toolroll 0.9.58 → 0.9.59

package/dist/planner-source.js

@@ -38,6 +38,8 @@
 import { createHash } from "node:crypto";
 import { EVIDENCE_CAPS, readVerifiedArtifact } from "./evidence.js";
 import { TEXT_LIMITS } from "./text-limits.js";
+import { PLAN_TOUCHES } from "./contracts/plan.js";
+import { contractChangesOf } from "./contract-changes.js";
 export const PLANNER_SOURCE_VERSION = 1;
 export const PLANNER_SOURCE_LIMITS = {
     /** The whole recorded source before lossless prompt fencing. Equal to
@@ -48,6 +50,9 @@ export const PLANNER_SOURCE_LIMITS = {
     amendment: TEXT_LIMITS.planAmendment,
     /** Earlier answers quoted into the brief. */
     answers: 5,
+    /** Terms that exceed the entire handoff cap cannot fit regardless of the plan's size. Do not reserve a maximum-
+     * sized plan here: a shorter document can carry larger valid terms. The final payload still enforces its byte cap. */
+    handoffTerms: TEXT_LIMITS.planPayloadBytes,
 };
 /** Stable JSON for hashing and equality only — no filling, no trimming. */
 export function canonicalContractJson(value) {
@@ -192,26 +197,55 @@ export function plannerSourceOf(store, root, taskId, answers) {
                 `(scope ${scopeBytes}, revision brief ${briefBytes}); nothing is trimmed silently — shorten the scope or brief, then plan again`,
         };
     }
+    const handoff = source.contract.scope === null ? null : plannerHandoffProblemOf(source.contract.scope);
+    if (handoff !== null)
+        return { ok: false, reason: "too-long", message: handoff };
     return { ok: true, source, bytes };
 }
 /**
  * The dispatch diagnosis's read of the same gate, from the store alone:
  * why the next pass would refuse to plan this task before spending — the
- * revision brief unreadable, or the filed request over the byte cap. The
- * size is a floor (the brief's stored bytes, before JSON quoting), so a
- * "yes" here is certain and the dispatch refusal itself stays the exact
- * word. Null when nothing here stands in the way.
+ * revision brief unreadable, the filed request over the byte cap, or terms
+ * the planner's handoff cannot carry. The size is a floor (the brief's
+ * stored bytes, before JSON quoting), so a "yes" here is certain and the
+ * dispatch refusal itself stays the exact word. Null when nothing here
+ * stands in the way.
  */
 export function plannerSourceProblemOf(store, taskId) {
+    const filed = (detail) => ({ title: "The filed request cannot be planned as filed", detail });
     if (store.answeredDecisionsFor(taskId, PLANNER_SOURCE_LIMITS.answers + 1).length > PLANNER_SOURCE_LIMITS.answers)
-        return `more than ${PLANNER_SOURCE_LIMITS.answers} answered decisions exceed the planner history bound; file a follow-up task with the consolidated decisions`;
+        return filed(`more than ${PLANNER_SOURCE_LIMITS.answers} answered decisions exceed the planner history bound; file a follow-up task with the consolidated decisions`);
     const contract = plannerContractOf(store, taskId);
     if (!contract.ok)
-        return contract.message;
+        return filed(contract.message);
     const briefBytes = contract.contract.revision === null ? 0 : (store.getArtifact(contract.contract.revision.briefArtifact)?.bytesStored ?? 0);
     const floor = Buffer.byteLength(JSON.stringify(contract.contract, null, 2), "utf8") + briefBytes;
     if (floor > PLANNER_SOURCE_LIMITS.bytes) {
-        return `the filed request is at least ${floor} bytes — over the ${PLANNER_SOURCE_LIMITS.bytes}-byte planner source cap; shorten the scope or brief before planning`;
+        return filed(`the filed request is at least ${floor} bytes — over the ${PLANNER_SOURCE_LIMITS.bytes}-byte planner source cap; shorten the scope or brief before planning`);
+    }
+    const handoff = contract.contract.scope === null ? null : plannerHandoffProblemOf(contract.contract.scope);
+    return handoff === null ? null : { title: "Scope too long to plan", detail: handoff };
+}
+/**
+ * Whether the planner can hand the filed terms back (contracts/plan.ts): it must reproduce the goal, exclusions,
+ * touches and criteria in its handoff, so terms its handoff cannot carry would end every attempt as a malformed plan.
+ * This names the problem before any workspace, run or provider spend instead: the actual size, the limit, and what to
+ * shorten. Null when the terms fit.
+ */
+export function plannerHandoffProblemOf(terms) {
+    const n = (value) => value.toLocaleString("en-US");
+    for (const [label, is, text] of [["goal", "is", terms.goal], ["exclusions", "are", terms.outOfScope ?? ""]]) {
+        if (text.length > TEXT_LIMITS.goal)
+            return `The ${label} ${is} ${n(text.length)} characters; the planner can carry at most ${n(TEXT_LIMITS.goal)}. Shorten the ${label} and planning starts again.`;
+    }
+    if (terms.touches.length > PLAN_TOUCHES)
+        return `The scope lists ${n(terms.touches.length)} paths; the planner can carry at most ${PLAN_TOUCHES}. List fewer paths and planning starts again.`;
+    const path = terms.touches.find(one => one.length > TEXT_LIMITS.planTouch);
+    if (path !== undefined)
+        return `A path is ${n(path.length)} characters; the planner can carry at most ${n(TEXT_LIMITS.planTouch)}. Shorten it and planning starts again.`;
+    const bytes = Buffer.byteLength(JSON.stringify({ goal: terms.goal, outOfScope: terms.outOfScope, touches: terms.touches, acceptance: terms.acceptance }), "utf8");
+    if (bytes > PLANNER_SOURCE_LIMITS.handoffTerms) {
+        return `The goal, exclusions, paths and criteria are ${n(bytes)} bytes together; the planner can carry at most ${n(PLANNER_SOURCE_LIMITS.handoffTerms)} bytes in its whole handoff. Shorten the scope and planning starts again.`;
     }
     return null;
 }
@@ -257,67 +291,8 @@ export function decodePlannerSource(content) {
         return null;
     }
 }
-const trimmed = (text) => {
-    if (text === null)
-        return null;
-    const t = text.trim();
-    return t === "" ? null : t;
-};
-/**
- * Every addition, change, and removal between the filed contract and a
- * proposed one. Whitespace at the ends and touch/evidence order do not
- * count (the scope digest ignores them too); everything else does,
- * including the advisory `how`, because the operator wrote it.
- */
-export function contractChangesOf(filed, proposed) {
-    const changes = [];
-    if (filed.goal.trim() !== proposed.goal.trim()) {
-        changes.push({ field: "goal", kind: "changed", before: filed.goal, after: proposed.goal });
-    }
-    const filedOut = trimmed(filed.outOfScope);
-    const proposedOut = trimmed(proposed.outOfScope);
-    if (filedOut !== proposedOut) {
-        changes.push({
-            field: "outOfScope",
-            kind: filedOut === null ? "added" : proposedOut === null ? "removed" : "changed",
-            before: filed.outOfScope,
-            after: proposed.outOfScope,
-        });
-    }
-    const filedTouches = new Set(filed.touches.map(one => one.trim()).filter(one => one !== ""));
-    const proposedTouches = new Set(proposed.touches.map(one => one.trim()).filter(one => one !== ""));
-    for (const path of filedTouches)
-        if (!proposedTouches.has(path))
-            changes.push({ field: "touches", kind: "removed", path });
-    for (const path of proposedTouches)
-        if (!filedTouches.has(path))
-            changes.push({ field: "touches", kind: "added", path });
-    const criterionOf = (one) => ({ statement: one.statement, evidence: [...one.evidence].sort(), how: one.how });
-    const filedById = new Map(filed.acceptance.map(one => [one.id, one]));
-    const proposedById = new Map(proposed.acceptance.map(one => [one.id, one]));
-    for (const [id, before] of filedById) {
-        const after = proposedById.get(id);
-        if (after === undefined) {
-            changes.push({ field: "acceptance", kind: "removed", id, before: criterionOf(before), after: null, moved: [] });
-            continue;
-        }
-        const moved = [];
-        if (before.statement.trim() !== after.statement.trim())
-            moved.push("statement");
-        if ([...before.evidence].sort().join(",") !== [...after.evidence].sort().join(","))
-            moved.push("evidence");
-        if (trimmed(before.how) !== trimmed(after.how))
-            moved.push("how");
-        if (moved.length > 0) {
-            changes.push({ field: "acceptance", kind: "changed", id, before: criterionOf(before), after: criterionOf(after), moved });
-        }
-    }
-    for (const [id, after] of proposedById) {
-        if (!filedById.has(id))
-            changes.push({ field: "acceptance", kind: "added", id, before: null, after: criterionOf(after), moved: [] });
-    }
-    return changes;
-}
+// ---- amendments -----------------------------------------------------------
+export { contractChangesOf } from "./contract-changes.js";
 const clip = (text, max) => (text.length > max ? `${text.slice(0, max - 1)}…` : text);
 /** One line per change, for terminals, notifications, and validation messages. */
 export function describeContractChanges(changes) {

package/dist/release-gate.d.ts

@@ -1,8 +1,7 @@
 /**
  * `toolroll release --release-gate <id>`: lift one update pause that a browser deployment (scripts/deploy-browser.mjs)
- * left behind when it stopped before the swap and its own recovery could not tell. The typical case is a deployment
- * killed between installing the pause and journaling that it had: the journal still says `preparing`, so
- * `--phase recover` leaves the pause alone, and new work stays paused.
+ * left behind when it stopped before the swap and its own exit recovery never ran. The typical case is a deployment
+ * killed outright (SIGKILL, a crash or power loss) while paused: nothing lifted the pause, and new work stays paused.
  *
  * The id alone proves nothing, and neither does the journal's phase. The pause is lifted only when every piece of
  * evidence agrees that the service was never swapped:

package/dist/release-gate.js

@@ -1,8 +1,7 @@
 /**
  * `toolroll release --release-gate <id>`: lift one update pause that a browser deployment (scripts/deploy-browser.mjs)
- * left behind when it stopped before the swap and its own recovery could not tell. The typical case is a deployment
- * killed between installing the pause and journaling that it had: the journal still says `preparing`, so
- * `--phase recover` leaves the pause alone, and new work stays paused.
+ * left behind when it stopped before the swap and its own exit recovery never ran. The typical case is a deployment
+ * killed outright (SIGKILL, a crash or power loss) while paused: nothing lifted the pause, and new work stays paused.
  *
  * The id alone proves nothing, and neither does the journal's phase. The pause is lifted only when every piece of
  * evidence agrees that the service was never swapped:
@@ -23,6 +22,7 @@ import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { durableJson } from "./desktop-update.js";
 import { removeUpdateGate, updateGateOwned } from "./desktop-update-gate.js";
+import { acquireDeploymentLock } from "./deploy-lock.js";
 /** The journal phases a deployment passes before it stops the old service (deploy-phases.mjs). */
 export const BEFORE_SWAP = Object.freeze(["preparing", "admission-paused", "frozen", "backup-verified", "rehearsed"]);
 /** Journal fields that only the swap and later phases write. */
@@ -129,22 +129,50 @@ export function proveBeforeSwap(id, world) {
 }
 /** Prove, then (with `yes`) lift exactly that pause and journal the release in the deployment's own journal. */
 export function releaseGate(id, world, yes) {
-    const proved = proveBeforeSwap(id, world);
-    if (!proved.ok)
-        return proved;
+    // Discovery is not authority to remove anything. Dry-run remains read-only, even for legacy stages.
+    const discovered = proveBeforeSwap(id, world);
+    if (!discovered.ok)
+        return discovered;
     if (!yes)
-        return { ok: true, released: false, id, stage: proved.stage, proof: proved.proof };
-    const db = world.open();
-    // removeUpdateGate checks the owner again inside its own write: a pause that changed hands is not touched.
+        return { ok: true, released: false, id, stage: discovered.stage, proof: discovered.proof };
+    const journalFile = join(discovered.stage, "deployment.json");
+    let lock;
     try {
-        removeUpdateGate(db, id);
+        lock = acquireDeploymentLock(journalFile);
+    }
+    catch (error) {
+        return refuse("deploying", error.message);
+    }
+    try {
+        const proved = proveBeforeSwap(id, world);
+        if (!proved.ok)
+            return proved;
+        if (proved.stage !== discovered.stage)
+            return refuse("conflict", "The deployment stage changed during release.");
+        const db = world.open();
+        try {
+            // Repeat the entire proof at the mutation boundary, under the same exclusion as deploy/resume/recover.
+            const fresh = proveBeforeSwap(id, world);
+            if (!fresh.ok)
+                return fresh;
+            if (fresh.stage !== proved.stage || JSON.stringify(fresh.journal) !== JSON.stringify(proved.journal) ||
+                JSON.stringify(JSON.parse(readFileSync(journalFile, "utf8"))) !== JSON.stringify(fresh.journal)) {
+                return refuse("conflict", "The deployment journal changed during release.");
+            }
+            lock.assertHeld(journalFile);
+            // The owner is checked again within removeUpdateGate's short write transaction.
+            removeUpdateGate(db, id);
+            durableJson(journalFile, {
+                ...fresh.journal, phase: "released", updatedAt: world.now().toISOString(),
+                releasedBeforeSwap: { at: world.now().toISOString(), by: "toolroll release --release-gate", from: fresh.journal.phase, proof: fresh.proof },
+            });
+            return { ok: true, released: true, id, stage: fresh.stage, proof: fresh.proof };
+        }
+        finally {
+            db.close();
+        }
     }
     finally {
-        db.close();
+        lock.release();
     }
-    durableJson(join(proved.stage, "deployment.json"), {
-        ...proved.journal, phase: "released", updatedAt: world.now().toISOString(),
-        releasedBeforeSwap: { at: world.now().toISOString(), by: "toolroll release --release-gate", from: proved.journal.phase, proof: proved.proof },
-    });
-    return { ok: true, released: true, id, stage: proved.stage, proof: proved.proof };
 }

package/dist/scope.js

@@ -2,6 +2,7 @@
 export { ACCEPTANCE_LIMITS, EVIDENCE_KINDS } from "./contracts/acceptance-terms.js";
 import { currentPasswordSource, passwordGuardOf, provenPasswordAccount } from "./sign-in-guard.js";
 import { validateScopeText } from "./task-text.js";
+import { contractChangesOf } from "./contract-changes.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { projectAuthority } from "./project-access.js";
 import { activeRemote } from "./remote-run.js";
@@ -558,6 +559,19 @@ route) {
         .slice(0, 32);
 }
 export function propose(store, input) {
+    return store.transact(() => {
+        const previous = store.getScope(input.taskId);
+        const saved = proposeLocked(store, input);
+        // A rewritten goal, exclusions, touches or rubric on a task that is planning starts its planning again (v119), in
+        // the same transaction: the next planner plans for the new terms, never from the old plan or its answers. An
+        // identical refile changes nothing; the planner's own handoff writes its draft without coming through here.
+        const ref = store.lookupRef(input.taskId);
+        if (ref !== null && ref.plan !== null && (previous === null || contractChangesOf(previous, saved).length > 0))
+            store.restartPlanning(ref.id, input.now);
+        return saved;
+    });
+}
+function proposeLocked(store, input) {
     const { taskId, goal, outOfScope = null, touches = [], budgetMicrousd = null, acceptance = [], qualityMode = "default", now, mutation = {}, profile, permissionMode, posture, proposedVia = null } = input;
     const draft = { goal, outOfScope, touches: [...touches], budgetMicrousd, acceptance: [...acceptance], qualityMode, candidate: input.candidate ?? null };
     const previous = store.getScope(taskId);

package/dist/server/render-chat.js

@@ -2,6 +2,7 @@
 import { assignmentSummaryHtml } from "../assignment-ui.js";
 import {} from "../assignment.js";
 import {} from "../browser-workspace.js";
+import { closedQuestionReason } from "../decision.js";
 import { CHAT_ACTIONS, sharedActionNeedsReview, sharedActionPayload, sharedActionReviewPath } from "../chat-actions.js";
 import { CHAT_CONTINUITY_SCRIPT } from "../chat-continuity.js";
 import { CHAT_CONTROLS, chatControlHref, isChatControl } from "../chat-controls.js";
@@ -478,6 +479,15 @@ export function proposalCardParts(view, inert, decision, returnTo = null) {
     const text = (key) => (typeof payload[key] === "string" ? payload[key] : "");
     const task = text("task");
     const repoId = text("repoId");
+    if (view.kind === "answer" && decision?.supersededReason != null) {
+        // The proposal remains in history, but its question no longer needs an answer.
+        // Both the server page and browser card use the same closed view, without stale consent controls.
+        const body = html `<p><a href="/d/${decision.id}">${decision.question}</a></p><p class="meta">${closedQuestionReason(decision.supersededReason)}</p>`;
+        return {
+            html: html `<article class="card proposal proposal-answer" data-card-kind="answer"><header class="proposal-head"><strong>Question closed</strong></header><div class="proposal-body">${body}</div></article>`,
+            card: { id: view.id, kind: view.kind, label: "Question closed", state: view.state, body: htmlString(body), said: null, links: [], primary: null, dismissable: false, note: null },
+        };
+    }
     const presentations = {
         task: { label: payload["report"] === true ? "Scout investigation" : "New task", action: "file task", icon: html `<path d="M12 5v14"/><path d="M5 12h14"/>` },
         next: { label: "Queue priority", action: "move to front", icon: html `<path d="M12 19V5"/><path d="m5 12 7-7 7 7"/>` },

package/dist/server/render-tasks.js

@@ -1,5 +1,6 @@
 /** Task pages: approval, agents, plans, controls, decisions and the task body. */
 import { html, htmlString, joinHtml, postForm, replaceMarkup } from "../html.js";
+import { closedQuestionReason, closedQuestionWords } from "../decision.js";
 import {} from "../activity-line.js";
 import {} from "../agentconfig.js";
 import { gateWords } from "../approval-policy.js";
@@ -1469,9 +1470,12 @@ export function taskBodyParts(data) {
         !(data.revision != null && "problem" in data.revision) && scope.profileState !== "unresolved" && consentDoorOf(scope, data.route).open;
     const planCard = data.planDocument === null
         ? data.plan === "requested"
-            ? data.revision != null && !("problem" in data.revision)
-                ? html `<div class="card planner-status"><span class="planner-orb" aria-hidden="true"></span><p><strong>Updating the plan</strong><span class="meta">Adding your notes to the plan. You approve any change before it builds.</span></p></div>`
-                : html `<div class="card planner-status"><span class="planner-orb" aria-hidden="true"></span><p><strong>Planning requested</strong><span class="meta">${data.planAuto ? "Automatic approval is enabled for a verified plan that preserves your filed contract. Amendments and unanswered questions still pause." : "The agent is inspecting the repository and drafting the goal, acceptance criteria, and approach. It will ask only if a missing answer changes the work."}</span></p></div>`
+            // A request the planner cannot be given waits on a person; the status card above already says what to shorten.
+            ? data.dispatch?.code === "planner-source"
+                ? ""
+                : data.revision != null && !("problem" in data.revision)
+                    ? html `<div class="card planner-status"><span class="planner-orb" aria-hidden="true"></span><p><strong>Updating the plan</strong><span class="meta">Adding your notes to the plan. You approve any change before it builds.</span></p></div>`
+                    : html `<div class="card planner-status"><span class="planner-orb" aria-hidden="true"></span><p><strong>Planning requested</strong><span class="meta">${data.planAuto ? "Automatic approval is enabled for a verified plan that preserves your filed contract. Amendments and unanswered questions still pause." : "The agent is inspecting the repository and drafting the goal, acceptance criteria, and approach. It will ask only if a missing answer changes the work."}</span></p></div>`
             : ""
         : joinHtml([
             approval.approved ? html `<details class="card planner-plan planner-plan-collapsed"><summary class="execution-plan-head">` : html `<section class="card planner-plan"><div class="execution-plan-head">`,
@@ -1788,7 +1792,7 @@ export function taskBodyParts(data) {
     })();
     const decisions = data.decisions.length === 0
         ? ""
-        : html `<h2>Decisions</h2>${joinHtml(data.decisions.map(decision => html `<p class="row"><a href="/d/${decision.id}">${decision.question}</a> <span class="meta">${decision.state}${isOverdue(decision, data.now) ? " · overdue" : ""}</span></p>`), "\n")}`;
+        : html `<h2>Decisions</h2>${joinHtml(data.decisions.map(decision => html `<p class="row"><a href="/d/${decision.id}">${decision.question}</a> <span class="meta">${decision.supersededReason !== null ? closedQuestionWords(decision.supersededReason) : decision.state}${isOverdue(decision, data.now) ? " · overdue" : ""}</span></p>`), "\n")}`;
     const incidents = data.incidents.length === 0
         ? ""
         : html `<h2>Incidents</h2>${joinHtml(data.incidents.map(one => one.resolvedAt === null
@@ -2068,7 +2072,11 @@ export function taskBodyParts(data) {
             continue;
         thread.push({ key: `question-${decision.id}`, at: decision.createdAt, kind: "question", who: "agent", author: "", title: "Asked",
             text: decision.question, link: { label: "Question", href: `/d/${decision.id}` }, html: "", more: null });
-        if (decision.answeredAt !== null) {
+        if (decision.supersededReason !== null) {
+            thread.push({ key: `answer-${decision.id}`, at: decision.answeredAt ?? decision.createdAt, kind: "progress", who: "agent", author: "", title: "Closed without an answer",
+                text: closedQuestionReason(decision.supersededReason), link: null, html: "", more: null });
+        }
+        else if (decision.answeredAt !== null) {
             const chosen = decision.options.find(one => one.id === decision.choice)?.label ?? decision.choice;
             thread.push({ key: `answer-${decision.id}`, at: decision.answeredAt, kind: "reply", who: "person", author: decision.answeredBy ?? "You", title: "Answered",
                 text: [chosen, decision.note].filter((one) => one !== null && one !== "").join(" — ") || null, link: null, html: "", more: null });
@@ -2320,9 +2328,11 @@ export function decisionOptionForms(decision, returnTo) {
 }
 export function decisionPage(chrome, decision, taskId, artifacts, who, now, returnTo = null) {
     const options = decisionOptionForms(decision, returnTo);
-    const answered = decision.state === "answered"
-        ? html `<div class="answered">Answered: <strong>${decision.choice ?? ""}</strong> by ${decision.answeredBy ?? ""}${decision.note === null ? "" : ` — ${decision.note}`}</div>`
-        : "";
+    const answered = decision.supersededReason !== null
+        ? html `<p class="meta">${closedQuestionReason(decision.supersededReason)}</p>`
+        : decision.state === "answered"
+            ? html `<div class="answered">Answered: <strong>${decision.choice ?? ""}</strong> by ${decision.answeredBy ?? ""}${decision.note === null ? "" : ` — ${decision.note}`}</div>`
+            : "";
     const evidence = artifacts.length === 0
         ? ""
         : joinHtml([
@@ -2331,7 +2341,7 @@ export function decisionPage(chrome, decision, taskId, artifacts, who, now, retu
             html `</div>`,
         ]);
     return screen(`decide · ${taskId}`, joinHtml([
-        html `<h1>${taskId} <span class="badge badge-${decision.state}">${decision.state}</span>${isOverdue(decision, now) ? html ` <span class="badge badge-overdue">Overdue</span>` : ""}${decision.deadline === null ? "" : html ` <span class="meta">deadline ${decision.deadline}</span>`}</h1>`,
+        html `<h1>${taskId} <span class="badge badge-${decision.state}">${decision.supersededReason !== null ? "closed" : decision.state}</span>${isOverdue(decision, now) ? html ` <span class="badge badge-overdue">Overdue</span>` : ""}${decision.deadline === null ? "" : html ` <span class="meta">deadline ${decision.deadline}</span>`}</h1>`,
         html `<div class="recap">${decision.recap}</div>`,
         html `<div class="question">${decision.question}</div>`,
         decision.state === "answered" ? answered : options,

package/dist/server/tasks.js

@@ -1,4 +1,5 @@
 import { handlersOf } from './handler-registry.js';
+import { closedQuestionWords } from "../decision.js";
 import { DEPRECATED_PAGE } from "../deprecations.js";
 /** tasks handlers, moved without changing their route bodies. */
 import { html, htmlString, joinHtml, postForm, textHtml } from "../html.js";
@@ -1118,7 +1119,8 @@ export function createTasksHandlers(runtime) {
         }, now);
         if (!answered.ok) {
             const status = answered.reason === "bad-option" || answered.reason === "bad-note" ? 400 : 409;
-            const why = answered.reason === "already-answered" ? "already answered — somebody got there first" : answered.reason;
+            const closed = answered.reason === "closed" ? store.getDecision(id)?.supersededReason ?? null : null;
+            const why = closed !== null ? closedQuestionWords(closed) : answered.reason === "already-answered" ? "already answered — somebody got there first" : answered.reason;
             return refuse(response, who, status, why, requestedReturn === null ? `/d/${id}` : decisionBack);
         }
         return redirect(response, decisionBack);

package/dist/store.d.ts

@@ -152,7 +152,7 @@ export type SealedLedgerEntry = LedgerEntry & {
         hash: string;
     } | null;
 };
-export declare const SCHEMA_VERSION = 118;
+export declare const SCHEMA_VERSION = 119;
 /** v118: the tables merged into `credential`, in the order they move (a person's API tokens keep their ids first). */
 export declare const V118_MERGED_TABLES: Readonly<Record<string, CredentialKind>>;
 /**
@@ -207,9 +207,16 @@ export declare const V115_DROPPED_TABLES: readonly string[];
  * teammates' to its subagents' (SQLite's RENAME, every row, id and link carried), renames their teammate column, and rewrites four internal kinds from 'teammate' to 'subagent' in place; the rehearsal checks
  * each renamed table's rows arrived under its new name. v118 (D7) is checked the same way: every row of api_token,
  * coordinator_credential and lead_credential moves into credential under its kind in one transaction that counts them
- * before the old tables drop, and the references that named them name credential in place, their rows untouched.
+ * before the old tables drop, and the references that named them name credential in place, their rows untouched. v119 only adds four columns
+ * (planning_generation on task_ref, run and plan_revision, defaulting to 0, and decision.superseded_reason, null);
+ * the rehearsal checks every saved row reads the declared default (HISTORY_RULES' added columns).
  */
 export declare const UPDATE_SAFE_MIGRATIONS: readonly number[];
+/** v119: the columns it adds, by table, with the value every row saved before it reads (toolroll-update's HISTORY_RULES). */
+export declare const V119_ADDED_COLUMNS: Readonly<Record<string, Readonly<Record<string, {
+    definition: string;
+    saved: string;
+}>>>>;
 /** Whether a database settled at `version` reaches this build's schema through update-safe migrations alone. */
 export declare function updateSafeSchema(version: number | null): boolean;
 export type OAuthClientRow = {
@@ -330,6 +337,9 @@ export type TaskRef = {
     plan: "requested" | "drafted" | null;
     /** Planning failures, counted apart from build strikes by design. */
     planStrikes: number;
+    /** v119: which planning context is active. A rewritten scope advances it; plans, revisions and answers from an
+     * earlier generation stay as history, never as the next planner's context. */
+    planningGeneration: number;
     /** What comes back (v34): a branch to publish, or a report to read.
      * Set at filing and never rewritten — a scout's strikes are the task's. */
     deliverable: "branch" | "report";
@@ -1050,6 +1060,8 @@ export type Run = {
     taskRef: number;
     leaseId: string;
     runner: string;
+    /** v119: the task's planning generation when this run opened (0 for every run before it). */
+    planningGeneration: number;
     /** Explicit watch ownership for claimless review runs; null on cron/legacy reviews. */
     watchIncarnation?: string | null;
     /** v50: a ROOT reviewer's attempt ordinal for its source run (1..3);
@@ -1194,7 +1206,12 @@ export type Decision = {
     answeredVia: "cli" | "web" | "telegram" | "slack" | "discord" | "teams" | null;
     choice: string | null;
     note: string | null;
+    /** v119: closed without an answer (state 'answered', no choice) because its task's scope changed or the task was
+     * cancelled. null is every real answer and every question still waiting. */
+    supersededReason: DecisionClosure | null;
 };
+/** Why a question closed without an answer (v119). */
+export type DecisionClosure = "scope-changed" | "cancelled";
 /** Evidence, by reference. `key` is relative to the evidence root, never absolute. */
 export type Artifact = {
     id: number;
@@ -3446,6 +3463,24 @@ export declare class Store {
         ok: false;
         reason: "live-claim";
     };
+    /**
+     * A rewritten scope starts planning again (v119), in one transaction: the task's planning generation advances, a
+     * requested or drafted plan becomes requested with no strikes, and what the old goal produced leaves the active
+     * planning context — its open questions close (typed 'scope-changed', never a fake answer, their holds and pages
+     * with them) and a revision still waiting for a person is rejected with its hold. The old runs, plans, revisions,
+     * answers and ledger rows all stay: generation-bound reads simply stop offering them to the next planner. Only a
+     * task already planning restarts; false (nothing changed) for any other.
+     */
+    restartPlanning(taskRef: number, now: Date): boolean;
+    /**
+     * Close a task's open and expired questions without answering them (v119): typed with why, no choice, their
+     * holds lifted and their pages resolved, so they leave every decision queue. Answered questions are never touched.
+     * `belowGeneration` limits it to questions asked in earlier planning generations. Caller holds the transaction.
+     */
+    private closeQuestionsLocked;
+    /** The number the next plan revision of a task takes: one past every revision it ever had, in any planning
+     * generation, so a restarted plan's revisions never collide with the history they follow. */
+    nextPlanRevisionNumber(taskRef: number): number;
     /** Move the planning state; null clears it. Caller owns the transaction story. */
     setPlanState(taskRef: number, state: "requested" | "drafted" | null): void;
     addPlanStrike(taskRef: number): number;
@@ -4475,7 +4510,8 @@ export declare class Store {
      * reads in the order the questions arrived. "unanswered" is open + expired:
      * expiry makes a decision louder, never gone.
      */
-    /** The newest planner run's plan document for a task, when one exists. */
+    /** The newest planner run's plan document for a task, when one exists in its current planning generation (v119:
+     * a plan drafted for a scope since rewritten is history, read by its artifact id). */
     latestPlanArtifact(taskRef: number): Artifact | null;
     /** The newest plan-contract INGESTION record on one of this task's
      * planner runs (contract handoff, task 1): what the draft proposed
@@ -4508,8 +4544,9 @@ export declare class Store {
         changedFields: readonly string[];
         status: PlanRevisionStatus;
     }, now: Date): number;
-    /** Every revision for a task, newest first — the immutable history a
-     * reader can show without a second table. */
+    /** Every revision for a task in its current planning generation, newest
+     * first — the immutable history a reader can show without a second table
+     * (v119: an earlier generation's rows stay, read by id). */
     listPlanRevisions(taskRef: number): PlanRevision[];
     /** The current plan revision: the newest row an operator (or an
      * auto-applied plan-only proposal) has actually put in force. Null for
@@ -4566,7 +4603,8 @@ export declare class Store {
     checkpointHistory(run: number): RunCheckpoint[];
     /** The newest scout run's report for a task (v34), when one exists. */
     latestReportArtifact(taskRef: number): Artifact | null;
-    /** Answered questions for one task, newest first — the planner's memory. */
+    /** Answered questions for one task, newest first — the planner's memory. Only real answers from its current
+     * planning generation (v119): a question closed unanswered, or asked about a scope since rewritten, is history. */
     answeredDecisionsFor(taskId: string, limit?: number): {
         question: string;
         choice: string | null;
@@ -4668,7 +4706,7 @@ export declare class Store {
         duplicate?: boolean;
     } | {
         ok: false;
-        reason: "unknown-decision" | "bad-option" | "already-answered" | "bad-note";
+        reason: "unknown-decision" | "bad-option" | "already-answered" | "closed" | "bad-note";
     };
     /**
      * The answer's body, for callers already holding the transaction — the
@@ -4689,7 +4727,7 @@ export declare class Store {
         duplicate?: boolean;
     } | {
         ok: false;
-        reason: "unknown-decision" | "bad-option" | "already-answered" | "bad-note";
+        reason: "unknown-decision" | "bad-option" | "already-answered" | "closed" | "bad-note";
     };
     saveArtifact(artifact: {
         run: number;