["createQuestionActions"]>;
+    getTelegramQuestionAction(...args: Parameters<ChatMessages["questionAction"]>): ReturnType<ChatMessages["questionAction"]>;
+    placeTelegramQuestionActions(...args: Parameters<ChatMessages["placeQuestionActions"]>): ReturnType<ChatMessages["placeQuestionActions"]>;
+    retireTelegramQuestion(...args: Parameters<ChatMessages["retireQuestion"]>): ReturnType<ChatMessages["retireQuestion"]>;
+    recordTelegramQuestionPrompt(...args: Parameters<ChatMessages["recordQuestionPrompt"]>): ReturnType<ChatMessages["recordQuestionPrompt"]>;
+    telegramQuestionPrompt(...args: Parameters<ChatMessages["questionPrompt"]>): ReturnType<ChatMessages["questionPrompt"]>;
+    getTelegramAction(...args: Parameters<ChatMessages["decisionAction"]>): ReturnType<ChatMessages["decisionAction"]>;
+    consumeTelegramChallenges(...args: Parameters<ChatMessages["consumeChallenges"]>): ReturnType<ChatMessages["consumeChallenges"]>;
+    consumeTelegramAction(...args: Parameters<ChatMessages["consumeDecisionAction"]>): ReturnType<ChatMessages["consumeDecisionAction"]>;
+    placeTelegramActions(...args: Parameters<ChatMessages["placeDecisionActions"]>): ReturnType<ChatMessages["placeDecisionActions"]>;
+    /**
+     * Take or renew the bridge's poll lease (ChatCore.acquire). One live poller per bot: cron
      * overlapping a follower gets `bridge-busy`, an expired holder is taken
      * over at the next generation, and the cursor rides the lease so a stale
      * generation can neither poll nor move it.
@@ -6879,10 +5541,30 @@ export declare class Store {
     flowTriggerCard(trigger: number, key: string): number | null;
     /** The active chat trigger a channel feeds (v89), if any: one per channel. */
     chatTriggerFor(app: string, installation: string, chat: string): FlowTriggerRow | null;
-    /** Record what a trigger did with one outside thing: the card it made, or why it made none. False when it was already recorded. */
-    recordFlowTriggerEvent(trigger: number, key: string, card: number | null, note: string | null, now: Date): boolean;
+    /**
+     * Record what a trigger did with one outside thing: the card it made, or why it made none, and (a standing order's
+     * firing) the task it filed. False when it was already recorded.
+     */
+    recordFlowTriggerEvent(trigger: number, key: string, card: number | null, note: string | null, now: Date, task?: string | null): boolean;
     /** The last card a trigger made, if any. */
     lastFlowTriggerCard(trigger: number): number | null;
+    /**
+     * One at a time (v115, from routines): the oldest task a standing order filed that has neither finished nor been
+     * cancelled — queued, running, held, parked and failed ones all count. A live claim counts whatever the task's state
+     * says, so a state written over a running build can't start a twin beside it.
+     */
+    standingOrderBlocker(trigger: number, routine: number | null, now: Date): {
+        taskId: string;
+        state: string;
+    } | null;
+    /**
+     * What a standing order's tasks spent since `sinceIso` (v115, from routines), anchored to when each provider started:
+     * a paid run whose cost never landed is counted as unmeasured, and a ceiling fails closed on it.
+     */
+    standingOrderSpend(trigger: number, routine: number | null, sinceIso: string): {
+        costUsd: number;
+        unmeasuredRuns: number;
+    };
     /** The tools a project's builds get now (active only), oldest first. */
     projectTools(repo: string): {
         id: number;
@@ -6935,10 +5617,7 @@ export declare class Store {
             reason: string;
         }[];
     } | null;
-    /** A Telegram message this bot sent that showed one task (v79): a reply to
-     * it is about that task (and that result, when it showed one). A message
-     * edited to show something else forgets it. */
-    recordTelegramTaskMessage(binding: TelegramBinding, messageId: string, taskId: string | null, run: number | null, now: Date): void;
+    recordTelegramTaskMessage(...args: Parameters<ChatMessages["recordTaskMessage"]>): ReturnType<ChatMessages["recordTaskMessage"]>;
     /** The approver's live personal threads that have messages, most recent
      * first — the chat list. Team conversations list themselves. */
     listMateThreads(approver: string, limit?: number): MateThreadSummary[];
@@ -7348,9 +6027,8 @@ export declare class Store {
      * built-in task ids it returned to the queue — rather than a bare count.
      * Nothing here decides liveness: the caller proves the runner is gone (or
      * is taking its name over) inside the transaction that calls this. What it
-     * never does: touch a run that already has an outcome, a run under a live
-     * held session, another runner's rows, or a task some newer live lease
-     * owns. A second pass over the same runner settles nothing and says so.
+     * never does: touch a run that already has an outcome, another runner's
+     * rows, or a task some newer live lease owns. A second pass over the same runner settles nothing and says so.
      */
     recoverRunnerWork(runner: string, now: Date): RunnerWorkRecovery;
     /**
@@ -7401,8 +6079,7 @@ export declare class Store {
      * durably with who asked and when BEFORE any process is signalled. The
      * transaction proves the run is this task's, is still open, holds the
      * task's CURRENT live claim (a reviewer's synthetic lease counts through
-     * its open outcome alone), is not a racing lane (tournaments keep their
-     * own controls), and has admitted no publication — an external request
+     * its open outcome alone), and has admitted no publication — an external request
      * in flight is never recalled by a stop, and the words say so. The
      * stop's hold rides the same write, owned by this run, so nothing
      * automatic retries the task while it is paused; a repeated request
@@ -7419,7 +6096,7 @@ export declare class Store {
         repeated: boolean;
     } | {
         ok: false;
-        reason: "no-run" | "wrong-task" | "finished" | "not-live" | "tournament" | "publication";
+        reason: "no-run" | "wrong-task" | "finished" | "not-live" | "publication";
         detail: string;
     };
     /** Settle a stop — compare-and-set on the unsettled row. True when THIS
@@ -7574,10 +6251,7 @@ export declare class Store {
     clearQuota(runner: string, provider: string, scope: string, authMode?: "subscription" | "api-key", credentialFp?: string): boolean;
     /**
      * Live claims this runner holds right now — the occupied slots of §8's
-     * capacity gate. A claim whose run is a HELD attended session is EXCLUDED
-     * (v6 W2): capacity governs unattended work; the attended bound is the
-     * session's own signed envelope (v28: any number of them), so watched
-     * conversations never freeze the runner's queue.
+     * capacity gate.
      */
     liveClaimCount(runner: string, now: Date): number;
     /** The same live claims as liveClaimCount, by the project their task is placed in. */
@@ -7588,15 +6262,9 @@ export declare class Store {
     recordProjectConcurrency(by: string, repo: string, before: number, after: number, now: Date): void;
     /** Review 827: a project's demo URL changed (`off` when it has none). */
     recordProjectDemo(by: string, repo: string, before: string | null, after: string | null, now: Date): void;
-    /** Forward only, and only under the live generation. A stale poller moves nothing. */
-    /** v98: an update Telegram pushed, kept until the bridge applies it; false when it's already kept or applied. */
-    queueTelegramUpdate(botId: string, updateId: number, payload: string, now: Date): boolean;
-    /** v98: pushed updates waiting for the bridge, oldest first. */
-    telegramInbox(botId: string, limit: number): {
-        updateId: number;
-        payload: string;
-    }[];
-    dropTelegramInbox(updateId: number): void;
+    queueTelegramUpdate(...args: Parameters<ChatMessages["queueUpdate"]>): ReturnType<ChatMessages["queueUpdate"]>;
+    telegramInbox(...args: Parameters<ChatMessages["inbox"]>): ReturnType<ChatMessages["inbox"]>;
+    dropTelegramInbox(...args: Parameters<ChatMessages["dropInbox"]>): ReturnType<ChatMessages["dropInbox"]>;
     /** v98: where Telegram pushes this bot's updates (null: the bridge asks for them), and what's wrong, if anything. */
     setTelegramPush(botId: string, state: {
         url: string | null;
@@ -7607,164 +6275,43 @@ export declare class Store {
         problem: string | null;
         at: string | null;
     } | null;
+    /** Forward only, and only under the live generation. A stale poller moves nothing. */
     advanceBridgeCursor(botId: string, owner: string, generation: number, cursor: number, now: Date): boolean;
-    /** True if this update has not been applied before. The PRIMARY KEY is the idempotency. */
-    markTelegramUpdateApplied(updateId: number, result: string, now: Date): boolean;
-    /** Persist one ordinary message before its update is acknowledged. The caller's transaction also marks the update applied. */
-    enqueueTelegramConversation(row: {
-        binding: TelegramBinding;
-        updateId: number;
-        messageId: string;
-        replyTo: string | null;
-        request: string;
-        text: string;
-        context: string | null;
-        taskId: string | null;
-        sourceRun: number | null;
-    }, now: Date): number;
-    /** Whether a message from this chat is already waiting on, or being answered from, this bot message (a tapped question). */
-    telegramConversationWaitingOn(binding: number, messageId: string): boolean;
-    getTelegramConversation(id: number): TelegramConversation | null;
-    listTelegramConversations(botId: string): TelegramConversation[];
-    /**
-     * Claim the oldest message that still needs a turn: queued, or running
-     * under a claim that lapsed (a crash mid-turn), and not deferred past now.
-     * One at a time per bot — the mate runs one turn per approver anyway.
-     */
-    claimTelegramConversation(botId: string, owner: string, ttlMs: number, now: Date, only?: "turns" | "replies"): TelegramConversation | null;
-    /** Extend a held claim; false means it lapsed and somebody else may hold the row. */
-    renewTelegramConversation(id: number, owner: string, ttlMs: number, now: Date): boolean;
-    /**
-     * Bind the session a turn is about to be dispatched under, BEFORE the
-     * dispatch: the engine receipts the request inside that session, so a
-     * later attempt — after a crash, even after the session was ended and
-     * replaced from the console — reads the receipt where it was written
-     * instead of resolving today's session and finding nothing there.
-     */
-    bindTelegramConversationSession(id: number, owner: string, session: number): boolean;
-    /** Bind the admitted turn to its row as soon as the engine's receipt names it. */
-    bindTelegramConversationTurn(id: number, owner: string, session: number, turn: number): boolean;
-    /**
-     * Settle a claimed row: done or failed with its outcome word, or back to
-     * queued for a later attempt (a busy engine). Only the claim holder may;
-     * a lapsed claim settles nothing, so a reclaimer's outcome stands.
-     */
-    finishTelegramConversation(id: number, owner: string, result: {
-        state: "done" | "failed";
-        outcome: string;
-        replyMessageId?: string | null;
-    } | {
-        state: "queued";
-        outcome: string;
-        nextAttemptAt: string;
-    }, now: Date): boolean;
-    /**
-     * Replies the assistant wrote that still have not reached the person
-     * `since` ago or longer (status and the console show them with a Retry):
-     * the message's row, whose it is, when the oldest unsent part was
-     * written, and the last send error.
-     */
-    unsentTelegramReplies(botId: string | null, approver: string | null, since: Date): {
-        conversation: number;
-        approver: string;
-        since: string;
-        error: string | null;
-    }[];
-    /** Send unsent replies on the next bridge pass instead of waiting out their backoff; returns how many. */
-    retryTelegramReplies(approver: string | null, now: Date): number;
-    /**
-     * Persist the whole outbound half of a turn — every reply part and every
-     * card, with the cards' tokens already minted — in one transaction, BEFORE
-     * any send. Only the claim holder may, and only once: a row that already
-     * has parts keeps them (a retry resumes, never re-plans). The turn's
-     * identity rides the row too, so the parts answer to exactly that turn.
-     */
-    planTelegramConversationParts(id: number, owner: string, turn: {
-        session: number;
-        turn: number;
-    }, parts: readonly TelegramConversationPartPlan[], now: Date): boolean;
-    listTelegramConversationParts(conversation: number): TelegramConversationPart[];
-    /**
-     * Settle one send attempt under the row's claim. A confirmed message id
-     * is the only success: the part is sent, and a reply part's id becomes
-     * the row's reply id. Anything else leaves the part pending with its
-     * attempt counted, its error named, its next attempt scheduled, and —
-     * when the answer was lost rather than refused — its uncertainty counted.
-     * A lapsed claim settles nothing, so a reclaimer's outcome stands.
-     */
-    settleTelegramConversationPart(conversation: number, ordinal: number, owner: string, outcome: {
-        ok: true;
-        messageId: string;
-    } | {
-        ok: false;
-        error: string;
-        uncertain: boolean;
-        retryAt: string;
-    }, now: Date): boolean;
-    /** A card whose proposal no longer waits (confirmed or dismissed from another surface, or gone) is moot: dropped with the reason, never sent. */
-    dropTelegramConversationPart(conversation: number, ordinal: number, owner: string, reason: string, now: Date): boolean;
-    /** The exact task/run bindings of one outbound message this bot sent: a
-     * plain fact names one, a digest part may name several, (v64) a confirmed
-     * result image names its exact task and run, the lead's reply names the
-     * task its turn was about, a card names its task, and (v79) a status
-     * message names the task it showed. */
-    telegramMessageBindings(binding: TelegramBinding, messageId: string): {
-        taskId: string | null;
-        taskRef: number | null;
-        run: number | null;
-        project: string | null;
-    }[];
-    createTelegramProposalAction(action: {
-        token: string;
-        binding: number;
-        proposal: number;
-        phase: TelegramProposalAction["phase"];
-        chatId: string;
-        messageId?: string;
-        ttlMs?: number;
-    }, now: Date): void;
-    getTelegramProposalAction(token: string): TelegramProposalAction | null;
-    /** Consume once. False means somebody already did, or it expired. */
-    consumeTelegramProposalAction(token: string, now: Date): boolean;
-    /** Kill every live token on a proposal — after it resolves, or when a challenge is cancelled. */
-    consumeTelegramProposalActions(proposal: number, now: Date, phases?: readonly TelegramProposalAction["phase"][]): void;
-    /** Stamp the message a card's keyboard actually landed on. */
-    placeTelegramProposalActions(tokens: readonly string[], messageId: string): void;
-    telegramDestination(binding: TelegramBinding): string;
-    /** A progress card belongs to one builder result, including its root review.
-     * Do not combine planners, correction children, or separate build attempts. */
-    telegramProgressRun(row: Pick<Notification, "taskRef" | "run">): Run | null;
-    /** Reuse a confirmed message in this exact destination. A mixed digest,
-     * decision, image, or message naming another attempt is never editable. The
-     * outbound history survives a restart even if the final receipt was lost. */
-    telegramProgressMessage(binding: TelegramBinding, result: Run): string | null;
-    /** The existing outbox, with a separate receipt for this exact pairing. */
-    claimTelegramDeliveries(binding: TelegramBinding, owner: string, ttlMs: number, now: Date, only?: "all" | "urgent"): TelegramDelivery[];
+    markTelegramUpdateApplied(...args: Parameters<ChatMessages["markUpdateApplied"]>): ReturnType<ChatMessages["markUpdateApplied"]>;
+    enqueueTelegramConversation(...args: Parameters<ChatMessages["enqueueMessage"]>): ReturnType<ChatMessages["enqueueMessage"]>;
+    telegramConversationWaitingOn(...args: Parameters<ChatMessages["messageWaitingOn"]>): ReturnType<ChatMessages["messageWaitingOn"]>;
+    getTelegramConversation(...args: Parameters<ChatMessages["getMessage"]>): ReturnType<ChatMessages["getMessage"]>;
+    listTelegramConversations(...args: Parameters<ChatMessages["listMessages"]>): ReturnType<ChatMessages["listMessages"]>;
+    claimTelegramConversation(...args: Parameters<ChatMessages["claimMessage"]>): ReturnType<ChatMessages["claimMessage"]>;
+    renewTelegramConversation(...args: Parameters<ChatMessages["renewMessage"]>): ReturnType<ChatMessages["renewMessage"]>;
+    bindTelegramConversationSession(...args: Parameters<ChatMessages["bindMessageSession"]>): ReturnType<ChatMessages["bindMessageSession"]>;
+    bindTelegramConversationTurn(...args: Parameters<ChatMessages["bindMessageTurn"]>): ReturnType<ChatMessages["bindMessageTurn"]>;
+    finishTelegramConversation(...args: Parameters<ChatMessages["finishMessage"]>): ReturnType<ChatMessages["finishMessage"]>;
+    unsentTelegramReplies(...args: Parameters<ChatMessages["unsentReplies"]>): ReturnType<ChatMessages["unsentReplies"]>;
+    retryTelegramReplies(...args: Parameters<ChatMessages["retryReplies"]>): ReturnType<ChatMessages["retryReplies"]>;
+    planTelegramConversationParts(...args: Parameters<ChatMessages["planReplyParts"]>): ReturnType<ChatMessages["planReplyParts"]>;
+    listTelegramConversationParts(...args: Parameters<ChatMessages["replyParts"]>): ReturnType<ChatMessages["replyParts"]>;
+    settleTelegramConversationPart(...args: Parameters<ChatMessages["settleReplyPart"]>): ReturnType<ChatMessages["settleReplyPart"]>;
+    dropTelegramConversationPart(...args: Parameters<ChatMessages["dropReplyPart"]>): ReturnType<ChatMessages["dropReplyPart"]>;
+    telegramMessageBindings(...args: Parameters<ChatMessages["messageBindings"]>): ReturnType<ChatMessages["messageBindings"]>;
+    createTelegramProposalAction(...args: Parameters<ChatMessages["createProposalAction"]>): ReturnType<ChatMessages["createProposalAction"]>;
+    getTelegramProposalAction(...args: Parameters<ChatMessages["proposalAction"]>): ReturnType<ChatMessages["proposalAction"]>;
+    consumeTelegramProposalAction(...args: Parameters<ChatMessages["consumeProposalAction"]>): ReturnType<ChatMessages["consumeProposalAction"]>;
+    consumeTelegramProposalActions(...args: Parameters<ChatMessages["consumeProposalActions"]>): ReturnType<ChatMessages["consumeProposalActions"]>;
+    placeTelegramProposalActions(...args: Parameters<ChatMessages["placeProposalActions"]>): ReturnType<ChatMessages["placeProposalActions"]>;
+    telegramDestination(...args: Parameters<ChatMessages["destination"]>): ReturnType<ChatMessages["destination"]>;
+    telegramProgressRun(...args: Parameters<ChatMessages["progressRun"]>): ReturnType<ChatMessages["progressRun"]>;
+    telegramProgressMessage(...args: Parameters<ChatMessages["progressMessage"]>): ReturnType<ChatMessages["progressMessage"]>;
+    claimTelegramDeliveries(...args: Parameters<ChatMessages["claimDeliveries"]>): ReturnType<ChatMessages["claimDeliveries"]>;
     telegramRetryAt(botId: string): string;
     deferTelegram(botId: string, until: string): void;
-    /** Synchronous final fence, called AFTER each asynchronous enrollment read. */
-    telegramDeliveryProblem(row: TelegramDelivery, binding: TelegramBinding, owner: string, projects: readonly string[], now: Date, batch?: readonly number[]): string | null;
-    private telegramClaimHeld;
-    /** A confirmed network message remains history even if authority changed
-     * while it was in flight. It only binds the OLD destination, never new work. */
-    recordTelegramMessage(row: TelegramDelivery, binding: TelegramBinding, messageId: string, now: Date): void;
-    /** The newest confirmed message this notification became at one destination, if any. */
-    telegramMessageOf(notification: number, destination: string): string | null;
-    finalizeTelegramDelivery(row: TelegramDelivery, binding: TelegramBinding, owner: string, outcome: {
-        ok: true;
-        receipt: string | null;
-    } | {
-        ok: false;
-        error: string;
-        retryAt?: string;
-    }, now: Date): boolean;
-    /** The notifications this pairing holds, each with its delivery state there. */
-    telegramDeliveries(binding: TelegramBinding): NotificationReceipt[];
-    /** The digest cadence: null everyMs = off. */
-    telegramDigest(): TelegramDigest;
-    /** Set (or clear, with null) the cadence. Turning it on starts the
-     * window NOW — nothing held before the choice is dumped at once. */
-    setTelegramDigest(everyMs: number | null, by: string, now: Date): void;
+    telegramDeliveryProblem(...args: Parameters<ChatMessages["deliveryProblem"]>): ReturnType<ChatMessages["deliveryProblem"]>;
+    recordTelegramMessage(...args: Parameters<ChatMessages["recordMessage"]>): ReturnType<ChatMessages["recordMessage"]>;
+    telegramMessageOf(...args: Parameters<ChatMessages["messageOf"]>): ReturnType<ChatMessages["messageOf"]>;
+    finalizeTelegramDelivery(...args: Parameters<ChatMessages["finalizeDelivery"]>): ReturnType<ChatMessages["finalizeDelivery"]>;
+    telegramDeliveries(...args: Parameters<ChatMessages["deliveries"]>): ReturnType<ChatMessages["deliveries"]>;
+    telegramDigest(...args: Parameters<ChatMessages["digest"]>): ReturnType<ChatMessages["digest"]>;
+    setTelegramDigest(...args: Parameters<ChatMessages["setDigest"]>): ReturnType<ChatMessages["setDigest"]>;
     /** How chats reach this person: only when they are needed unless they chose every step. */
     notificationPreference(account: string): NotificationPreference;
     /** Change one person's choice; a digest time is a local HH:MM, or null for no evening digest. */
@@ -7881,7 +6428,7 @@ export declare class Store {
     chatBatchMessageFor(destination: string, taskRef: number, run: number): string | null;
     /** The message now showing this card, and what it shows. */
     setChatCardMessage(id: number, message: string, digest: string): void;
-    markTelegramDigestSent(now: Date): void;
+    markTelegramDigestSent(...args: Parameters<ChatMessages["markDigestSent"]>): ReturnType<ChatMessages["markDigestSent"]>;
     /** Routine rows waiting for the next digest: pending, and not urgent.
      * A row the live pairing delivered, or skipped as pre-pairing history,
      * is settled and not waiting. */
@@ -8006,42 +6553,10 @@ export declare class Store {
  * explicit skip, with no delivered timestamp and no attempt, so suppressed
  * history is never reported as a send that happened. */
 export declare const TELEGRAM_SKIPPED_RECEIPT = "skipped:before-pairing";
-/** v83: a notification for another person, settled for this destination without sending. */
-export declare const TELEGRAM_SKIPPED_ELSEWHERE = "skipped:for-another-person";
-/** A met promise the lead made on another chat: reported there, settled here without sending. */
-export declare const TELEGRAM_SKIPPED_OTHER_CHAT = "skipped:for-another-chat";
-/** A fact this person is not messaged about: the lead's work, their own act, or a project they muted. */
-export declare const TELEGRAM_SKIPPED_QUIET = "skipped:quiet";
-/**
- * Why the store itself holds a Telegram delivery back: authority,
- * provenance, ordering, a switched-off channel, or a wait it imposed. A
- * row held for one of these is waiting on policy, not failing on the wire.
- * Every other error recorded on a receipt came from an actual send, and
- * THAT is delivery trouble (`pendingForAttention`). One table, so the
- * fences and the tally can never disagree about the words.
- */
-export declare const TELEGRAM_HOLD_REASONS: Readonly<{
-    authority: "Telegram pairing or actor authorization changed";
-    destination: "Telegram destination changed";
-    claim: "Telegram delivery claim expired or changed";
-    rateLimit: "Telegram rate limit is still active";
-    resolved: "Notification no longer needs delivery";
-    provenance: "Notification has no trusted project provenance";
-    installation: "Installation notification requires instance access";
-    project: "Notification project is not currently authorized and enrolled";
-    task: "Notification task provenance changed";
-    order: "Earlier task notification is still undelivered";
-    disabled: "Telegram delivery is disabled";
-}>;
-/**
- * Why a contest lane cannot present or accept authority (final authority
- * closure), or null when it can: the lane must be nonterminal, carry a
- * readable stored profile, and that profile's provider, model, and
- * effective repair model must BE the lane's own columns. A profile_json
- * copied from another agent beside stale provider/model columns is a row
- * two authorities wrote; nothing spends on it.
- */
-export declare function laneAuthorityProblem(lane: Contestant): string | null;
+export { TELEGRAM_HOLD_REASONS, TELEGRAM_SKIPPED_ELSEWHERE, TELEGRAM_SKIPPED_OTHER_CHAT, TELEGRAM_SKIPPED_QUIET };
+export { isLifecycleNotification, isTelegramProgressNotification, LIFECYCLE_KEY_PREFIX, LIFECYCLE_KINDS, proposalTaskOf, type LifecycleKind };
+/** A Telegram pairing, in the Telegram adapter's names: the bot is the installation, the user the member, the private chat the channel. */
+export declare function telegramBindingOf(binding: ChatBinding): TelegramBinding;
 export type WorktreeRow = {
     path: string;
     repo: string;
@@ -8074,16 +6589,6 @@ export type IntakeGrant = {
     revokedBy: string | null;
 };
 /** A review comment bound to the exact bytes of an immutable terminal diff. */
-export type FallbackCycle = {
-    id: number;
-    taskRef: number;
-    chainDigest: string;
-    cursor: number;
-    state: "open" | "sanitizing" | "awaiting-release" | "pending-admission" | "incident" | "closed";
-    transitionGeneration: number;
-    tailRun: number | null;
-    closedReason: string | null;
-};
 export type DiffComment = {
     id: number;
     artifact: number;
@@ -8192,21 +6697,19 @@ export type RevisionRefusal = "busy" | "source-task" | "source-run" | "stale-sou
  *   INHERITED, verbatim, from the source (declared requirements and
  *   constraints — never the installation's defaults of the day):
  *     goal (the child appends its explicitly described repair), exclusions,
- *     touches, the exact rubric, declared risk (never below the source's
- *     signed level or its durable task choice), quality mode (strict stays
+ *     touches, the exact rubric, quality mode (strict stays
  *     strict), permission posture (the source's durable choice, else the
  *     posture its sealed profile ran under — never wider), the per-attempt
  *     budget ceiling (never lifted; a mode's filing default may only
  *     tighten it), the approver's per-phase route overrides, and the
  *     build/plan agent pins.
  *   RE-RESOLVED at filing, then approved afresh: the phase route and its
- *     execution profile (recommended over the inherited risk, quality,
- *     overrides, and pins under today's configuration), the fallback
- *     chain (from the repository's configuration, never copied), and the
+ *     execution profile (recommended over the inherited quality,
+ *     overrides, and pins under today's configuration), and the
  *     auth mode. The child's digest binds what it resolved to; a yes on
  *     the source never covers it.
- *   NEVER INHERITED: the approval stamp and its basis, attended
- *     authorizations, publication and merge grants, the plan document and
+ *   NEVER INHERITED: the approval stamp and its basis,
+ *     publication and merge grants, the plan document and
  *     its revision ledger (a revision is planned afresh, if at all; the
  *     brief plus the source scope are its contract), strikes, holds.
  *   FRESH from a live mode, only when the caller re-proved coverage inside
@@ -8221,7 +6724,6 @@ export type RevisionTerms = {
     outOfScope: string | null;
     touches: string[];
     acceptance: AcceptanceCriterion[];
-    riskLevel: RiskLevel;
     qualityMode: QualityMode;
     permissionMode: UnattendedPermissionMode;
     budgetMicrousd: number | null;
@@ -8240,7 +6742,7 @@ export type RevisionTerms = {
 };
 /** The operator-facing posture a sealed profile actually ran under. */
 export declare function permissionModeOfProfile(profile: ExecutionProfile | null): UnattendedPermissionMode | null;
-export declare function revisionTermsOf(sourceRef: Pick<TaskRef, "riskLevel" | "qualityMode" | "permissionMode" | "routeOverrides" | "agentProvider" | "agentModel" | "planProvider" | "planModel">, sourceScope: Scope | null, coverage: {
+export declare function revisionTermsOf(sourceRef: Pick<TaskRef, "qualityMode" | "permissionMode" | "routeOverrides" | "agentProvider" | "agentModel" | "planProvider" | "planModel">, sourceScope: Scope | null, coverage: {
     defaultBudgetMicrousd: number | null;
     escalated: boolean;
 } | null, permissionDefault: UnattendedPermissionMode, qualityDefault: QualityMode): RevisionTerms;
@@ -8264,7 +6766,6 @@ export type RevisionLineage = {
     ancestors: string[];
     root: string;
     terms: {
-        riskLevel: RiskLevel;
         qualityMode: QualityMode;
         permissionMode: UnattendedPermissionMode;
         budgetMicrousd: number | null;
@@ -8305,9 +6806,6 @@ export type ProofAcceptanceRow = {
     note: string | null;
     acceptedAt: string;
 };
-/** A contestant's execution profile (v24): exact ids from the race terms,
- * effective limits from the same constants every dispatch uses. */
-export declare function contestantProfileOf(provider: string, model: string, repairModel: string, permissionMode?: UnattendedPermissionMode): ExecutionProfile;
 /**
  * The raw terms verdict for one stored scope row (raw authority repair):
  * every term the digest binds and every metadata word an authority reads,