toolroll 0.9.55 → 0.9.56

package/dist/chat-migration.d.ts

@@ -6,7 +6,7 @@ export declare const legacyAppSchema: (app: LegacyChatApp) => string;
 /** One app's 16 old tables, parents first. */
 export declare const legacyAppTables: (app: LegacyChatApp) => string[];
 /** Telegram's own tables (v1-v114) and the bridge's lease, kept verbatim. */
-export declare const LEGACY_TELEGRAM_SCHEMA = "\nCREATE TABLE IF NOT EXISTS telegram_flow_choice (\n  token       TEXT PRIMARY KEY,\n  binding     INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  card        INTEGER NOT NULL REFERENCES flow_card(id),\n  entry       INTEGER NOT NULL,\n  choice      INTEGER NOT NULL,\n  label       TEXT NOT NULL,\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT,\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT\n);\nCREATE INDEX IF NOT EXISTS telegram_flow_choice_visit ON telegram_flow_choice (card, entry);\n\n-- v79: a Telegram message that showed one task (a /task status, a task\n-- picked from /tasks): a reply to it is about that task. Like chat_focus,\n-- a pointer and never an authority \u2014 the turn re-proves the task.\nCREATE TABLE IF NOT EXISTS telegram_task_message (\n  binding    INTEGER NOT NULL,\n  chat_id    TEXT NOT NULL,\n  message_id TEXT NOT NULL,\n  task_id    TEXT NOT NULL,\n  source_run INTEGER,\n  created_at TEXT NOT NULL,\n  PRIMARY KEY (binding, chat_id, message_id)\n);\n\n\n-- Away mode (v34, mate arc \u00A710): the Telegram bridge's digest cadence.\n-- One row. every_ms NULL = off (every fact pages as it lands); set, the\n-- bridge holds ROUTINE rows unclaimed until the window elapses and sends\n-- them as one message \u2014 decisions and attention-class facts still page\n-- singly. last_sent_at anchors the window; it never deletes a row.\nCREATE TABLE IF NOT EXISTS telegram_digest (\n  id           INTEGER PRIMARY KEY CHECK (id = 1),\n  every_ms     INTEGER,\n  set_by       TEXT,\n  set_at       TEXT,\n  last_sent_at TEXT\n);\nINSERT OR IGNORE INTO telegram_digest (id, every_ms) VALUES (1, NULL);\n\n\n-- One Telegram chat speaking as one approver. Bindings are never deleted:\n-- revocation is a stamp, because \"who could answer as whom, when\" is an\n-- audit question a DELETE cannot answer. The partial unique index (v72) is\n-- the rule that one Telegram user has one live binding per bot: several\n-- teammates pair their own private chats with the same bot.\nCREATE TABLE IF NOT EXISTS telegram_binding (\n  id                  INTEGER PRIMARY KEY AUTOINCREMENT,\n  bot_id              TEXT NOT NULL,\n  chat_id             TEXT NOT NULL,\n  user_id             TEXT NOT NULL,\n  approver            TEXT NOT NULL REFERENCES approver(name) ON DELETE RESTRICT,\n  approver_generation INTEGER NOT NULL,\n  paired_at           TEXT NOT NULL,\n  paired_by           TEXT NOT NULL,\n  pair_update_id      INTEGER,\n  revoked_at          TEXT,\n  revoked_by          TEXT\n);\nCREATE UNIQUE INDEX IF NOT EXISTS telegram_binding_live_user\n  ON telegram_binding (bot_id, user_id) WHERE revoked_at IS NULL;\n\n-- v72: a Telegram chat's place in the shared team conversations. A group\n-- follows exactly one team conversation (and a conversation has at most one\n-- group); a private chat may select one conversation to talk in instead of\n-- its personal assistant. The cursor is the last conversation message this\n-- chat received. Rows are revoked, never deleted.\nCREATE TABLE IF NOT EXISTS telegram_team_chat (\n  id           INTEGER PRIMARY KEY AUTOINCREMENT,\n  bot_id       TEXT NOT NULL,\n  chat_id      TEXT NOT NULL,\n  binding      INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  kind         TEXT NOT NULL CHECK (kind IN ('group','private')),\n  conversation TEXT NOT NULL REFERENCES team_conversation(id) ON DELETE RESTRICT,\n  bound_by     TEXT NOT NULL,\n  bound_at     TEXT NOT NULL,\n  cursor       INTEGER NOT NULL DEFAULT 0,\n  revoked_at   TEXT,\n  revoked_by   TEXT\n);\nCREATE UNIQUE INDEX IF NOT EXISTS telegram_team_chat_live\n  ON telegram_team_chat (bot_id, chat_id) WHERE revoked_at IS NULL;\nCREATE UNIQUE INDEX IF NOT EXISTS telegram_team_chat_group\n  ON telegram_team_chat (conversation) WHERE revoked_at IS NULL AND kind = 'group';\n\n\nCREATE TABLE IF NOT EXISTS telegram_outbound_message (\n  binding INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  bot_id TEXT NOT NULL,\n  chat_id TEXT NOT NULL,\n  message_id TEXT NOT NULL,\n  notification INTEGER NOT NULL REFERENCES notification(id) ON DELETE RESTRICT,\n  destination TEXT NOT NULL,\n  project TEXT,\n  task_ref INTEGER REFERENCES task_ref(id),\n  task_id TEXT,\n  source_run INTEGER REFERENCES run(id),\n  created_at TEXT NOT NULL,\n  PRIMARY KEY (binding, chat_id, message_id, notification)\n);\nCREATE TABLE IF NOT EXISTS telegram_retry (\n  bot_id TEXT PRIMARY KEY,\n  next_attempt_at TEXT NOT NULL\n);\n\n-- One-time pairing codes, hashed like every other credential, consumed in\n-- one transaction with the binding they create.\nCREATE TABLE IF NOT EXISTS telegram_pairing (\n  code_hash       TEXT PRIMARY KEY,\n  approver        TEXT NOT NULL REFERENCES approver(name) ON DELETE RESTRICT,\n  approver_generation INTEGER NOT NULL,\n  created_at      TEXT NOT NULL,\n  created_by      TEXT NOT NULL,\n  expires_at      TEXT NOT NULL,\n  consumed_at     TEXT,\n  consumed_chat   TEXT,\n  consumed_user   TEXT,\n  consumed_update INTEGER\n);\n\n-- Every Telegram update this installation has applied, exactly once. The\n-- PRIMARY KEY is the idempotency: a replayed batch re-applies nothing.\nCREATE TABLE IF NOT EXISTS telegram_update (\n  update_id  INTEGER PRIMARY KEY,\n  applied_at TEXT NOT NULL,\n  result     TEXT NOT NULL\n);\n\n-- Opaque one-tap actions. callback_data carries only the random token; what\n-- the tap MEANS \u2014 which binding, decision, option, and phase \u2014 lives here,\n-- where a stolen bot token cannot read or forge it. Confirm challenges are\n-- short-lived rows in the same table, consumed exactly once.\nCREATE TABLE IF NOT EXISTS telegram_action (\n  token       TEXT PRIMARY KEY,\n  binding     INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  decision    INTEGER NOT NULL REFERENCES decision(id) ON DELETE CASCADE,\n  option_id   TEXT NOT NULL,\n  phase       TEXT NOT NULL CHECK (phase IN ('choose','confirm','cancel')),\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT,\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT,\n  consumed_at TEXT\n);\nCREATE INDEX IF NOT EXISTS telegram_action_by_decision ON telegram_action (decision);\n\n-- v86: a flow card waiting at a \"Person decides\" zone reaches the decider on\n-- Telegram with Approve / Edit / Send back. Each button is one opaque token\n-- for one visit of one card (card, entry), placed on the message it rides so\n-- a tap on any other message proves itself stale. Edit and Send back ask\n-- for a reply to a prompt: telegram_flow_prompt names which prompt means\n-- what, so the reply becomes the new draft or the note.\nCREATE TABLE IF NOT EXISTS telegram_flow_action (\n  token       TEXT PRIMARY KEY,\n  binding     INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  card        INTEGER NOT NULL REFERENCES flow_card(id),\n  entry       INTEGER NOT NULL,\n  action      TEXT NOT NULL CHECK (action IN ('approve','edit','send-back')),\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT,\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT\n);\nCREATE INDEX IF NOT EXISTS telegram_flow_action_visit ON telegram_flow_action (card, entry);\n-- v93: a teammate's question on Telegram. One button per option (choice)\n-- and one to reply in words (choice NULL), placed on the message it rides;\n-- a reply to the prompt the Reply button sends is the answer.\nCREATE TABLE IF NOT EXISTS telegram_question_action (\n  token       TEXT PRIMARY KEY,\n  binding     INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  question    INTEGER NOT NULL REFERENCES teammate_question(id),\n  choice      TEXT,\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT,\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT\n);\nCREATE TABLE IF NOT EXISTS telegram_question_prompt (\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT NOT NULL,\n  binding     INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  question    INTEGER NOT NULL REFERENCES teammate_question(id),\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT,\n  PRIMARY KEY (chat_id, message_id)\n);\nCREATE TABLE IF NOT EXISTS telegram_flow_prompt (\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT NOT NULL,\n  binding     INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  card        INTEGER NOT NULL REFERENCES flow_card(id),\n  entry       INTEGER NOT NULL,\n  mode        TEXT NOT NULL CHECK (mode IN ('edit','send-back')),\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT,\n  PRIMARY KEY (chat_id, message_id)\n);\n\n-- Which outbound Telegram message carries which decision (v10). A free-text\n-- reply is routed through the EXACT message it replies to \u2014 never \"the\n-- latest decision\", never \"the only open one\" (Codex free-text review,\n-- finding 1). Losing the send/record race fails closed: an unrecorded\n-- message routes nothing.\nCREATE TABLE IF NOT EXISTS telegram_decision_message (\n  binding    INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE CASCADE,\n  chat_id    TEXT NOT NULL,\n  message_id TEXT NOT NULL,\n  decision   INTEGER NOT NULL REFERENCES decision(id) ON DELETE CASCADE,\n  created_at TEXT NOT NULL,\n  PRIMARY KEY (binding, chat_id, message_id)\n);\n\n-- The free-text draft (v10): an operator's note, held immutable and\n-- expiring until a TAP commits it with the choice. One live draft per\n-- (binding, decision); a newer valid reply SUPERSEDES, never edits.\nCREATE TABLE IF NOT EXISTS telegram_note_draft (\n  id         INTEGER PRIMARY KEY AUTOINCREMENT,\n  binding    INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE CASCADE,\n  decision   INTEGER NOT NULL REFERENCES decision(id) ON DELETE CASCADE,\n  update_id  INTEGER NOT NULL,\n  message_id TEXT NOT NULL,\n  reply_to   TEXT NOT NULL,\n  note       TEXT NOT NULL,\n  state      TEXT NOT NULL DEFAULT 'pending' CHECK (state IN ('pending','armed','superseded','consumed','discarded')),\n  created_at TEXT NOT NULL,\n  expires_at TEXT NOT NULL\n);\n\nCREATE UNIQUE INDEX IF NOT EXISTS telegram_note_draft_live\n  ON telegram_note_draft (binding, decision) WHERE state IN ('pending','armed');\n\n-- v62: the durable inbound conversation queue. An ordinary paired message\n-- becomes a row in the SAME transaction that marks its update applied, so\n-- the poll cursor never moves past text nobody holds. The row carries the\n-- exact binding, sender, update, message and the request identity the\n-- shared mate engine receipts it under; the async model turn runs OUTSIDE\n-- any transaction under a short claim, and a replay or restart finds the\n-- receipt instead of dispatching the provider again.\nCREATE TABLE IF NOT EXISTS telegram_conversation (\n  id                  INTEGER PRIMARY KEY AUTOINCREMENT,\n  binding             INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  bot_id              TEXT NOT NULL,\n  chat_id             TEXT NOT NULL,\n  user_id             TEXT NOT NULL,\n  approver            TEXT NOT NULL,\n  approver_generation INTEGER NOT NULL,\n  update_id           INTEGER NOT NULL UNIQUE,\n  message_id          TEXT NOT NULL,\n  reply_to            TEXT,\n  request             TEXT NOT NULL UNIQUE,\n  text                TEXT NOT NULL,\n  context             TEXT,\n  task_id             TEXT,\n  source_run          INTEGER,\n  state               TEXT NOT NULL CHECK (state IN ('queued','running','done','failed')),\n  claim_owner         TEXT,\n  claim_expires_at    TEXT,\n  attempts            INTEGER NOT NULL DEFAULT 0,\n  next_attempt_at     TEXT,\n  session             INTEGER,\n  turn                INTEGER,\n  outcome             TEXT,\n  reply_message_id    TEXT,\n  created_at          TEXT NOT NULL,\n  started_at          TEXT,\n  finished_at         TEXT\n);\nCREATE INDEX IF NOT EXISTS telegram_conversation_queue ON telegram_conversation (bot_id, state, id);\n\n-- v62: opaque one-tap tokens for the mate's proposal cards, the same shape\n-- as telegram_action for decisions: callback_data carries only the token,\n-- and what a tap MEANS (which binding, which proposal, which phase) lives\n-- here. Consumed exactly once; an irreversible answer arms a yes/cancel\n-- pair first, exactly as a decision button does.\nCREATE TABLE IF NOT EXISTS telegram_proposal_action (\n  token       TEXT PRIMARY KEY,\n  binding     INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  proposal    INTEGER NOT NULL REFERENCES mate_proposal(id) ON DELETE CASCADE,\n  phase       TEXT NOT NULL CHECK (phase IN ('confirm','dismiss','yes','cancel')),\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT,\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT,\n  consumed_at TEXT\n);\nCREATE INDEX IF NOT EXISTS telegram_proposal_action_by_proposal ON telegram_proposal_action (proposal);\n\n-- v63: the outbound half of a conversation, durable BEFORE any send. Once\n-- the engine's turn is answered (or recovered from its receipt), the exact\n-- reply text, split into Telegram-sized parts, and one card per pending\n-- proposal are written here in one transaction; the bridge then sends\n-- them in order under the row's claim, marking a part sent only when\n-- Telegram confirmed a message id. A crash, an outage, a rate limit or a\n-- restart resumes from the first unsent part \u2014 never another model call,\n-- proposal, task or revision. A card's buttons are minted with the part,\n-- so a resend carries the same tokens. A part whose network answer was\n-- lost is counted as uncertain: a resend may duplicate it, and the row\n-- says so instead of claiming an exactly-once Telegram cannot provide.\n-- v64: an 'image' part is one verified screenshot of one exact result,\n-- named by typed columns \u2014 task, run, artifact and the hash its record\n-- carried when the part was planned \u2014 never by JSON inside text or a\n-- keyboard, and never by bytes: every send re-reads the artifact from the\n-- evidence root and re-verifies it against these columns first. Its text\n-- is the short caption. A confirmed image message binds replies to that\n-- exact task and run, exactly as an outbox fact's message does.\nCREATE TABLE IF NOT EXISTS telegram_conversation_part (\n  conversation    INTEGER NOT NULL REFERENCES telegram_conversation(id) ON DELETE CASCADE,\n  ordinal         INTEGER NOT NULL,\n  kind            TEXT NOT NULL CHECK (kind IN ('reply','card','image')),\n  text            TEXT NOT NULL,\n  reply_to        TEXT,\n  proposal        INTEGER REFERENCES mate_proposal(id) ON DELETE SET NULL,\n  keyboard_json   TEXT,\n  state           TEXT NOT NULL CHECK (state IN ('pending','sent','dropped')),\n  message_id      TEXT,\n  attempts        INTEGER NOT NULL DEFAULT 0,\n  uncertain       INTEGER NOT NULL DEFAULT 0,\n  next_attempt_at TEXT,\n  last_error      TEXT,\n  created_at      TEXT NOT NULL,\n  sent_at         TEXT,\n  task_id         TEXT,\n  source_run      INTEGER REFERENCES run(id),\n  artifact        INTEGER,\n  sha256          TEXT,\n  PRIMARY KEY (conversation, ordinal),\n  CHECK ((state = 'sent') = (message_id IS NOT NULL)),\n  CHECK ((state = 'sent') = (sent_at IS NOT NULL)),\n  CHECK ((kind = 'image') = (task_id IS NOT NULL AND source_run IS NOT NULL AND artifact IS NOT NULL AND sha256 IS NOT NULL))\n);\n\n\n-- The bridge's poll lease and cursor, per bot. One live poller at a time;\n-- the cursor only ever moves forward, and only under a live generation.\nCREATE TABLE IF NOT EXISTS bridge_lease (\n  bot_id       TEXT PRIMARY KEY,\n  owner        TEXT NOT NULL,\n  generation   INTEGER NOT NULL,\n  cursor       INTEGER NOT NULL DEFAULT 0,\n  expires_at   TEXT NOT NULL,\n  heartbeat_at TEXT NOT NULL,\n  push_url     TEXT,\n  push_at      TEXT,\n  push_problem TEXT\n);\n-- v98: updates Telegram pushed to /hooks/telegram, kept until the bridge\n-- applies them (in update order, through the same door as polled ones).\nCREATE TABLE IF NOT EXISTS telegram_inbox (\n  update_id    INTEGER PRIMARY KEY,\n  bot_id       TEXT NOT NULL,\n  payload      TEXT NOT NULL,\n  received_at  TEXT NOT NULL\n);\n\n\nCREATE TABLE IF NOT EXISTS telegram_flow_confirm (\n  token       TEXT PRIMARY KEY,\n  binding     INTEGER NOT NULL,\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT NOT NULL,\n  card        INTEGER NOT NULL,\n  entry       INTEGER NOT NULL,\n  phase       TEXT NOT NULL CHECK (phase IN ('yes','cancel')),\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT\n);\nCREATE INDEX IF NOT EXISTS telegram_flow_confirm_visit ON telegram_flow_confirm (card, entry);\n";
+export declare const LEGACY_TELEGRAM_SCHEMA = "\nCREATE TABLE IF NOT EXISTS telegram_flow_choice (\n  token       TEXT PRIMARY KEY,\n  binding     INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  card        INTEGER NOT NULL REFERENCES flow_card(id),\n  entry       INTEGER NOT NULL,\n  choice      INTEGER NOT NULL,\n  label       TEXT NOT NULL,\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT,\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT\n);\nCREATE INDEX IF NOT EXISTS telegram_flow_choice_visit ON telegram_flow_choice (card, entry);\n\n-- v79: a Telegram message that showed one task (a /task status, a task\n-- picked from /tasks): a reply to it is about that task. Like chat_focus,\n-- a pointer and never an authority \u2014 the turn re-proves the task.\nCREATE TABLE IF NOT EXISTS telegram_task_message (\n  binding    INTEGER NOT NULL,\n  chat_id    TEXT NOT NULL,\n  message_id TEXT NOT NULL,\n  task_id    TEXT NOT NULL,\n  source_run INTEGER,\n  created_at TEXT NOT NULL,\n  PRIMARY KEY (binding, chat_id, message_id)\n);\n\n\n-- Away mode (v34, mate arc \u00A710): the Telegram bridge's digest cadence.\n-- One row. every_ms NULL = off (every fact pages as it lands); set, the\n-- bridge holds ROUTINE rows unclaimed until the window elapses and sends\n-- them as one message \u2014 decisions and attention-class facts still page\n-- singly. last_sent_at anchors the window; it never deletes a row.\nCREATE TABLE IF NOT EXISTS telegram_digest (\n  id           INTEGER PRIMARY KEY CHECK (id = 1),\n  every_ms     INTEGER,\n  set_by       TEXT,\n  set_at       TEXT,\n  last_sent_at TEXT\n);\nINSERT OR IGNORE INTO telegram_digest (id, every_ms) VALUES (1, NULL);\n\n\n-- One Telegram chat speaking as one approver. Bindings are never deleted:\n-- revocation is a stamp, because \"who could answer as whom, when\" is an\n-- audit question a DELETE cannot answer. The partial unique index (v72) is\n-- the rule that one Telegram user has one live binding per bot: several\n-- teammates pair their own private chats with the same bot.\nCREATE TABLE IF NOT EXISTS telegram_binding (\n  id                  INTEGER PRIMARY KEY AUTOINCREMENT,\n  bot_id              TEXT NOT NULL,\n  chat_id             TEXT NOT NULL,\n  user_id             TEXT NOT NULL,\n  approver            TEXT NOT NULL REFERENCES approver(name) ON DELETE RESTRICT,\n  approver_generation INTEGER NOT NULL,\n  paired_at           TEXT NOT NULL,\n  paired_by           TEXT NOT NULL,\n  pair_update_id      INTEGER,\n  revoked_at          TEXT,\n  revoked_by          TEXT\n);\nCREATE UNIQUE INDEX IF NOT EXISTS telegram_binding_live_user\n  ON telegram_binding (bot_id, user_id) WHERE revoked_at IS NULL;\n\n-- v72: a Telegram chat's place in the shared team conversations. A group\n-- follows exactly one team conversation (and a conversation has at most one\n-- group); a private chat may select one conversation to talk in instead of\n-- its personal assistant. The cursor is the last conversation message this\n-- chat received. Rows are revoked, never deleted.\nCREATE TABLE IF NOT EXISTS telegram_team_chat (\n  id           INTEGER PRIMARY KEY AUTOINCREMENT,\n  bot_id       TEXT NOT NULL,\n  chat_id      TEXT NOT NULL,\n  binding      INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  kind         TEXT NOT NULL CHECK (kind IN ('group','private')),\n  conversation TEXT NOT NULL REFERENCES team_conversation(id) ON DELETE RESTRICT,\n  bound_by     TEXT NOT NULL,\n  bound_at     TEXT NOT NULL,\n  cursor       INTEGER NOT NULL DEFAULT 0,\n  revoked_at   TEXT,\n  revoked_by   TEXT\n);\nCREATE UNIQUE INDEX IF NOT EXISTS telegram_team_chat_live\n  ON telegram_team_chat (bot_id, chat_id) WHERE revoked_at IS NULL;\nCREATE UNIQUE INDEX IF NOT EXISTS telegram_team_chat_group\n  ON telegram_team_chat (conversation) WHERE revoked_at IS NULL AND kind = 'group';\n\n\nCREATE TABLE IF NOT EXISTS telegram_outbound_message (\n  binding INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  bot_id TEXT NOT NULL,\n  chat_id TEXT NOT NULL,\n  message_id TEXT NOT NULL,\n  notification INTEGER NOT NULL REFERENCES notification(id) ON DELETE RESTRICT,\n  destination TEXT NOT NULL,\n  project TEXT,\n  task_ref INTEGER REFERENCES task_ref(id),\n  task_id TEXT,\n  source_run INTEGER REFERENCES run(id),\n  created_at TEXT NOT NULL,\n  PRIMARY KEY (binding, chat_id, message_id, notification)\n);\nCREATE TABLE IF NOT EXISTS telegram_retry (\n  bot_id TEXT PRIMARY KEY,\n  next_attempt_at TEXT NOT NULL\n);\n\n-- One-time pairing codes, hashed like every other credential, consumed in\n-- one transaction with the binding they create.\nCREATE TABLE IF NOT EXISTS telegram_pairing (\n  code_hash       TEXT PRIMARY KEY,\n  approver        TEXT NOT NULL REFERENCES approver(name) ON DELETE RESTRICT,\n  approver_generation INTEGER NOT NULL,\n  created_at      TEXT NOT NULL,\n  created_by      TEXT NOT NULL,\n  expires_at      TEXT NOT NULL,\n  consumed_at     TEXT,\n  consumed_chat   TEXT,\n  consumed_user   TEXT,\n  consumed_update INTEGER\n);\n\n-- Every Telegram update this installation has applied, exactly once. The\n-- PRIMARY KEY is the idempotency: a replayed batch re-applies nothing.\nCREATE TABLE IF NOT EXISTS telegram_update (\n  update_id  INTEGER PRIMARY KEY,\n  applied_at TEXT NOT NULL,\n  result     TEXT NOT NULL\n);\n\n-- Opaque one-tap actions. callback_data carries only the random token; what\n-- the tap MEANS \u2014 which binding, decision, option, and phase \u2014 lives here,\n-- where a stolen bot token cannot read or forge it. Confirm challenges are\n-- short-lived rows in the same table, consumed exactly once.\nCREATE TABLE IF NOT EXISTS telegram_action (\n  token       TEXT PRIMARY KEY,\n  binding     INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  decision    INTEGER NOT NULL REFERENCES decision(id) ON DELETE CASCADE,\n  option_id   TEXT NOT NULL,\n  phase       TEXT NOT NULL CHECK (phase IN ('choose','confirm','cancel')),\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT,\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT,\n  consumed_at TEXT\n);\nCREATE INDEX IF NOT EXISTS telegram_action_by_decision ON telegram_action (decision);\n\n-- v86: a flow card waiting at a \"Person decides\" zone reaches the decider on\n-- Telegram with Approve / Edit / Send back. Each button is one opaque token\n-- for one visit of one card (card, entry), placed on the message it rides so\n-- a tap on any other message proves itself stale. Edit and Send back ask\n-- for a reply to a prompt: telegram_flow_prompt names which prompt means\n-- what, so the reply becomes the new draft or the note.\nCREATE TABLE IF NOT EXISTS telegram_flow_action (\n  token       TEXT PRIMARY KEY,\n  binding     INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  card        INTEGER NOT NULL REFERENCES flow_card(id),\n  entry       INTEGER NOT NULL,\n  action      TEXT NOT NULL CHECK (action IN ('approve','edit','send-back')),\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT,\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT\n);\nCREATE INDEX IF NOT EXISTS telegram_flow_action_visit ON telegram_flow_action (card, entry);\n-- v93: a subagent's question on Telegram. One button per option (choice)\n-- and one to reply in words (choice NULL), placed on the message it rides;\n-- a reply to the prompt the Reply button sends is the answer.\nCREATE TABLE IF NOT EXISTS telegram_question_action (\n  token       TEXT PRIMARY KEY,\n  binding     INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  question    INTEGER NOT NULL REFERENCES subagent_question(id),\n  choice      TEXT,\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT,\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT\n);\nCREATE TABLE IF NOT EXISTS telegram_question_prompt (\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT NOT NULL,\n  binding     INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  question    INTEGER NOT NULL REFERENCES subagent_question(id),\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT,\n  PRIMARY KEY (chat_id, message_id)\n);\nCREATE TABLE IF NOT EXISTS telegram_flow_prompt (\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT NOT NULL,\n  binding     INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  card        INTEGER NOT NULL REFERENCES flow_card(id),\n  entry       INTEGER NOT NULL,\n  mode        TEXT NOT NULL CHECK (mode IN ('edit','send-back')),\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT,\n  PRIMARY KEY (chat_id, message_id)\n);\n\n-- Which outbound Telegram message carries which decision (v10). A free-text\n-- reply is routed through the EXACT message it replies to \u2014 never \"the\n-- latest decision\", never \"the only open one\" (Codex free-text review,\n-- finding 1). Losing the send/record race fails closed: an unrecorded\n-- message routes nothing.\nCREATE TABLE IF NOT EXISTS telegram_decision_message (\n  binding    INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE CASCADE,\n  chat_id    TEXT NOT NULL,\n  message_id TEXT NOT NULL,\n  decision   INTEGER NOT NULL REFERENCES decision(id) ON DELETE CASCADE,\n  created_at TEXT NOT NULL,\n  PRIMARY KEY (binding, chat_id, message_id)\n);\n\n-- The free-text draft (v10): an operator's note, held immutable and\n-- expiring until a TAP commits it with the choice. One live draft per\n-- (binding, decision); a newer valid reply SUPERSEDES, never edits.\nCREATE TABLE IF NOT EXISTS telegram_note_draft (\n  id         INTEGER PRIMARY KEY AUTOINCREMENT,\n  binding    INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE CASCADE,\n  decision   INTEGER NOT NULL REFERENCES decision(id) ON DELETE CASCADE,\n  update_id  INTEGER NOT NULL,\n  message_id TEXT NOT NULL,\n  reply_to   TEXT NOT NULL,\n  note       TEXT NOT NULL,\n  state      TEXT NOT NULL DEFAULT 'pending' CHECK (state IN ('pending','armed','superseded','consumed','discarded')),\n  created_at TEXT NOT NULL,\n  expires_at TEXT NOT NULL\n);\n\nCREATE UNIQUE INDEX IF NOT EXISTS telegram_note_draft_live\n  ON telegram_note_draft (binding, decision) WHERE state IN ('pending','armed');\n\n-- v62: the durable inbound conversation queue. An ordinary paired message\n-- becomes a row in the SAME transaction that marks its update applied, so\n-- the poll cursor never moves past text nobody holds. The row carries the\n-- exact binding, sender, update, message and the request identity the\n-- shared mate engine receipts it under; the async model turn runs OUTSIDE\n-- any transaction under a short claim, and a replay or restart finds the\n-- receipt instead of dispatching the provider again.\nCREATE TABLE IF NOT EXISTS telegram_conversation (\n  id                  INTEGER PRIMARY KEY AUTOINCREMENT,\n  binding             INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  bot_id              TEXT NOT NULL,\n  chat_id             TEXT NOT NULL,\n  user_id             TEXT NOT NULL,\n  approver            TEXT NOT NULL,\n  approver_generation INTEGER NOT NULL,\n  update_id           INTEGER NOT NULL UNIQUE,\n  message_id          TEXT NOT NULL,\n  reply_to            TEXT,\n  request             TEXT NOT NULL UNIQUE,\n  text                TEXT NOT NULL,\n  context             TEXT,\n  task_id             TEXT,\n  source_run          INTEGER,\n  state               TEXT NOT NULL CHECK (state IN ('queued','running','done','failed')),\n  claim_owner         TEXT,\n  claim_expires_at    TEXT,\n  attempts            INTEGER NOT NULL DEFAULT 0,\n  next_attempt_at     TEXT,\n  session             INTEGER,\n  turn                INTEGER,\n  outcome             TEXT,\n  reply_message_id    TEXT,\n  created_at          TEXT NOT NULL,\n  started_at          TEXT,\n  finished_at         TEXT\n);\nCREATE INDEX IF NOT EXISTS telegram_conversation_queue ON telegram_conversation (bot_id, state, id);\n\n-- v62: opaque one-tap tokens for the lead's proposal cards, the same shape\n-- as telegram_action for decisions: callback_data carries only the token,\n-- and what a tap MEANS (which binding, which proposal, which phase) lives\n-- here. Consumed exactly once; an irreversible answer arms a yes/cancel\n-- pair first, exactly as a decision button does.\nCREATE TABLE IF NOT EXISTS telegram_proposal_action (\n  token       TEXT PRIMARY KEY,\n  binding     INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  proposal    INTEGER NOT NULL REFERENCES lead_proposal(id) ON DELETE CASCADE,\n  phase       TEXT NOT NULL CHECK (phase IN ('confirm','dismiss','yes','cancel')),\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT,\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT,\n  consumed_at TEXT\n);\nCREATE INDEX IF NOT EXISTS telegram_proposal_action_by_proposal ON telegram_proposal_action (proposal);\n\n-- v63: the outbound half of a conversation, durable BEFORE any send. Once\n-- the engine's turn is answered (or recovered from its receipt), the exact\n-- reply text, split into Telegram-sized parts, and one card per pending\n-- proposal are written here in one transaction; the bridge then sends\n-- them in order under the row's claim, marking a part sent only when\n-- Telegram confirmed a message id. A crash, an outage, a rate limit or a\n-- restart resumes from the first unsent part \u2014 never another model call,\n-- proposal, task or revision. A card's buttons are minted with the part,\n-- so a resend carries the same tokens. A part whose network answer was\n-- lost is counted as uncertain: a resend may duplicate it, and the row\n-- says so instead of claiming an exactly-once Telegram cannot provide.\n-- v64: an 'image' part is one verified screenshot of one exact result,\n-- named by typed columns \u2014 task, run, artifact and the hash its record\n-- carried when the part was planned \u2014 never by JSON inside text or a\n-- keyboard, and never by bytes: every send re-reads the artifact from the\n-- evidence root and re-verifies it against these columns first. Its text\n-- is the short caption. A confirmed image message binds replies to that\n-- exact task and run, exactly as an outbox fact's message does.\nCREATE TABLE IF NOT EXISTS telegram_conversation_part (\n  conversation    INTEGER NOT NULL REFERENCES telegram_conversation(id) ON DELETE CASCADE,\n  ordinal         INTEGER NOT NULL,\n  kind            TEXT NOT NULL CHECK (kind IN ('reply','card','image')),\n  text            TEXT NOT NULL,\n  reply_to        TEXT,\n  proposal        INTEGER REFERENCES lead_proposal(id) ON DELETE SET NULL,\n  keyboard_json   TEXT,\n  state           TEXT NOT NULL CHECK (state IN ('pending','sent','dropped')),\n  message_id      TEXT,\n  attempts        INTEGER NOT NULL DEFAULT 0,\n  uncertain       INTEGER NOT NULL DEFAULT 0,\n  next_attempt_at TEXT,\n  last_error      TEXT,\n  created_at      TEXT NOT NULL,\n  sent_at         TEXT,\n  task_id         TEXT,\n  source_run      INTEGER REFERENCES run(id),\n  artifact        INTEGER,\n  sha256          TEXT,\n  PRIMARY KEY (conversation, ordinal),\n  CHECK ((state = 'sent') = (message_id IS NOT NULL)),\n  CHECK ((state = 'sent') = (sent_at IS NOT NULL)),\n  CHECK ((kind = 'image') = (task_id IS NOT NULL AND source_run IS NOT NULL AND artifact IS NOT NULL AND sha256 IS NOT NULL))\n);\n\n\n-- The bridge's poll lease and cursor, per bot. One live poller at a time;\n-- the cursor only ever moves forward, and only under a live generation.\nCREATE TABLE IF NOT EXISTS bridge_lease (\n  bot_id       TEXT PRIMARY KEY,\n  owner        TEXT NOT NULL,\n  generation   INTEGER NOT NULL,\n  cursor       INTEGER NOT NULL DEFAULT 0,\n  expires_at   TEXT NOT NULL,\n  heartbeat_at TEXT NOT NULL,\n  push_url     TEXT,\n  push_at      TEXT,\n  push_problem TEXT\n);\n-- v98: updates Telegram pushed to /hooks/telegram, kept until the bridge\n-- applies them (in update order, through the same door as polled ones).\nCREATE TABLE IF NOT EXISTS telegram_inbox (\n  update_id    INTEGER PRIMARY KEY,\n  bot_id       TEXT NOT NULL,\n  payload      TEXT NOT NULL,\n  received_at  TEXT NOT NULL\n);\n\n\nCREATE TABLE IF NOT EXISTS telegram_flow_confirm (\n  token       TEXT PRIMARY KEY,\n  binding     INTEGER NOT NULL,\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT NOT NULL,\n  card        INTEGER NOT NULL,\n  entry       INTEGER NOT NULL,\n  phase       TEXT NOT NULL CHECK (phase IN ('yes','cancel')),\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT\n);\nCREATE INDEX IF NOT EXISTS telegram_flow_confirm_visit ON telegram_flow_confirm (card, entry);\n";
 /** Telegram's 21 old tables and the bridge's lease, children first. */
 export declare const LEGACY_TELEGRAM_TABLES: readonly ["telegram_note_draft", "telegram_decision_message", "telegram_task_message", "telegram_outbound_message", "telegram_action", "telegram_proposal_action", "telegram_flow_action", "telegram_flow_confirm", "telegram_flow_choice", "telegram_flow_prompt", "telegram_question_action", "telegram_question_prompt", "telegram_conversation_part", "telegram_conversation", "telegram_team_chat", "telegram_pairing", "telegram_update", "telegram_inbox", "telegram_retry", "telegram_digest", "telegram_binding", "bridge_lease"];
 /** Whether this database already keeps its chats in the shared tables (v116 ran, or it was made at v116 or later). */

package/dist/chat-migration.js

@@ -25,7 +25,7 @@ CREATE TABLE IF NOT EXISTS chat_event (
  kind TEXT NOT NULL CHECK(kind IN ('message','action','pair','notice')),
  channel TEXT NOT NULL, member TEXT NOT NULL, ts TEXT NOT NULL, thread TEXT NOT NULL,
  payload TEXT NOT NULL, created TEXT NOT NULL,
- session INTEGER REFERENCES mate_session(id), state TEXT NOT NULL DEFAULT 'queued' CHECK(state IN ('queued','done','dropped')),
+ session INTEGER REFERENCES lead_session(id), state TEXT NOT NULL DEFAULT 'queued' CHECK(state IN ('queued','done','dropped')),
  next_at TEXT, problem TEXT
 );
 CREATE INDEX IF NOT EXISTS chat_pending_event ON chat_event(installation,state,next_at);
@@ -38,7 +38,7 @@ CREATE TABLE IF NOT EXISTS chat_part (
 );
 CREATE TABLE IF NOT EXISTS chat_action (
  token TEXT PRIMARY KEY, part INTEGER NOT NULL REFERENCES chat_part(id),
- proposal INTEGER NOT NULL REFERENCES mate_proposal(id), phase TEXT NOT NULL CHECK(phase IN ('confirm','dismiss','yes','cancel')),
+ proposal INTEGER NOT NULL REFERENCES lead_proposal(id), phase TEXT NOT NULL CHECK(phase IN ('confirm','dismiss','yes','cancel')),
  expires TEXT NOT NULL, consumed TEXT
 );
 CREATE TABLE IF NOT EXISTS chat_progress (
@@ -105,19 +105,19 @@ CREATE TABLE IF NOT EXISTS chat_flow_note (
 );
 CREATE INDEX IF NOT EXISTS chat_flow_note_visit ON chat_flow_note(card, entry);
 `;
-/** v93: a teammate's question in the chat app. One button per option (choice)
+/** v93: a subagent's question in the chat app. One button per option (choice)
  * and one to answer in words (choice NULL); that one opens a prompt the
  * person's next message in their DM answers. Never in CHAT_TABLES: an older
  * database has no such tables until this schema creates them. */
 const LEGACY_APP_QUESTION_SCHEMA = `
 CREATE TABLE IF NOT EXISTS chat_question_action (
  token TEXT PRIMARY KEY, part INTEGER NOT NULL REFERENCES chat_part(id),
- question INTEGER NOT NULL REFERENCES teammate_question(id), choice TEXT, expires TEXT NOT NULL, consumed TEXT
+ question INTEGER NOT NULL REFERENCES subagent_question(id), choice TEXT, expires TEXT NOT NULL, consumed TEXT
 );
 CREATE INDEX IF NOT EXISTS chat_question_action_question ON chat_question_action(question);
 CREATE TABLE IF NOT EXISTS chat_question_prompt (
  id INTEGER PRIMARY KEY AUTOINCREMENT, binding INTEGER NOT NULL REFERENCES chat_binding(id),
- question INTEGER NOT NULL REFERENCES teammate_question(id), created TEXT NOT NULL, expires TEXT NOT NULL, consumed TEXT
+ question INTEGER NOT NULL REFERENCES subagent_question(id), created TEXT NOT NULL, expires TEXT NOT NULL, consumed TEXT
 );
 CREATE INDEX IF NOT EXISTS chat_question_prompt_open ON chat_question_prompt(binding, consumed);
 `;
@@ -306,13 +306,13 @@ CREATE TABLE IF NOT EXISTS telegram_flow_action (
   consumed_at TEXT
 );
 CREATE INDEX IF NOT EXISTS telegram_flow_action_visit ON telegram_flow_action (card, entry);
--- v93: a teammate's question on Telegram. One button per option (choice)
+-- v93: a subagent's question on Telegram. One button per option (choice)
 -- and one to reply in words (choice NULL), placed on the message it rides;
 -- a reply to the prompt the Reply button sends is the answer.
 CREATE TABLE IF NOT EXISTS telegram_question_action (
   token       TEXT PRIMARY KEY,
   binding     INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,
-  question    INTEGER NOT NULL REFERENCES teammate_question(id),
+  question    INTEGER NOT NULL REFERENCES subagent_question(id),
   choice      TEXT,
   chat_id     TEXT NOT NULL,
   message_id  TEXT,
@@ -324,7 +324,7 @@ CREATE TABLE IF NOT EXISTS telegram_question_prompt (
   chat_id     TEXT NOT NULL,
   message_id  TEXT NOT NULL,
   binding     INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,
-  question    INTEGER NOT NULL REFERENCES teammate_question(id),
+  question    INTEGER NOT NULL REFERENCES subagent_question(id),
   created_at  TEXT NOT NULL,
   expires_at  TEXT NOT NULL,
   consumed_at TEXT,
@@ -414,7 +414,7 @@ CREATE TABLE IF NOT EXISTS telegram_conversation (
 );
 CREATE INDEX IF NOT EXISTS telegram_conversation_queue ON telegram_conversation (bot_id, state, id);
 
--- v62: opaque one-tap tokens for the mate's proposal cards, the same shape
+-- v62: opaque one-tap tokens for the lead's proposal cards, the same shape
 -- as telegram_action for decisions: callback_data carries only the token,
 -- and what a tap MEANS (which binding, which proposal, which phase) lives
 -- here. Consumed exactly once; an irreversible answer arms a yes/cancel
@@ -422,7 +422,7 @@ CREATE INDEX IF NOT EXISTS telegram_conversation_queue ON telegram_conversation
 CREATE TABLE IF NOT EXISTS telegram_proposal_action (
   token       TEXT PRIMARY KEY,
   binding     INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,
-  proposal    INTEGER NOT NULL REFERENCES mate_proposal(id) ON DELETE CASCADE,
+  proposal    INTEGER NOT NULL REFERENCES lead_proposal(id) ON DELETE CASCADE,
   phase       TEXT NOT NULL CHECK (phase IN ('confirm','dismiss','yes','cancel')),
   chat_id     TEXT NOT NULL,
   message_id  TEXT,
@@ -456,7 +456,7 @@ CREATE TABLE IF NOT EXISTS telegram_conversation_part (
   kind            TEXT NOT NULL CHECK (kind IN ('reply','card','image')),
   text            TEXT NOT NULL,
   reply_to        TEXT,
-  proposal        INTEGER REFERENCES mate_proposal(id) ON DELETE SET NULL,
+  proposal        INTEGER REFERENCES lead_proposal(id) ON DELETE SET NULL,
   keyboard_json   TEXT,
   state           TEXT NOT NULL CHECK (state IN ('pending','sent','dropped')),
   message_id      TEXT,

package/dist/chat-rooms.js

@@ -1,6 +1,6 @@
 import { TeamLeads } from "./team-leads.js";
 import { tooLongText } from "./chat-channel.js";
-import { MATE_MESSAGE_MAX_CHARS } from "./mate.js";
+import { LEAD_MESSAGE_MAX_CHARS } from "./lead.js";
 import { phoneText } from "./telegram-status.js";
 /** `/team` lists, `/team <n>` chooses, `/team off` (or `private`) leaves.
  * The bare word works too, because Slack and Discord keep unregistered
@@ -130,7 +130,7 @@ export function applyRoomInbound(input) {
         report.ignored++;
         return true;
     }
-    if (trimmed.length > MATE_MESSAGE_MAX_CHARS) {
+    if (trimmed.length > LEAD_MESSAGE_MAX_CHARS) {
         say(tooLongText(trimmed.length));
         report.chatRefused = (report.chatRefused ?? 0) + 1;
         return true;
@@ -192,7 +192,7 @@ export function roomGrantAllowed(store, domain, backend, room) {
 export function teamDomain(store, projects) { return domainFor(store, projects); }
 /** The conversation messages a room has not received yet, oldest first. */
 export function roomMessagesAfter(store, thread, cursor, limit = 20) {
-    return store.handle.prepare(`SELECT m.id, m.role, m.text, m.turn, q.author, q.request_id, q.status FROM mate_message m
+    return store.handle.prepare(`SELECT m.id, m.role, m.text, m.turn, q.author, q.request_id, q.status FROM lead_message m
     LEFT JOIN team_message q ON q.message = m.id WHERE m.thread = ? AND m.id > ? ORDER BY m.id LIMIT ?`).all(thread, cursor, limit)
         .map(row => ({ id: Number(row["id"]), role: row["role"] === "assistant" ? "assistant" : "operator", text: String(row["text"]), turn: row["turn"] === null ? null : Number(row["turn"]),
         author: row["author"] === null || row["author"] === undefined ? null : String(row["author"]), requestId: row["request_id"] === null || row["request_id"] === undefined ? null : String(row["request_id"]), status: row["status"] === null || row["status"] === undefined ? null : String(row["status"]) }));

package/dist/chat-warmth.d.ts

@@ -1,7 +1,7 @@
 /** Small warm touches while the lead works on a chat app: once a turn will take more than a few seconds (its first tool
  * step starts), a 👍 on the owner's message and the app's typing indicator until the turn ends. Best effort only: an
  * app or permission that does not allow it is skipped silently, and nothing here can fail, delay or change the turn. */
-import type { MateProgress } from "./mate-progress.js";
+import type { LeadProgress } from "./lead-progress.js";
 export declare const WARM_EMOJI = "\uD83D\uDC4D";
 /** Telegram and Teams show typing for about five seconds, Discord for ten: refreshed inside the shorter window. */
 export declare const TYPING_REFRESH_MS = 4000;
@@ -12,7 +12,7 @@ export type WarmHooks = {
     typing?: () => Promise<unknown>;
 };
 export type WarmTurn = {
-    onProgress: (event: MateProgress) => void;
+    onProgress: (event: LeadProgress) => void;
     stop: () => void;
 };
 /** The turn's progress listener: on the first tool step, react once and keep typing shown until `stop`. */

package/dist/cli.d.ts

@@ -41,7 +41,7 @@ export type ParseResult = {
     error: string;
 };
 type Write = (line: string) => void;
-export declare const HELP = "toolroll \u2014 a control plane for unattended coding agents\n\nUsage\n  toolroll [path...]        report what is in flight\n  toolroll pulls            report what is waiting on a person\n  toolroll graph            report which work graph is already here\n  toolroll repos            list connected repositories, and how to adjust\n  toolroll repos add <path> add a project; it is in the console at once (no path: the repo you are in)\n  toolroll repos remove <path>\n                                   take it out of the console; its tasks and results stay\n  toolroll repos add-from-github <owner/name> --root <dir>\n                                   preview, then clone and connect (--yes)\n  toolroll link             put `toolroll` on your PATH\n  toolroll unlink           take it off again\n  toolroll update           update to the latest release: verified, drained, undoable\n                                   (preview first; --yes, --now, --at HH:MM, --rollback)\n  toolroll release <branch> release Toolroll itself: gate, your approval, deploy, merge, tag, publish\n                                   (resumable: rerun to continue; --help)\n  toolroll contract         the machine contract: envelope version + capabilities\n                                   (--commands dumps the declared command guide)\n  toolroll skills install --claude-code [--dir <path>]\n                                   install this binary's guides for Claude Code (preview first)\n  toolroll skills install   teach a repo's agents this queue exists (preview first)\n  toolroll skills list      the guides this exact binary serves\n  toolroll skills get <name>  print one guide (version-matched, never stale)\n  toolroll demo             a seeded throwaway sandbox \u2014 see it working in 90 seconds\n  toolroll up               app + builder for every saved project \u2014 the normal start\n  toolroll onboard          make your agent Toolroll's lead: add this repo, install its skill (--yes), offer starter flows (--starter)\n  toolroll status           running, queued, ready results, release check and plan windows\n  toolroll health           recent server latency, write waits and live streams\n  toolroll integrations     which integrations work, and what to do about the ones that don't (--json)\n  toolroll session          native coding sessions through the running service\n  toolroll connect          save a private connection to your central service\n  toolroll lead             named leads on the connected service\n  toolroll lead token       mint your lead agent's credential: its own work pings nobody\n  toolroll lead say \"<text>\"  (the lead) one short message in its person's chat\n  toolroll conversation     shared and private conversations on that service\n  toolroll chat --lead <id> --conversation <id>  central chat (use --local for local chat)\n\nOperating the queue \u2014 `toolroll task` prints the whole surface,\nand any queue command + --help prints it too\n  toolroll approver add <name>\n                               mint the credential that lets a person say yes\n  toolroll ready            what could be dispatched right now\n  toolroll check-progress <run>  current or final approved check progress\n  toolroll task wait <id> [--timeout <seconds>]\n                               wait for this attempt to finish or need a person\n  toolroll task add <title> queue work\n  toolroll task scope <id> --goal <text>\n                               state what success is; approval binds to it\n  toolroll task approve <id>\n                               the yes \u2014 nothing builds without one\n  toolroll claim <id> --runner <name>\n  toolroll heartbeat <lease> / worker release <lease> / reap\n  toolroll tick --runner <name> --token <t> --repo <path>\n                               one unattended pass over the ready set\n  toolroll flows list | show <id> | create | edit | trigger | script | card | archive\n                               set up and inspect flows (writes preview until --yes)\n  toolroll chat --as <you> --token <t>\n                               talk to the mate: one conversation across every\n                               project; it proposes, you confirm (--say \"\u2026\" for one turn)\n  toolroll serve --repo <path>  advanced: run only the console\n                               (--editor vscode with --runner: file links\n                               open in VS Code on the device you browse from)\n  toolroll watch / daemon install   advanced: run only the builder\n  toolroll reconcile        recover what the last stretch left behind\n\nWith nothing connected it reports everything it can find below the working\ndirectory. Once you connect repositories it reports those instead.\n\nOptions\n  --all         report everything discoverable, ignoring connected repos\n  --depth <n>   directory levels to descend (default: 6)\n  --hidden      include dot-directories, which are skipped by default\n  --dirty       also read each working tree for uncommitted files\n  --local       branches only: no network, no pull requests, no issues\n  --json        emit a machine-readable envelope instead of a report\n  -o <file>     also write that envelope to a file (requires --json)\n  -h, --help    show this\n\nNothing is written, installed, or configured. Every repository is read\nthrough git with --no-optional-locks, so a scan never contends for the\nindex lock with an editor you have open.\n\n--dirty is off by default because reading a working tree is unbounded\nwork: on a large or cloud-synced repo `git status` can take minutes,\nwhere listing branches takes milliseconds.\n\nlink shows what it would do and changes nothing; add --yes to apply it,\nor --to <dir> to choose where. It never uses sudo, never leaves your\nhome directory, and never touches a file it did not create.";
+export declare const HELP = "toolroll \u2014 a control plane for unattended coding agents\n\nUsage\n  toolroll [path...]        report what is in flight\n  toolroll pulls            report what is waiting on a person\n  toolroll graph            report which work graph is already here\n  toolroll repos            list connected repositories, and how to adjust\n  toolroll repos add <path> add a project; it is in the console at once (no path: the repo you are in)\n  toolroll repos remove <path>\n                                   take it out of the console; its tasks and results stay\n  toolroll repos add-from-github <owner/name> --root <dir>\n                                   preview, then clone and connect (--yes)\n  toolroll link             put `toolroll` on your PATH\n  toolroll unlink           take it off again\n  toolroll update           update to the latest release: verified, drained, undoable\n                                   (preview first; --yes, --now, --at HH:MM, --rollback)\n  toolroll release <branch> release Toolroll itself: gate, your approval, deploy, merge, tag, publish\n                                   (resumable: rerun to continue; --help)\n  toolroll contract         the machine contract: envelope version + capabilities\n                                   (--commands dumps the declared command guide)\n  toolroll skills install --claude-code [--dir <path>]\n                                   install this binary's guides for Claude Code (preview first)\n  toolroll skills install   teach a repo's agents this queue exists (preview first)\n  toolroll skills list      the guides this exact binary serves\n  toolroll skills get <name>  print one guide (version-matched, never stale)\n  toolroll demo             a seeded throwaway sandbox \u2014 see it working in 90 seconds\n  toolroll up               app + builder for every saved project \u2014 the normal start\n  toolroll onboard          make your agent Toolroll's lead: add this repo, install its skill (--yes), offer starter flows (--starter)\n  toolroll status           running, queued, ready results, release check and plan windows\n  toolroll health           recent server latency, write waits and live streams\n  toolroll integrations     which integrations work, and what to do about the ones that don't (--json)\n  toolroll lead token       mint your lead agent's credential: its own work pings nobody\n  toolroll lead say \"<text>\"  (the lead) one short message in its person's chat\n\nOperating the queue \u2014 `toolroll task` prints the whole surface,\nand any queue command + --help prints it too\n  toolroll approver add <name>\n                               mint the credential that lets a person say yes\n  toolroll ready            what could be dispatched right now\n  toolroll check-progress <run>  current or final approved check progress\n  toolroll task wait <id> [--timeout <seconds>]\n                               wait for this attempt to finish or need a person\n  toolroll task add <title> queue work\n  toolroll task scope <id> --goal <text>\n                               state what success is; approval binds to it\n  toolroll task approve <id>\n                               the yes \u2014 nothing builds without one\n  toolroll claim <id> --runner <name>\n  toolroll heartbeat <lease> / worker release <lease> / reap\n  toolroll tick --runner <name> --token <t> --repo <path>\n                               one unattended pass over the ready set\n  toolroll flows list | show <id> | create | edit | trigger | script | card | archive\n                               set up and inspect flows (writes preview until --yes)\n  toolroll chat --as <you> --token <t>\n                               talk to your lead: one conversation across every\n                               project; it proposes, you confirm (--say \"\u2026\" for one turn)\n  toolroll serve --repo <path>  advanced: run only the console\n                               (--editor vscode with --runner: file links\n                               open in VS Code on the device you browse from)\n  toolroll watch / daemon install   advanced: run only the builder\n  toolroll reconcile        recover what the last stretch left behind\n\nWith nothing connected it reports everything it can find below the working\ndirectory. Once you connect repositories it reports those instead.\n\nOptions\n  --all         report everything discoverable, ignoring connected repos\n  --depth <n>   directory levels to descend (default: 6)\n  --hidden      include dot-directories, which are skipped by default\n  --dirty       also read each working tree for uncommitted files\n  --local       branches only: no network, no pull requests, no issues\n  --json        emit a machine-readable envelope instead of a report\n  -o <file>     also write that envelope to a file (requires --json)\n  -h, --help    show this\n\nNothing is written, installed, or configured. Every repository is read\nthrough git with --no-optional-locks, so a scan never contends for the\nindex lock with an editor you have open.\n\n--dirty is off by default because reading a working tree is unbounded\nwork: on a large or cloud-synced repo `git status` can take minutes,\nwhere listing branches takes milliseconds.\n\nlink shows what it would do and changes nothing; add --yes to apply it,\nor --to <dir> to choose where. It never uses sudo, never leaves your\nhome directory, and never touches a file it did not create.";
 export declare function parseArgs(argv: readonly string[]): ParseResult;
 /** The commands that operate the queue rather than report on the world. */
 /** Every verb the CLI routes OUTSIDE runOperate. Exported (with

package/dist/cli.js

@@ -27,6 +27,7 @@ import { run as execRun } from "./exec.js";
 import { COMMAND_GUIDE, SURFACE_NOTES, SURFACE_SCHEMA_VERSION } from "./surface.js";
 import { runSessionCommand, SESSION_CLI_ACTIONS } from "./session-cli.js";
 import { maybeRunTeamCommand, TEAM_CLI_ACTIONS } from "./team-cli.js";
+import { deprecationWarning } from "./deprecations.js";
 import { maybeRunRemoteCommand } from "./remote-exec.js";
 import { runHealthCommand } from "./health-cli.js";
 import { discover, inspectAll } from "./discover.js";
@@ -73,13 +74,8 @@ Usage
   toolroll status           running, queued, ready results, release check and plan windows
   toolroll health           recent server latency, write waits and live streams
   toolroll integrations     which integrations work, and what to do about the ones that don't (--json)
-  toolroll session          native coding sessions through the running service
-  toolroll connect          save a private connection to your central service
-  toolroll lead             named leads on the connected service
   toolroll lead token       mint your lead agent's credential: its own work pings nobody
   toolroll lead say "<text>"  (the lead) one short message in its person's chat
-  toolroll conversation     shared and private conversations on that service
-  toolroll chat --lead <id> --conversation <id>  central chat (use --local for local chat)
 
 Operating the queue — \`toolroll task\` prints the whole surface,
 and any queue command + --help prints it too
@@ -101,7 +97,7 @@ and any queue command + --help prints it too
   toolroll flows list | show <id> | create | edit | trigger | script | card | archive
                                set up and inspect flows (writes preview until --yes)
   toolroll chat --as <you> --token <t>
-                               talk to the mate: one conversation across every
+                               talk to your lead: one conversation across every
                                project; it proposes, you confirm (--say "…" for one turn)
   toolroll serve --repo <path>  advanced: run only the console
                                (--editor vscode with --runner: file links
@@ -425,8 +421,11 @@ async function dispatch(argv, write, mainOptions) {
     }
     if (first === "contract")
         return runContractCommand(rest, write);
-    if (first === "session")
+    if (first === "session") {
+        // D5: native coding sessions are deprecated. They still run this release; each use says so once, on stderr.
+        (mainOptions.session?.stderr ?? (line => process.stderr.write(`${line}\n`)))(deprecationWarning(`session ${rest.find(arg => !arg.startsWith("-")) ?? ""}`.trim(), "session"));
         return runSessionCommand(rest, write, mainOptions.session);
+    }
     if (first === "demo")
         return runDemoCommand(rest, write);
     if (first === "skills")

package/dist/contracts/chat-actions.d.ts

@@ -146,35 +146,40 @@ export declare const chatActionRequestSchemas: {
     readonly flow_trigger_remove: z.ZodObject<{
         trigger: z.ZodInt;
     }, z.core.$strict>;
-    readonly teammate_create: z.ZodObject<{
+    readonly subagent_create: z.ZodObject<{
         repo: z.ZodString;
         template: z.ZodOptional<z.ZodUnknown>;
         name: z.ZodOptional<z.ZodUnknown>;
         soul: z.ZodOptional<z.ZodUnknown>;
     }, z.core.$strict>;
-    readonly teammate_soul: z.ZodObject<{
-        teammate: z.ZodInt;
+    readonly subagent_soul: z.ZodObject<{
+        subagent: z.ZodInt;
         soul: z.ZodString;
     }, z.core.$strict>;
-    readonly teammate_state: z.ZodObject<{
-        teammate: z.ZodInt;
+    readonly subagent_state: z.ZodObject<{
+        subagent: z.ZodInt;
         state: z.ZodEnum<{
             active: "active";
             paused: "paused";
             removed: "removed";
         }>;
     }, z.core.$strict>;
-    readonly teammate_note: z.ZodObject<{
-        teammate: z.ZodInt;
+    readonly subagent_note: z.ZodObject<{
+        subagent: z.ZodInt;
         note: z.ZodString;
     }, z.core.$strict>;
-    readonly teammate_answer: z.ZodObject<{
+    /** D5: the lead delegates — "ask Rosa to …" — as a card on the subagent's desk. */
+    readonly subagent_ask: z.ZodObject<{
+        subagent: z.ZodInt;
+        text: z.ZodString;
+    }, z.core.$strict>;
+    readonly subagent_answer: z.ZodObject<{
         question: z.ZodInt;
         choice: z.ZodOptional<z.ZodUnknown>;
         text: z.ZodOptional<z.ZodUnknown>;
     }, z.core.$strict>;
-    readonly teammate_tools: z.ZodObject<{
-        teammate: z.ZodInt;
+    readonly subagent_tools: z.ZodObject<{
+        subagent: z.ZodInt;
         tool: z.ZodString;
         change: z.ZodEnum<{
             grant: "grant";
@@ -187,8 +192,8 @@ export declare const chatActionRequestSchemas: {
         limitOver: z.ZodOptional<z.ZodUnknown>;
         undoWith: z.ZodOptional<z.ZodUnknown>;
     }, z.core.$strict>;
-    readonly teammate_memory: z.ZodObject<{
-        teammate: z.ZodInt;
+    readonly subagent_memory: z.ZodObject<{
+        subagent: z.ZodInt;
         memory: z.ZodInt;
         change: z.ZodEnum<{
             edit: "edit";
@@ -196,8 +201,8 @@ export declare const chatActionRequestSchemas: {
         }>;
         text: z.ZodOptional<z.ZodUnknown>;
     }, z.core.$strict>;
-    readonly teammate_routine: z.ZodObject<{
-        teammate: z.ZodInt;
+    readonly subagent_routine: z.ZodObject<{
+        subagent: z.ZodInt;
         change: z.ZodEnum<{
             add: "add";
             remove: "remove";
@@ -206,8 +211,8 @@ export declare const chatActionRequestSchemas: {
         schedule: z.ZodOptional<z.ZodUnknown>;
         text: z.ZodOptional<z.ZodUnknown>;
     }, z.core.$strict>;
-    readonly teammate_undo: z.ZodObject<{
-        teammate: z.ZodInt;
+    readonly subagent_undo: z.ZodObject<{
+        subagent: z.ZodInt;
         call: z.ZodInt;
     }, z.core.$strict>;
     readonly kit_setup: z.ZodObject<{
@@ -294,17 +299,18 @@ export declare const sharedActionSchema: z.ZodObject<{
         skill_import: "skill_import";
         skill_restore: "skill_restore";
         skill_test: "skill_test";
+        subagent_answer: "subagent_answer";
+        subagent_ask: "subagent_ask";
+        subagent_create: "subagent_create";
+        subagent_memory: "subagent_memory";
+        subagent_note: "subagent_note";
+        subagent_routine: "subagent_routine";
+        subagent_soul: "subagent_soul";
+        subagent_state: "subagent_state";
+        subagent_tools: "subagent_tools";
+        subagent_undo: "subagent_undo";
         task_cancel: "task_cancel";
         task_resume: "task_resume";
-        teammate_answer: "teammate_answer";
-        teammate_create: "teammate_create";
-        teammate_memory: "teammate_memory";
-        teammate_note: "teammate_note";
-        teammate_routine: "teammate_routine";
-        teammate_soul: "teammate_soul";
-        teammate_state: "teammate_state";
-        teammate_tools: "teammate_tools";
-        teammate_undo: "teammate_undo";
         tool_add: "tool_add";
         tool_remove: "tool_remove";
     }>;
@@ -324,5 +330,4 @@ export declare function upgradeUnversionedSharedAction(body: Record<string, unkn
 export declare const SHARED_ACTION_UPGRADES: {
     readonly 0: typeof upgradeUnversionedSharedAction;
 };
-/** Legacy readers checked only the envelope. Confirmation still prepares the request again before acting. */
-export declare function readSharedAction(input: unknown): ContractResult<SharedAction>;
+export declare function readSharedAction(given: unknown): ContractResult<SharedAction>;

package/dist/contracts/chat-actions.js

@@ -57,18 +57,20 @@ export const chatActionRequestSchemas = {
     flow_trigger_pause: z.strictObject({ trigger: id }),
     flow_trigger_resume: z.strictObject({ trigger: id }),
     flow_trigger_remove: z.strictObject({ trigger: id }),
-    teammate_create: z.strictObject({ repo: words, template: z.unknown().optional(), name: z.unknown().optional(), soul: z.unknown().optional() }),
-    teammate_soul: z.strictObject({ teammate: id, soul: words }),
-    teammate_state: z.strictObject({ teammate: id, state: z.enum(["active", "paused", "removed"]) }),
-    teammate_note: z.strictObject({ teammate: id, note: words }),
-    teammate_answer: z.strictObject({ question: id, choice: z.unknown().optional(), text: z.unknown().optional() }),
-    teammate_tools: z.strictObject({
-        teammate: id, tool: words, change: z.enum(["grant", "revoke", "rule"]), action: z.unknown().optional(), use: z.unknown().optional(),
+    subagent_create: z.strictObject({ repo: words, template: z.unknown().optional(), name: z.unknown().optional(), soul: z.unknown().optional() }),
+    subagent_soul: z.strictObject({ subagent: id, soul: words }),
+    subagent_state: z.strictObject({ subagent: id, state: z.enum(["active", "paused", "removed"]) }),
+    subagent_note: z.strictObject({ subagent: id, note: words }),
+    /** D5: the lead delegates — "ask Rosa to …" — as a card on the subagent's desk. */
+    subagent_ask: z.strictObject({ subagent: id, text: words }),
+    subagent_answer: z.strictObject({ question: id, choice: z.unknown().optional(), text: z.unknown().optional() }),
+    subagent_tools: z.strictObject({
+        subagent: id, tool: words, change: z.enum(["grant", "revoke", "rule"]), action: z.unknown().optional(), use: z.unknown().optional(),
         limitField: z.unknown().optional(), limitOver: z.unknown().optional(), undoWith: z.unknown().optional(),
     }),
-    teammate_memory: z.strictObject({ teammate: id, memory: id, change: z.enum(["edit", "forget"]), text: z.unknown().optional() }),
-    teammate_routine: z.strictObject({ teammate: id, change: z.enum(["add", "remove"]), routine: z.unknown().optional(), schedule: z.unknown().optional(), text: z.unknown().optional() }),
-    teammate_undo: z.strictObject({ teammate: id, call: id }),
+    subagent_memory: z.strictObject({ subagent: id, memory: id, change: z.enum(["edit", "forget"]), text: z.unknown().optional() }),
+    subagent_routine: z.strictObject({ subagent: id, change: z.enum(["add", "remove"]), routine: z.unknown().optional(), schedule: z.unknown().optional(), text: z.unknown().optional() }),
+    subagent_undo: z.strictObject({ subagent: id, call: id }),
     kit_setup: z.strictObject({ repo: words, kit: words }),
     decision_record: z.strictObject({ repo: words, claim: words, why: words, supersedes: id.optional(), source: words.optional() }),
     decision_retire: z.strictObject({ repo: words, decision: id, reason: words }),
@@ -120,7 +122,23 @@ const under = (prefix, issues) => issues.map(issue => {
     return { ...issue, path, line: `${path}${issue.line.slice(issue.path.length)}` };
 });
 /** Legacy readers checked only the envelope. Confirmation still prepares the request again before acting. */
-export function readSharedAction(input) {
+/**
+ * D5 (schema v117): a subagent action was a "teammate_…" one, naming its "teammate", before. A saved card reads in today's
+ * words, so a conversation's history still shows it; its stamp was made over the old words, so confirming it asks for
+ * a fresh proposal, as any card drafted before a change does.
+ */
+function legacySubagentAction(input) {
+    if (input === null || typeof input !== "object" || Array.isArray(input))
+        return input;
+    const row = input;
+    if (typeof row["operation"] !== "string" || !row["operation"].startsWith("teammate_"))
+        return input;
+    const renamed = (value) => value === null || typeof value !== "object" || Array.isArray(value) ? value
+        : Object.fromEntries(Object.entries(value).map(([key, one]) => [key === "teammate" ? "subagent" : key, one]));
+    return { ...row, operation: `subagent_${row["operation"].slice("teammate_".length)}`, request: renamed(row["request"]), ...(Object.hasOwn(row, "state") ? { state: renamed(row["state"]) } : {}) };
+}
+export function readSharedAction(given) {
+    const input = legacySubagentAction(given);
     const read = readVersioned(sharedActionSchema, input, SHARED_ACTION_UPGRADES);
     if (!read.ok)
         return read;

package/dist/contracts/chat-content.d.ts

@@ -67,7 +67,7 @@ export declare const chatContentShape: {
         entry: z.ZodInt;
         held: z.ZodString;
     }, z.core.$strict>>;
-    /** A teammate's question's buttons ride this part (v93): each option, then one to answer in words (choice null). */
+    /** A subagent's question's buttons ride this part (v93): each option, then one to answer in words (choice null). */
     question: z.ZodOptional<z.ZodObject<{
         id: z.ZodInt;
         choices: z.ZodArray<z.ZodObject<{

package/dist/contracts/chat-content.js

@@ -37,7 +37,7 @@ export const chatContentShape = {
     choose: z.strictObject({ card: id, entry: z.int(), options: z.array(z.strictObject({ choice: z.int(), label: z.string() })) }).optional(),
     /** "Use this as your note?" Yes / No about the person's message `held` (an event id), for one choice's visit. */
     note: z.strictObject({ card: id, entry: z.int(), held: z.string() }).optional(),
-    /** A teammate's question's buttons ride this part (v93): each option, then one to answer in words (choice null). */
+    /** A subagent's question's buttons ride this part (v93): each option, then one to answer in words (choice null). */
     question: z.strictObject({ id, choices: z.array(z.strictObject({ choice: z.string().nullable(), label: z.string() })) }).optional(),
     /** The lead's question to its owner rides this part: its options, then "Something else". */
     ask: z.strictObject({ turn: id, options: z.array(z.string()) }).optional(),

package/dist/contracts/chat-tables.js

@@ -55,7 +55,7 @@ CREATE INDEX IF NOT EXISTS chat_part_message ON chat_part(provider, message);
 -- A button rides its planned part, or (Telegram) the binding, chat and message it was placed on.
 CREATE TABLE IF NOT EXISTS chat_action (
  ${PROVIDER}, token TEXT NOT NULL, part INTEGER, binding INTEGER, chat TEXT, message TEXT,
- proposal INTEGER REFERENCES mate_proposal(id) ON DELETE CASCADE,
+ proposal INTEGER REFERENCES lead_proposal(id) ON DELETE CASCADE,
  decision INTEGER REFERENCES decision(id) ON DELETE CASCADE, option_id TEXT, note_digest TEXT,
  phase TEXT NOT NULL CHECK (phase IN ('confirm','dismiss','yes','cancel','choose')),
  created TEXT, expires TEXT, consumed TEXT,
@@ -135,17 +135,17 @@ CREATE TABLE IF NOT EXISTS chat_flow_note (
  FOREIGN KEY (provider, part) REFERENCES chat_part(provider, id)
 );
 CREATE INDEX IF NOT EXISTS chat_flow_note_visit ON chat_flow_note(card, entry);
--- A teammate's question: one button per option and one to answer in words (choice NULL).
+-- A subagent's question: one button per option and one to answer in words (choice NULL).
 CREATE TABLE IF NOT EXISTS chat_question_action (
  ${PROVIDER}, token TEXT NOT NULL, part INTEGER, binding INTEGER, chat TEXT, message TEXT,
- question INTEGER NOT NULL REFERENCES teammate_question(id), choice TEXT, created TEXT, expires TEXT NOT NULL, consumed TEXT,
+ question INTEGER NOT NULL REFERENCES subagent_question(id), choice TEXT, created TEXT, expires TEXT NOT NULL, consumed TEXT,
  PRIMARY KEY (provider, token),
  FOREIGN KEY (provider, part) REFERENCES chat_part(provider, id)
 );
 CREATE INDEX IF NOT EXISTS chat_question_action_question ON chat_question_action(question);
 CREATE TABLE IF NOT EXISTS chat_question_prompt (
  ${PROVIDER}, id INTEGER NOT NULL, binding INTEGER NOT NULL, chat TEXT, message TEXT,
- question INTEGER NOT NULL REFERENCES teammate_question(id), created TEXT NOT NULL, expires TEXT NOT NULL, consumed TEXT,
+ question INTEGER NOT NULL REFERENCES subagent_question(id), created TEXT NOT NULL, expires TEXT NOT NULL, consumed TEXT,
  PRIMARY KEY (provider, id)
 );
 CREATE INDEX IF NOT EXISTS chat_question_prompt_open ON chat_question_prompt(provider, binding, consumed);

package/dist/contracts/console-api.d.ts

@@ -71,7 +71,7 @@ export declare const CONSOLE_FORMS: {
     readonly skillsRevise: FormContract<"feedback" | "nonce" | "repo" | "run">;
     readonly skillsChange: FormContract<"action" | "content" | "files" | "identity" | "method" | "nonce" | "repo" | "restore" | "revision" | "sample" | "sha" | "url">;
     readonly kit: FormContract<"repo">;
-    readonly teammates: FormContract<"choice" | "dailyTurns" | "id" | "manager" | "model" | "name" | "note" | "op" | "repo" | "schedule" | "soul" | "state" | "template" | "text" | "tool" | `field.${string}` | `over.${string}` | `undo.${string}` | `use.${string}`>;
+    readonly subagents: FormContract<"choice" | "dailyTurns" | "id" | "manager" | "model" | "name" | "note" | "op" | "repo" | "schedule" | "soul" | "state" | "template" | "text" | "tool" | `field.${string}` | `over.${string}` | `undo.${string}` | `use.${string}`>;
     readonly galleryUse: FormContract<string>;
     readonly flows: FormContract<"about" | "address" | "answers" | "approve" | "body" | "choice" | "confirm" | "decision" | "definition" | "description" | "document" | "draft" | "entry" | "file" | "key" | "label" | "language" | "name" | "note" | "owner" | "password" | "previewed" | "remove" | "repo" | "revision" | "secret" | "stage" | "template" | "timeoutMinutes" | "title" | "trigger" | "url" | "value" | "watching" | `param.${string}`>;
     readonly spendBudget: FormContract<"action" | "password" | "stop" | "target" | "usd">;
@@ -140,11 +140,11 @@ export declare const CONSOLE_FORMS: {
     readonly leadAbout: FormContract<"about">;
     readonly leadPromiseCancel: FormContract<"promise">;
     readonly chatConfig: FormContract<"daily-turns" | "forget-key" | "key" | "model" | "off" | "provider" | "return" | "token" | "weekly-usd">;
-    readonly mateMint: FormContract<"ceiling-usd" | "follow" | "return" | "token">;
-    readonly mateFollow: FormContract<"enabled" | "return">;
-    readonly mateEnd: FormContract<"return">;
-    readonly mateStop: FormContract<"return" | "turn">;
-    readonly mateProposal: FormContract<"confirm" | "nonce" | "return" | "token">;
+    readonly leadMint: FormContract<"ceiling-usd" | "follow" | "return" | "token">;
+    readonly leadFollow: FormContract<"enabled" | "return">;
+    readonly leadEnd: FormContract<"return">;
+    readonly leadStop: FormContract<"return" | "turn">;
+    readonly leadProposal: FormContract<"confirm" | "nonce" | "return" | "token">;
     readonly coordinatorProposal: FormContract<"confirm" | "return">;
     readonly chat: FormContract<"message" | "mode" | "project" | "request" | "request-session" | "result" | "task" | "token">;
     readonly chatFile: FormContract<"token">;

package/dist/contracts/console-api.js

@@ -61,7 +61,7 @@ export function readForm(body, contract, report = toStderr) {
 // ---- every console form ------------------------------------------------------------------------------------------
 //
 // One per route (or per verb, where one route takes several bodies). A family whose sub-routes share one dispatch —
-// `/code/*`, `/flows/*`, the teammate pages, Slack/Teams/Discord — has one contract naming every field its handlers
+// `/code/*`, `/flows/*`, the subagent pages, Slack/Teams/Discord — has one contract naming every field its handlers
 // read. Every body also passes through `mutationGuardForm` (the shared CSRF and duplicate check, unchanged) and
 // `ledgerTargetForm` (the project a request is recorded against).
 export const CONSOLE_FORMS = {
@@ -80,7 +80,7 @@ export const CONSOLE_FORMS = {
     skillsRevise: formContract("POST /settings/skills/revise", ["run", "repo", "feedback", "nonce"]),
     skillsChange: formContract("POST /settings/skills/import, /settings/skills/change", ["repo", "identity", "revision", "method", "content", "files", "url", "action", "sha", "sample", "nonce", "restore"]),
     kit: formContract("POST /kits/<kit>/<act>", ["repo"]),
-    teammates: formContract("POST /teammates/new, /teammates/<id>/<part>, /teammates/questions/<id>/answer", ["choice", "text", "repo", "template", "name", "soul", "op", "id", "schedule", "tool", "state", "note", "model", "dailyTurns", "manager"], { prefixes: ["use.", "undo.", "field.", "over."] }),
+    subagents: formContract("POST /settings/lead/subagents/new, /settings/lead/subagents/<id>/<part>, /settings/lead/subagents/questions/<id>/answer", ["choice", "text", "repo", "template", "name", "soul", "op", "id", "schedule", "tool", "state", "note", "model", "dailyTurns", "manager"], { prefixes: ["use.", "undo.", "field.", "over."] }),
     galleryUse: formContract("POST /flows/new/<template>", ["repo", "send-result", "name", "intent", "previewed"], { dynamic: true }),
     flows: formContract("POST /flows/new, /flows/example, /flows/import, /flows/<id>/<act>, /flows/<id>/cards/<card>/<act>, /flows/<id>/triggers/<trigger>/<act>", ["repo", "document", "url", "confirm", "previewed", "template", "name", "answers", "password", "secret", "trigger", "approve", "remove", "about", "body", "timeoutMinutes", "language", "file", "address", "key", "definition", "owner", "revision", "value", "title", "description", "stage", "decision", "note", "draft", "choice", "entry", "label", "watching"], { prefixes: ["param."] }),
     spendBudget: formContract("POST /spend/budget", ["password", "target", "action", "usd", "stop"]),
@@ -149,11 +149,11 @@ export const CONSOLE_FORMS = {
     leadAbout: formContract("POST /settings/lead/about", ["about"]),
     leadPromiseCancel: formContract("POST /settings/lead/promise/cancel", ["promise"]),
     chatConfig: formContract("POST /chat/config", ["return", "token", "off", "forget-key", "provider", "model", "weekly-usd", "daily-turns", "key"]),
-    mateMint: formContract("POST /chat/mate/mint", ["return", "ceiling-usd", "token", "follow"]),
-    mateFollow: formContract("POST /chat/mate/follow", ["enabled", "return"]),
-    mateEnd: formContract("POST /chat/mate/end", ["return"]),
-    mateStop: formContract("POST /chat/mate/stop", ["return", "turn"]),
-    mateProposal: formContract("POST /chat/proposal/<id>/confirm|dismiss", ["return", "nonce", "confirm", "token"]),
+    leadMint: formContract("POST /chat/mate/mint", ["return", "ceiling-usd", "token", "follow"]),
+    leadFollow: formContract("POST /chat/mate/follow", ["enabled", "return"]),
+    leadEnd: formContract("POST /chat/mate/end", ["return"]),
+    leadStop: formContract("POST /chat/mate/stop", ["return", "turn"]),
+    leadProposal: formContract("POST /chat/proposal/<id>/confirm|dismiss", ["return", "nonce", "confirm", "token"]),
     coordinatorProposal: formContract("POST /proposals/<id>/confirm|dismiss", ["return", "confirm"]),
     chat: formContract("POST /chat", ["task", "project", "result", "mode", "request", "request-session", "message", "token"]),
     chatFile: formContract("POST /chat/file/<id>", ["token"]),