toolroll 0.9.6 → 0.9.8

package/dist/store.js

@@ -8,6 +8,7 @@ import { MEMORY_SCHEMA } from "./project-memory.js";
 import { MODELS_SCHEMA } from "./model-catalog.js";
 import { validateTaskText } from "./task-text.js";
 import { chatControlHref, chatResultHref } from "./chat-controls.js";
+import { actorLabel, currentActor, leadSecretMatches, mintLeadToken, parseLeadToken } from "./actor.js";
 import { scanForSecrets } from "./evidence.js";
 /**
  * The database: a small task store, and the operational overlay beside it.
@@ -58,6 +59,7 @@ import { modeDigestOf, modeTermsFromJson } from "./modes.js";
 import { readVerifiedArtifact } from "./evidence.js";
 import { isProviderId } from "./provider.js";
 import { authenticate as runnerAuthenticate } from "./runner.js";
+import { stampNewProjectLevel } from "./check-levels.js";
 import { parseCheckProgressSnapshot } from "./check-progress.js";
 import { normalizeProjectAccess, projectAccessAllows, readProjectAccess } from "./project-access.js";
 import { LEDGER_SCHEMA, LEDGER_TABLE, LEDGER_V54_COLUMNS, LEDGER_V54_TABLE, installLedgerTriggers } from "./action-ledger.js";
@@ -65,8 +67,9 @@ import { PLAN_AUTO_SCHEMA } from "./plan-auto.js";
 import { RECIPE_SCHEMA } from "./recipes.js";
 import { POLICY_SCHEMA, agentRefusal, approvalRefusal, attendedRefusal, policyParts, readPolicy, underCeiling, sessionCeilingRefusal } from "./policy.js";
 import { PROVIDER_AUTH_SCHEMA } from "./provider-auth.js";
+import { REVIEW_SCHEMA, reviewSwitchWords } from "./review-switch.js";
 import { SPEND_SCHEMA, billingOf, budgetStates, canPrice, claudeMachineBilling, countsToward, filersOf, monthOf, priceWork, seenBilling as seenBillingOf, spendItems, teammateFilers, usd } from "./spend.js";
-import { FOREVER, RETENTION_SCHEMA, periodWords } from "./retention.js";
+import { DEFAULT_PERIODS, RETENTION_SCHEMA, periodWords, widenRetentionSchema } from "./retention.js";
 import { CHECKOUT_CLEANUP_SCHEMA, DEFAULT_CLEANUP, cleanupWords } from "./storage.js";
 import { IN_RANGE, LEDGER_CHAIN_SCHEMA, safeWhole, sealLedger, verifyLedgerChain } from "./ledger-chain.js";
 import { NO_RULES, filerFor, isProtectedWork, protectedChanges, rulesWords } from "./approval-policy.js";
@@ -164,6 +167,54 @@ CREATE TABLE IF NOT EXISTS chat_card_task (
 );
 CREATE INDEX IF NOT EXISTS chat_card_task_card ON chat_card_task(card);
 `;
+/** Pings follow responsibility (no version bump: additive only). `lead_credential` is a lead token: an agent acting
+ * for `owner`, only its hash kept. `task_act` is who filed, approved, cancelled, completed or handed on a task
+ * (`lead` 1: the owner's lead; `person`/`why`: who the lead asked, and why). `notification_actor` is whose act made
+ * a fact. `task_replacement` is the task that replaced a cancelled one. `project_mute` is a person's muted projects. */
+const LEAD_QUIET_SCHEMA = `
+CREATE TABLE IF NOT EXISTS lead_credential (
+  id          TEXT PRIMARY KEY,
+  owner       TEXT NOT NULL,
+  secret_hash TEXT NOT NULL,
+  created_at  TEXT NOT NULL,
+  created_by  TEXT NOT NULL,
+  revoked_at  TEXT,
+  revoked_by  TEXT
+);
+CREATE INDEX IF NOT EXISTS lead_credential_owner ON lead_credential (owner);
+CREATE TABLE IF NOT EXISTS task_act (
+  id       INTEGER PRIMARY KEY AUTOINCREMENT,
+  task_ref INTEGER NOT NULL,
+  act      TEXT NOT NULL CHECK (act IN ('filed', 'approved', 'cancelled', 'completed', 'asked')),
+  account  TEXT NOT NULL,
+  lead     INTEGER NOT NULL DEFAULT 0 CHECK (lead IN (0, 1)),
+  person   TEXT,
+  why      TEXT,
+  at       TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS task_act_task ON task_act (task_ref, id);
+CREATE TABLE IF NOT EXISTS notification_actor (
+  notification INTEGER PRIMARY KEY REFERENCES notification(id) ON DELETE CASCADE,
+  account      TEXT NOT NULL,
+  lead         INTEGER NOT NULL DEFAULT 0 CHECK (lead IN (0, 1))
+);
+CREATE TABLE IF NOT EXISTS task_replacement (
+  task_ref  INTEGER PRIMARY KEY,
+  successor TEXT NOT NULL,
+  by        TEXT,
+  at        TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS project_mute (
+  account TEXT NOT NULL,
+  repo    TEXT NOT NULL,
+  at      TEXT NOT NULL,
+  PRIMARY KEY (account, repo)
+);
+`;
+/** What still pings on the lead's own work: a security alert. */
+const SECURITY_KINDS = new Set(["secret-detected", "security-release"]);
+/** A failure that leaves nothing for the lead to try: the attempts are spent. */
+const SPENT_KINDS = new Set(["attempts-exhausted", "plan-attempts-exhausted"]);
 /** Settings → Integrations (no version bump): each integration's last check. `outcome` is ok, failed, or absent (the check found
  * nothing set up, such as no `gh` sign-in). `ok_at` and `error`/`error_at` keep the last success and the last
  * failure across checks, so a row can say both. `account` is a display name only, never a credential. */
@@ -450,7 +501,8 @@ function readFlowRow(row) {
 function readFlowScriptRow(row) {
     return { id: Number(row["id"]), repo: String(row["repo"]), name: String(row["name"]), about: String(row["about"]), body: String(row["body"]), timeoutMinutes: Number(row["timeout_minutes"]),
         version: Number(row["version"]), digest: String(row["digest"]), savedBy: String(row["saved_by"]), savedAt: String(row["saved_at"]),
-        language: row["language"] === "python" || row["language"] === "node" ? row["language"] : "shell", file: row["file"] === null || row["file"] === undefined ? null : String(row["file"]) };
+        language: row["language"] === "python" || row["language"] === "node" ? row["language"] : "shell", file: row["file"] === null || row["file"] === undefined ? null : String(row["file"]),
+        held: row["held"] === null || row["held"] === undefined ? null : String(row["held"]) };
 }
 function readFlowStepRunRow(row) {
     const optional = (key) => row[key] === null || row[key] === undefined ? null : String(row[key]);
@@ -3750,13 +3802,17 @@ function initializeStore(db, file) {
     db.exec(PROVIDER_AUTH_SCHEMA);
     // The sign-in pause the dispatch gate last left this task waiting on (null: none), for the work index.
     addColumn(db, "task_ref", "auth_wait_pause", "INTEGER REFERENCES provider_auth_pause(id)");
+    db.exec(REVIEW_SCHEMA);
     db.exec(RETENTION_SCHEMA);
+    // 1-day evidence: an older file's retention_setting only allowed 7 days or more (no version bump: its rows carry over).
+    widenRetentionSchema(db);
     db.exec(CHECKOUT_CLEANUP_SCHEMA);
     db.exec(BACKUP_SCHEMA);
     // Sprint 8: the organisation policy (one row, or none: nothing restricted).
     db.exec(POLICY_SCHEMA);
     db.exec(RUN_CHECK_SCHEMA);
     db.exec(QUIET_CHAT_SCHEMA);
+    db.exec(LEAD_QUIET_SCHEMA);
     mergeCheckTables(db);
     addColumn(db, "monitoring_status", "target", "TEXT");
     // v105: how a teammate's turn was billed (this computer's Claude sign-in, as last seen).
@@ -3778,6 +3834,8 @@ function initializeStore(db, file) {
     // v90: scripts in Python and Node, and scripts that run a file in the project.
     addColumn(db, "flow_script", "language", "TEXT NOT NULL DEFAULT 'shell'");
     addColumn(db, "flow_script", "file", "TEXT");
+    // A script that came in with an imported flow waits for a person to approve it before it runs (no version bump: additive only).
+    addColumn(db, "flow_script", "held", "TEXT");
     addColumn(db, "notification", "recipient", "TEXT");
     addColumn(db, "approver", "projects_json", "TEXT");
     addColumn(db, "invite", "projects_json", "TEXT");
@@ -6942,6 +7000,8 @@ export class Store {
             const earlier = this.db.prepare("SELECT 1 AS hit FROM task_ref WHERE external_id = ?").get(spec.id) !== undefined;
             // Created here, so it is ours — the one place that is true by construction.
             const ref = this.refFor(BUILT_IN, spec.id, "ours");
+            // Who filed it, when someone is acting: the lead's work pings nobody.
+            this.noteTaskAct(ref.id, "filed", now);
             if (earlier)
                 this.recordAction({ at: stamp, actor: "system", repo: ref.repo, taskId: spec.id, runId: null, action: "task registered", outcome: "recorded", source: "work", detail: REGISTERED_AT_FILING });
             // v102: who filed it, set once with the filing (separation of duties reads it; nothing changes it).
@@ -7006,10 +7066,10 @@ export class Store {
      * they admit from (`null` = any). It returns raw changes; callers keep
      * their own refusal words and wake bumps.
      */
-    applyCancellation(taskId, reason, now, admittedFrom) {
-        return this.transact(() => this.applyCancellationLocked(taskId, reason, now, admittedFrom));
+    applyCancellation(taskId, reason, now, admittedFrom, replacedBy) {
+        return this.transact(() => this.applyCancellationLocked(taskId, reason, now, admittedFrom, replacedBy));
     }
-    applyCancellationLocked(taskId, reason, now, admittedFrom) {
+    applyCancellationLocked(taskId, reason, now, admittedFrom, replacedBy) {
         const ref = this.db
             .prepare("SELECT id, coordinator_cid FROM task_ref WHERE backend = ? AND external_id = ?")
             .get(BUILT_IN, taskId);
@@ -7035,6 +7095,14 @@ export class Store {
             .run(now.toISOString(), taskId, ...(admittedFrom ?? []));
         if (Number(changes) === 0)
             return { changed: false };
+        // Replaced: the successor is part of the cancellation, so every surface says "Replaced by <id>".
+        if (ref !== undefined && replacedBy !== undefined) {
+            this.db.prepare(`INSERT INTO task_replacement (task_ref, successor, by, at) VALUES (?, ?, ?, ?)
+        ON CONFLICT (task_ref) DO UPDATE SET successor = excluded.successor, by = excluded.by, at = excluded.at`)
+                .run(Number(ref["id"]), replacedBy, currentActor() === null ? null : actorLabel(currentActor()), now.toISOString());
+        }
+        if (ref !== undefined && prior?.["state"] !== "cancelled")
+            this.noteTaskAct(Number(ref["id"]), "cancelled", now);
         // A cancelled task's pending steering settles superseded in the SAME
         // transaction, whichever road cancelled it — a note silently waiting
         // for a build that can no longer happen is wrong on every road, not
@@ -7058,18 +7126,20 @@ export class Store {
         if (ref !== undefined && prior?.["state"] !== "cancelled") {
             this.noteLifecycle({
                 taskRef: Number(ref["id"]), kind: "task-cancelled", identity: `t${Number(ref["id"])}`,
-                subject: "Cancelled",
-                body: reason.kind === "operator"
-                    ? `${cancellationWords(reason.text)} Nothing more runs for it.`
-                    : reason.code === "mirror-latched"
-                        ? "The tracker closed it. Nothing more runs for it."
-                        : "The tracker closed it while it was being built, so the finished work was not accepted.",
-                link: chatControlHref("task", taskId),
+                subject: replacedBy === undefined ? "Cancelled" : `Replaced by ${replacedBy}`,
+                body: replacedBy !== undefined
+                    ? `${replacedBy} replaces it. Nothing more runs for it.`
+                    : reason.kind === "operator"
+                        ? `${cancellationWords(reason.text)} Nothing more runs for it.`
+                        : reason.code === "mirror-latched"
+                            ? "The tracker closed it. Nothing more runs for it."
+                            : "The tracker closed it while it was being built, so the finished work was not accepted.",
+                link: chatControlHref("task", replacedBy ?? taskId),
             }, now);
         }
         return { changed: true };
     }
-    setTaskState(id, state, now, mutation = {}, cancellationReason) {
+    setTaskState(id, state, now, mutation = {}, cancellationReason, replacedBy) {
         return this.once(mutation, "setTaskState", () => {
             // The terminal guard lives IN the primitive so every present and
             // future caller is covered (external dispatch, finding 23): a
@@ -7085,7 +7155,7 @@ export class Store {
             }
             return this.transact(() => {
                 if (state === "cancelled") {
-                    const done = this.applyCancellation(id, { kind: "operator", text: cancellationReason ?? null }, now, null);
+                    const done = this.applyCancellation(id, { kind: "operator", text: cancellationReason ?? null }, now, null, replacedBy);
                     if (done.reason !== undefined)
                         return { ok: false, reason: done.reason };
                     if (!done.changed)
@@ -7099,6 +7169,11 @@ export class Store {
                     .run(state, now.toISOString(), id);
                 if (Number(changes) === 0)
                     return { ok: false, reason: "unknown-task" };
+                if (state === "done" && prior?.["state"] !== "done") {
+                    const done = this.lookupRef(id);
+                    if (done !== null)
+                        this.noteTaskAct(done.id, "completed", now);
+                }
                 // The return-to-queue fact (Telegram task updates): a running
                 // task its worker released unfinished, or a closed one reopened
                 // by the state verb. Marking done or failed by hand rides the
@@ -8475,6 +8550,8 @@ export class Store {
                 // (setup review): the approval is what was stale, and it is new.
                 const ref = this.db.prepare("SELECT id FROM task_ref WHERE backend = ? AND external_id = ?").get(BUILT_IN, taskId);
                 if (ref !== undefined) {
+                    if (basis === undefined)
+                        this.noteTaskAct(Number(ref["id"]), "approved", now);
                     this.db.prepare("DELETE FROM hold WHERE owner_kind = 'backoff' AND owner_id = ?").run(`stale:${Number(ref["id"])}`);
                     this.db
                         .prepare("UPDATE notification SET resolved_at = ? WHERE dedupe_key LIKE ? AND resolved_at IS NULL")
@@ -8488,7 +8565,7 @@ export class Store {
                             taskRef: Number(ref["id"]), kind: "scope-approved", identity: `t${Number(ref["id"])}`,
                             subject: "Scope approved",
                             body: basis === undefined
-                                ? `Approved by ${lifecycleWords(by, 40)}. A connected worker can take it next.`
+                                ? `Approved by ${currentActor()?.lead === true ? "the lead" : lifecycleWords(by, 40)}. A connected worker can take it next.`
                                 : "Approved automatically under the operating mode. A connected worker can take it next.",
                             link: chatControlHref("task", taskId),
                         }, now);
@@ -9260,6 +9337,27 @@ export class Store {
             return;
         this.recordAction({ at: now.toISOString(), actor: by, repo, taskId: null, runId: null, action, outcome, source: "policy", detail: `${before} → ${after}` });
     }
+    /** The project's automatic review switch: its explicit setting, else on
+     * while a hands-off mode is active on it, else off. */
+    reviewSwitch(repo, now) {
+        const row = this.db.prepare("SELECT enabled, changed_by, changed_at FROM review_switch WHERE repo = ?").get(repo);
+        if (row !== undefined)
+            return { on: Number(row["enabled"]) === 1, source: "project", changedBy: String(row["changed_by"]), changedAt: String(row["changed_at"]) };
+        const handsOff = this.activeMode(repo, now)?.name === "hands-off";
+        return { on: handsOff, source: handsOff ? "hands-off" : "default", changedBy: null, changedAt: null };
+    }
+    /** Turn a project's automatic review on or off; the policy log keeps before → after. */
+    setReviewSwitch(repo, on, by, now) {
+        return this.transact(() => {
+            const before = this.reviewSwitch(repo, now);
+            this.db.prepare(`INSERT INTO review_switch (repo, enabled, changed_by, changed_at) VALUES (?, ?, ?, ?)
+        ON CONFLICT(repo) DO UPDATE SET enabled = excluded.enabled, changed_by = excluded.changed_by, changed_at = excluded.changed_at`)
+                .run(repo, on ? 1 : 0, by, now.toISOString());
+            const after = this.reviewSwitch(repo, now);
+            this.recordPolicy(by, repo, "automatic review", reviewSwitchWords(before), reviewSwitchWords(after), now);
+            return { before, after };
+        });
+    }
     /** A project deleted (project-delete.ts): who, and what it held → how it went. Returns the entry's id. */
     recordProjectDeleted(by, repo, held, how, now) {
         this.recordPolicy(by, repo, "project deleted", held, how, now, "deleted");
@@ -14928,10 +15026,15 @@ export class Store {
             : source !== undefined && "project" in source && source.project !== "" ? "project"
                 : source !== undefined && "installation" in source ? "installation" : "unknown";
         const project = scope === "task" ? String(ref["repo"]) : scope === "project" && source !== undefined && "project" in source ? source.project : null;
-        const { changes } = this.db
+        const { changes, lastInsertRowid } = this.db
             .prepare(`INSERT OR IGNORE INTO notification (dedupe_key, kind, subject, body, created_at, push_class, link, provenance_scope, project, task_ref, task_id, source_run, recipient)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
             .run(notification.dedupeKey, notification.kind, notification.subject, notification.body, now.toISOString(), notification.pushClass ?? null, notification.link ?? null, scope, project, ref === undefined ? null : taskRef, ref === undefined ? null : String(ref["external_id"]), run?.id ?? null, notification.recipient ?? null);
+        // Whose act made this fact: pings follow it (see pingAllowed).
+        const actor = currentActor();
+        if (Number(changes) > 0 && actor !== null) {
+            this.db.prepare("INSERT OR IGNORE INTO notification_actor (notification, account, lead) VALUES (?, ?, ?)").run(Number(lastInsertRowid), actor.account, actor.lead ? 1 : 0);
+        }
         return Number(changes) > 0;
     }
     /**
@@ -16275,13 +16378,17 @@ export class Store {
         });
     }
     // ---- Retention (v105) -----------------------------------------------------
-    /** How long each kind of data is kept; null is forever (every kind, until someone chooses). */
+    /** How long each kind of data is kept; null is forever. A kind nobody chose keeps its default (evidence 28 days, the rest forever). */
     retentionPeriods() {
-        const periods = { ...FOREVER };
+        return { ...DEFAULT_PERIODS, ...this.retentionChosen() };
+    }
+    /** The periods someone chose: only kinds with a saved row. */
+    retentionChosen() {
+        const chosen = {};
         for (const row of this.db.prepare("SELECT kind, days FROM retention_setting").all()) {
-            periods[String(row["kind"])] = row["days"] === null ? null : Number(row["days"]);
+            chosen[String(row["kind"])] = row["days"] === null ? null : Number(row["days"]);
         }
-        return periods;
+        return chosen;
     }
     /** Set how long one kind is kept (null: forever); the ledger keeps before → after. */
     setRetentionPeriod(kind, days, by, now) {
@@ -19161,11 +19268,16 @@ export class Store {
             const version = (current?.version ?? Number(this.db.prepare("SELECT COALESCE(MAX(version), 0) AS v FROM flow_script WHERE repo = ? AND name = ?").get(script.repo, script.name)?.["v"] ?? 0)) + 1;
             if (current !== null)
                 this.db.prepare("UPDATE flow_script SET state = 'removed' WHERE id = ?").run(current.id);
-            this.db.prepare(`INSERT INTO flow_script (repo, name, about, body, timeout_minutes, version, digest, saved_by, saved_at, state, language, file)
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'active', ?, ?)`).run(script.repo, script.name, script.about, script.body, script.timeoutMinutes, version, script.digest, script.by, now.toISOString(), script.language ?? "shell", script.file ?? null);
+            this.db.prepare(`INSERT INTO flow_script (repo, name, about, body, timeout_minutes, version, digest, saved_by, saved_at, state, language, file, held)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'active', ?, ?, ?)`).run(script.repo, script.name, script.about, script.body, script.timeoutMinutes, version, script.digest, script.by, now.toISOString(), script.language ?? "shell", script.file ?? null, script.held ?? null);
             return version;
         });
     }
+    /** A person approves a held script (one an imported flow brought): from now on it runs. False when it wasn't held. */
+    approveFlowScript(repo, name) {
+        const { changes } = this.db.prepare("UPDATE flow_script SET held = NULL WHERE repo = ? AND name = ? AND state = 'active' AND held IS NOT NULL").run(repo, name);
+        return Number(changes) === 1;
+    }
     removeFlowScript(repo, name) {
         const { changes } = this.db.prepare("UPDATE flow_script SET state = 'removed' WHERE repo = ? AND name = ? AND state = 'active'").run(repo, name);
         return Number(changes) === 1;
@@ -19819,12 +19931,18 @@ export class Store {
         return this.db.prepare("SELECT * FROM chat_turn WHERE mate_turn = ? ORDER BY id ASC").all(mateTurn).map(readChatTurn);
     }
     // ---- projects ------------------------------------------------------------
-    /** Remember a project was opened. Upsert keeps added_at; recency always moves. */
+    /** Remember a project was opened. Upsert keeps added_at; recency always moves.
+     * A project added for the first time starts on Quick checks. */
     upsertProject(path, name, now) {
-        this.db
-            .prepare(`INSERT INTO project (path, name, added_at, last_opened_at) VALUES (?, ?, ?, ?)
-         ON CONFLICT (path) DO UPDATE SET name = excluded.name, last_opened_at = excluded.last_opened_at`)
-            .run(path, name, now.toISOString(), now.toISOString());
+        this.transact(() => {
+            const added = this.db.prepare("SELECT 1 FROM project WHERE path = ?").get(path) === undefined;
+            this.db
+                .prepare(`INSERT INTO project (path, name, added_at, last_opened_at) VALUES (?, ?, ?, ?)
+           ON CONFLICT (path) DO UPDATE SET name = excluded.name, last_opened_at = excluded.last_opened_at`)
+                .run(path, name, now.toISOString(), now.toISOString());
+            if (added)
+                stampNewProjectLevel(this, path, now);
+        });
     }
     /** Most recently opened first — the opener page's order. */
     listProjects() {
@@ -20971,6 +21089,108 @@ export class Store {
         this.db.prepare("UPDATE run_process SET exited_at = ? WHERE id = ? AND pid IS NULL AND ((containment IS NULL AND container IS NULL) OR container_empty_at IS NOT NULL)")
             .run(now.toISOString(), witness);
     }
+    /** The reconcile road for a pid-less witness a crash or a thrown spawn
+     * left behind: once its run has finished, no live child is tracked for it
+     * here, every other witness of the run has exited and none of the run's
+     * process groups is alive, it settles as never started, with a ledger
+     * entry. A sole pid-less witness has no group to prove gone and stays for
+     * `run settle`. Native witnesses keep their OS-only road. */
+    settleUnspawnedWitnesses(now) {
+        const candidates = this.db.prepare(`SELECT DISTINCT p.run FROM run_process p JOIN run r ON r.id = p.run
+      WHERE p.exited_at IS NULL AND p.pid IS NULL AND p.containment IS NULL AND p.container IS NULL
+        AND p.host = ? AND r.outcome IS NOT NULL AND r.finished_at IS NOT NULL ORDER BY p.run`).all(hostname());
+        let settled = 0;
+        for (const candidate of candidates) {
+            const runId = Number(candidate["run"]);
+            this.recordRunProcessExits(runId, now);
+            settled += this.transact(() => {
+                const run = this.getRun(runId);
+                if (run === null || run.outcome === null)
+                    return 0;
+                if (ownedProcessCount(runOwnerTag(this, runId)) > 0)
+                    return 0;
+                const held = this.heldSessionOf(runId);
+                if (held !== null && held.endedAt === null)
+                    return 0;
+                const rows = this.db.prepare("SELECT * FROM run_process WHERE run = ? ORDER BY id").all(runId);
+                const pidless = rows.filter(row => row["exited_at"] === null && row["pid"] === null && row["containment"] === null && row["container"] === null && row["host"] === hostname());
+                const others = rows.filter(row => !pidless.includes(row));
+                if (pidless.length === 0 || others.length === 0)
+                    return 0;
+                if (others.some(row => row["exited_at"] === null))
+                    return 0;
+                // Exit was recorded once; the group's members are asked again now.
+                const groups = others.filter(row => row["pid"] !== null && row["host"] === hostname());
+                if (groups.length === 0 || groups.some(row => processMayBeAlive(Number(row["pid"]), row["process_group"] === 1, { observedAt: row["observed_at"], finishedAt: run.finishedAt })))
+                    return 0;
+                const ref = this.refById(run.taskRef);
+                let count = 0;
+                for (const row of pidless) {
+                    const changed = this.db.prepare(`UPDATE run_process SET exited_at = ?
+            WHERE id = ? AND run = ? AND pid IS NULL AND exited_at IS NULL AND containment IS NULL AND container IS NULL`)
+                        .run(now.toISOString(), row["id"], runId);
+                    if (Number(changed.changes) !== 1)
+                        continue;
+                    count++;
+                    this.recordAction({ at: now.toISOString(), actor: "system", repo: ref?.repo ?? null, taskId: ref?.externalId ?? null, runId,
+                        action: "process witness settled", outcome: "never started", source: "work",
+                        detail: `witness ${String(row["id"])}: no pid; the run finished, every other witness exited and none of its process groups is alive` });
+                }
+                return count;
+            });
+        }
+        return settled;
+    }
+    /** `run settle` (an approver's last resort): every witness of a finished
+     * run that cannot be proven either way is recorded settled under the
+     * approver's reason, in the ledger. Refuses while anything of the run is
+     * alive or could be checked only from another host. Never signals. */
+    settleRunWitnessesByApprover(args, now) {
+        return this.transact(() => {
+            const run = this.getRun(args.runId);
+            if (run === null)
+                return { ok: false, reason: "unknown-run", detail: `no run #${args.runId}` };
+            if (run.outcome === null)
+                return { ok: false, reason: "still-running", detail: `run #${args.runId} is still open` };
+            const alive = (detail) => ({ ok: false, reason: "alive", detail });
+            if (ownedProcessCount(runOwnerTag(this, args.runId)) > 0)
+                return alive(`run #${args.runId} still has an owned subprocess`);
+            const held = this.heldSessionOf(args.runId);
+            if (held !== null && held.endedAt === null)
+                return alive(`run #${args.runId}'s held supervisor has not finished shutdown`);
+            const rows = this.db.prepare("SELECT * FROM run_process WHERE run = ? ORDER BY id").all(args.runId);
+            const open = rows.filter(row => row["exited_at"] === null);
+            for (const row of rows) {
+                if (row["pid"] === null)
+                    continue;
+                if (row["host"] !== hostname()) {
+                    if (row["exited_at"] === null)
+                        return alive(`run #${args.runId}'s process ${String(row["pid"])} belongs to ${String(row["host"])}; settle it there`);
+                    continue;
+                }
+                if (processMayBeAlive(Number(row["pid"]), row["process_group"] === 1, { observedAt: row["observed_at"], finishedAt: run.finishedAt }))
+                    return alive(`run #${args.runId}'s process ${String(row["pid"])} is still running`);
+            }
+            for (const row of open) {
+                if (row["pid"] === null && row["host"] !== hostname())
+                    return alive(`run #${args.runId} has a witness from ${String(row["host"])}; settle it there`);
+                if (row["containment"] != null && row["container"] != null && row["container_empty_at"] == null &&
+                    containerEmptiness(String(row["containment"]), String(row["container"]), process.platform, row["container_identity"] == null ? null : String(row["container_identity"])) === "populated") {
+                    return alive(`run #${args.runId}'s ${String(row["containment"])} object ${String(row["container"])} still has members`);
+                }
+            }
+            if (open.length === 0)
+                return { ok: true, witnesses: [], repeated: true };
+            const ids = open.map(row => Number(row["id"]));
+            for (const id of ids)
+                this.db.prepare("UPDATE run_process SET exited_at = ? WHERE id = ? AND run = ? AND exited_at IS NULL").run(now.toISOString(), id, args.runId);
+            const ref = this.refById(run.taskRef);
+            this.recordAction({ at: now.toISOString(), actor: args.by, repo: ref?.repo ?? null, taskId: ref?.externalId ?? null, runId: args.runId,
+                action: "process witness settled by approver", outcome: `witness ${ids.join(", ")}`, source: "request", detail: args.why });
+            this.settleQuiescentStops(now);
+            return { ok: true, witnesses: ids, repeated: false };
+        });
+    }
     recordRunProcess(runId, pid, now, group = true, witness) {
         if (!Number.isSafeInteger(pid) || pid <= 0)
             throw new Error("a process witness needs a valid spawned PID");
@@ -21182,6 +21402,48 @@ export class Store {
             .get(runner, now.toISOString());
         return Number(row?.["n"] ?? 0);
     }
+    /** The same live claims as liveClaimCount, by the project their task is placed in. */
+    liveClaimCountsByRepo(runner, now) {
+        const rows = this.db
+            .prepare(`SELECT task_ref.repo AS repo, COUNT(*) AS n FROM claim
+           JOIN task_ref ON task_ref.id = claim.task_ref
+          WHERE claim.runner = ? AND claim.released_at IS NULL AND claim.expires_at > ?
+            AND claim.lease_generation = (
+              SELECT MAX(newest.lease_generation) FROM claim AS newest
+              WHERE newest.task_ref = claim.task_ref
+            )
+            AND claim.lease_id NOT IN (SELECT lease_id FROM held_session WHERE ended_at IS NULL)
+          GROUP BY task_ref.repo`)
+            .all(runner, now.toISOString());
+        const counts = new Map();
+        for (const row of rows)
+            if (row["repo"] != null)
+                counts.set(String(row["repo"]), Number(row["n"]));
+        return counts;
+    }
+    /** Every builder's live attempts, by project: what `status` shows against each project's limit. */
+    runningBuildsByRepo(now) {
+        const rows = this.db
+            .prepare(`SELECT task_ref.repo AS repo, COUNT(*) AS n FROM claim
+           JOIN task_ref ON task_ref.id = claim.task_ref
+          WHERE claim.released_at IS NULL AND claim.expires_at > ?
+            AND claim.lease_generation = (
+              SELECT MAX(newest.lease_generation) FROM claim AS newest
+              WHERE newest.task_ref = claim.task_ref
+            )
+            AND claim.lease_id NOT IN (SELECT lease_id FROM held_session WHERE ended_at IS NULL)
+          GROUP BY task_ref.repo`)
+            .all(now.toISOString());
+        const counts = new Map();
+        for (const row of rows)
+            if (row["repo"] != null)
+                counts.set(String(row["repo"]), Number(row["n"]));
+        return counts;
+    }
+    /** A project's build concurrency changed (project-concurrency.ts): the ledger keeps before → after. */
+    recordProjectConcurrency(by, repo, before, after, now) {
+        this.recordPolicy(by, repo, "builds at once", String(before), String(after), now);
+    }
     /** Forward only, and only under the live generation. A stale poller moves nothing. */
     /** v98: an update Telegram pushed, kept until the bridge applies it; false when it's already kept or applied. */
     queueTelegramUpdate(botId, updateId, payload, now) {
@@ -21509,6 +21771,14 @@ export class Store {
             this.db.prepare(`UPDATE notification_delivery SET receipt = '${TELEGRAM_SKIPPED_ELSEWHERE}'
         WHERE destination = ? AND delivered_at IS NULL AND receipt IS NULL
           AND notification IN (SELECT id FROM notification WHERE recipient IS NOT NULL AND recipient <> ?)`).run(destination, binding.approver);
+            // Pings follow responsibility (the lead's work, this person's own act, a muted project): settled here, unsent.
+            for (const raw of this.db.prepare(`SELECT n.* FROM notification n JOIN notification_delivery d ON d.notification = n.id AND d.destination = ?
+          WHERE n.resolved_at IS NULL AND d.delivered_at IS NULL AND d.receipt IS NULL AND (d.claim_owner IS NULL OR d.claim_expires_at <= ?)`).all(destination, now.toISOString())) {
+                const row = readNotification(raw);
+                if (!this.pingAllowed(row, binding.approver)) {
+                    this.db.prepare(`UPDATE notification_delivery SET receipt = '${TELEGRAM_SKIPPED_QUIET}' WHERE notification = ? AND destination = ?`).run(row.id, destination);
+                }
+            }
             if (this.telegramRetryAt(binding.botId) > now.toISOString())
                 return [];
             const rows = this.db.prepare(`SELECT n.*, d.claim_generation FROM notification n
@@ -21722,6 +21992,143 @@ export class Store {
         return Number(this.db.prepare("UPDATE notification_preference SET digest_on = ? WHERE account = ? AND digest_at IS NOT NULL AND (digest_on IS NULL OR digest_on < ?)")
             .run(day, account, day).changes) === 1;
     }
+    // ---- pings follow responsibility: the lead, who acted, replacements and muted projects ----
+    /** A lead token for one person, shown once. A new one ends their earlier ones; the ledger names it "lead for <owner>". */
+    mintLeadCredential(owner, by, now) {
+        return this.transact(() => {
+            const stamp = now.toISOString();
+            this.db.prepare("UPDATE lead_credential SET revoked_at = ?, revoked_by = ? WHERE owner = ? AND revoked_at IS NULL").run(stamp, by, owner);
+            const minted = mintLeadToken();
+            this.db.prepare("INSERT INTO lead_credential (id, owner, secret_hash, created_at, created_by) VALUES (?, ?, ?, ?, ?)").run(minted.id, owner, minted.hash, stamp, by);
+            this.recordAction({ at: stamp, actor: by, repo: null, taskId: null, runId: null, action: "lead token created", outcome: "recorded", source: "access", detail: `lead for ${owner}` });
+            return { id: minted.id, token: minted.token };
+        });
+    }
+    /** End every live lead token for one person. */
+    revokeLeadCredentials(owner, by, now) {
+        return this.transact(() => {
+            const ended = Number(this.db.prepare("UPDATE lead_credential SET revoked_at = ?, revoked_by = ? WHERE owner = ? AND revoked_at IS NULL").run(now.toISOString(), by, owner).changes);
+            if (ended > 0)
+                this.recordAction({ at: now.toISOString(), actor: by, repo: null, taskId: null, runId: null, action: "lead token revoked", outcome: "recorded", source: "access", detail: `lead for ${owner}` });
+            return ended;
+        });
+    }
+    /** Whose lead a presented token is: a live token whose owner is still an approver, or null. */
+    leadFor(presented) {
+        const parsed = parseLeadToken(presented);
+        if (parsed === null)
+            return null;
+        const row = this.db.prepare("SELECT owner, secret_hash FROM lead_credential WHERE id = ? AND revoked_at IS NULL").get(parsed.id);
+        if (row === undefined || !leadSecretMatches(parsed.secret, String(row["secret_hash"])))
+            return null;
+        const owner = String(row["owner"]), account = this.accountOf(owner);
+        return account === null || account.revokedAt !== null || account.role !== "approver" ? null : { owner, id: parsed.id };
+    }
+    /** Record who did this to a task, when someone is acting. The lead's acts are also in the ledger as "lead for <owner>". */
+    noteTaskAct(taskRef, act, now, handed, actor = currentActor()) {
+        if (actor === null)
+            return;
+        this.db.prepare("INSERT INTO task_act (task_ref, act, account, lead, person, why, at) VALUES (?, ?, ?, ?, ?, ?, ?)")
+            .run(taskRef, act, actor.account, actor.lead ? 1 : 0, handed?.person ?? null, handed?.why ?? null, now.toISOString());
+        if (!actor.lead)
+            return;
+        const ref = this.db.prepare("SELECT repo, external_id FROM task_ref WHERE id = ?").get(taskRef);
+        this.recordAction({ at: now.toISOString(), actor: actorLabel(actor), repo: ref?.["repo"] == null ? null : String(ref["repo"]), taskId: ref === undefined ? null : String(ref["external_id"]), runId: null,
+            action: act === "asked" ? "task handed to a person" : `task ${act}`, outcome: "recorded", source: "work", detail: handed === undefined ? null : `${handed.person}: ${handed.why}` });
+    }
+    /** Every recorded act on a task, oldest first. */
+    taskActs(taskRef) {
+        return this.db.prepare("SELECT act, account, lead, person, why, at FROM task_act WHERE task_ref = ? ORDER BY id").all(taskRef).map(row => ({
+            act: String(row["act"]), account: String(row["account"]), lead: Number(row["lead"]) === 1,
+            person: row["person"] == null ? null : String(row["person"]), why: row["why"] == null ? null : String(row["why"]), at: String(row["at"])
+        }));
+    }
+    /** Whose lead's work this task is: the last to file, approve or hand it on was that person's lead (null: a person's). */
+    leadWorkOf(taskRef) {
+        const row = this.db.prepare("SELECT account, lead, act FROM task_act WHERE task_ref = ? AND act IN ('filed', 'approved', 'asked') ORDER BY id DESC LIMIT 1").get(taskRef);
+        return row === undefined || Number(row["lead"]) !== 1 || row["act"] === "asked" ? null : String(row["account"]);
+    }
+    /** The lead hands a task to a person: it becomes theirs, and they get one message saying why. */
+    askPerson(taskId, person, why, now) {
+        return this.transact(() => {
+            const ref = this.lookupRef(taskId);
+            if (ref === null)
+                return { ok: false, reason: "unknown-task" };
+            if (ref.repo === null)
+                return { ok: false, reason: "unplaced" };
+            const account = this.accountOf(person);
+            if (account === null || account.revokedAt !== null || !this.accountCanAccess(person, ref.repo))
+                return { ok: false, reason: "unknown-person" };
+            this.noteTaskAct(ref.id, "asked", now, { person, why });
+            const asks = this.taskActs(ref.id).filter(one => one.act === "asked").length;
+            const actor = currentActor();
+            this.enqueueNotification({ dedupeKey: `ask:${ref.id}:${asks}`, kind: "task-ask", pushClass: "attention", recipient: person,
+                subject: `${actor?.lead ? "The lead" : actor?.account ?? "Someone"} needs you: ${lifecycleWords(this.getTask(taskId)?.title ?? taskId, 80)}`,
+                body: lifecycleWords(why, 400), link: chatControlHref("task", taskId), source: { taskRef: ref.id } }, now);
+            return { ok: true };
+        });
+    }
+    /** The task that replaced a cancelled one, or null. */
+    replacementOf(taskId) {
+        const row = this.db.prepare("SELECT r.successor FROM task_replacement r JOIN task_ref t ON t.id = r.task_ref WHERE t.backend = ? AND t.external_id = ?").get(BUILT_IN, taskId);
+        return row === undefined ? null : String(row["successor"]);
+    }
+    /** Every replaced task in one read, for lists: task id → its successor. */
+    replacements() {
+        return new Map(this.db.prepare("SELECT t.external_id, r.successor FROM task_replacement r JOIN task_ref t ON t.id = r.task_ref").all()
+            .map(row => [String(row["external_id"]), String(row["successor"])]));
+    }
+    /** Mute or unmute one project's pings for one person. The console and digest keep everything. */
+    setProjectMuted(account, repo, muted, now) {
+        if (muted)
+            this.db.prepare("INSERT OR IGNORE INTO project_mute (account, repo, at) VALUES (?, ?, ?)").run(account, repo, now.toISOString());
+        else
+            this.db.prepare("DELETE FROM project_mute WHERE account = ? AND repo = ?").run(account, repo);
+    }
+    mutedProjects(account) {
+        return this.db.prepare("SELECT repo FROM project_mute WHERE account = ? ORDER BY repo").all(account).map(row => String(row["repo"]));
+    }
+    /** Whose act made this fact, if anyone's. */
+    notificationActor(id) {
+        const row = this.db.prepare("SELECT account, lead FROM notification_actor WHERE notification = ?").get(id);
+        return row === undefined ? null : { account: String(row["account"]), lead: Number(row["lead"]) === 1 };
+    }
+    /**
+     * Whether this fact may message this person (every chat, phone and browser asks here). Pings follow
+     * responsibility: a security alert always does; nobody is messaged about their own act (or their lead's);
+     * the lead's work messages nobody unless it is handed to a person or fails with nothing left for the lead
+     * to try; and a person's muted project stays quiet. A fact addressed to one person is theirs. The console
+     * and the evening digest keep every fact either way.
+     */
+    pingAllowed(row, account) {
+        if (SECURITY_KINDS.has(row.kind) || row.kind === "evening-digest")
+            return true;
+        if (row.recipient !== null && row.kind === "task-ask")
+            return true;
+        const actor = this.notificationActor(row.id);
+        if (actor !== null && actor.account === account)
+            return false;
+        if (row.recipient !== null)
+            return true;
+        if (this.leadQuiet(row, actor))
+            return false;
+        return row.project === null || this.db.prepare("SELECT 1 AS hit FROM project_mute WHERE account = ? AND repo = ?").get(account, row.project) === undefined;
+    }
+    /** The lead's work, which messages nobody: unless it is a security alert or a failure with nothing left for the lead. */
+    leadQuiet(row, actor = this.notificationActor(row.id)) {
+        if (SECURITY_KINDS.has(row.kind))
+            return false;
+        const lead = actor?.lead === true || (row.taskRef !== null && this.leadWorkOf(row.taskRef) !== null);
+        return lead && !this.failedForGood(row);
+    }
+    /** A failure with nothing left for the lead to do: its attempts are spent, or the task has failed for good. */
+    failedForGood(row) {
+        if (SPENT_KINDS.has(row.kind))
+            return true;
+        if (!/fail|exhausted/.test(row.kind) || row.taskRef === null)
+            return false;
+        return this.db.prepare("SELECT 1 AS hit FROM task t JOIN task_ref r ON r.external_id = t.id AND r.backend = ? WHERE r.id = ? AND t.state = 'failed'").get(BUILT_IN, row.taskRef) !== undefined;
+    }
     /** The card a destination keeps for this task. A task with none joins a card whose first task was filed within
      * a minute of it (up to eight tasks), or starts its own. */
     chatCardFor(destination, taskRef, filedAt, now) {
@@ -21927,6 +22334,17 @@ export class Store {
             AND push_subscription.retired_at IS NULL
             AND notification.id > push_subscription.starts_after_notification`)
             .run(now.toISOString());
+        // Pings follow responsibility: a pair this person must not be alerted about retires before it is ever sent.
+        if (Number(changes) > 0) {
+            const fresh = this.db.prepare(`SELECT p.id AS pair, s.approver AS approver, n.* FROM push_delivery p
+          JOIN push_subscription s ON s.id = p.subscription JOIN notification n ON n.id = p.notification
+          WHERE p.state = 'pending' AND p.attempts = 0 AND p.created_at = ?`).all(now.toISOString());
+            for (const raw of fresh) {
+                if (!this.pingAllowed(readNotification(raw), String(raw["approver"]))) {
+                    this.db.prepare("UPDATE push_delivery SET state = 'retired', last_error = 'quiet' WHERE id = ? AND state = 'pending'").run(Number(raw["pair"]));
+                }
+            }
+        }
         return Number(changes);
     }
     /**
@@ -22247,6 +22665,8 @@ function readHold(row) {
 export const TELEGRAM_SKIPPED_RECEIPT = "skipped:before-pairing";
 /** v83: a notification for another person, settled for this destination without sending. */
 export const TELEGRAM_SKIPPED_ELSEWHERE = "skipped:for-another-person";
+/** A fact this person is not messaged about: the lead's work, their own act, or a project they muted. */
+export const TELEGRAM_SKIPPED_QUIET = "skipped:quiet";
 /** A destination receipt (`d` = notification_delivery) that still owes a
  * send: not delivered, and not explicitly skipped as pre-pairing history.
  * Every reader of Telegram receipts that means "undelivered" uses this, so