toolroll 0.9.7 → 0.9.9

package/dist/operate.js

@@ -1,13 +1,18 @@
 import { maybeTriggerRepair } from "./dispose.js";
 import { CHECK_LEVEL_HINTS, CHECK_LEVEL_WORDS, isCheckLevel, liveQuickCommand, projectCheckLevel, quickVerifyKey, setProjectCheckLevel, setTaskCheckLevel, suggestQuickCommand } from "./check-levels.js";
 import { fileAddTestsTask, followUpChecksOf, requestFollowUpChecks, runFollowUpCheck, runWaitingChecks } from "./result-follow-ups.js";
+import { buildReviewPass } from "./build-review.js";
+import { buildReviewLines, buildReviewOf } from "./review-switch.js";
 import { parseProtectedPaths } from "./approval-policy.js";
 import { rulesSummary } from "./approval-rules-ui.js";
 import { evidencePack, exportDay, ledgerExportChunks, standaloneEvidenceHtml } from "./evidence-pack.js";
 import { matchesOutsideCheckpoint } from "./ledger-chain.js";
-import { CLEANUP_CHOICES, bytesWords, cleanupWords, parseCleanup, storageReport } from "./storage.js";
-import { checkoutPlan, cleanCheckouts, discardCheckout, whyWords } from "./checkout-cleanup.js";
-import { MIN_DAYS, RETENTION_KINDS, countWords, dailyRetention, isRetentionKind, lastSweepAt, parsePeriod, periodWords, retentionPlan, sweepWords } from "./retention.js";
+import { CLEANUP_CHOICES, bytesWords, cleanupWords, diskBytes, parseCleanup, storageReport } from "./storage.js";
+import { removeStaleTestTemp, tempRoots, testTempFolders } from "./test-temp.js";
+import { removeShared, sharedDepsRoot, sharedUse, unusedShared } from "./shared-deps.js";
+import { checkoutPlan, cleanCheckouts, discardCheckout, finishedCheckouts, slimKeptCheckouts, whyWords } from "./checkout-cleanup.js";
+import { closeOutCheckouts, closeOutRuns, stoppedWords } from "./run-closeout.js";
+import { MIN_DAYS, RETENTION_KINDS, countWords, dailyRetention, isRetentionKind, lastSweepAt, parsePeriod, periodLabel, periodWords, retentionPlan, sweepWords } from "./retention.js";
 import { checkPolicy, parseList, policyParts } from "./policy.js";
 import { billingOf, budgetHoldWords, budgetLabel, budgetStates, monthNamed, monthOf, spendItems, teammateNames, usd as spendUsd } from "./spend.js";
 import { spendCsv } from "./spend-ui.js";
@@ -71,6 +76,7 @@ import { pullRequestLines, runTaskMergeCommand, runTaskOutcomeCommand } from "./
  */
 import { homedir, hostname, tmpdir } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
+import { releaseStalledUpdate, waitingUpdate } from "./toolroll-update.js";
 import { openStore, openStoreNoMigrate, CONCURRENT_WRITER_WAIT_MS, isDatabaseBusy, databasePath, BUILT_IN, DEFAULT_ACTOR, parseCapabilityKey, verifiedAuthor, contestantProfileOf, isDigestTime, } from "./store.js";
 import { randomBytes, randomInt, randomUUID } from "node:crypto";
 import { authorizePlanUnderMode } from "./plan-auto.js";
@@ -191,7 +197,7 @@ import { runModelsCommand } from "./models-cli.js";
 import { updateAdmissionPaused, UPDATE_PAUSED } from "./desktop-update-gate.js";
 import { beads } from "./beads.js";
 import { githubIssues } from "./issues.js";
-import { installationStatus, renderInstallationStatus, renderTaskWait, taskWaitSnapshot } from "./lead-status.js";
+import { installationStatus, renderInstallationStatus, renderTaskWait, repairStaleStatuses, taskWaitSnapshot } from "./lead-status.js";
 import { latestRelease, newerRelease, notifySecurityRelease, recordRunnerVersion, startUpdateChecks, updateLine } from "./releases.js";
 import { installMethod } from "./install-method.js";
 import { PACKAGE_VERSION } from "./version.js";
@@ -225,8 +231,8 @@ export const OPERATE_HELP = `toolroll — operating the queue
                                         how many of a project's tasks build at once (default 2, never past the
                                         worker's capacity); an approver changes it with <n>
   toolroll task evidence <id>        the task's evidence pack as JSON (--html for a printable page; --out <file>)
-  toolroll storage                   where the disk goes: database, build checkouts, releases, evidence
-  toolroll storage clean [--yes]     preview removing finished tasks' clean checkouts (their branches stay); --yes removes them
+  toolroll storage                   where the disk goes: database, build checkouts, releases, evidence, leftover test temp folders
+  toolroll storage clean [--yes]     preview removing finished tasks' clean checkouts (their branches stay) and test temp folders older than a day; --yes removes them
   toolroll storage cleanup <when>    remove a finished task's clean checkout: finished|2d|7d|never (instance operator)
   toolroll storage discard <path> --yes   throw away a checkout kept for its changes; its branch stays
   toolroll integrations [--json]     which integrations work: Connected, Not set up or Broken, and what to do (--saved: no new checks)
@@ -239,9 +245,10 @@ export const OPERATE_HELP = `toolroll — operating the queue
   toolroll notifications digest <HH:MM>|off   one evening message: what finished, what waits, what failed
   toolroll notifications mute|unmute --repo <p>   no pings for a project; the console and digest keep it
   toolroll retention show|preview    how long evidence, checkout records, chat and notifications are kept; what the daily sweep would remove
-  toolroll retention set <kind> <period>   evidence|checkouts|chat|notifications, 30d|1y|forever (instance operator)
+  toolroll retention set <kind> <period>   evidence|checkouts|chat|notifications, 1d|30d|1y|forever (instance operator)
   toolroll backup now|list          back the database up now; list backups and how the last ones went
   toolroll restore <file> [--dry-run]  put a backup back (Toolroll stopped; the current database is kept)
+  toolroll review show|on|off --repo <path>  one automatic review of each finished build; only HIGH findings send it back
   toolroll policy show|set          the organisation policy; an instance operator sets it with --providers claude,codex|any,
                                         --models <m,…>|any, --tools <t,…>|any, --ceiling safe|standard|escalated
   toolroll ledger verify             check the action ledger's hash chain (--checkpoint <n:hash> to compare a copied head)
@@ -804,6 +811,7 @@ export async function runOperate(command, argv, write, options = {}) {
             // it matters.
             evidenceRoot: join(dirname(file), "evidence"),
             databaseFile: file,
+            ...(options.tempRoots === undefined ? {} : { tempRoots: options.tempRoots }),
             // The bot token's file home. Never a column; see telegram.ts.
             telegramTokenFile: join(dirname(file), "telegram-token"),
             ...(options.desktopIdentity === undefined ? {} : { desktopIdentity: options.desktopIdentity }),
@@ -932,6 +940,8 @@ async function dispatch(command, positional, flags, context) {
             return storageCommand(positional, flags, context);
         case "integrations":
             return integrationsCommand(positional, flags, context);
+        case "review":
+            return reviewSwitchCommand(positional, flags, context);
         case "monitoring": {
             // Where the audit stream and traces go, and how each destination is doing. Settings → Monitoring changes it.
             const settings = readMonitoring(dirname(context.databaseFile));
@@ -992,6 +1002,8 @@ async function dispatch(command, positional, flags, context) {
             return tickCommand(flags, context);
         case "reconcile":
             return reconcileCommand(flags, context);
+        case "run":
+            return runCommand(positional, flags, context);
         case "cap":
             return capCommand(positional, flags, context);
         case "gaps":
@@ -4277,19 +4289,20 @@ async function tickCommand(flags, context) {
                 broke++;
         }
     }
-    // Retire queued model-review work without creating a run or a passing verdict.
-    // Reauthenticate inside the write transaction and touch only admitted projects.
-    if (!buildsOnly)
-        store.transact(() => {
-            const current = authenticate(store, runner, token);
-            if (!current.ok)
-                return;
-            for (const request of store.openReviewRequests()) {
-                if (request.repo !== null && current.runner.repos.includes(request.repo)) {
-                    store.consumeReviewRequest(request.id, "model-review-retired", clock());
-                }
-            }
+    // The one automatic review each finished build gets when its project's
+    // switch is on, before the result is handed on below. Other queued review
+    // asks close unrun. Reauthenticated first; only admitted projects.
+    if (!buildsOnly && authenticate(store, runner, token).ok) {
+        const reviewed = await buildReviewPass(store, {
+            runner, token, repos: auth.runner.repos, clock,
+            root: context.evidenceRoot,
+            ...(text(flags, "incarnation") === undefined ? {} : { watchIncarnation: text(flags, "incarnation") }),
+            ...(context.agentRunner === undefined ? {} : { agent: context.agentRunner }),
+            shouldStop: () => context.shouldStop?.() === true || context.shouldPauseAdmission?.() === true,
         });
+        for (const one of reviewed)
+            dispatched.push({ id: `review of run ${one.run}`, outcome: one.outcome === "not-reviewed" ? "not-reviewed" : "reviewed", reason: one.detail });
+    }
     // Existing worker pass owns durable lead handoffs; reads never create events.
     if (!buildsOnly)
         syncAssignmentHandoffs(store, clock(), auth.runner.repos, context.evidenceRoot);
@@ -4327,7 +4340,7 @@ async function tickCommand(flags, context) {
             routines,
         });
     }
-    if (built > 0 || parked > 0 || dispatched.some(one => one.outcome === "planned" || one.outcome === "reported" || one.outcome === "held")) {
+    if (built > 0 || parked > 0 || dispatched.some(one => one.outcome === "planned" || one.outcome === "reported" || one.outcome === "held" || one.outcome === "reviewed" || one.outcome === "not-reviewed")) {
         return succeed(write, json, "tick", { considered, dispatched, routines, ...flows }, summary);
     }
     if (considered === 0) {
@@ -4389,7 +4402,21 @@ async function reconcileCommand(flags, context) {
         }
     }
     const recovered = recoverDead(store, clock());
+    // A run that ended, whatever its outcome, leaves nothing running: what is still in its process groups is stopped
+    // (SIGTERM, then SIGKILL after 10 s) and the ledger names it. Never the live service.
+    const closedRuns = await closeOutRuns(store, clock, { repo });
+    // A finished run's processes that have since gone get their exits recorded,
+    // so its task stops waiting on a person by itself.
+    store.recordFinishedRunExits(clock());
+    // A witness reserved for a spawn that never made a process (a crash or a
+    // thrown spawn) settles once its run's process groups are proven gone.
+    store.settleUnspawnedWitnesses(clock());
     store.settleQuiescentStops(clock());
+    // An update whose updater ended while letting work finish must not leave new work paused.
+    try {
+        releaseStalledUpdate(dirname(context.databaseFile), clock());
+    }
+    catch { /* status and the console say it */ }
     for (const one of recovered) {
         for (const leaseId of one.claims) {
             // Lease ids are unique forever, so each recovery is its own episode.
@@ -4441,7 +4468,11 @@ async function reconcileCommand(flags, context) {
     }
     // Checkout cleanup (Settings → Storage): finished work's clean checkouts go as the setting says (by default when
     // the task is complete or cancelled); their branches stay. Each removal is in the ledger.
+    // Completing or cancelling a task stops anything still running from its checkout first.
+    const closedCheckouts = await closeOutCheckouts(store, clock, finishedCheckouts(store, clock(), repo));
     const pruned = await cleanCheckouts(store, worktrees, clock, { manual: false, actor: "worker", repo });
+    // What stays for review or for its changes drops its dependencies and build output; the next run's setup restores them.
+    const slimmed = await slimKeptCheckouts(store, worktrees, clock, { actor: "worker", repo });
     // Retention (Settings → Retention): once a day, what's older than its setting goes; one ledger entry says what.
     let retention = null;
     try {
@@ -4457,6 +4488,9 @@ async function reconcileCommand(flags, context) {
         adoption.adopted.length === 0 &&
         adoption.forgotten.length === 0 &&
         pruned.removed.length === 0 &&
+        closedRuns.length === 0 &&
+        closedCheckouts.length === 0 &&
+        slimmed.slimmed.length === 0 &&
         liveSwept.removed.length === 0;
     return succeed(write, json, "reconcile", {
         recovered,
@@ -4465,6 +4499,8 @@ async function reconcileCommand(flags, context) {
         forgotten: adoption.forgotten,
         checkoutsRemoved: pruned.removed.map(one => one.path),
         checkoutsKept: pruned.kept,
+        processesStopped: [...closedRuns.map(one => ({ run: one.runId, pids: one.done.stopped.map(row => row.pid) })), ...closedCheckouts.map(one => ({ checkout: one.path, pids: one.done.stopped.map(row => row.pid) }))],
+        checkoutsSlimmed: slimmed.slimmed.map(one => one.path),
         liveViewsSwept: liveSwept.removed.length,
         retention: retention === null ? null : { counts: retention.counts, freedBytes: retention.freed },
     }, () => nothing
@@ -4475,6 +4511,9 @@ async function reconcileCommand(flags, context) {
             ...adoption.adopted.map(path => `Adopted ${path} — released, unverified, somebody should look.`),
             ...adoption.forgotten.map(path => `Forgot ${path} — its directory is gone.`),
             ...(pruned.removed.length === 0 ? [] : [`Removed ${pruned.removed.length} finished task checkout(s), about ${bytesWords(pruned.freed)}; their branches stay.`]),
+            ...closedRuns.map(one => `Run #${one.runId} ended; stopped ${stoppedWords(one.done)}.`),
+            ...closedCheckouts.map(one => `${one.path}: its task finished; stopped ${stoppedWords(one.done)}.`),
+            ...(slimmed.slimmed.length === 0 ? [] : [`Dropped dependencies and build output from ${slimmed.slimmed.length} kept checkout(s), about ${bytesWords(slimmed.slimmed.reduce((sum, one) => sum + one.bytes, 0))}.`]),
             ...(liveSwept.removed.length === 0 ? [] : [`Cleared ${liveSwept.removed.length} finished live view(s).`]),
             ...(retention === null || retained.length === 0 ? [] : [`Retention removed ${sweepWords(retention.counts, retention.freed)}.`]),
         ]);
@@ -5045,13 +5084,18 @@ async function planTaskCommand(positional, flags, context) {
 }
 /** The retired command is a typed refusal, never a new provider request. */
 async function reviewTaskCommand(positional, flags, context) {
-    const { store, write, json, clock } = context;
+    const { store, write, json } = context;
     const [runText] = positional;
     const runId = Number(runText ?? "");
     if (runText === undefined || !Number.isInteger(runId) || runId < 1) {
         return fail(write, json, "task review", "usage", "`toolroll task review <run-id>`", EXIT.usage);
     }
-    return fail(write, json, "task review", "model-review-retired", `Separate model review has been removed. Inspect run ${runId}'s saved work and checks, then give feedback or request a revision.`, EXIT.refused);
+    // Read-only: the run's one automatic review, when it had one.
+    const review = buildReviewOf(store, runId);
+    if (review !== null) {
+        return succeed(write, json, "task review", { run: runId, review }, () => [`Run ${runId}`, ...buildReviewLines(review)]);
+    }
+    return fail(write, json, "task review", "model-review-retired", `Run ${runId} has no automatic review. Manual review requests have been removed; a project's builds are reviewed automatically when its switch is on (\`toolroll review on --repo <path>\`). Inspect the saved work and checks, then give feedback or request a revision.`, EXIT.refused);
 }
 /**
  * `toolroll incident list|resolve <id>` — the parks that never became
@@ -7243,6 +7287,8 @@ async function daemonCommand(positional, flags, context) {
 // ---- the watch loop --------------------------------------------------------
 const WATCH_LEASE_MS = 90_000;
 const WATCH_HEARTBEAT_MS = 30_000;
+/** The start repair runs once per process, not once per project loop. */
+let staleStatusesRepaired = false;
 async function runWatchLoop(args) {
     const { context, flags, runner, token, repo, progress } = args;
     const { store } = context;
@@ -7280,6 +7326,14 @@ async function runWatchLoop(args) {
     store.startWatchEpisode({ repo, runner, incarnation }, new Date());
     recordRunnerVersion(dirname(context.databaseFile), runner, PACKAGE_VERSION, new Date());
     args.onReady?.();
+    // Once per worker start, before any pass: statuses an older build left
+    // stale (unrecorded exits of finished runs) are re-derived and clear.
+    if (!staleStatusesRepaired) {
+        staleStatusesRepaired = true;
+        const repaired = repairStaleStatuses(store, new Date());
+        if (repaired.exitsRecorded > 0)
+            progress(`watch: recorded ${repaired.exitsRecorded} finished process exit(s) left open by an earlier version`);
+    }
     // A false renewal is FATAL (arc 2 finding 15): the lease or the
     // credential is gone, and admitting one more pass would be work done for
     // an authority this process no longer holds.
@@ -7776,7 +7830,8 @@ async function watchCommand(flags, context) {
             token,
             repo,
             progress,
-            isStopping: () => stopping,
+            // An injected fence (tests) stops admission exactly as a signal does.
+            isStopping: () => stopping || context.shouldStop?.() === true,
             onFollowController: controller => {
                 followAbort = controller;
             },
@@ -8820,6 +8875,10 @@ async function bridgeCommand(positional, flags, context) {
         const runFor = text(flags, "for");
         const timer = runFor === undefined ? null : setTimeout(() => controller.abort(), Number(runFor));
         timer?.unref?.();
+        // An injected fence (tests) ends the follow exactly as a signal does.
+        const fence = context.shouldStop === undefined ? null : setInterval(() => { if (context.shouldStop?.() === true)
+            controller.abort(); }, 50);
+        fence?.unref?.();
         if (!json)
             write(`Following bot ${source.botId} — taps apply as they arrive. Ctrl-C stops it.`);
         try {
@@ -8849,6 +8908,8 @@ async function bridgeCommand(positional, flags, context) {
         finally {
             if (timer !== null)
                 clearTimeout(timer);
+            if (fence !== null)
+                clearInterval(fence);
             process.removeListener("SIGINT", stop);
             process.removeListener("SIGTERM", stop);
         }
@@ -9512,10 +9573,13 @@ async function statusCommand(positional, flags, context) {
     const brokenIntegrations = await savedIntegrations(context).then(list => list.filter(one => one.state === "broken"), () => []);
     const brokenLine = integrationsBrokenLine(brokenIntegrations);
     const integrations = brokenIntegrations.length === 0 ? {} : { integrations: { broken: brokenIntegrations.map(one => ({ key: one.key, name: one.name, fix: one.action.kind === "fix" ? one.action.words : null })) } };
+    // An update waiting, on what, and the action: before anything else, as it holds up new work.
+    const waiting = waitingUpdate(context.databaseFile, run => context.store.stopQuiescenceProblem(run) !== null, context.clock());
+    const updateWaiting = waiting === null ? {} : { updateWaiting: { app: waiting.app, version: waiting.version, stopped: waiting.stopped, run: waiting.run, on: waiting.on, action: waiting.action } };
     const projects = projectBuildsStatus(context);
     const projectsLine = projects.length === 0 ? null
         : `Builds by project: ${projects.slice(0, 8).map(one => `${one.name} ${one.running} of ${one.limit}`).join(", ")}${projects.length > 8 ? ", …" : ""}`;
-    return succeed(context.write, context.json, command, { ...status, projects, ...update, ...integrations }, () => [...renderInstallationStatus(status), ...(projectsLine === null ? [] : [projectsLine]), ...(line === null ? [] : [line]), ...(brokenLine === null ? [] : [brokenLine])]);
+    return succeed(context.write, context.json, command, { ...status, projects, ...update, ...integrations, ...updateWaiting }, () => [...(waiting === null ? [] : [waiting.words]), ...renderInstallationStatus(status), ...(projectsLine === null ? [] : [projectsLine]), ...(line === null ? [] : [line]), ...(brokenLine === null ? [] : [brokenLine])]);
 }
 /** Each known project's running builds against its limit: its own number, never past its workers' capacity. */
 function projectBuildsStatus(context) {
@@ -10147,6 +10211,9 @@ function showTask(positional, context) {
         // v50: the latest build's bounded review history — every root attempt
         // in order, the open request, and the one state they add up to.
         review: latestFinished === null ? null : store.reviewRetryStateOf(latestFinished.id),
+        // The one automatic review of the latest build: HIGH findings, suggested
+        // follow-ups (MEDIUM/LOW), or why it was not reviewed.
+        automaticReview: latestFinished === null ? null : buildReviewOf(store, latestFinished.id),
         dispatch: diagnoseTaskDispatch(store, id, now),
         // v52: the exact-run control the console shows — Stop, Stopping,
         // Paused (resume), or the review-retry door — and every stop on record.
@@ -10199,7 +10266,7 @@ function showTask(positional, context) {
                     : detail.control.kind === "paused"
                         ? [`  control: paused — run #${detail.control.run} was stopped by ${detail.control.stop.requestedBy} (${detail.control.stop.settlement ?? "?"})${detail.control.committed ? "; its commit is on the branch" : ""}; work preserved${detail.control.worktree === null ? "" : ` in ${detail.control.worktree}`} — \`task resume ${task.id} --run ${detail.control.run} --as <you> --token <t>\``]
                         : [`  control: review #${detail.control.run} was stopped by ${detail.control.stop.requestedBy} — inspect its saved result and give feedback; separate model review has been removed`]),
-        ...reviewStatusLines(detail.review, latestFinished?.id ?? null),
+        ...(detail.automaticReview === null ? reviewStatusLines(detail.review, latestFinished?.id ?? null) : buildReviewLines(detail.automaticReview)),
         ...(scope === null
             ? ["  no scope — nothing will build this until one is written and approved"]
             : describeScope(scope, readiness)),
@@ -11662,6 +11729,48 @@ async function resumeTaskCommand(positional, flags, context) {
             : `  Not starting yet — ${resumed.gate.summary}: ${resumed.gate.detail}`,
     ]);
 }
+/**
+ * `toolroll run settle <id> --why "<text>" --as <you> --token <t>`: an
+ * approver's last resort for a finished run whose process witnesses can be
+ * proven neither exited nor alive (a spawn interrupted before its pid was
+ * written). Refuses while anything of the run is alive; the reason is kept
+ * in the ledger against the approver's name. Signals nothing.
+ */
+async function runCommand(positional, flags, context) {
+    const { store, write, json, clock } = context;
+    const [action, id, ...extra] = positional;
+    const command = "run settle";
+    const usage = "`toolroll run settle <run-id> --why \"<reason>\" --as <you> --token <t>`";
+    if (action !== "settle")
+        return fail(write, json, "run", "usage", usage, EXIT.usage);
+    const runId = Number(id ?? "");
+    const why = text(flags, "why")?.trim();
+    if (id === undefined || extra.length > 0 || !/^[1-9]\d*$/.test(id) || !Number.isSafeInteger(runId))
+        return fail(write, json, command, "usage", usage, EXIT.usage);
+    if (why === undefined || why === "" || why.length > 300 || /[\x00-\x1f\x7f]/.test(why)) {
+        return fail(write, json, command, "usage", "say why in one line with --why (at most 300 characters) — it is kept in the ledger", EXIT.usage);
+    }
+    const run = store.getRun(runId);
+    if (run === null)
+        return fail(write, json, command, "unknown-run", `no run #${runId}`, EXIT.refused);
+    const acting = await askCredentials(flags, context);
+    if (acting === null) {
+        return fail(write, json, command, "usage", "settling takes `--as <you> --token <t>` — it is an approver's act and is recorded against your name", EXIT.usage);
+    }
+    const authenticated = authenticateApprover(store, acting.name, acting.token);
+    const repo = store.refById(run.taskRef)?.repo ?? null;
+    if (!authenticated.ok || !store.accountCanAccess(acting.name, repo)) {
+        return fail(write, json, command, "not-an-approver", "that is not an approver for this run's project, or the token does not match", EXIT.refused);
+    }
+    const settled = store.settleRunWitnessesByApprover({ runId, by: acting.name, why }, clock());
+    if (!settled.ok)
+        return fail(write, json, command, settled.reason, settled.detail, EXIT.refused, { run: runId });
+    return succeed(write, json, command, { run: runId, witnesses: settled.witnesses, repeated: settled.repeated }, () => [
+        settled.repeated
+            ? `Run #${runId} has no unsettled process witness; nothing changed.`
+            : `Settled run #${runId}: ${settled.witnesses.length} process witness${settled.witnesses.length === 1 ? "" : "es"} recorded as ended, with your reason in the ledger.`,
+    ]);
+}
 // ---- shared ---------------------------------------------------------------
 /**
  * `project rules --repo <path>` shows a project's approval rules (v102);
@@ -12026,9 +12135,11 @@ async function retentionCommand(positional, flags, context) {
     const label = (kind) => RETENTION_KINDS.find(one => one.kind === kind).label;
     if (action === undefined || action === "show") {
         const periods = store.retentionPeriods();
+        const chosen = store.retentionChosen();
+        const defaulted = RETENTION_KINDS.map(one => one.kind).filter(kind => !(kind in chosen));
         const last = lastSweepAt(store);
-        return succeed(context.write, context.json, command, { periods, lastSweep: last }, () => [
-            ...RETENTION_KINDS.map(one => `  ${one.kind.padEnd(14)} ${periodWords(periods[one.kind]).padEnd(9)} ${one.label}`),
+        return succeed(context.write, context.json, command, { periods, defaulted, lastSweep: last }, () => [
+            ...RETENTION_KINDS.map(one => `  ${one.kind.padEnd(14)} ${periodLabel(one.kind, periods[one.kind], one.kind in chosen).toLowerCase().padEnd(18)} ${one.label}`),
             last === null ? "No sweep yet; the worker runs one a day." : `Last sweep ${last.slice(0, 16).replace("T", " ")} UTC.`,
         ]);
     }
@@ -12044,11 +12155,11 @@ async function retentionCommand(positional, flags, context) {
         return fail(context.write, context.json, command, "usage", "Use retention show, retention preview or retention set <kind> <period>.", EXIT.usage);
     const [kind, period, ...extra] = rest;
     if (kind === undefined || !isRetentionKind(kind) || period === undefined || extra.length > 0) {
-        return fail(context.write, context.json, command, "usage", `Use retention set <${RETENTION_KINDS.map(one => one.kind).join("|")}> <days, like 90d or 1y, or forever>.`, EXIT.usage);
+        return fail(context.write, context.json, command, "usage", `Use retention set <${RETENTION_KINDS.map(one => one.kind).join("|")}> <days, like 1d, 90d or 1y, or forever>.`, EXIT.usage);
     }
     const days = parsePeriod(period);
     if (days === undefined)
-        return fail(context.write, context.json, command, "usage", `A period is forever, or ${MIN_DAYS} days to 10 years (90d, 12w, 1y).`, EXIT.usage);
+        return fail(context.write, context.json, command, "usage", `A period is forever, or ${MIN_DAYS} day to 10 years (1d, 90d, 12w, 1y).`, EXIT.usage);
     const acting = await askCredentials(flags, context);
     const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
     if (acting === null || verified === null || !verified.ok || !store.isInstanceOperator(acting.name)) {
@@ -12082,13 +12193,35 @@ async function storageCommand(positional, flags, context) {
         `A finished task's clean checkout is removed ${cleanupWords(plan.cleanup)}; its branch stays.`,
     ];
     const itemLine = (one) => `  ${bytesWords(one.bytes).padStart(8)}  ${one.path}${one.why === null ? "" : `  (${whyWords(one)})`}`;
+    // Test temp folders the tests, journeys and scripts left (a killed run, an older version): those nothing touched for a day go.
+    const roots = context.tempRoots ?? tempRoots();
+    // Counting is quick; sizing thousands of folders isn't, so only a clean-up measures them.
+    const leftovers = (measure) => {
+        const found = testTempFolders(roots, context.clock());
+        const sizes = measure ? diskBytes(found.stale.map(one => one.path)) : new Map();
+        return { count: found.all.length, stale: found.stale.length, staleBytes: [...sizes.values()].reduce((sum, one) => sum + one, 0) };
+    };
+    const leftoverLine = (temp) => temp.count === 0 ? "Test temp folders: none." :
+        `Test temp folders: ${temp.count}; ${temp.stale === 0 ? "none older than a day." : `${temp.stale} older than a day: toolroll storage clean removes them.`}`;
+    // Shared dependencies (shared-deps.ts): one install per lockfile, linked into checkouts.
+    const depsRoot = sharedDepsRoot(context.databaseFile);
+    const checkoutRows = () => store.listWorktrees().map(row => ({ path: row.path, repo: row.repo }));
+    const sharedFacts = (copies) => {
+        const sizes = diskBytes(copies.map(one => one.dir));
+        return copies.map(one => ({ key: one.key, repo: one.repo, path: one.dir, bytes: sizes.get(one.dir) ?? 0, checkouts: one.checkouts.length, usedBy: one.checkouts, retired: one.retired, node: one.node, createdAt: one.createdAt, usedAt: one.usedAt }));
+    };
+    const sharedLine = (one) => `  ${bytesWords(one.bytes).padStart(8)}  ${projectName(one.repo)} ${one.key.slice(0, 8)}: ${one.checkouts === 1 ? "1 checkout uses it" : `${one.checkouts} checkouts use it`}${one.retired ? " (changed after install; never linked again)" : ""}`;
     if (action === undefined) {
         const plan = await checkoutPlan(store, pool, context.clock(), { manual: true });
         const report = storageReport(store, context.databaseFile, plan.go.length === 0 ? "nothing to clean up" : `about ${bytesWords(plan.freeBytes)} to clean up`);
-        return succeed(context.write, context.json, "storage", { ...report, checkouts: checkoutSummary(plan) }, () => [
+        const { staleBytes: _, ...temp } = leftovers(false);
+        const shared = sharedFacts(sharedUse(depsRoot, checkoutRows()));
+        return succeed(context.write, context.json, "storage", { ...report, checkouts: checkoutSummary(plan), testTemp: temp, shared }, () => [
             `${report.folder}: ${bytesWords(report.total)}`,
-            ...report.lines.map(one => `  ${one.what.padEnd(17)} ${bytesWords(one.bytes).padStart(8)}${one.count === undefined ? "" : `  (${one.count})`}${one.note === undefined ? "" : `  ${one.note}`}`),
+            ...report.lines.map(one => `  ${one.what.padEnd(19)} ${bytesWords(one.bytes).padStart(8)}${one.count === undefined ? "" : `  (${one.count})`}${one.note === undefined ? "" : `  ${one.note}`}`),
+            ...(shared.length === 0 ? [] : ["Shared dependencies:", ...shared.map(sharedLine)]),
             ...summary(plan),
+            leftoverLine({ ...temp, staleBytes: 0 }),
         ]);
     }
     if (action === "cleanup") {
@@ -12110,20 +12243,48 @@ async function storageCommand(positional, flags, context) {
             return fail(context.write, context.json, command, "usage", "Use storage clean to preview, then storage clean --yes.", EXIT.usage);
         if (!flags.has("yes")) {
             const plan = await checkoutPlan(store, pool, context.clock(), { manual: true });
-            return succeed(context.write, context.json, command, { preview: true, go: plan.go, stay: plan.stay, freeBytes: plan.freeBytes }, () => [
-                ...(plan.go.length === 0 ? ["Nothing to clean up."] : [`Would remove ${plan.go.length} checkout${plan.go.length === 1 ? "" : "s"}, freeing about ${bytesWords(plan.freeBytes)} (their branches stay):`, ...plan.go.map(itemLine)]),
+            const temp = leftovers(true);
+            // A shared copy goes when no checkout uses it, counting the checkouts this clean-up would remove.
+            const leaving = new Set(plan.go.map(one => one.path));
+            const unused = unusedShared(depsRoot, checkoutRows().filter(row => !leaving.has(row.path)), context.clock());
+            const sharedGo = sharedFacts(unused.copies);
+            const sharedBytes = sharedGo.reduce((sum, one) => sum + one.bytes, 0);
+            const anything = plan.go.length > 0 || temp.stale > 0 || sharedGo.length > 0;
+            return succeed(context.write, context.json, command, { preview: true, go: plan.go, stay: plan.stay, freeBytes: plan.freeBytes, testTemp: temp, sharedGo, sharedFreeBytes: sharedBytes }, () => [
+                ...(plan.go.length === 0 ? [anything ? "No checkouts to clean up." : "Nothing to clean up."] : [`Would remove ${plan.go.length} checkout${plan.go.length === 1 ? "" : "s"}, freeing about ${bytesWords(plan.freeBytes)} (their branches stay):`, ...plan.go.map(itemLine)]),
+                ...(sharedGo.length === 0 ? [] : [`Would remove ${sharedGo.length} shared dependency install${sharedGo.length === 1 ? "" : "s"} no checkout uses, about ${bytesWords(sharedBytes)}:`, ...sharedGo.map(sharedLine)]),
                 ...(plan.stay.length === 0 ? [] : [`Stays (${plan.stay.length}):`, ...plan.stay.map(itemLine)]),
-                plan.go.length === 0 ? "Nothing was removed." : "Nothing was removed. Run toolroll storage clean --yes to remove them.",
+                ...(temp.stale === 0 ? [] : [`Would remove ${temp.stale} test temp folder${temp.stale === 1 ? "" : "s"} older than a day, about ${bytesWords(temp.staleBytes)}.`]),
+                anything ? "Nothing was removed. Run toolroll storage clean --yes to remove them." : "Nothing was removed.",
             ]);
         }
         const actor = await operator();
         if (actor === null)
             return refused("cleans up checkouts");
         const done = await cleanCheckouts(store, pool, context.clock, { manual: true, actor });
-        return succeed(context.write, context.json, command, { removed: done.removed, kept: done.kept, freedBytes: done.freed }, () => [
-            done.removed.length === 0 ? "Nothing to clean up." : `Removed ${done.removed.length} checkout${done.removed.length === 1 ? "" : "s"}, about ${bytesWords(done.freed)}; their branches stay.`,
+        const temp = leftovers(true);
+        const swept = removeStaleTestTemp(roots, context.clock());
+        if (swept.removed.length > 0) {
+            store.recordAction({ at: context.clock().toISOString(), actor, repo: null, taskId: null, runId: null, action: "test temp folders removed", outcome: "removed", source: "request",
+                detail: `${swept.removed.length} older than a day, about ${bytesWords(temp.staleBytes)}${swept.failed.length === 0 ? "" : `; ${swept.failed.length} couldn't be removed`}` });
+        }
+        // After the checkouts go: a shared copy none of the remaining ones uses goes too.
+        const unused = unusedShared(depsRoot, checkoutRows(), context.clock());
+        const sharedRemoved = sharedFacts(unused.copies).filter(one => removeShared(one.path));
+        for (const one of sharedRemoved) {
+            store.recordAction({ at: context.clock().toISOString(), actor, repo: one.repo, taskId: null, runId: null, action: "shared dependencies removed", outcome: "removed", source: "request",
+                detail: `${one.key} (about ${bytesWords(one.bytes)}); no checkout used it` });
+        }
+        for (const debris of unused.debris)
+            removeShared(debris);
+        const sharedFreed = sharedRemoved.reduce((sum, one) => sum + one.bytes, 0);
+        return succeed(context.write, context.json, command, { removed: done.removed, kept: done.kept, freedBytes: done.freed, testTempRemoved: swept.removed.length, testTempFailed: swept.failed, sharedRemoved, sharedFreedBytes: sharedFreed }, () => [
+            done.removed.length === 0 ? (swept.removed.length === 0 && sharedRemoved.length === 0 ? "Nothing to clean up." : "No checkouts to clean up.") : `Removed ${done.removed.length} checkout${done.removed.length === 1 ? "" : "s"}, about ${bytesWords(done.freed)}; their branches stay.`,
             ...done.removed.map(itemLine),
+            ...(sharedRemoved.length === 0 ? [] : [`Removed ${sharedRemoved.length} shared dependency install${sharedRemoved.length === 1 ? "" : "s"} no checkout used, about ${bytesWords(sharedFreed)}.`, ...sharedRemoved.map(sharedLine)]),
             ...done.kept.map(one => `  kept ${one.path} (${whyWords({ why: one.why })})`),
+            ...(swept.removed.length === 0 ? [] : [`Removed ${swept.removed.length} test temp folder${swept.removed.length === 1 ? "" : "s"} older than a day, about ${bytesWords(temp.staleBytes)}.`]),
+            ...(swept.failed.length === 0 ? [] : [`Couldn't remove ${swept.failed.length} test temp folder${swept.failed.length === 1 ? "" : "s"}: ${swept.failed.slice(0, 3).join(", ")}${swept.failed.length > 3 ? " …" : ""}`]),
         ]);
     }
     if (action === "discard") {
@@ -12148,6 +12309,40 @@ async function storageCommand(positional, flags, context) {
 function checkoutSummary(plan) {
     return { count: plan.count, totalBytes: plan.totalBytes, waitingReview: plan.waitingReview, withChanges: plan.withChanges, cleanBytes: plan.freeBytes, cleanCount: plan.go.length, cleanup: plan.cleanup };
 }
+/** `review [show] | on | off --repo <path>`: the project's one automatic review
+ * of finished builds. Changing it takes an approver of that project; the
+ * policy log keeps before → after. */
+async function reviewSwitchCommand(positional, flags, context) {
+    const { store, write, json } = context;
+    const [action = "show", ...extra] = positional;
+    const command = `review ${action}`;
+    if (extra.length > 0 || !["show", "on", "off"].includes(action))
+        return fail(write, json, command, "usage", "Use toolroll review show|on|off --repo <path>.", EXIT.usage);
+    const allowed = new Set(["repo", "db", "json", ...(action === "show" ? [] : ["as", "token", "token-file", "token-env"])]);
+    for (const name of flags.keys())
+        if (!allowed.has(name))
+            return fail(write, json, command, "usage", `--${name} is not a ${command} option.`, EXIT.usage);
+    const given = text(flags, "repo");
+    if (given === undefined)
+        return fail(write, json, command, "usage", "Name the project: toolroll review " + action + " --repo <path>.", EXIT.usage);
+    const repo = canonicalProject(given) ?? resolve(given);
+    const words = (on, source) => `${projectName(repo)}: automatic review is ${on ? "on" : "off"}${source === "hands-off" ? " (on while the hands-off mode lasts)" : source === "default" ? " (the default)" : ""}.`;
+    if (action === "show") {
+        const state = store.reviewSwitch(repo, context.clock());
+        return succeed(write, json, command, { repo, ...state }, () => [words(state.on, state.source)]);
+    }
+    const acting = await askCredentials(flags, context);
+    if (acting === null)
+        return fail(write, json, command, "usage", `Sign in first, or pass --as <you> --token <t>: toolroll review ${action} --repo <path>.`, EXIT.usage);
+    const verified = authenticateApprover(store, acting.name, acting.token, repo);
+    if (!verified.ok)
+        return fail(write, json, command, verified.reason, `Only an approver of ${projectName(repo)} can change its review switch.`, EXIT.refused);
+    const changed = store.setReviewSwitch(repo, action === "on", acting.name, context.clock());
+    return succeed(write, json, command, { repo, ...changed.after, before: changed.before }, () => [
+        words(changed.after.on, changed.after.source),
+        changed.after.on ? "Each finished build whose check passes gets one read-only review; only HIGH findings send it back, once." : "Finished builds go straight to you.",
+    ]);
+}
 /** `policy show | set` (sprint 8): the organisation policy. Setting it takes an instance operator's credentials; each rule
  * that changed is in the ledger, before → after. A flag left out keeps its rule; "any" lifts it. */
 async function policyCommand(positional, flags, context) {

package/dist/plane-review.js

@@ -148,6 +148,10 @@ export function reviewPlane(store, now, canSee = () => true) {
     for (const row of tasks) {
         if (!canSee(str(row["repo"])))
             continue;
+        // A version a later revision replaced never waits on its own.
+        const family = store.taskFamilyOf(String(row["id"]), null, true);
+        if (family !== null && family.current.id !== String(row["id"]))
+            continue;
         const snapshot = taskWaitSnapshot(store, String(row["id"]), now);
         if (snapshot === null || (snapshot.reason !== "needs-person" && snapshot.reason !== "ready"))
             continue;

package/dist/process-custody.js

@@ -69,6 +69,14 @@ export function witnessedRunner(store, runId, clock, runner) {
                 store.recordRunProcess(runId, pid, clock(), options.processGroup === true, witnesses.at(-1));
                 options.onSpawn?.(pid);
             },
+            // The spawn made no process (ENOENT, EAGAIN, a throw): its reservation
+            // settles as never started now, not only if the transport returns.
+            onSpawnFailed: () => {
+                const witness = witnesses.at(-1);
+                if (witness !== undefined)
+                    store.finishUnspawnedProcess(witness, clock());
+                options.onSpawnFailed?.();
+            },
             onContainer: info => {
                 native = true;
                 const witness = witnesses.at(-1);

package/dist/process-recovery-eligibility.d.ts

@@ -95,6 +95,7 @@ export declare function preparedCandidateObserverGapEligibility(store: Store, in
                     readonly items: readonly string[];
                     readonly gaps: readonly string[];
                     readonly priorSupport: "eligible" | "invalid" | "none";
+                    readonly assets?: string;
                 };
             }[];
             readonly machineVerdict: import("./store.js").ProofVerdictRow["verdict"] | null;

package/dist/project-learning.d.ts

@@ -48,9 +48,9 @@ export type LearningEvent = {
 };
 export declare const learningSha: (text: string) => string;
 /** Path plus the physical shared Git database: replacing a repository does not inherit its lessons. */
-export declare function learningIdentity(repo: string): string;
+export declare function learningIdentity(repo: string, seen?: Map<string, string>): string;
 /** Compare the applicable code and configuration, not model confidence or a claimed passing command. */
-export declare function learningFingerprint(repo: string, head: string, paths: readonly string[]): string;
+export declare function learningFingerprint(repo: string, head: string, paths: readonly string[], seen?: Map<string, string>): string;
 export declare function parseLearning(value: unknown): LearningCandidate[];
 /** A write problem is optional: preserve core completion, leave a visible diagnostic, retry on the next read/admission. */
 export declare function learningFailure(store: Store, repo: string, run: number | null, now: Date): void;
@@ -60,7 +60,7 @@ export declare function queueLearning(store: Store, source: number, reviewer: nu
     sha256: string;
 }[], now: Date, assessment?: unknown): void;
 /** Validate after core commit; both suggestions commit or neither. */
-export declare function recoverLearning(store: Store, root: string, repo: string, now?: Date): void;
+export declare function recoverLearning(store: Store, root: string, repo: string, now?: Date, seen?: Map<string, string>): void;
 export declare function learningView(store: Store, root: string, repo: string, actor: string, before?: number): {
     repo: string;
     identity: string;