toolroll 0.9.63 → 0.9.65

package/dist/result-review.d.ts

@@ -149,7 +149,7 @@ export declare const RESULT_FACT_KEYS: readonly ["run", "head", "base", "head-so
 export declare function resultFactsFromHtml(html: string): Record<string, string>[];
 /** Where a result form may send its reader back: the review cockpit's
  * own deep link, the chat's result detail, the page of a task named in
- * `tasks` (the run's own), or the run page. Anything else lands on the run
+ * `tasks` (the run's own) or its Result tab at this run, or the run page. Anything else lands on the run
  * page. Matched exactly — never a bare open redirect. */
 export declare function resultReturnTarget(raw: string | null | undefined, runId: number, tasks?: readonly string[]): string;
 /** A form's own request token, minted per render — the same shape the

package/dist/result-review.js

@@ -147,7 +147,7 @@ export function resultFactsFromHtml(html) {
 }
 /** Where a result form may send its reader back: the review cockpit's
  * own deep link, the chat's result detail, the page of a task named in
- * `tasks` (the run's own), or the run page. Anything else lands on the run
+ * `tasks` (the run's own) or its Result tab at this run, or the run page. Anything else lands on the run
  * page. Matched exactly — never a bare open redirect. */
 export function resultReturnTarget(raw, runId, tasks = []) {
     if (raw !== null && raw !== undefined) {
@@ -160,6 +160,10 @@ export function resultReturnTarget(raw, runId, tasks = []) {
         // The run's own task page, which offered Run checks in place; never another task's.
         if (tasks.some(task => raw === `/t/${encodeURIComponent(task)}`))
             return raw;
+        // That task page's Result tab at this run (docs/plans/one-page-task-and-agent.md), its version and view kept.
+        const tab = /^\/t\/([A-Za-z0-9._~%-]{1,200})\?(?:version=[A-Za-z0-9._~%-]{1,200}&)?tab=result&run=([0-9]{1,15})(?:&section=(?:summary|changes|checks))?$/.exec(raw);
+        if (tab !== null && Number(tab[2]) === runId && tasks.some(task => tab[1] === encodeURIComponent(task)))
+            return raw;
     }
     return `/r/${runId}`;
 }
@@ -240,6 +244,8 @@ export const RESULT_REVIEW_SCRIPT = String.raw `
   var user=panel?panel.getAttribute('data-result-user')||'':'';
   var task=panel?panel.getAttribute('data-result-task')||'':'';
   var run=panel?panel.getAttribute('data-result-run')||'':'';
+  // The address parameter that holds the result's own view: 'tab' on its page, 'section' on a task page's Result tab.
+  var viewParam=panel&&panel.getAttribute('data-result-param')==='section'?'section':'tab';
   var draftPrefix='standing-orders:review-draft:',scrollPrefix='standing-orders:result-scroll:';
   var day=86400000,storage=true,rememberPosition=null;
   function read(key){try{return JSON.parse(sessionStorage.getItem(key)||'null');}catch(e){return null;}}
@@ -262,7 +268,7 @@ export const RESULT_REVIEW_SCRIPT = String.raw `
       tab.addEventListener('click',function(ev){
         if(ev.metaKey||ev.ctrlKey||ev.shiftKey||ev.altKey||ev.button!==0)return;
         ev.preventDefault();var name=tab.getAttribute('data-result-tab');show(name);
-        try{var url=new URL(location.href);url.searchParams.set('tab',name);url.hash='';history.replaceState(history.state,'',url.toString());}catch(e){}
+        try{var url=new URL(location.href);url.searchParams.set(viewParam,name);url.hash='';history.replaceState(history.state,'',url.toString());}catch(e){}
         if(rememberPosition)rememberPosition();
       });
       tab.addEventListener('keydown',function(ev){
@@ -383,7 +389,7 @@ export const RESULT_REVIEW_SCRIPT = String.raw `
   // view the URL now names.
   var returnKey=scrollPrefix+user+':'+task+':return';
   function scrollKeyFor(){var url=null;try{url=new URL(location.href);}catch(e){}
-    return scrollPrefix+user+':'+task+':'+(url?(url.searchParams.get('result')||run)+':'+(url.searchParams.get('tab')||'summary'):run);}
+    return scrollPrefix+user+':'+task+':'+(url?(url.searchParams.get('result')||run)+':'+(url.searchParams.get(viewParam)||'summary'):run);}
   // Once a navigation has begun (pageswap / beforeunload) the document's
   // scroll is no longer the reader's — a cross-document transition can
   // move it to the top while it is captured — so remembering stops.

package/dist/retention-ui.js

@@ -3,7 +3,7 @@
  * the next daily sweep would remove. An instance operator's page; changes
  * take a step-up.
  */
-import { html, postForm } from "./html.js";
+import { html, postForm, reauth } from "./html.js";
 import { bytesWords } from "./storage.js";
 import { RETENTION_KINDS, countWords, periodChoices, periodLabel } from "./retention.js";
 export const RETENTION_CSS = `.retention{max-width:720px;min-width:0}.retention-next{margin:0 0 16px}` +
@@ -31,5 +31,5 @@ export function retentionHtml(view, notice) {
         return html `<div class="kind" data-kind="${kind}"><label class="name" for="keep-${kind}">${label}</label><p class="meta">${detail}</p><select id="keep-${kind}" name="${kind}">${options}</select></div>`;
     });
     const last = view.lastSweep === null ? "" : ` Last sweep ${view.lastSweep.slice(0, 10)}.`;
-    return html `<article class="retention">${note}<p class="retention-next" data-retention-next>${nextWords(view)}${last}</p>${postForm("/settings/retention", html `${rows}<label class="step-up">Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label><button type="submit">Save</button>`)}<p class="meta">Never removed: the action ledger, and anything a task still needs (unfinished tasks, results Ready for review, anything on hold).</p></article>`;
+    return html `<article class="retention">${note}<p class="retention-next" data-retention-next>${nextWords(view)}${last}</p>${postForm("/settings/retention", html `${rows}${reauth(html `<label class="step-up">Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label>`)}<button type="submit">Save</button>`)}<p class="meta">Never removed: the action ledger, and anything a task still needs (unfinished tasks, results Ready for review, anything on hold).</p></article>`;
 }

package/dist/retention.js

@@ -24,6 +24,10 @@ import { RETENTION_NOTE } from "./evidence.js";
 import { COMPLETION_ACTION } from "./result-completion.js";
 import { bytesWords, treeBytes } from "./storage.js";
 import { RETENTION_DAYS, retentionDaysSchema, retentionKindSchema } from "./contracts/retention.js";
+/** A personal lead-queue row the sweep keeps (with its message): one still waiting, running or uncertain, and any of a
+ * conversation that is still open — its request id is the tombstone that stops a removed message being sent again. */
+const KEPT_QUEUE_ROW = (message) => `lead_queue lq WHERE lq.message = ${message}
+  AND (lq.status IN ('queued', 'running', 'uncertain') OR EXISTS (SELECT 1 FROM lead_session ls WHERE ls.id = lq.session AND ls.ended_at IS NULL))`;
 const RETENTION_TABLE = (name) => `
 CREATE TABLE IF NOT EXISTS ${name} (
   kind       TEXT PRIMARY KEY CHECK (kind IN ('evidence', 'checkouts', 'chat', 'notifications')),
@@ -177,6 +181,7 @@ export function retentionPlan(store, evidenceRoot, now, periods = store.retentio
         const rows = db.prepare(`SELECT m.id AS id, length(m.text) + COALESCE(length(m.activity), 0) + 64 AS bytes FROM lead_message m JOIN lead_thread th ON th.id = m.thread
       WHERE m.created_at < ?
         AND NOT EXISTS (SELECT 1 FROM team_message tm WHERE tm.message = m.id AND tm.status IN ('queued', 'running', 'uncertain'))
+        AND NOT EXISTS (SELECT 1 FROM ${KEPT_QUEUE_ROW("m.id")})
         AND NOT EXISTS (SELECT 1 FROM mate_turn turn WHERE turn.id = m.turn AND turn.state IN ('queued', 'running'))
         AND NOT (th.scope_kind = 'task' AND NOT EXISTS (SELECT 1 FROM task_ref r WHERE r.external_id = th.scope_key AND ${finishedTask("r")}))
       ORDER BY m.id LIMIT ?`).all(cutoff(now, periods.chat), SWEEP_BATCH + 1);
@@ -263,14 +268,18 @@ export function sweepRetention(store, evidenceRoot, now, actor = "worker") {
         }
         if (periods.chat !== null) {
             const team = db.prepare("DELETE FROM team_message WHERE message = ? AND status NOT IN ('queued', 'running', 'uncertain')");
-            const message = db.prepare("DELETE FROM lead_message WHERE id = ? AND NOT EXISTS (SELECT 1 FROM team_message WHERE message = ?)");
+            const message = db.prepare(`DELETE FROM lead_message WHERE id = ? AND NOT EXISTS (SELECT 1 FROM team_message WHERE message = ?)
+        AND NOT EXISTS (SELECT 1 FROM ${KEPT_QUEUE_ROW("lead_message.id")})`);
             const asked = db.prepare("SELECT turn FROM lead_message WHERE id = ? AND role = 'assistant' AND turn IS NOT NULL");
+            const searchCopy = db.prepare("DELETE FROM memory_search WHERE kind = 'conversation' AND ref = ?");
             // The lead's question goes with the reply that asked it; its buttons then say it expired.
             const ask = db.prepare("DELETE FROM lead_ask WHERE turn = ? AND NOT EXISTS (SELECT 1 FROM lead_message WHERE turn = ? AND role = 'assistant')");
             for (const one of plan.items.chat) {
                 team.run(one.id);
                 const turn = asked.get(one.id)?.["turn"];
                 if (Number(message.run(one.id, one.id).changes) === 1) {
+                    // Its search copy goes with it (search never shows words the store no longer keeps).
+                    searchCopy.run(`message:${one.id}`);
                     done.chat.count++;
                     done.chat.bytes += one.bytes;
                     if (turn !== undefined && turn !== null)

package/dist/run-efficiency.d.ts

@@ -0,0 +1,73 @@
+/**
+ * How a run went (docs/plans/run-efficiency.md): derived from the run's own records, display only. It never changes a
+ * completion, an approval, a charge or a check verdict, and it claims nothing its sources don't hold — an unreported
+ * number is unknown (null, shown as a dash), never zero.
+ *
+ * Sources, and what each can say: the run row (wall times, tokens, the provider's raw usage with its cache counts, the
+ * agent's turns where reported) is kept with the run; the live records (`<evidence>/live/<run>.jsonl`, display-only,
+ * kept 24 hours) are read once, bounded, through the descriptor-safe live reader, for step counts and observed step
+ * times. No command text is ever stored here: repeats are counted, never quoted.
+ */
+import type { Run, Store } from "./store.js";
+import type { LiveActivityKind, LiveRecord } from "./live-records.js";
+export declare const RUN_EFFICIENCY_VERSION = 3;
+/** Budgets for one derivation: never more than the live file's own cap, and a bounded record count. */
+export declare const EFFICIENCY_READ_BYTES: number;
+export declare const EFFICIENCY_RECORDS = 20000;
+export type StepsState = "complete" | "truncated" | "expired" | "absent";
+export type RunEfficiency = {
+    version: number;
+    /** Waiting to start (claimed → provider started) and the agent (provider started → finished); null when unrecorded. */
+    time: {
+        waitMs: number | null;
+        agentMs: number | null;
+    };
+    turns: number | null;
+    /** Tokens in counts everything the model read (cached included); `cacheShare` is read-from-cache ÷ that, 0–1. */
+    usage: {
+        in: number | null;
+        out: number | null;
+        cacheRead: number | null;
+        cacheWrite: number | null;
+        cacheShare: number | null;
+        provider: string;
+        model: string | null;
+    };
+    steps: {
+        state: StepsState;
+        reason: string | null;
+        total: number | null;
+        failed: number | null;
+        unknownDuration: number | null;
+        byKind: Partial<Record<LiveActivityKind, number>>;
+        longest: {
+            kind: LiveActivityKind;
+            ms: number;
+        }[];
+        /** Repeated activity: the same step (kind and its full recorded input) at least three times. Null when the inputs
+         * can't be compared (command detail off, or a target hidden or shortened) — said, never guessed. */
+        repeats: {
+            kind: LiveActivityKind;
+            count: number;
+        }[] | null;
+        repeatsReason: string | null;
+    };
+};
+/** Tokens and cache from the provider's own usage report, read per provider (their counts mean different things). */
+export declare function usageOf(run: Pick<Run, "provider" | "model" | "tokensIn" | "tokensOut"> & {
+    usageJson?: string | null;
+}): RunEfficiency["usage"];
+/** The live records' steps, bounded: counts by kind, failures, observed times and repeats (never their words). */
+/** `measured`: the recorder saw this provider's steps start and end as they happened (Claude's stream does); for the
+ * others their times are partly made up (Codex reports a step when it completes, ACP agents may report late), so no
+ * duration is claimed for them. */
+export declare function stepsOf(records: Iterable<LiveRecord>, truncated: string | null, measured?: boolean): RunEfficiency["steps"];
+/** Derive a finished run's How it ran from its records. */
+export declare function deriveRunEfficiency(run: Run & {
+    usageJson?: string | null;
+}, evidenceRoot: string, now: Date): RunEfficiency;
+/**
+ * A finished run's How it ran: the saved one when it was derived by this version, else derived now and saved (once:
+ * a row whose steps were complete or have expired is final). An unfinished run is derived but never saved.
+ */
+export declare function runEfficiencyOf(store: Store, evidenceRoot: string, runId: number, now: Date): RunEfficiency | null;

package/dist/run-efficiency.js

@@ -0,0 +1,228 @@
+import { closeSync, constants, fstatSync, lstatSync, openSync, readSync } from "node:fs";
+import { join } from "node:path";
+import { LIVE_RETAIN_MS, legacyLiveLogPath, liveLogPath, liveWindowRecords } from "./live.js";
+export const RUN_EFFICIENCY_VERSION = 3;
+/** Budgets for one derivation: never more than the live file's own cap, and a bounded record count. */
+export const EFFICIENCY_READ_BYTES = 4 * 1024 * 1024;
+export const EFFICIENCY_RECORDS = 20_000;
+const LONGEST = 5;
+const num = (value) => typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : null;
+const msBetween = (from, to) => {
+    if (from === null || to === null)
+        return null;
+    const ms = Date.parse(to) - Date.parse(from);
+    return Number.isFinite(ms) && ms >= 0 ? ms : null;
+};
+/** Tokens and cache from the provider's own usage report, read per provider (their counts mean different things). */
+export function usageOf(run) {
+    let raw = {};
+    try {
+        const parsed = run.usageJson == null ? null : JSON.parse(run.usageJson);
+        if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed))
+            raw = parsed;
+    }
+    catch {
+        raw = {};
+    }
+    const base = { provider: run.provider, model: run.model ?? null, out: num(raw["output_tokens"]) ?? run.tokensOut ?? null };
+    if (run.provider === "claude") {
+        // Claude's input_tokens leave out what was read from or written to the cache: the three add up to what it read, so
+        // all three must be reported before a total or a share is claimed (a missing one is unknown, never zero).
+        const input = num(raw["input_tokens"]), read = num(raw["cache_read_input_tokens"]), write = num(raw["cache_creation_input_tokens"]);
+        const total = input === null || read === null || write === null ? null : input + read + write;
+        return { ...base, in: total, cacheRead: read, cacheWrite: write, cacheShare: total === null || total === 0 ? null : read / total };
+    }
+    if (run.provider === "codex") {
+        // Codex's input_tokens already include what came from its cache: both reported, or no share.
+        const input = num(raw["input_tokens"]), read = num(raw["cached_input_tokens"]);
+        return { ...base, in: input ?? run.tokensIn ?? null, cacheRead: read, cacheWrite: null,
+            cacheShare: read === null || input === null || input === 0 || read > input ? null : read / input };
+    }
+    return { ...base, in: run.tokensIn ?? null, cacheRead: null, cacheWrite: null, cacheShare: null };
+}
+/** The live records' steps, bounded: counts by kind, failures, observed times and repeats (never their words). */
+/** `measured`: the recorder saw this provider's steps start and end as they happened (Claude's stream does); for the
+ * others their times are partly made up (Codex reports a step when it completes, ACP agents may report late), so no
+ * duration is claimed for them. */
+export function stepsOf(records, truncated, measured = true) {
+    let detail = "base";
+    const open = new Map();
+    const byKind = {};
+    const longest = [];
+    let total = 0, failed = 0, unknown = 0;
+    for (const record of records) {
+        if (record.k === "open")
+            detail = record.detail;
+        else if (record.k === "step") {
+            if (record.kind === "session" || record.kind === "message")
+                continue;
+            total++;
+            byKind[record.kind] = (byKind[record.kind] ?? 0) + 1;
+            open.set(record.id, { kind: record.kind, at: record.at, once: record.once === true });
+        }
+        else if (record.k === "done") {
+            const started = open.get(record.id);
+            if (started === undefined)
+                continue;
+            open.delete(record.id);
+            if (record.ok === false)
+                failed++;
+            // Not a measured time: a provider whose times the recorder can't see as they happen, a start and end made up
+            // together (`once`), a step the recorder closed itself when the run ended (outcome unknown), or no time between.
+            const ms = !measured || started.once || record.ok === null ? null : msBetween(started.at || null, record.at || null);
+            if (ms === null || ms === 0) {
+                unknown++;
+                continue;
+            }
+            longest.push({ kind: started.kind, ms });
+            longest.sort((a, b) => b.ms - a.ms);
+            if (longest.length > LONGEST)
+                longest.pop();
+        }
+    }
+    // Steps that never closed (the run ended, or the file was cut) have no measured time.
+    unknown += open.size;
+    // Repeats are never claimed: the step records keep a display form of each step (a file name, a host, a command with
+    // its shell wrapper taken off), so two different steps can read alike. Said, not guessed.
+    const repeatsReason = detail === "commands"
+        ? "Repeats can't be told apart: the step records keep a short form of each step, not its whole input."
+        : "Repeats can't be told apart: this project doesn't record step details.";
+    const repeats = null;
+    return { state: truncated === null ? "complete" : "truncated", reason: truncated, total, failed, unknownDuration: unknown, byKind, longest, repeats, repeatsReason };
+}
+const noSteps = (state, reason) => ({ state, reason, total: null, failed: null, unknownDuration: null, byKind: {}, longest: [], repeats: null, repeatsReason: null });
+/** Read the run's live records once, strictly bounded: its own descriptor (no link followed, in a real live
+ * directory), measured once, and never more than the budget read whatever the file does meanwhile; then parsed line by
+ * line. A file over the budget, in the older text format, with lines that don't read, or cut or capped while the agent
+ * ran, says its steps are incomplete. Null when there is no step file at all. */
+function readRecords(evidenceRoot, runId) {
+    try {
+        const dir = lstatSync(join(evidenceRoot, "live"));
+        if (!dir.isDirectory() || dir.isSymbolicLink())
+            return null;
+    }
+    catch {
+        return null;
+    }
+    let fd;
+    try {
+        fd = openSync(liveLogPath(evidenceRoot, runId), constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            return { unreadable: "The step records couldn't be read." };
+        // No records file: an older run's plain text file has no step detail; with neither, there is nothing.
+        try {
+            lstatSync(legacyLiveLogPath(evidenceRoot, runId));
+            return { unreadable: "This run's steps were recorded in an older format that has no step detail." };
+        }
+        catch {
+            return null;
+        }
+    }
+    let text, short = false;
+    try {
+        const stat = fstatSync(fd);
+        if (!stat.isFile())
+            return { unreadable: "The step records aren't a plain file, so they weren't read." };
+        if (stat.size > EFFICIENCY_READ_BYTES)
+            return { unreadable: "The step records are larger than they can be read here." };
+        // At most what it measured, and never past the budget: growth after the measure is not read.
+        const buffer = Buffer.alloc(stat.size);
+        let at = 0;
+        while (at < buffer.length) {
+            const got = readSync(fd, buffer, at, buffer.length - at, at);
+            if (got <= 0)
+                break;
+            at += got;
+        }
+        // Less than it measured: the file changed under the read.
+        short = at < buffer.length;
+        text = buffer.subarray(0, at).toString("utf8");
+    }
+    catch {
+        return { unreadable: "The step records couldn't be read." };
+    }
+    finally {
+        closeSync(fd);
+    }
+    const lines = text.split("\n");
+    // The last line may be unfinished (the agent's final write): it is read when it parses, never counted as a loss.
+    const unfinished = lines.at(-1) ?? "";
+    const whole = lines.slice(0, -1).filter(line => line.trim() !== "");
+    if (whole.length > EFFICIENCY_RECORDS)
+        whole.length = EFFICIENCY_RECORDS;
+    const keys = { inKey: false };
+    // One record per line: a whole line that doesn't read is a record lost.
+    const read = liveWindowRecords({ text: whole.length === 0 ? "" : `${whole.join("\n")}\n`, format: "records" }, keys);
+    const lost = whole.length - read.length;
+    // A finished run's last line without its newline is read like any other; one that doesn't read is a record lost.
+    const tail = unfinished.trim() === "" ? [] : liveWindowRecords({ text: `${unfinished}\n`, format: "records" }, keys);
+    const records = [...read, ...tail];
+    const lostAll = lost + (unfinished.trim() !== "" && tail.length === 0 ? 1 : 0);
+    if (records.length === 0 && text.trim() !== "")
+        return { unreadable: "The step records couldn't be read." };
+    const truncated = short ? "the step records changed while they were read"
+        : lines.length - 1 > EFFICIENCY_RECORDS ? `only the first ${EFFICIENCY_RECORDS.toLocaleString("en-US")} records were read`
+            : records.some(one => one.k === "cap") ? "the step records reached their size limit while the agent ran"
+                : records.some(one => one.k === "cut") ? "a step record was too long to keep"
+                    : lostAll > 0 ? `${lostAll} step record${lostAll === 1 ? "" : "s"} couldn't be read`
+                        : null;
+    return { records, truncated };
+}
+/** Derive a finished run's How it ran from its records. */
+export function deriveRunEfficiency(run, evidenceRoot, now) {
+    const finished = run.finishedAt;
+    const read = readRecords(evidenceRoot, run.id);
+    const steps = read !== null && "unreadable" in read ? noSteps("truncated", read.unreadable)
+        : read !== null ? stepsOf(read.records, read.truncated, run.provider === "claude")
+            : finished !== null && now.getTime() - Date.parse(finished) > LIVE_RETAIN_MS ? noSteps("expired", "Step details are kept for a day after a run; this one's have expired.")
+                : noSteps("absent", "No step records were kept for this run.");
+    return {
+        version: RUN_EFFICIENCY_VERSION,
+        time: { waitMs: msBetween(run.startedAt, run.providerStartedAt), agentMs: msBetween(run.providerStartedAt, finished) },
+        turns: run.agentTurns ?? null,
+        usage: usageOf(run),
+        steps,
+    };
+}
+/**
+ * A finished run's How it ran: the saved one when it was derived by this version, else derived now and saved (once:
+ * a row whose steps were complete or have expired is final). An unfinished run is derived but never saved.
+ */
+export function runEfficiencyOf(store, evidenceRoot, runId, now) {
+    const run = store.getRun(runId);
+    if (run === null)
+        return null;
+    const usageJson = store.handle.prepare("SELECT usage_json FROM run WHERE id = ?").get(runId)?.["usage_json"];
+    const full = { ...run, usageJson: typeof usageJson === "string" ? usageJson : null };
+    if (run.finishedAt === null)
+        return deriveRunEfficiency(full, evidenceRoot, now);
+    let saved;
+    try {
+        saved = store.handle.prepare("SELECT parser_version, payload_json FROM run_efficiency WHERE run = ?").get(runId);
+    }
+    catch {
+        saved = undefined;
+    }
+    if (saved !== undefined && Number(saved["parser_version"]) === RUN_EFFICIENCY_VERSION) {
+        try {
+            return JSON.parse(String(saved["payload_json"]));
+        }
+        catch { /* derived again below */ }
+    }
+    const derived = deriveRunEfficiency(full, evidenceRoot, now);
+    const payload = JSON.stringify(derived);
+    // A row too large for its column (it can't be: the counts are bounded) is shown, never saved.
+    // Saving is a convenience: a store that can't take the row (read-only, busy) still shows what was derived.
+    if (payload.length <= 16_384) {
+        try {
+            store.handle.prepare(`INSERT INTO run_efficiency (run, parser_version, steps, steps_reason, payload_json, derived_at) VALUES (?, ?, ?, ?, ?, ?)
+        ON CONFLICT(run) DO UPDATE SET parser_version = excluded.parser_version, steps = excluded.steps, steps_reason = excluded.steps_reason,
+          payload_json = excluded.payload_json, derived_at = excluded.derived_at`)
+                .run(runId, RUN_EFFICIENCY_VERSION, derived.steps.state, derived.steps.reason, payload, now.toISOString());
+        }
+        catch { /* shown, not saved: derived again next time */ }
+    }
+    return derived;
+}

package/dist/runner.d.ts

@@ -19,6 +19,8 @@
  * again. Reaping on the second tells you a *machine* is gone, and everything
  * it was holding — claims and worktrees alike — needs recovering together.
  */
+import { type AcpProviderId } from "./acp-agents.js";
+import type { AcpAttestation } from "./store.js";
 import type { Store, Mutation } from "./store.js";
 import { type ProviderId } from "./provider.js";
 import type { ReadinessObservation } from "./phase-routing.js";
@@ -264,7 +266,9 @@ export type ReadinessProbe = (file: string, args: readonly string[], options?: {
     notFound: boolean;
     timedOut: boolean;
 }>;
-export declare function observeProviderReadiness(probe: ReadinessProbe, env?: Record<string, string | undefined>, providers?: readonly ProviderId[]): Promise<Omit<ReadinessObservation, "runner" | "observedAt">[]>;
+export declare function observeProviderReadiness(probe: ReadinessProbe, env?: Record<string, string | undefined>, providers?: readonly ProviderId[], 
+/** An ACP agent's live check on this runner (store.acpAttestationFor), when the caller can read one. */
+acpChecked?: (provider: AcpProviderId) => AcpAttestation | null): Promise<Omit<ReadinessObservation, "runner" | "observedAt">[]>;
 /**
  * Record a runner's observations under its OWN authenticated name: the
  * credential is verified and the rows written in one transaction, so a

package/dist/runner.js

@@ -19,6 +19,9 @@
  * again. Reaping on the second tells you a *machine* is gone, and everything
  * it was holding — claims and worktrees alike — needs recovering together.
  */
+import { isAcpProvider } from "./acp-agents.js";
+import { verifyLaunch } from "./acp-attest.js";
+import { inspectAcpAgent, inspectionWords } from "./acp-inspect.js";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { resolve } from "node:path";
 import { canonicalProject } from "./project.js";
@@ -363,8 +366,26 @@ function sameDigest(left, right) {
     return a.length === b.length && timingSafeEqual(a, b);
 }
 const READINESS_PROBE_TIMEOUT_MS = 5_000;
-export async function observeProviderReadiness(probe, env = process.env, providers = PROVIDER_IDS) {
+export async function observeProviderReadiness(probe, env = process.env, providers = PROVIDER_IDS, 
+/** An ACP agent's live check on this runner (store.acpAttestationFor), when the caller can read one. */
+acpChecked) {
     return Promise.all(providers.map(async (provider) => {
+        // An ACP agent is looked at, never run, outside the gateway (acp-inspect.ts). It is ready only once its
+        // conformance check passed on this computer; until then it says so.
+        if (isAcpProvider(provider)) {
+            const checked = acpChecked?.(provider) ?? null;
+            if (checked !== null) {
+                // Ready only while every file its check bound is still the one that passed.
+                const verified = verifyLaunch(checked.launch);
+                return verified.ok
+                    ? { provider, state: "ready", reason: `${checked.agent.name} ${checked.agent.version}, checked ${checked.recordedAt.slice(0, 10)}`, probe: "version" }
+                    : { provider, state: "unavailable", reason: `${verified.problem}`, probe: "version" };
+            }
+            const seen = inspectAcpAgent(provider, env);
+            return seen.found
+                ? { provider, state: "unavailable", reason: `${inspectionWords(seen)}; not checked on this computer — run \`toolroll agents check ${provider}\``, probe: "version" }
+                : { provider, state: "unavailable", reason: inspectionWords(seen), probe: "version" };
+        }
         const facts = inspectionOf(provider);
         const version = await probe(facts.binary, ["--version"], { timeoutMs: READINESS_PROBE_TIMEOUT_MS, omitEnv: ALL_CREDENTIAL_ENV });
         if (version.notFound) {