toolroll 0.9.73 → 0.9.74

package/dist/live.js

@@ -13,17 +13,25 @@
  * Fail-soft everywhere: a live view that cannot be written must never
  * break, slow, or reclassify a build.
  */
-import { closeSync, constants, fstatSync, lstatSync, mkdirSync, openSync, readSync, readdirSync, statSync, unlinkSync, writeSync } from "node:fs";
+import { randomBytes } from "node:crypto";
+import { closeSync, constants, fstatSync, linkSync, lstatSync, mkdirSync, openSync, readSync, readdirSync, renameSync, statSync, unlinkSync, writeSync } from "node:fs";
 import { join } from "node:path";
 import { scanForSecrets } from "./evidence.js";
 import { createLiveRecorder, parseLiveRecords, redactLiveLines, projectLiveText, serializeLiveRecord } from "./live-records.js";
+import { childLogWriter, createChildRecorder } from "./live-children.js";
+import { topLevelEvent } from "./stream-scope.js";
 export const LIVE_LINE_CAP = 2 * 1024;
 export const LIVE_FILE_CAP = 4 * 1024 * 1024;
 export const LIVE_REDACTED_LINE = "[a credential-shaped line was redacted]";
 /** Finalized runs keep their live file this long for the final drain. */
 export const LIVE_RETAIN_MS = 24 * 60 * 60 * 1000;
-/** The bounded sweep: at most this many FINALIZED files survive a pass. */
+/** The bounded sweep: at most this many FINALIZED runs' files survive a pass (a run's records and its subagents' file
+ * count as one). */
 export const LIVE_FILE_BOUND = 500;
+/** A run's subagent file (docs/plans/agents-view.md §2.3) is never larger than this; its writer stops there. */
+export const LIVE_SUB_FILE_CAP = 16 * 1024 * 1024;
+/** All finished and orphan live files together stay under this; the oldest runs go first past it. */
+export const LIVE_TOTAL_BYTES = 1024 * 1024 * 1024;
 export function liveDir(root) {
     return join(root, "live");
 }
@@ -33,6 +41,10 @@ export function liveDir(root) {
 export function liveLogPath(root, runId) {
     return join(liveDir(root), `${Math.trunc(runId)}.jsonl`);
 }
+/** A run's subagents' records (docs/plans/agents-view.md §2.3): the run's file, swept with it. */
+export function liveSubLogPath(root, runId) {
+    return join(liveDir(root), `${Math.trunc(runId)}.sub.jsonl`);
+}
 /** The plain-text file runs wrote before the live conversation; read until it ages out. */
 export function legacyLiveLogPath(root, runId) {
     return join(liveDir(root), `${Math.trunc(runId)}.log`);
@@ -62,6 +74,9 @@ const toolKind = (name) => TOOL_KINDS.get(typeof name === "string" ? name : "")
  */
 export function liveActivityKind(event) {
     try {
+        // A subagent's events, of every type, are not this run's activity (stream-scope.ts).
+        if (!topLevelEvent(event))
+            return null;
         const type = String(event["type"] ?? "");
         if ((type === "system" && String(event["subtype"] ?? "") === "init") || type === "thread.started" || type === "init")
             return "session";
@@ -76,9 +91,6 @@ export function liveActivityKind(event) {
             return toolKind(event["name"] ?? event["tool"]?.["name"]);
         if (type !== "assistant")
             return null;
-        const parent = event["parent_tool_use_id"];
-        if (parent !== undefined && parent !== null)
-            return null;
         const content = event["message"]?.["content"];
         if (!Array.isArray(content))
             return null;
@@ -140,7 +152,12 @@ export function openLiveLog(root, runId, options = {}) {
     catch {
         return null;
     }
-    const recorder = createLiveRecorder({ base: options.base ?? null, commands: options.commands === true, ...(options.clock === undefined ? {} : { clock: options.clock }) });
+    const recorderOptions = { base: options.base ?? null, commands: options.commands === true, ...(options.clock === undefined ? {} : { clock: options.clock }) };
+    // The run's subagents go to their own file (live-children.ts), under the same captured answer; this file is unchanged
+    // (the recorder only tells the subagents' side which step it wrote for each delegation).
+    const children = createChildRecorder(recorderOptions);
+    const recorder = createLiveRecorder({ ...recorderOptions, onStep: children.parentStep });
+    const childLog = childLogWriter(root, runId);
     let written = 0;
     let capped = false;
     let closed = false;
@@ -178,8 +195,13 @@ export function openLiveLog(root, runId, options = {}) {
     return {
         observe(event) {
             try {
-                for (const record of recorder.observe(event))
+                const mine = recorder.observe(event);
+                for (const record of mine)
                     append(record);
+                if (!closed) {
+                    const before = childLog.due() ? children.checkpoint() : null;
+                    childLog.append(children.observe(event), before);
+                }
             }
             catch {
                 // Recording is observational; a malformed event records nothing.
@@ -195,6 +217,12 @@ export function openLiveLog(root, runId, options = {}) {
             catch {
                 // the steps simply stay open in the file
             }
+            try {
+                const before = childLog.due() ? children.checkpoint() : null;
+                childLog.append(children.end(), before);
+            }
+            catch { /* the subagents' steps stay open in theirs */ }
+            childLog.close();
             closed = true;
             try {
                 closeSync(fd);
@@ -326,18 +354,42 @@ export function readLiveWindow(root, runId, from, allowTail = false) {
         closeSync(fd);
     }
 }
-/** A window's complete lines as the plain words the run page and `toolroll peek` show, whatever its format. */
-export function liveWindowLines(read, keys = { inKey: false }) {
+/** A window's complete lines as the plain words the run page and `toolroll peek` show, whatever its format. `commands` is
+ * the run's own captured answer (store.ts runLiveCommands), never the file's say. */
+export function liveWindowLines(read, commands, keys = { inKey: false }) {
     if (read.format === "records")
-        return projectLiveText(parseLiveRecords(read.text, keys));
+        return projectLiveText(withholdCommands(parseLiveRecords(read.text, keys), commands));
     return cleanLegacy(read.text, keys).split("\n").filter(one => one !== "");
 }
-/** A window as records, whatever its format: an older plain file's lines become the agent's words. */
-export function liveWindowRecords(read, keys = { inKey: false }) {
+/** A window as records, whatever its format: an older plain file's lines become the agent's words. Command text and
+ * output show only when the run's own captured answer (`commands`) is on. */
+export function liveWindowRecords(read, commands, keys = { inKey: false }) {
     if (read.format === "records")
-        return parseLiveRecords(read.text, keys);
+        return withholdCommands(parseLiveRecords(read.text, keys), commands);
     return cleanLegacy(read.text, keys).split("\n").filter(one => one !== "").map(line => ({ k: "say", at: "", t: [line] }));
 }
+/**
+ * Enforce a run's captured "Show commands" answer on read: the file is build-writable, so an `open` record, a command
+ * step's text or a step's output may say anything. With the answer off, every `open` reads the base tier, command steps
+ * lose their text and steps lose their output. (The older plain-text format predates command detail and is unchanged.)
+ */
+export function withholdCommands(records, commands) {
+    if (commands)
+        return records;
+    return records.map(record => {
+        if (record.k === "open")
+            return record.detail === "base" ? record : { ...record, detail: "base" };
+        if (record.k === "step" && record.kind === "command" && record.target !== undefined) {
+            const { target: _target, ...rest } = record;
+            return rest;
+        }
+        if (record.k === "done" && record.out !== undefined) {
+            const { out: _out, ...rest } = record;
+            return rest;
+        }
+        return record;
+    });
+}
 /** Legacy text lines, cleaned again on read: the file may have been altered after it was written. */
 function cleanLegacy(text, keys) {
     const lines = text.split("\n");
@@ -348,10 +400,9 @@ function cleanLegacy(text, keys) {
     return ended ? `${shown.join("\n")}\n` : shown.join("\n");
 }
 /**
- * Enumerate the live directory for the reconcile sweep. Pure listing — the
- * CALLER decides which runs are finalized and when; this module only
- * refuses to guess. Non-run names are reported with runId null (orphans
- * from nothing this plane wrote; aged on mtime like everything else).
+ * Enumerate the live directory for the reconcile sweep: names only. Pure listing — the CALLER settles which runs are
+ * finalized before it measures anything; this module only refuses to guess. Non-run names are reported with runId
+ * null (orphans from nothing this plane wrote; aged on mtime like everything else).
  */
 export function listLiveFiles(root) {
     let names;
@@ -361,74 +412,172 @@ export function listLiveFiles(root) {
     catch {
         return [];
     }
-    const out = [];
-    for (const name of names) {
-        let mtimeMs = 0;
-        try {
-            mtimeMs = statSync(join(liveDir(root), name)).mtimeMs;
-        }
-        catch {
-            continue;
-        }
-        const match = /^(\d{1,15})\.(?:jsonl|log)$/.exec(name);
-        out.push({ runId: match === null ? null : Number(match[1]), fileName: name, mtimeMs });
-    }
-    return out;
+    // A sweep's private claim (QUARANTINE_PREFIX) is never listed: it is the sweep's own, and one it couldn't restore
+    // stays for a person to look at rather than be aged out under a name nobody chose.
+    return names.filter(name => !name.startsWith(QUARANTINE_PREFIX)).map(name => {
+        const match = /^(\d{1,15})\.(jsonl|log|sub\.jsonl)$/.exec(name);
+        // The writer stops at its cap and adds one last record; anything far past it is no file this plane wrote.
+        const cap = match === null ? null : (match[2] === "sub.jsonl" ? LIVE_SUB_FILE_CAP : LIVE_FILE_CAP) + 64 * 1024;
+        return { runId: match === null ? null : Number(match[1]), fileName: name, cap };
+    });
 }
-/** Remove one live file, silently: a sweep never throws over display state. */
-export function removeLiveFile(root, fileName) {
+/** Remove one live file, silently: a sweep never throws over display state. True when it is gone now. */
+export function removeLiveFile(root, fileName, unlink = unlinkSync) {
     // The name comes from listLiveFiles' own readdir, never from user input.
     if (fileName.includes("/") || fileName.includes("\\") || fileName.includes(".."))
-        return;
+        return false;
     try {
-        unlinkSync(join(liveDir(root), fileName));
+        unlink(join(liveDir(root), fileName));
+        return true;
     }
-    catch {
-        // already gone
+    catch (error) {
+        return error.code === "ENOENT";
     }
 }
+/** The prefix of a sweep's private claim on a file it is about to remove (never a name a writer uses). */
+const QUARANTINE_PREFIX = ".sweep-claim-";
 /**
  * The reconcile sweep (arc 1 §2): ACTIVE runs are exempt ABSOLUTELY — the
- * transport's no-truncation assumption depends on it. Finalized runs age
- * from finished_at; orphans (no run row, or a name this plane never
- * writes) age from mtime; and the 500-file bound applies only WITHIN the
- * finalized-or-orphan set, oldest first.
+ * transport's no-truncation assumption depends on it — and a run's files
+ * (its records, its subagents' file, an older text file) go together, as one.
+ * A run is settled finished (or absent) BEFORE its files are measured.
+ * Finalized runs age from finished_at; orphans (no run row, or a name this
+ * plane never writes) age from mtime. Among the finalized-or-orphan: a file
+ * far past its own cap goes at once, then the day's retention, then the
+ * 500-run bound, then the total byte limit, oldest first, until each limit is
+ * really met or nothing eligible is left. Each removal re-proves, under the
+ * store's write lock (the one run admission takes), that the run is still
+ * not active and the file is the very one measured; otherwise it is kept. A
+ * file that can't be removed stays counted and never stops the rest.
  */
-export function sweepLiveLogs(store, root, now) {
+export function sweepLiveLogs(store, root, now, io = {}) {
     const removed = [];
-    const removable = [];
-    for (const entry of listLiveFiles(root)) {
-        if (entry.runId !== null) {
-            const run = store.getRun(entry.runId);
-            if (run !== null && run.outcome === null)
-                continue; // live: untouchable
-            const finished = run?.finishedAt === null || run?.finishedAt === undefined ? null : Date.parse(run.finishedAt);
-            removable.push({
-                fileName: entry.fileName,
-                ageAnchorMs: finished === null || Number.isNaN(finished) ? entry.mtimeMs : finished,
-            });
+    const settled = (runId) => {
+        if (runId === null)
+            return null;
+        try {
+            const run = store.getRun(runId);
+            return run !== null && run.outcome === null ? "active" : run;
+        }
+        catch {
+            return "unknown";
+        }
+    };
+    const at = (name) => join(liveDir(root), name);
+    const lstat = io.lstat ?? ((path) => lstatSync(path));
+    /** A file as it is now: measured, confirmed gone (ENOENT only), or unknown (any other failure: never taken as gone). */
+    const measure = (fileName, runId, path = at(fileName)) => {
+        try {
+            const stat = lstat(path);
+            return { fileName, runId, dev: stat.dev, ino: stat.ino, size: stat.size, mtimeMs: stat.mtimeMs, bytes: stat.isFile() ? stat.size : 0 };
         }
-        else {
-            removable.push({ fileName: entry.fileName, ageAnchorMs: entry.mtimeMs });
+        catch (error) {
+            return error.code === "ENOENT" ? "gone" : "unknown";
         }
-    }
-    removable.sort((a, b) => a.ageAnchorMs - b.ageAnchorMs);
-    const cutoff = now.getTime() - LIVE_RETAIN_MS;
-    const survivors = [];
-    for (const one of removable) {
-        if (one.ageAnchorMs <= cutoff) {
-            removeLiveFile(root, one.fileName);
-            removed.push(one.fileName);
+    };
+    const same = (a, b) => a.dev === b.dev && a.ino === b.ino && a.size === b.size && a.mtimeMs === b.mtimeMs;
+    /** The run is still not active, proved under the store's write lock (the one run admission takes) — and only that. */
+    const stillSweepable = (runId) => {
+        const check = () => { const state = settled(runId); return state !== "active" && state !== "unknown"; };
+        try {
+            return store.transact === undefined ? check() : store.transact(check);
+        }
+        catch {
+            return false;
+        }
+    };
+    /** Put a claimed file back under its name without overwriting whatever may be there now. */
+    const restore = (claim, fileName) => {
+        try {
+            linkSync(at(claim), at(fileName));
+            unlinkSync(at(claim));
+        }
+        catch { /* the name is taken: the claim stays, unlisted */ }
+    };
+    /**
+     * Remove one measured file: its run still not active, then the name atomically claimed under a private name in the
+     * live directory, then the claim proved to be the very file measured (dev, inode, size, mtime) and the run still not
+     * active — and only then is the private claim deleted. A mismatch is put back without overwriting anything. The
+     * store's lock covers the run-state checks only; the filesystem work runs outside it.
+     */
+    const remove = (file) => {
+        if (file.failed === true)
+            return false;
+        const done = (gone) => { if (gone)
+            removed.push(file.fileName);
+        else
+            file.failed = true; return gone; };
+        io.beforeRemove?.(file.fileName);
+        if (file.fileName.includes("/") || file.fileName.includes("..") || !stillSweepable(file.runId))
+            return done(false);
+        io.afterCheck?.(file.fileName);
+        const claim = `${QUARANTINE_PREFIX}${randomBytes(12).toString("hex")}`;
+        try {
+            renameSync(at(file.fileName), at(claim));
+        }
+        catch (error) {
+            return done(error.code === "ENOENT");
         }
-        else {
-            survivors.push(one);
+        const claimed = measure(file.fileName, file.runId, at(claim));
+        if (claimed === "gone")
+            return done(true);
+        if (claimed === "unknown" || !same(claimed, file) || !stillSweepable(file.runId)) {
+            restore(claim, file.fileName);
+            return done(false);
         }
+        if (removeLiveFile(root, claim, io.unlink))
+            return done(true);
+        restore(claim, file.fileName);
+        return done(false);
+    };
+    // One group per finished run (keyed by id) or per orphan file, aged from the run's end or the file's mtime.
+    const groups = new Map();
+    // Settle every listed run first, then list again and measure: a file a run wrote (or grew) before it finished is
+    // seen at its final size, and one its run created after the first listing is counted with it.
+    const states = new Map();
+    for (const entry of listLiveFiles(root))
+        if (entry.runId !== null && !states.has(entry.runId))
+            states.set(entry.runId, settled(entry.runId));
+    for (const entry of listLiveFiles(root)) {
+        // A run first seen in this listing waits for the next pass: it was never settled before its files were listed.
+        if (entry.runId !== null && !states.has(entry.runId))
+            continue;
+        const state = entry.runId === null ? null : states.get(entry.runId);
+        if (state === "active" || state === "unknown")
+            continue; // live, or unknown this pass: kept, never guessed
+        // Measured only now, after the run is settled finished: its writer is done.
+        const file = measure(entry.fileName, entry.runId);
+        if (file === "gone" || file === "unknown")
+            continue;
+        if (entry.cap !== null && file.bytes > entry.cap && remove(file))
+            continue;
+        const finished = state === null || state.finishedAt === null ? null : Date.parse(state.finishedAt);
+        const anchor = finished === null || Number.isNaN(finished) ? file.mtimeMs : finished;
+        const key = entry.runId === null ? `file:${entry.fileName}` : `run:${entry.runId}`;
+        const group = groups.get(key) ?? { files: [], ageAnchorMs: anchor };
+        group.files.push(file);
+        group.ageAnchorMs = Math.min(group.ageAnchorMs, anchor);
+        groups.set(key, group);
     }
-    // Oldest-first beyond the bound — still never touching an active run.
-    for (let index = 0; index < survivors.length - LIVE_FILE_BOUND; index += 1) {
-        const one = survivors[index];
-        removeLiveFile(root, one.fileName);
-        removed.push(one.fileName);
+    /** Remove a group's files; what can't be removed stays in it (and in every count after). True when it's empty. */
+    const removeGroup = (group) => {
+        group.files = group.files.filter(file => !remove(file));
+        return group.files.length === 0;
+    };
+    const cutoff = now.getTime() - LIVE_RETAIN_MS;
+    let kept = [...groups.values()].sort((a, b) => a.ageAnchorMs - b.ageAnchorMs).filter(group => group.ageAnchorMs > cutoff || !removeGroup(group));
+    // Oldest-first beyond the bound, continuing past any that can't go — still never touching an active run.
+    let excess = kept.length - LIVE_FILE_BOUND;
+    kept = kept.filter(group => excess <= 0 || !removeGroup(group) || (excess -= 1, false));
+    // Then the total, oldest first, counting only what is really still there.
+    const bytesOf = (group) => group.files.reduce((sum, file) => sum + file.bytes, 0);
+    let total = kept.reduce((sum, group) => sum + bytesOf(group), 0);
+    for (const group of kept) {
+        if (total <= LIVE_TOTAL_BYTES)
+            break;
+        const before = bytesOf(group);
+        removeGroup(group);
+        total -= before - bytesOf(group);
     }
     return { removed };
 }

package/dist/operate.js

@@ -4072,7 +4072,8 @@ async function requeueTask(positional, flags, context) {
  * `toolroll task regate <id>` — the approved check again on the last
  * attempt's exact commit (v70). A new attempt whose prepared candidate is
  * that commit: no agent, a fresh receipt and proof, the ordinary review.
- * The operator's yes seals the rerun scope; who asked is recorded.
+ * The operator's yes seals the rerun scope; who asked is recorded. A task
+ * that already names a prepared candidate keeps its approved scope as it is.
  */
 async function regateTaskCommand(positional, flags, context) {
     const { store, write, json, clock } = context;
@@ -4087,7 +4088,7 @@ async function regateTaskCommand(positional, flags, context) {
     if (!result.ok)
         return fail(write, json, "task regate", result.reason, result.message, EXIT.refused);
     return succeed(write, json, "task regate", { id, run: result.run, head: result.head }, () => [
-        `${id} is queued again: the approved check runs on commit ${result.head.slice(0, 7)} exactly as attempt #${result.run} left it, with no agent. A fresh review follows.`,
+        `${id} is queued again: the approved check runs on commit ${result.head.slice(0, 7)}, the same files attempt #${result.run} checked, with no agent. A fresh review follows.`,
     ]);
 }
 /**

package/dist/peek-cli.d.ts

@@ -14,7 +14,7 @@
  * Read-only by construction: nothing here writes to the store or the
  * files; a peek is a look.
  */
-import type { Store } from "./store.js";
+import { type Store } from "./store.js";
 export declare const PEEK_TAIL_LINES = 400;
 export type PeekPane = {
     runId: number;
@@ -39,14 +39,21 @@ type Tail = {
     gen?: string;
     inKey?: boolean;
     keyTail?: string;
+    /** The "Show commands" answer the cached lines were made under; absent is unknown (treated as on: never trusted). */
+    commands?: boolean;
 };
 /**
  * Advance one run's tail from its offset; `replaced` resets visibly. The
  * offset always moves by the bytes read, even when nothing in them shows
  * (a finished step, a skipped line), and an offset is only ever used
- * against the file it came from.
+ * against the file it came from. `commands` is the run's own captured
+ * "Show commands" answer (store.ts runLiveCommands), read now: lines cached
+ * under any other answer (off, on, or unknown) are dropped and the file is
+ * read again from its start under this one, on every path — nothing
+ * projected with command detail outlives the answer turning off, and a
+ * recovered answer shows the detail again.
  */
-export declare function advanceTail(root: string, runId: number, tail: Tail): Tail;
+export declare function advanceTail(root: string, runId: number, previous: Tail, commands: boolean): Tail;
 /** The stage word for a pane: the machine's own phase, or what precedes it. */
 export declare function stageWord(run: {
     phase: string | null;

package/dist/peek-cli.js

@@ -17,6 +17,7 @@
 import { spawn } from "node:child_process";
 import { liveWindowLines, readLiveWindow } from "./live.js";
 import { validKeyTail } from "./live-records.js";
+import { runLiveCommands } from "./store.js";
 import { sleep } from "./sleep.js";
 export const PEEK_TAIL_LINES = 400;
 const ESC = "\u001b";
@@ -25,21 +26,29 @@ const REPLACED = { offset: 0, lines: ["[the live view was replaced — starting
  * Advance one run's tail from its offset; `replaced` resets visibly. The
  * offset always moves by the bytes read, even when nothing in them shows
  * (a finished step, a skipped line), and an offset is only ever used
- * against the file it came from.
+ * against the file it came from. `commands` is the run's own captured
+ * "Show commands" answer (store.ts runLiveCommands), read now: lines cached
+ * under any other answer (off, on, or unknown) are dropped and the file is
+ * read again from its start under this one, on every path — nothing
+ * projected with command detail outlives the answer turning off, and a
+ * recovered answer shows the detail again.
  */
-export function advanceTail(root, runId, tail) {
+export function advanceTail(root, runId, previous, commands) {
+    const tail = previous.commands !== commands && (previous.lines.length > 0 || previous.offset > 0)
+        ? { offset: 0, lines: [], state: "not-yet" }
+        : previous;
     const read = readLiveWindow(root, runId, tail.offset);
     if (!read.ok) {
         if (read.reason === "replaced")
-            return REPLACED;
-        return { ...tail, keyTail: validKeyTail(tail.keyTail ?? "") ? tail.keyTail ?? "" : "", state: read.reason === "missing" ? (tail.lines.length === 0 ? "not-yet" : tail.state) : "unreadable" };
+            return { ...REPLACED, commands };
+        return { ...tail, commands, keyTail: validKeyTail(tail.keyTail ?? "") ? tail.keyTail ?? "" : "", state: read.reason === "missing" ? (tail.lines.length === 0 ? "not-yet" : tail.state) : "unreadable" };
     }
     if (tail.gen !== undefined && tail.gen !== read.gen)
-        return { ...REPLACED, gen: read.gen };
+        return { ...REPLACED, gen: read.gen, commands };
     const keys = { inKey: tail.inKey === true, tail: validKeyTail(tail.keyTail ?? "") ? tail.keyTail ?? "" : "" };
-    const fresh = liveWindowLines(read, keys);
+    const fresh = liveWindowLines(read, commands, keys);
     const lines = [...tail.lines, ...fresh].slice(-PEEK_TAIL_LINES);
-    return { offset: read.nextOffset, lines, state: lines.length === 0 ? "not-yet" : "live", gen: read.gen, inKey: keys.inKey, keyTail: keys.tail };
+    return { offset: read.nextOffset, lines, state: lines.length === 0 ? "not-yet" : "live", gen: read.gen, inKey: keys.inKey, keyTail: keys.tail, commands };
 }
 /** The stage word for a pane: the machine's own phase, or what precedes it. */
 export function stageWord(run) {
@@ -58,7 +67,7 @@ export function snapshotLiveRuns(store, root, now, tails = new Map()) {
     const panes = [];
     for (const run of store.liveRuns(now)) {
         const previous = tails.get(run.id) ?? { offset: 0, lines: [], state: "not-yet" };
-        const tail = advanceTail(root, run.id, previous);
+        const tail = advanceTail(root, run.id, previous, runLiveCommands(store, run.id));
         tails.set(run.id, tail);
         panes.push({
             runId: run.id,

package/dist/planner.js

@@ -585,7 +585,7 @@ export async function plan(store, request) {
     }
     // The live window (peek): the same transcript file the builder keeps,
     // so `toolroll peek` and the run page can watch this session too.
-    const liveLog = withRunActivity(openLiveLog(root, request.runId, liveLogContext(store, taskRef, worktree)), store, request.runId, clock);
+    const liveLog = withRunActivity(openLiveLog(root, request.runId, liveLogContext(store, request.runId, taskRef, worktree, clock())), store, request.runId, clock);
     // The durable run row, not a caller's duplicate options, is the route
     // every correction inherits.
     const provider = logicalRun.provider;

package/dist/provider-limits.d.ts

@@ -24,7 +24,9 @@ export type LimitReading = {
     billing?: Billing;
 };
 export declare const record: (value: unknown) => Record<string, unknown> | null;
-/** A Claude stream event's limits, or null when it isn't a `rate_limit_event` or says nothing usable. */
+/** A Claude stream event's limits, or null when it isn't the session's own `rate_limit_event` or says nothing usable.
+ * A subagent's (parent_tool_use_id set) is never read: the session reports its own windows each turn, and a
+ * subagent-tagged reading can't be told apart from one shaped by the subagent's own traffic (stream-scope.ts). */
 export declare function claudeLimitsOf(event: unknown): LimitReading | null;
 /** Codex's `account/rateLimits/read` answer as a reading, or null. */
 export declare function codexLimitsOf(result: unknown): LimitReading | null;

package/dist/provider-limits.js

@@ -1,3 +1,4 @@
+import { topLevelEvent } from "./stream-scope.js";
 const WINDOW_NAME = /^[a-z][a-z0-9_]{0,39}$/;
 const CLAUDE_MINUTES = { five_hour: 300, seven_day: 10_080, seven_day_opus: 10_080, seven_day_sonnet: 10_080 };
 const finite = (value) => typeof value === "number" && Number.isFinite(value) ? value : null;
@@ -8,10 +9,12 @@ const epoch = (value) => {
     return seconds === null || seconds < 1_000_000_000 || seconds > 10_000_000_000 ? null : new Date(seconds * 1000).toISOString();
 };
 export const record = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
-/** A Claude stream event's limits, or null when it isn't a `rate_limit_event` or says nothing usable. */
+/** A Claude stream event's limits, or null when it isn't the session's own `rate_limit_event` or says nothing usable.
+ * A subagent's (parent_tool_use_id set) is never read: the session reports its own windows each turn, and a
+ * subagent-tagged reading can't be told apart from one shaped by the subagent's own traffic (stream-scope.ts). */
 export function claudeLimitsOf(event) {
     const body = record(event);
-    if (body === null || body["type"] !== "rate_limit_event")
+    if (body === null || body["type"] !== "rate_limit_event" || !topLevelEvent(body))
         return null;
     const info = record(body["rate_limit_info"]);
     if (info === null)

package/dist/provider.js

@@ -29,6 +29,7 @@ import { REVIEW_OUTPUT_LIMITS } from "./structured-output.js";
 import { ACP_AGENTS, isAcpProvider, withAcp } from "./acp-agents.js";
 import { acpParse } from "./acp-client.js";
 import { agentSpecSchema, MODEL_ID, modelIdSchema, PROVIDER_ID_VALUES, providerIdSchema } from "./contracts/provider.js";
+import { primaryResultEvent, topLevelEvent } from "./stream-scope.js";
 export const PROVIDER_IDS = PROVIDER_ID_VALUES;
 export function isProviderId(value) {
     return providerIdSchema.safeParse(value).success;
@@ -292,17 +293,6 @@ function claudeFinalMessage(result) {
     }
     return typeof result.result === "string" ? result.result : null;
 }
-/**
- * The primary-result allowlist (arc 1 finding 10): only an absent origin or
- * an explicit human origin can be the main query's accounting envelope.
- * Every other kind — task-notification, channel, peer, coordinator, and
- * anything the SDK grows later — fails closed as a non-primary result.
- */
-function claudePrimaryOrigin(event) {
-    if (event.origin === undefined || event.origin === null)
-        return true;
-    return typeof event.origin === "object" && String(event.origin["kind"] ?? "") === "human";
-}
 function claudeEnvelopeOf(result, sessionFromInit, initObserved, initSessionConflict = false) {
     const input = result?.usage?.input_tokens;
     const output = result?.usage?.output_tokens;
@@ -378,6 +368,10 @@ function claudeParse(stdout) {
         }
         if (event === null || typeof event !== "object")
             continue;
+        // A subagent's object (parent_tool_use_id set) is never the session's envelope, init, result or overflow witness
+        // (stream-scope.ts). The transport's own witness carries no parent and still counts.
+        if (!topLevelEvent(event))
+            continue;
         const type = event["type"];
         if (type === undefined) {
             // Legacy buffered envelope: one JSON object, no event framing.
@@ -404,7 +398,7 @@ function claudeParse(stdout) {
                 // replacement for the primary result's usage/accounting envelope.
                 transportFailure = result;
             }
-            if (primary === null && claudePrimaryOrigin(result))
+            if (primary === null && primaryResultEvent(event))
                 primary = result;
         }
     }

package/dist/release-adapters.js

@@ -115,6 +115,9 @@ export function gateStateOf(answer, accounts = []) {
     const failed = newest !== undefined && newest["finishedAt"] != null && newest["outcome"] !== "built" && newest["outcome"] !== "no-change" && Number(newest["id"]) !== resultRun
         ? `run ${String(newest["id"])} ended ${String(newest["outcome"] ?? "without an outcome")}` : null;
     const worktree = runs.find(run => run["id"] === resultRun)?.["worktree"];
+    // Queued again or still building past the result shown (a regate): that result is the one before the rerun.
+    const state = object(answer["task"])["state"];
+    const pending = resultRun !== null && (state === "queued" || state === "running" || (newest !== undefined && newest["finishedAt"] == null && Number(newest["id"]) > resultRun));
     return {
         exists: true,
         candidate: textOr(scope["candidate"]),
@@ -131,6 +134,7 @@ export function gateStateOf(answer, accounts = []) {
                 : checks["status"] === "passed" && checks["level"] !== "full" ? "not-full" : String(checks["status"] ?? "not-run"),
         },
         failed,
+        pending,
         completion: textOr(completion["digest"]) === null ? null : { actor: String(completion["actor"]), at: String(completion["at"]), digest: String(completion["digest"]) },
     };
 }

package/dist/release.d.ts

@@ -90,6 +90,9 @@ export type GateState = {
     } | null;
     /** A finished build that left no result to complete (it failed before the check), in words. */
     failed: string | null;
+    /** A newer attempt is queued or running (`task regate` after a failed check): the result shown is the one before it.
+     * Absent from a plane too old to say. */
+    pending?: boolean;
     completion: {
         actor: string;
         at: string;

package/dist/release.js

@@ -535,6 +535,9 @@ export async function runRelease(options, adapters) {
                             await watch("dispatch");
                             const gate = await adapters.toolroll.gate(j.task.id);
                             await approved(gate);
+                            // A rerun of the same approved commit is on its way: the failure before it is not this release's answer.
+                            if (gate.pending === true && gate.result?.check !== "passed")
+                                return null;
                             if (gate.failed !== null)
                                 throw new Stop("check-failed", `The release build of ${j.task.id} failed: ${gate.failed}. Fix it and release the new commit with --new.`);
                             if (gate.result === null || gate.result.check === "running" || gate.result.check === "pending")