toolroll 0.9.61 → 0.9.62

package/dist/server/render-tasks.js

@@ -7,6 +7,7 @@ import { gateWords } from "../approval-policy.js";
 import { assignmentCardOf, assignmentStatusOf, assignmentSummaryHtml } from "../assignment-ui.js";
 import {} from "../assignment.js";
 import { holdOwnerWords } from "../board.js";
+import { baseStandingWords } from "../task-base.js";
 import {} from "../browser-workspace.js";
 import { permissionPlainWords } from "../chat-decide.js";
 import { CHAT_TASK_ACTIONS } from "../chat-task-actions.js";
@@ -2108,6 +2109,8 @@ export function taskBodyParts(data) {
     work.push({ label: "Status", parts: [data.assignment != null && assignmentOptions !== null ? assignmentCardOf(data.assignment, assignmentOptions).status.headline : status.label] });
     if (data.repo !== null)
         work.push({ label: "Project", parts: [projectName(data.repo)] });
+    if (data.base != null)
+        work.push({ label: "Base", parts: [baseStandingWords(data.base)] });
     work.push({ label: "Agent", parts: [lastRunForAgent !== undefined ? `${lastRunForAgent.provider}${lastRunForAgent.model === null ? "" : ` · ${lastRunForAgent.model}`} on ${lastRunForAgent.runner}`
                 : data.route?.legacy != null ? `${data.route.legacy.provider} · ${data.route.legacy.model}` : "The project's default"] });
     if (scope !== null)

package/dist/server/settings.js

@@ -104,6 +104,7 @@ import { budgetStates, monthNamed, spendItems, usd as spendUsd, subagentNames as
 import { removeSsoSettings, saveSsoSettings, SSO_CALLBACK, ssoChangeWords } from "../sso-settings.js";
 import { ssoSettingsHtml } from "../sso-ui.js";
 import { lastSweep, saveSweep, storageSweepOff } from "../storage-sweep.js";
+import { sweepSchedule } from "../storage-sweep-schedule.js";
 import { storageHtml } from "../storage-ui.js";
 import { landedSummary } from "../landed-cleanup.js";
 import { bytesWords, parseCleanup } from "../storage.js";
@@ -302,7 +303,7 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
             return refuse(response, who, 403, "That project is outside your access.", "/settings/project");
         const selector = projects.length > 1 ? html `<form class="approval-project" method="get" action="/settings/project"><label>Project<select name="repo">${projects.map(p => html `<option value="${p}"${p === chosen ? " selected" : ""}>${projectName(p)}</option>`)}</select></label><button>Show</button></form>` : "";
         const notice = { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") };
-        const content = chosen === "" ? html `${notice.said ? html `<p role="status">${notice.said}</p>` : ""}<p>No projects yet.</p>` : (projectSettingsHtml(projectViewOf(chosen, who), notice));
+        const content = chosen === "" ? html `${notice.said ? html `<p role="status">${notice.said}</p>` : ""}<p>No projects yet.</p>` : (projectSettingsHtml({ ...projectViewOf(chosen, who), remoteUrl: store.projectRemote(chosen) }, notice));
         return sendScreen(response, 200, screen("Project", html `<p><a href="/settings">Settings</a></p><h1>Project</h1>${selector}${content}`, { chrome: chromeFor(chosen || null, "settings") }));
     }
     // v102: Settings → Approval rules, a project's separation of duties. Anyone who sees the project reads them; an instance operator sets them.
@@ -398,7 +399,7 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         if (databaseFile === null)
             return refuse(response, who, 403, "An instance operator looks after storage.", "/settings");
         const plan = await checkoutPlan(store, storagePool(databaseFile), now, { manual: true });
-        const sweep = { last: lastSweep(store), off: storageSweepOff() };
+        const sweep = { last: lastSweep(store), off: storageSweepOff(), schedule: sweepSchedule(store, now) };
         return sendScreen(response, 200, screen("Storage", html `<p><a href="/settings">Settings</a></p><h1>Storage</h1>${(storageHtml({ plan, csrf: who.session.csrf, sweep, landed: landedSummary(store) }, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") }))}`, { chrome: chromeFor(project, "settings") }));
     }
     // Settings → Projects → Pull requests: one project's setup. Off, the checks run on open, so the page says

package/dist/server/task-views.js

@@ -1,3 +1,4 @@
+import { taskBaseOf } from "../task-base.js";
 import { assignmentPresentationOf, historicalAssessmentReason } from '../assignment-presentation.js';
 import { html, joinHtml } from "../html.js";
 import { assignmentStatusOf, assignmentWithEvidence } from '../assignment-ui.js';
@@ -482,6 +483,7 @@ export function createTaskViews(runtime) {
                 return { rows, decisions: decisionsFor(runtime.store, rows), now };
             })(),
             steering: ref === null ? [] : runtime.store.listSteerNotes(ref.id),
+            base: taskBaseOf(runtime.store, taskId),
             steeringLive: ref !== null && runtime.store.steeringLiveBuild(ref.id, now) !== null,
             // "publishes as" reads ONLY publicationGrantFor(repo) — the grant
             // the publisher would act under — never listGrants(), which is

package/dist/storage-sweep-process.d.ts

@@ -29,6 +29,13 @@ export type SweepSupervisor = {
 };
 export declare const SWEEP_TIMEOUT_MS: number;
 export declare const SWEEP_KILL_GRACE_MS = 5000;
+/** The sweep runs behind everything else: a positive nice and, on macOS, the background CPU and I/O policy. */
+export declare const SWEEP_NICE = 10;
+/** How the child starts: taskpolicy execs Node in place, so the pid, its group and the IPC channel stay the same. */
+export declare function sweepLaunch(platform?: NodeJS.Platform, exists?: (path: string) => boolean): {
+    execPath: string;
+    prefix: string[];
+};
 /** Owns one child without lending its lifetime to a reconcile pass or its database connection. */
 export declare function createSweepSupervisor(options?: {
     timeoutMs?: number;

package/dist/storage-sweep-process.js

@@ -1,5 +1,7 @@
 /** The storage child's bounded IPC protocol. No paths or process arguments are written to logs. */
 import { fork } from "node:child_process";
+import { existsSync } from "node:fs";
+import { setPriority } from "node:os";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 const object = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
@@ -23,13 +25,28 @@ export function sweepResponse(value, request) {
 }
 export const SWEEP_TIMEOUT_MS = 20 * 60_000;
 export const SWEEP_KILL_GRACE_MS = 5_000;
+/** The sweep runs behind everything else: a positive nice and, on macOS, the background CPU and I/O policy. */
+export const SWEEP_NICE = 10;
+const TASKPOLICY = "/usr/sbin/taskpolicy";
+/** How the child starts: taskpolicy execs Node in place, so the pid, its group and the IPC channel stay the same. */
+export function sweepLaunch(platform = process.platform, exists = existsSync) {
+    return platform === "darwin" && exists(TASKPOLICY) ? { execPath: TASKPOLICY, prefix: ["-b", process.execPath] } : { execPath: process.execPath, prefix: [] };
+}
 /** Only source checkouts need tsx; installed builds use the sibling child and the same Node. */
 function forkSweep() {
     const source = import.meta.url.endsWith(".ts");
+    const launch = sweepLaunch();
     const child = fork(fileURLToPath(new URL(source ? "./storage-sweep-child.ts" : "./storage-sweep-child.js", import.meta.url)), [], {
-        execArgv: source ? ["--import", "tsx"] : [], stdio: ["ignore", "ignore", "ignore", "ipc"], detached: true,
+        execPath: launch.execPath, execArgv: [...launch.prefix, ...(source ? ["--import", "tsx"] : [])], stdio: ["ignore", "ignore", "ignore", "ipc"], detached: true,
     });
-    // A one-shot CLI may exit after reconcile; the child's parent-loss guard then ends it.
+    // Before the request is sent, so every rm/du the child starts inherits it.
+    if (child.pid !== undefined) {
+        try {
+            setPriority(child.pid, SWEEP_NICE);
+        }
+        catch { /* the default priority still works */ }
+    }
+    // The service never waits on the child to exit; stop() and the child's parent-loss guard end it.
     child.unref();
     child.channel?.unref();
     return child;
@@ -165,7 +182,7 @@ export function createSweepSupervisor(options = {}) {
         },
     };
 }
-// All watch loops in this process share a flight. Other workers arbitrate the daily claim in SQLite.
+// All watch loops in this process share a flight. Other services arbitrate the claim in SQLite.
 const supervisors = new Map();
 export function storageSweepSupervisor(databaseFile) {
     const key = resolve(databaseFile);

package/dist/storage-sweep-schedule.d.ts

@@ -0,0 +1,30 @@
+import { type SweepDeps, type SweepRecord } from "./storage-sweep.js";
+import { type SweepSupervisor } from "./storage-sweep-process.js";
+import { type Store } from "./store.js";
+/** How often the service looks again at a due sweep. */
+export declare const SWEEP_CHECK_MS: number;
+/** After this long without an automatic sweep, it runs even while work is running or waiting. */
+export declare const SWEEP_FORCE_MS: number;
+export type SweepBusy = "run" | "claim" | "ready";
+/** What keeps a due sweep waiting now, or null when nothing is running or waiting. */
+export declare function sweepBusy(store: Store, now: Date): SweepBusy | null;
+/** Whether a long-lived Toolroll service holds a current lease. Rows from earlier services don't count. */
+export declare function sweepServiceRunning(store: Store, now: Date): boolean;
+export type SweepState = "off" | "sweeping" | "no-service" | "recent" | "retry" | "busy" | "forced" | "due";
+export type SweepSchedule = {
+    state: SweepState;
+    /** The latest automatic sweep's recorded time, or null when there has been none. */
+    lastAt: string | null;
+    /** When the next sweep is due, or null when it is off or due now. */
+    nextAt: string | null;
+    busy: SweepBusy | null;
+};
+/** The sweep's schedule from what is recorded now; reads only. */
+export declare function sweepSchedule(store: Store, now: Date, env?: NodeJS.ProcessEnv): SweepSchedule;
+/** Why the sweep is waiting or when it is next due, after "Automatic sweep: ". `when` formats a time for the reader. */
+export declare function sweepScheduleWords(schedule: SweepSchedule, when: (at: string) => string): string;
+/**
+ * The service's claim and launch. A one-shot caller has no `owner` and never claims. A hung child never holds
+ * reconciliation or the caller's store open; the result is saved by the flight's own connection.
+ */
+export declare function idleStorageSweep(store: Store, deps: SweepDeps, now: () => Date, supervisor?: SweepSupervisor): SweepRecord | null;

package/dist/storage-sweep-schedule.js

@@ -0,0 +1,164 @@
+/**
+ * When the automatic storage sweep (storage-sweep.ts) starts, and what `toolroll storage` and Settings → Storage say
+ * about it. A sweep is due a day after the last one (an hour after one that failed somewhere). Once due, the
+ * long-lived Toolroll service looks at most every 15 minutes and starts it only while nothing is running or waiting:
+ * no open run, no live claim and no task a worker could claim now. Work held by an approval, a hold or a provider limit
+ * is not waiting to start, so it never defers the sweep. 48 hours after the last automatic sweep it runs anyway: its
+ * scans run in a low-priority child, and every removal asks again whether live work uses the folder.
+ *
+ * Only the service claims a sweep (it passes its owner): a one-shot `toolroll reconcile` exits before a child would
+ * finish, and a claim it made would be lost until the next day. The idle gates are asked again inside the transaction
+ * that claims the sweep, so work that started since the first look still defers it.
+ */
+import { diagnoseTaskDispatch, diagnosisIsDispatchable } from "./dispatch.js";
+import { lastSweep, RETRY_MS, saveSweep, storageSweepOff, sweepFailure, SWEEP_CURSOR, SWEEP_EVERY_MS } from "./storage-sweep.js";
+import { storageSweepSupervisor, SWEEP_KILL_GRACE_MS, SWEEP_TIMEOUT_MS } from "./storage-sweep-process.js";
+import { openStoreNoMigrate } from "./store.js";
+/** How often the service looks again at a due sweep. */
+export const SWEEP_CHECK_MS = 15 * 60_000;
+/** After this long without an automatic sweep, it runs even while work is running or waiting. */
+export const SWEEP_FORCE_MS = 48 * 3_600_000;
+/** What keeps a due sweep waiting now, or null when nothing is running or waiting. */
+export function sweepBusy(store, now) {
+    const db = store.handle;
+    if (db.prepare("SELECT 1 FROM run WHERE finished_at IS NULL LIMIT 1").get() !== undefined)
+        return "run";
+    if (db.prepare("SELECT 1 FROM claim WHERE released_at IS NULL AND expires_at > ? LIMIT 1").get(now.toISOString()) !== undefined)
+        return "claim";
+    // Ready means a worker could claim it now: the same answer the task page gives, not merely queued.
+    if (store.listReady(now).some(ref => diagnosisIsDispatchable(diagnoseTaskDispatch(store, ref.externalId, now))))
+        return "ready";
+    return null;
+}
+/** Whether a long-lived Toolroll service holds a current lease. Rows from earlier services don't count. */
+export function sweepServiceRunning(store, now) {
+    return store.handle.prepare("SELECT 1 FROM watch_lease WHERE owner GLOB 'toolroll-service:*' AND expires_at > ? LIMIT 1").get(now.toISOString()) !== undefined;
+}
+const dueAt = (store) => store.serviceCursor(SWEEP_CURSOR) + SWEEP_EVERY_MS;
+/** Count from the last result, or the durable installation time before the first result. */
+function forcedFrom(store, last) {
+    if (last !== null)
+        return Date.parse(last.at);
+    const installed = store.installationFact("installed-at");
+    return installed === null ? null : Date.parse(installed);
+}
+/** The sweep's schedule from what is recorded now; reads only. */
+export function sweepSchedule(store, now, env = process.env) {
+    const last = lastSweep(store, "automatic");
+    const lastAt = last?.at ?? null;
+    if (storageSweepOff(env))
+        return { state: "off", lastAt, nextAt: null, busy: null };
+    const cursor = store.serviceCursor(SWEEP_CURSOR);
+    // Results record completion time, which may be later than the claim. An older result cannot finish a new claim.
+    if (cursor !== 0 && now.getTime() - cursor < SWEEP_TIMEOUT_MS + SWEEP_KILL_GRACE_MS && now.getTime() >= cursor && (lastAt === null || Date.parse(lastAt) < cursor)) {
+        return { state: "sweeping", lastAt, nextAt: null, busy: null };
+    }
+    const due = dueAt(store);
+    const nextAt = cursor === 0 || due <= now.getTime() ? null : new Date(due).toISOString();
+    if (!sweepServiceRunning(store, now))
+        return { state: "no-service", lastAt, nextAt, busy: null };
+    if (nextAt !== null) {
+        // Completion can follow the claim: elapsed sweep time alone does not mean a retry.
+        const retry = last !== null && Date.parse(last.at) >= cursor && last.parts.some(one => one.failed > 0 || one.more === true || one.problem !== undefined);
+        return { state: retry ? "retry" : "recent", lastAt, nextAt, busy: null };
+    }
+    const from = forcedFrom(store, last);
+    if (from !== null && now.getTime() - from >= SWEEP_FORCE_MS)
+        return { state: "forced", lastAt, nextAt: null, busy: null };
+    const busy = sweepBusy(store, now);
+    return { state: busy === null ? "due" : "busy", lastAt, nextAt: null, busy };
+}
+const BUSY_WORDS = { run: "work is running", claim: "a worker is starting a task", ready: "a task is ready to start" };
+/** Why the sweep is waiting or when it is next due, after "Automatic sweep: ". `when` formats a time for the reader. */
+export function sweepScheduleWords(schedule, when) {
+    switch (schedule.state) {
+        case "off": return "off.";
+        case "sweeping": return "sweeping now.";
+        case "no-service": return "waiting: no Toolroll service running.";
+        case "recent": return `swept recently, next due ${when(schedule.nextAt)}.`;
+        case "retry": return `retry due ${when(schedule.nextAt)}.`;
+        case "busy": return `due, waiting: ${BUSY_WORDS[schedule.busy]}.`;
+        case "forced": return "over 48 hours since the last sweep; it runs at the next check even if work is running.";
+        case "due": return "due; it starts within 15 minutes while nothing is running.";
+    }
+}
+// The last look per flight, so a due sweep is looked at no more than every 15 minutes.
+const looked = new WeakMap();
+/**
+ * The service's claim and launch. A one-shot caller has no `owner` and never claims. A hung child never holds
+ * reconciliation or the caller's store open; the result is saved by the flight's own connection.
+ */
+export function idleStorageSweep(store, deps, now, supervisor = storageSweepSupervisor(deps.databaseFile)) {
+    if (deps.owner === undefined || storageSweepOff() || supervisor.running)
+        return null;
+    const at = now();
+    // Older installations have no creation fact. Anchor once on their first service pass; never backdate a claim.
+    if (store.installationFact("installed-at") === null)
+        store.recordInstallationFact("installed-at", at.toISOString(), at);
+    if (at.getTime() < dueAt(store))
+        return null;
+    const seen = looked.get(supervisor);
+    if (seen !== undefined && at.getTime() - seen < SWEEP_CHECK_MS && at.getTime() >= seen)
+        return null;
+    looked.set(supervisor, at.getTime());
+    const ready = () => {
+        if (at.getTime() < dueAt(store))
+            return false;
+        const from = forcedFrom(store, lastSweep(store, "automatic"));
+        return (from !== null && at.getTime() - from >= SWEEP_FORCE_MS) || sweepBusy(store, at) === null;
+    };
+    if (!ready())
+        return null;
+    // This handle belongs to the flight, not to the pass that has already returned by the time it finishes.
+    const connection = openStoreNoMigrate(deps.databaseFile);
+    if (!connection.ok)
+        throw new Error("Sweep result store unavailable");
+    const results = connection.store;
+    let completed = null;
+    let owned = false;
+    try {
+        // Asked again where the cursor moves: work that started since the first look still defers the sweep.
+        const mine = store.transact(() => {
+            if (!ready())
+                return false;
+            store.setServiceCursor(SWEEP_CURSOR, at.getTime(), at);
+            return true;
+        });
+        if (!mine)
+            return null;
+        const request = { version: 1, databaseFile: deps.databaseFile, poolRoot: deps.pool?.root ?? null, tempRoots: [...deps.tempRoots], actor: deps.actor ?? "worker", at: at.toISOString() };
+        owned = supervisor.start(request, result => {
+            const record = result.ok ? result.record : sweepFailure(request.at, request.actor, deps.pool !== null, result.reason);
+            try {
+                results.transact(() => {
+                    if (!results.schemaCurrent())
+                        throw new Error("Sweep result store changed");
+                    saveSweep(results, record);
+                    // Only this claim can reschedule itself. A later claim must never be overwritten by a late callback.
+                    if (record.parts.some(one => one.failed > 0 || one.more === true || one.problem !== undefined) && results.serviceCursor(SWEEP_CURSOR) === at.getTime()) {
+                        results.setServiceCursor(SWEEP_CURSOR, Math.max(1, now().getTime() - SWEEP_EVERY_MS + RETRY_MS), now());
+                    }
+                });
+                completed = record;
+            }
+            catch {
+                // No exception/path from a process or database is safe to copy into a log.
+                console.error("Could not save the storage sweep result.");
+            }
+            finally {
+                results.close();
+            }
+        }, deps.owner);
+        if (!owned) {
+            store.transact(() => {
+                if (store.serviceCursor(SWEEP_CURSOR) === at.getTime())
+                    store.setServiceCursor(SWEEP_CURSOR, Math.max(1, at.getTime() - SWEEP_EVERY_MS + RETRY_MS), now());
+            });
+        }
+        return completed;
+    }
+    finally {
+        if (!owned)
+            results.close();
+    }
+}

package/dist/storage-sweep.d.ts

@@ -1,8 +1,9 @@
 import { type Located } from "./orphan-sweep.js";
 import { type ProcessRow } from "./run-closeout.js";
-import { type Store } from "./store.js";
+import type { Store } from "./store.js";
 import { type WorktreePool } from "./worktree.js";
-import { type SweepSupervisor, type SweepExecutor } from "./storage-sweep-process.js";
+import { type SweepCompletion, type SweepExecutor } from "./storage-sweep-process.js";
+export declare const SWEEP_CURSOR = "storage-sweep";
 export declare const SWEEP_EVERY_MS = 86400000;
 /** A sweep that failed somewhere, or left work for later, runs again this soon. */
 export declare const RETRY_MS: number;
@@ -36,9 +37,9 @@ export type SweepDeps = {
     graceMs?: number;
 };
 export declare function storageSweepOff(env?: NodeJS.ProcessEnv): boolean;
-export declare function storageSweepDue(store: Store, now: Date): boolean;
-/** Claim and launch only. A hung child never holds reconciliation or the caller's store open. */
-export declare function dailyStorageSweep(store: Store, deps: SweepDeps, now: () => Date, supervisor?: SweepSupervisor): SweepRecord | null;
+export declare function sweepFailure(at: string, actor: string, withPool: boolean, reason: Exclude<SweepCompletion, {
+    ok: true;
+}>["reason"]): SweepRecord;
 /**
  * What live work uses now. Live work: an open run, a current (unexpired, unreleased) lease, or a checkout leased, held
  * by a process or whose task has either. It uses its checkouts, the shared install each links, and every folder its

package/dist/storage-sweep.js

@@ -1,7 +1,7 @@
 /**
- * The daily storage sweep: the plane cleans up after itself without anyone running a command. Once a day (one worker
- * takes the day: the cursor moves in the same transaction) it removes test temp folders nothing touched for a day
- * (test-temp.ts), stops orphans Toolroll left running (orphan-sweep.ts), removes finished checkouts the cleanup
+ * The storage sweep: the plane cleans up after itself without anyone running a command. About once a day, when nothing
+ * is running or waiting (storage-sweep-schedule.ts: one service takes it, the cursor moves in the same transaction),
+ * it removes test temp folders nothing touched for a day (test-temp.ts), stops orphans Toolroll left running (orphan-sweep.ts), removes finished checkouts the cleanup
  * setting lets go (checkout-cleanup.ts), keeps the current, previous and newest staged runtimes (staged-runtimes.ts)
  * and removes shared dependency installs no checkout has used for a week (shared-deps.ts).
  *
@@ -17,8 +17,9 @@
  *
  * What each sweep did is saved (the latest few) and in the ledger: `toolroll storage` and Settings → Storage show it.
  * A clean-up by hand (`storage clean --yes`) is saved the same way. A part that failed, or had more than one pass
- * takes, brings the next sweep forward to an hour later. `TOOLROLL_STORAGE_SWEEP=off` turns the automatic sweep off
- * (the unit tests do, so a test never sweeps the machine it runs on).
+ * takes, brings the next sweep forward to an hour later; it still waits for nothing to be running.
+ * `TOOLROLL_STORAGE_SWEEP=off` turns the automatic sweep off (the unit tests do, so a test never sweeps the machine
+ * it runs on).
  */
 import { realpathSync } from "node:fs";
 import { hostname } from "node:os";
@@ -29,11 +30,10 @@ import { processCensus } from "./run-closeout.js";
 import { linkedKey, pruneUnusedShared, sharedDepsRoot, sharedUse, SHARED_UNUSED_MS } from "./shared-deps.js";
 import { pruneStagedRuntimes, runtimesInUse, runtimeScriptPaths, stagePlan } from "./staged-runtimes.js";
 import { bytesWords, diskBytes } from "./storage.js";
-import { openStoreNoMigrate } from "./store.js";
 import { removeStaleTestTemp } from "./test-temp.js";
 import { worktreeProcessOccupancy } from "./worktree.js";
-import { runSweepChild, storageSweepSupervisor } from "./storage-sweep-process.js";
-const CURSOR = "storage-sweep";
+import { runSweepChild } from "./storage-sweep-process.js";
+export const SWEEP_CURSOR = "storage-sweep";
 export const SWEEP_EVERY_MS = 86_400_000;
 /** A sweep that failed somewhere, or left work for later, runs again this soon. */
 export const RETRY_MS = 60 * 60_000;
@@ -46,67 +46,7 @@ const ITEMS_MAX = 20;
 export function storageSweepOff(env = process.env) {
     return (env["TOOLROLL_STORAGE_SWEEP"] ?? "").trim().toLowerCase() === "off";
 }
-export function storageSweepDue(store, now) {
-    return now.getTime() - store.serviceCursor(CURSOR) >= SWEEP_EVERY_MS;
-}
-/** Claim and launch only. A hung child never holds reconciliation or the caller's store open. */
-export function dailyStorageSweep(store, deps, now, supervisor = storageSweepSupervisor(deps.databaseFile)) {
-    if (storageSweepOff() || supervisor.running || !storageSweepDue(store, now()))
-        return null;
-    // This handle belongs to the flight, not to the command that has already returned by the time it finishes.
-    const connection = openStoreNoMigrate(deps.databaseFile);
-    if (!connection.ok)
-        throw new Error("Sweep result store unavailable");
-    const results = connection.store;
-    const at = now();
-    let completed = null;
-    let owned = false;
-    try {
-        const mine = store.transact(() => {
-            if (!storageSweepDue(store, at))
-                return false;
-            store.setServiceCursor(CURSOR, at.getTime(), at);
-            return true;
-        });
-        if (!mine)
-            return null;
-        const request = { version: 1, databaseFile: deps.databaseFile, poolRoot: deps.pool?.root ?? null, tempRoots: [...deps.tempRoots], actor: deps.actor ?? "worker", at: at.toISOString() };
-        owned = supervisor.start(request, result => {
-            const record = result.ok ? result.record : sweepFailure(request.at, request.actor, deps.pool !== null, result.reason);
-            try {
-                results.transact(() => {
-                    if (!results.schemaCurrent())
-                        throw new Error("Sweep result store changed");
-                    saveSweep(results, record);
-                    // Only this claim can reschedule itself. A later claim must never be overwritten by a late callback.
-                    if (record.parts.some(one => one.failed > 0 || one.more === true || one.problem !== undefined) && results.serviceCursor(CURSOR) === at.getTime()) {
-                        results.setServiceCursor(CURSOR, Math.max(0, now().getTime() - SWEEP_EVERY_MS + RETRY_MS), now());
-                    }
-                });
-                completed = record;
-            }
-            catch {
-                // No exception/path from a process or database is safe to copy into a log.
-                console.error("Could not save the storage sweep result.");
-            }
-            finally {
-                results.close();
-            }
-        }, deps.owner);
-        if (!owned) {
-            store.transact(() => {
-                if (store.serviceCursor(CURSOR) === at.getTime())
-                    store.setServiceCursor(CURSOR, Math.max(0, at.getTime() - SWEEP_EVERY_MS + RETRY_MS), now());
-            });
-        }
-        return completed;
-    }
-    finally {
-        if (!owned)
-            results.close();
-    }
-}
-function sweepFailure(at, actor, withPool, reason) {
+export function sweepFailure(at, actor, withPool, reason) {
     const problem = reason === "timeout" ? "The sweep process exceeded its time limit; some cleanup may have completed. Cleanup will retry later."
         : reason === "stopped" ? "The sweep process was stopped; some cleanup may have completed. Cleanup will retry later."
             : "The sweep process did not return a valid result; some cleanup may have completed.";
@@ -339,7 +279,7 @@ export function lastSweep(store, source) {
 export function nextSweepAt(store) {
     if (storageSweepOff())
         return null;
-    const last = store.serviceCursor(CURSOR);
+    const last = store.serviceCursor(SWEEP_CURSOR);
     return last === 0 ? null : new Date(last + SWEEP_EVERY_MS).toISOString();
 }
 const NOUNS = {

package/dist/storage-ui.d.ts

@@ -1,6 +1,7 @@
 import { type Html } from "./html.js";
 import { type CheckoutPlan } from "./checkout-cleanup.js";
 import { type SweepRecord } from "./storage-sweep.js";
+import { type SweepSchedule } from "./storage-sweep-schedule.js";
 import type { LandedSummary } from "./landed-cleanup.js";
 export declare const STORAGE_CSS: string;
 export type StorageView = {
@@ -9,6 +10,7 @@ export type StorageView = {
     sweep?: {
         last: SweepRecord | null;
         off: boolean;
+        schedule?: SweepSchedule;
     };
     landed?: LandedSummary;
 };

package/dist/storage-ui.js

@@ -1,7 +1,7 @@
 /**
  * Settings → Storage: how much space task checkouts use, what a clean-up would free now, a Clean up button whose
  * preview (what goes, what stays and why, with paths) sits behind the password, what the last storage sweep removed
- * and when (its paths in a disclosure), what landed work's teardown did and still waits on (in a disclosure, with the
+ * and when (its paths in a disclosure) and why the next one waits, what landed work's teardown did and still waits on (in a disclosure, with the
  * one-time command for older work), and when a finished task's clean checkout goes by itself. An instance operator's page.
  */
 import { homedir } from "node:os";
@@ -10,6 +10,7 @@ import { html, postForm } from "./html.js";
 import { previewDigest, whyWords } from "./checkout-cleanup.js";
 import { CLEANUP_CHOICES, bytesWords } from "./storage.js";
 import { sweepDetails, sweepWords } from "./storage-sweep.js";
+import { sweepScheduleWords } from "./storage-sweep-schedule.js";
 const plural = (count, one, many = `${one}s`) => `${count} ${count === 1 ? one : many}`;
 export const STORAGE_CSS = `.storage{max-width:720px;min-width:0;overflow-wrap:anywhere}.storage h2{font-size:1.0625rem;margin:24px 0 4px}` +
     `.storage .storage-state{display:grid;gap:12px}.storage .storage-state h2{margin:0}.storage .storage-state p{margin:0}` +
@@ -45,15 +46,17 @@ function whenWords(at) {
     const date = new Date(at);
     return Number.isNaN(date.getTime()) ? at : date.toLocaleString("en-US", { month: "short", day: "numeric", hour: "numeric", minute: "2-digit" });
 }
-/** One line: when the last sweep ran and what it did; its paths and problems behind Details. */
+/** When the last sweep ran and what it did, then why the next one waits or when it is due; paths and problems behind Details. */
 function sweepHtml(sweep) {
     const last = sweep.last;
+    const schedule = sweep.schedule === undefined ? (sweep.off ? html `<p class="meta" data-sweep-state="off">Automatic sweep: off.</p>` : "")
+        : html `<p class="meta" data-sweep-state="${sweep.schedule.state}">Automatic sweep: ${sweepScheduleWords(sweep.schedule, whenWords)}</p>`;
     if (last === null)
-        return html `<p class="meta" data-last-sweep="">${sweep.off ? "Automatic sweep is off." : html `Toolroll sweeps leftovers once a day. It hasn't run yet.`}</p>`;
+        return html `<div class="sweep" data-last-sweep=""><p>Not swept yet.</p>${schedule}</div>`;
     const who = last.source === "manual" ? `Cleaned up by ${last.actor}` : "Swept";
     const details = sweepDetails(last.parts);
     const problem = last.parts.some(one => one.failed > 0 || one.problem !== undefined);
-    return html `<div class="sweep" data-last-sweep="${last.at}"><p${problem ? html ` class="problem"` : ""}>${who} <time datetime="${last.at}">${whenWords(last.at)}</time>. ${sweepWords(last.parts)}</p>${details.length === 0 ? "" : html `<details class="sweep-details"><summary>Details</summary><ul>${details.map(line => html `<li>${homeAsTilde(line)}</li>`)}</ul></details>`}</div>`;
+    return html `<div class="sweep" data-last-sweep="${last.at}"><p${problem ? html ` class="problem"` : ""}>${who} <time datetime="${last.at}">${whenWords(last.at)}</time>. ${sweepWords(last.parts)}</p>${schedule}${details.length === 0 ? "" : html `<details class="sweep-details"><summary>Details</summary><ul>${details.map(line => html `<li>${homeAsTilde(line)}</li>`)}</ul></details>`}</div>`;
 }
 /** Landed work, on demand: what its teardown did, what it waits on and why, and the one-time command for older work. */
 function landedHtml(landed) {

package/dist/store.d.ts

@@ -78,6 +78,11 @@ export declare const FLOW_SEND_SCHEMA = "\nCREATE TABLE IF NOT EXISTS flow_send
  * vocabulary and when — never text, tool names or arguments. Display state, not evidence;
  * a finished run's row goes with the live log's own retention (sweepRunActivity). */
 export declare const RUN_ACTIVITY_SCHEMA = "\nCREATE TABLE IF NOT EXISTS run_activity (\n  run  INTEGER PRIMARY KEY REFERENCES run(id) ON DELETE CASCADE,\n  kind TEXT NOT NULL CHECK (kind IN ('session','message','edit','command','read','search','lookup','plan','delegate','tool')),\n  at   TEXT NOT NULL\n);\n";
+/** A task branch moved to current main before an attempt (fresh base; v122, a new table: additive only): the branch
+ * had no commits of its own and no changes, so it started over from `to_rev`. `after_run` is the newest run id when it
+ * moved: the branch's whole-task diff runs from the first builder base recorded after it (firstBuilderBase), never from
+ * the older main it left. */
+export declare const BRANCH_BASE_MOVE_SCHEMA = "\nCREATE TABLE IF NOT EXISTS branch_base_move (\n  id        INTEGER PRIMARY KEY AUTOINCREMENT,\n  task_ref  INTEGER NOT NULL REFERENCES task_ref(id) ON DELETE CASCADE,\n  branch    TEXT NOT NULL,\n  from_rev  TEXT NOT NULL,\n  to_rev    TEXT NOT NULL,\n  after_run INTEGER NOT NULL,\n  moved_at  TEXT NOT NULL\n);\nCREATE INDEX IF NOT EXISTS branch_base_move_branch ON branch_base_move (task_ref, branch, id);\n";
 /** Pausing a running Claude build (live steering, v121: additive only). A person's Pause asks the build to
  * stop its current turn and keep its session: one row per request, bound to the exact run it was asked of, under the
  * request id the asker chose (a repeated request is the same request). `note` is the steering note a Pause and steer
@@ -161,7 +166,7 @@ export type SealedLedgerEntry = LedgerEntry & {
         hash: string;
     } | null;
 };
-export declare const SCHEMA_VERSION = 121;
+export declare const SCHEMA_VERSION = 122;
 /** v118: the tables merged into `credential`, in the order they move (a person's API tokens keep their ids first). */
 export declare const V118_MERGED_TABLES: Readonly<Record<string, CredentialKind>>;
 /**
@@ -220,7 +225,9 @@ export declare const V115_DROPPED_TABLES: readonly string[];
  * (planning_generation on task_ref, run and plan_revision, defaulting to 0, and decision.superseded_reason, null);
  * the rehearsal checks every saved row reads the declared default (HISTORY_RULES' added columns). v120 only adds
  * three nullable task_steer columns (the running build's steering folder), checked the same way. v121 only adds
- * new tables and the columns in V121_ADDED_COLUMNS (null, or no sends), checked the same way.
+ * new tables and the columns in V121_ADDED_COLUMNS (null, or no sends), checked the same way. v122 only adds a new
+ * table (branch_base_move) and the nullable column in V122_ADDED_COLUMNS (a project's recorded remote), checked the
+ * same way.
  */
 export declare const UPDATE_SAFE_MIGRATIONS: readonly number[];
 /** v119: the columns it adds, by table, with the value every row saved before it reads (toolroll-update's HISTORY_RULES). */
@@ -250,6 +257,12 @@ export declare const V121_ADDED_COLUMNS: Readonly<Record<string, Readonly<Record
     definition: string;
     saved: string;
 }>>>>;
+/** v122: the column it adds, with the value every row saved before it reads: the remote URL an owner's project add
+ * recorded (projects added before it read none, until `repos add <project> --remote <url>` records one). */
+export declare const V122_ADDED_COLUMNS: Readonly<Record<string, Readonly<Record<string, {
+    definition: string;
+    saved: string;
+}>>>>;
 /** Whether a database settled at `version` reaches this build's schema through update-safe migrations alone. */
 export declare function updateSafeSchema(version: number | null): boolean;
 export type OAuthClientRow = {
@@ -4350,6 +4363,20 @@ export declare class Store {
      * legacy first-attempt behavior, unchanged byte-for-byte.
      */
     firstBuilderBase(taskRef: number, branch: string): string | null;
+    /** Where a task branch's attempts start now: a builder branch's pinned base, or the newest base any other attempt on
+     * it recorded (a planner never commits). Null before any attempt on the branch recorded one, or after a move to
+     * current main until the next attempt records its base. */
+    recordedBranchBase(taskRef: number, branch: string): string | null;
+    /** Record a task branch's move to current main, before git moves it: a move that then fails leaves the next
+     * attempt's own base (still the old one) as the branch's origin, which is exactly right. */
+    recordBranchBaseMove(taskRef: number, branch: string, from: string, to: string, now: Date): void;
+    /** The newest move of a task branch to current main, or null. */
+    latestBranchBaseMove(taskRef: number, branch: string): {
+        from: string;
+        to: string;
+        afterRun: number;
+        movedAt: string;
+    } | null;
     finishRun(id: number, result: {
         outcome: "built" | "failed" | "refused" | "parked" | "no-change" | "interrupted";
         reason?: string;
@@ -6004,7 +6031,15 @@ export declare class Store {
     leadStepsOf(leadTurn: number): ChatTurn[];
     /** Remember a project was opened. Upsert keeps added_at; recency always moves.
      * A project added for the first time starts on Quick checks. */
-    upsertProject(path: string, name: string, now: Date): void;
+    upsertProject(path: string, name: string, now: Date, admission?: {
+        remoteUrl: string | null;
+    }): void;
+    /** Includes removed/legacy projects, so deleting a row never makes build-writable config authoritative again. */
+    projectAdmissionKnown(path: string): boolean;
+    /** Full structured URL audit, without the generic ledger's display-text truncation. */
+    recordProjectRemote(actor: string, repo: string, previous: string | null, remoteUrl: string, now: Date): void;
+    /** The remote URL captured on admission or explicitly supplied by the owner; null when none was (or the project was removed). */
+    projectRemote(path: string): string | null;
     /** A project removed from the lists (project-admission.ts): only its row goes; its tasks, results and settings stay. */
     forgetProject(path: string): void;
     /** Most recently opened first — the opener page's order. */
@@ -6013,6 +6048,7 @@ export declare class Store {
         name: string;
         addedAt: string;
         lastOpenedAt: string;
+        remoteUrl: string | null;
     }[];
     /**
      * Tasks whose scope waits on a person's yes: proposed, not approved (or