toolroll 0.9.76 → 0.9.78

package/dist/operate.js

@@ -1,3 +1,4 @@
+import { mintSecret } from "./secret-mint.js";
 import { ACP_AGENTS, ACP_PROVIDER_IDS, isAcpProvider, isKeyedProvider } from "./acp-agents.js";
 import { inspectAcpAgent } from "./acp-inspect.js";
 import { runAcpChecks } from "./acp-check.js";
@@ -43,6 +44,7 @@ import { createConnectionChecker } from "./provider-connection.js";
 import { checkIntegrations, integrationsBrokenLine, integrationsNow, renderIntegrations } from "./integrations.js";
 import { buildHandoff, handoffLines, loginAccount, runOnboard } from "./agent-onboard.js";
 import { backupFiles, backupFolderOf, backupOwner, backupNow, restoreDatabase, startBackups } from "./backup.js";
+import { startLiveBackups } from "./live-backup.js";
 import { pushLimitSink } from "./provider-limits.js";
 import { heuristicSizing, installFilingSizer, ownerSizer, refineFiledSizing, settleSizings } from "./task-sizing.js";
 import { tierLines, tierReport } from "./tier-report.js";
@@ -56,7 +58,7 @@ import { readHooksBase, scheduleFromWords } from "./flow-triggers.js";
 import { sendSubagentSummaries } from "./subagent-admin.js";
 import { runRequestedUndos, sendSubagentWeeklies } from "./subagent-week.js";
 import { refreshConnections } from "./mcp-connect.js";
-import { releaseTermsFor } from "./release-carry.js";
+import { releaseCheckPurposeFor, releaseTermsFor } from "./release-carry.js";
 import { refreshTrustedMains, settleReleaseChecks } from "./nightly-check.js";
 import { SECRETS_FIRST, startToolSecrets, toolSecretStorage } from "./project-tools.js";
 import { followDiscord } from "./discord.js";
@@ -99,7 +101,7 @@ import { taskReviewBrief, renderReviewBrief } from "./task-review-brief.js";
 import { homedir, hostname } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
 import { releaseStalledUpdate, waitingUpdate } from "./toolroll-update.js";
-import { openStore, openStoreNoMigrate, CONCURRENT_WRITER_WAIT_MS, isDatabaseBusy, databasePath, BUILT_IN, parseCapabilityKey, verifiedAuthor, isDigestTime, RESULT_SCREENSHOTS, } from "./store.js";
+import { openStore, openStoreNoMigrate, CONCURRENT_WRITER_WAIT_MS, isDatabaseBusy, databasePath, BUILT_IN, parseCapabilityKey, verifiedAuthor, isDigestTime, predecessorWatches, RESULT_SCREENSHOTS, lifecycleOf, reportLifecycle, beatLifecycle, } from "./store.js";
 import { createHash, randomBytes, randomInt, randomUUID } from "node:crypto";
 import { claimInstance, clearInstance, openInstanceSocket } from "./console-instance.js";
 import { authorizePlanUnderMode } from "./plan-auto.js";
@@ -122,6 +124,9 @@ import { admissionRecorded, admitProject, commandLineActor } from "./project-adm
 import { leadClaim, leadSay, noteLeadWork } from "./lead-voice.js";
 import { createServer as createNetServer } from "node:net";
 import { spawn as spawnChild } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { superviseController } from "./controller-supervisor.js";
+import { buildIdentity, memoryChannel, RoleGenerations, roleMessage } from "./up-processes.js";
 // Every envelope is checked against its command's schema (logged, never refused), then serialized unchanged.
 import { checkedEnvelopeJson as envelopeJson } from "./contracts/cli.js";
 import { auditCommand } from "./audit-cli.js";
@@ -190,7 +195,9 @@ import { acquire, acquireIfReady, heartbeat, release, reap, currentClaim, DEFAUL
 import { disposeBuildOutcome, holdStaleApproval, regateTask } from "./dispose.js";
 import { proposeGrant, describeGrant, describeWithheld, permits, MUTATION_CLASSES, DEFAULT_MUTATIONS, } from "./grant.js";
 import { builtIn, guarded } from "./backend.js";
-import { register, authenticate, heartbeat as heartbeatRunner, isAlive, recoverDead, recoveredAnything, acquireWatchLeaseAuthed, heartbeatWatchLeaseAuthed, addRunnerReposAuthed, removeRunnerRepoAuthed, registerRunnerIfIdle, retireRunnerIfCurrent, normalizeRunnerName, validRunnerName, canonicalRepos, RUNNER_NAME_MAX, RUNNER_CAPACITY_MAX, parseRunnerCapacity, } from "./runner.js";
+import { register, authenticate, heartbeat as heartbeatRunner, isAlive, recoverDead, recoveredAnything, acquireWatchLeaseAuthed, heartbeatWatchLeaseAuthed, addRunnerReposAuthed, removeRunnerRepoAuthed, registerRunnerIfIdle, retireRunnerIfCurrent, drainRunnerIfCurrent, RUNNER_HEARTBEAT_MS, MAX_WATCH_LEASE_MS, normalizeRunnerName, validRunnerName, canonicalRepos, RUNNER_NAME_MAX, RUNNER_CAPACITY_MAX, parseRunnerCapacity, hashToken as hashRunnerToken, } from "./runner.js";
+import { credentialDigest, recordedHolderProvedGone, processGone, processStart, readRunnerProcessRecord, runnerProcessFile, sealRunnerProcessRecord, writeRunnerProcessRecord } from "./runner-process.js";
+import { stopProcessTree } from "./process-tree.js";
 import { mintCoordinator, revokeCoordinator, listCoordinators } from "./coordinator.js";
 import { serveMcp } from "./mcp.js";
 import { createInterface } from "node:readline";
@@ -224,7 +231,8 @@ import { scout as scoutTask } from "./scout.js";
 import { profileDigestOf } from "./scope.js";
 import { PROVIDER_KEY_ENV, clearProviderKey, keyStatus, readAuthMode, readAuthModeStrict, readProviderKey, saveProviderKey, setAuthMode, verifyProviderKey, verdictWords } from "./keys.js";
 import { run, terminateLiveProviders, run as execRun } from "./exec.js";
-import { hardenedGit } from "./teardown-git.js";
+import { hardenedGit, lazyFetchSafeGit, noLazyFetch, PARTIAL_CLONE_REFUSAL } from "./teardown-git.js";
+import { installedGitFloorProblem } from "./git-floor.js";
 import { noticeGitIncidents } from "./git-incident.js";
 import { containmentNotice, containmentStatus, currentContainment, describeContainment, resolveContainment } from "./containment.js";
 import { readPulls } from "./pulls.js";
@@ -435,6 +443,8 @@ External trackers — build what a tracker nominates, under local approvals
                                         app; they start without a restart.
                                         --repo still adds an exact path;
                                         --no-open skips the browser;
+                                        the app and the builder run as two
+                                        processes (--single-process: one);
                                         --host 0.0.0.0 --allow-host name:port
                                         reaches a phone over a tailnet;
                                         --runner names the worker;
@@ -656,6 +666,8 @@ export const KEYS_ACTIONS = ["status", "set", "clear", "verify", "auth"];
  * tests): every value-taking flag any verb reads, and every boolean.
  * A --flag in neither set is a typo, refused by name.
  */
+/** Flags whose value is a secret someone types or pastes: taken as the next argument even when it starts with "--". */
+export const SECRET_VALUE_FLAGS = new Set(["token", "password"]);
 export const OPERATE_VALUE_FLAGS = new Set([
     "key", "db", "runner", "ttl", "state", "on", "reason", "until", "id", "backend",
     "allow", "selector", "paths", "credentials", "repo", "token", "capacity",
@@ -706,7 +718,7 @@ export const OPERATE_BOOLEAN_FLAGS = new Set([
     "no-carry",
     "json", "yes", "all", "brief", "local", "history", "latest-watch", "dry-run", "file",
     "clear", "follow", "ready", "all-tasks", "inbound-only", "help", "undo", "anyone", "allow-dispatch", "allow-merge", "merge-delete-branch",
-    "no-open", "remove", "no-verify", "no-follow", "end", "report", "off", "tmux",
+    "no-open", "single-process", "remove", "no-verify", "no-follow", "end", "report", "off", "tmux",
     "self-heal", "plan-auto", "chat-approve", "full-access", "repair-auto", "review-retry-auto", "no-local",
     "html", "csv", "alerts-only",
     // project network: what its builds may reach (--open | --allowlist).
@@ -772,11 +784,11 @@ export function parseOperateArgs(argv, ownValues = new Set()) {
         const value = equals === -1 ? argv[++index] : argument.slice(equals + 1);
         // A following --flag is not a value — consuming it would swallow a real
         // flag and leave this one holding a name-shaped lie.
-        // Minted 32-byte base64url credentials may begin with two hyphens.
-        // Accept that exact token shape without swallowing a following flag.
-        // Explicit --name=value also carries arbitrary literal leading hyphens.
-        const mintedToken = name === "token" && value !== undefined && /^[A-Za-z0-9_-]{43}$/.test(value);
-        if (value === undefined || (equals === -1 && value.startsWith("--") && !mintedToken))
+        // A secret (a password, a token) is random base64url and may begin with two hyphens: it is the next argument
+        // unless that argument is exactly a flag this parser knows (a real flag is never swallowed, finding 22). Other flags
+        // never take a following --flag. Explicit --name=value carries arbitrary literal leading hyphens for every flag.
+        const namesFlag = (one) => { const flag = one.slice(2).split("=")[0]; return booleans.has(flag) || wantsValue.has(flag); };
+        if (value === undefined || (equals === -1 && value.startsWith("--") && (!SECRET_VALUE_FLAGS.has(name) || namesFlag(value))))
             return { error: `--${name} needs a value` };
         // `flows import --param a=1 --param b=2`: each value kept, one per line.
         flags.set(name, name === "param" && typeof flags.get(name) === "string" ? `${flags.get(name)}\n${value}` : value);
@@ -943,6 +955,8 @@ async function dispatchOn(command, positional, flags, repoList, base, options, e
             ...(options.installBin === undefined ? {} : { installBin: options.installBin }),
             ...(options.onboardSeams === undefined ? {} : { onboardSeams: options.onboardSeams }),
             ...(options.upSeams === undefined ? {} : { upSeams: options.upSeams }),
+            ...(options.upRole === undefined ? {} : { upRole: options.upRole }),
+            ...(upNeedsOneProcess(options) ? { upOneProcess: true } : {}),
             ...(activeRemote() === null ? {} : { principal: activeRemote() }),
         });
         return await enter(run);
@@ -1312,11 +1326,11 @@ async function dispatch(command, positional, flags, context) {
         case "sync":
             return syncCommand(flags, context);
         case "serve":
-            return serveCommand(flags, context);
+            return gitTooOld(command, context) ?? serveCommand(flags, context);
         case "watch":
-            return watchCommand(flags, context);
+            return gitTooOld(command, context) ?? watchCommand(flags, context);
         case "up":
-            return upCommand(flags, context);
+            return gitTooOld(command, context) ?? upCommand(flags, context);
         case "onboard":
             return onboardCommand(flags, context);
         case "daemon":
@@ -1531,6 +1545,10 @@ function claimCommand(positional, flags, context) {
             return fail(write, json, "claim", "coordinator-filed", "a coordinator filed this — nothing runs until the operator signs its scope", EXIT.refused);
         if (result.reason === "sweep-limit")
             return fail(write, json, "claim", "sweep-limit", `its sweep already has ${result.limit} running at once — it starts when one finishes`, EXIT.refused, { sweep: result.sweep, limit: result.limit });
+        if (result.reason === "watch-custody")
+            return fail(write, json, "claim", "watch-custody", "This worker no longer holds the project; restart the watch", EXIT.refused);
+        if (result.reason === "draining")
+            return fail(write, json, "claim", "draining", `Toolroll is restarting (draining): ${runner} takes no new work until it is back (by ${result.until})`, EXIT.refused, { until: result.until });
         return fail(write, json, "claim", result.reason, `held by ${result.by} until ${result.until}`, EXIT.refused, { holder: result.by, until: result.until });
     }
     // Taking a task is what makes it running; leaving that to the caller would
@@ -3105,9 +3123,10 @@ async function tickCommand(flags, context) {
                     buildBase = source.head;
                 else {
                     const descendant = exists.code === 0 ? branch : base;
-                    const ancestry = await git("git", ["--no-lazy-fetch", "--no-replace-objects", "merge-base", "--is-ancestor", source.head, descendant], { cwd: repo });
+                    // On a git without --no-lazy-fetch, through a frozen read view that refuses a partial clone (lazyFetchSafeGit).
+                    const ancestry = await lazyFetchSafeGit(git)("git", [...noLazyFetch(), "-c", "protocol.allow=never", "--no-replace-objects", "merge-base", "--is-ancestor", source.head, descendant], { cwd: repo });
                     if (ancestry.code !== 0)
-                        problem = "the requested revision base does not contain its source head";
+                        problem = ancestry.stderr.includes(PARTIAL_CLONE_REFUSAL) ? PARTIAL_CLONE_REFUSAL : "the requested revision base does not contain its source head";
                 }
             }
             if (problem !== null) {
@@ -3936,6 +3955,7 @@ async function startConsole(options) {
         ...(options.upConsole === undefined ? {} : { upConsole: options.upConsole }),
         ...(options.editorLinks === undefined ? {} : { editorLinks: options.editorLinks }),
         ...(options.instanceSecret === undefined ? {} : { instanceSecret: options.instanceSecret }),
+        ...(options.draining === undefined ? {} : { draining: options.draining }),
     });
     await new Promise((resolve, reject) => {
         server.once("error", reject);
@@ -5992,8 +6012,10 @@ async function daemonCommand(positional, flags, context) {
     return fail(write, json, "daemon", "usage", "`toolroll daemon [install|status|uninstall|logs]`", EXIT.usage);
 }
 // ---- the watch loop --------------------------------------------------------
-const WATCH_LEASE_MS = 90_000;
-const WATCH_HEARTBEAT_MS = 30_000;
+// A watch lease lasts at most a minute and is renewed every 15 s (docs/plans/actors-lessons.md): a crashed worker's
+// projects are free within a minute, and a clean stop hands them back at once (retireRunnerIfCurrent).
+const WATCH_LEASE_MS = MAX_WATCH_LEASE_MS;
+const WATCH_HEARTBEAT_MS = RUNNER_HEARTBEAT_MS;
 /** The start repair runs once per process, not once per project loop. */
 /**
  * The Telegram follower: one actor on the wire that sends notifications and
@@ -6056,7 +6078,19 @@ async function runWatchLoop(args) {
     }
     // The owner carries lifetime without changing the lease schema. Bounded watches cannot host automatic sweeps.
     const incarnation = `${runFor === null ? "toolroll-service:" : ""}${randomUUID()}`;
-    const lease = acquireWatchLeaseAuthed(store, { runner, token, repo, owner: incarnation, ttlMs: WATCH_LEASE_MS }, new Date());
+    let lease = acquireWatchLeaseAuthed(store, { runner, token, repo, owner: incarnation, ttlMs: WATCH_LEASE_MS }, new Date());
+    // Only expiry hands the lease over (store.acquireWatchLease): a predecessor still renewing keeps it, and the takeover
+    // recovers its incarnation in the same transaction, exactly as a fresh `up` after a crash would.
+    const waitUntil = Date.now() + (args.leaseWaitMs ?? 0);
+    let saidWaiting = false;
+    const waitStopping = args.leaseWaitStopping ?? args.isStopping;
+    while (!lease.ok && lease.reason === "watch-busy" && Date.now() < waitUntil && !waitStopping()) {
+        if (!saidWaiting)
+            progress(`watch: ${repo} is still held by the previous worker until ${lease.until ?? "its lease lapses"}; taking it over then`);
+        saidWaiting = true;
+        await new Promise(resolve => setTimeout(resolve, 1_000));
+        lease = acquireWatchLeaseAuthed(store, { runner, token, repo, owner: incarnation, ttlMs: WATCH_LEASE_MS }, new Date());
+    }
     if (!lease.ok) {
         return {
             ok: false,
@@ -6656,8 +6690,9 @@ async function watchCommand(flags, context) {
  *
  * COMPOSITION ONLY: identities mint through the atomic doors (a first
  * approver only while none exists; a runner only while its name is idle),
- * then the extracted console and one watch loop per repository run in this
- * one process, under one supervisor, over one shared store. Nothing here
+ * then the console and the worker (one watch loop per repository) run as two
+ * supervised processes over one shared store (isolated-checks.md, stage 1;
+ * up-processes.ts says what each holds). Nothing here
  * loosens a ceremony: approval, budgets, publication, and every fence work
  * exactly as they do for the long-hand verbs.
  */
@@ -6728,7 +6763,7 @@ async function resolveUpApprover(context, flags, canPrompt) {
             // the insert (finding 27). A refused insert unlinks only when an
             // UNRELATED approver won (finding 32).
             const name = asFlag ?? process.env["USER"] ?? process.env["USERNAME"] ?? "operator";
-            const password = randomBytes(12).toString("base64url");
+            const password = mintSecret(12);
             try {
                 writeLoginFileDurably(loginFile, name, password);
             }
@@ -6960,6 +6995,9 @@ async function onboardCommand(flags, context) {
 }
 async function upCommand(flags, context) {
     const { store, write, json, clock } = context;
+    // A role of an `up` that is already running (up-role-child.ts): no validation, identity or port of its own.
+    if (context.upRole !== undefined)
+        return upRoleCommand(context, context.upRole);
     const demoFence = refuseDemo(context, "up");
     if (demoFence !== null)
         return demoFence;
@@ -7082,8 +7120,13 @@ async function upCommand(flags, context) {
         probe.once("error", () => resolveProbe(false));
         probe.listen(port, "127.0.0.1", () => resolveProbe(true));
     });
-    if (!reserved)
+    if (!reserved) {
+        // The console that holds it said it is stopping: a restart is under way, so say that instead of "another one runs".
+        const holder = lifecycleOf(store, `console:${port}`);
+        if (holder?.state === "draining")
+            return fail(write, json, "up", "port-busy", `Toolroll is restarting (draining): the console on port ${port} is stopping — try again in a few seconds`, EXIT.refused);
         return fail(write, json, "up", "port-busy", `port ${port} is taken — another \`up\` or \`serve\` may already be running; stop it, or pick a different --port`, EXIT.refused);
+    }
     // Under a coding agent nothing is asked and no secret is printed, even in a real terminal: what is shown lands in
     // its transcript.
     const agentRunning = underAgent(context.upSeams?.env ?? process.env);
@@ -7115,21 +7158,47 @@ async function upCommand(flags, context) {
             // The runner's authority is BOUND to the canonical roots this up
             // serves (MCP spec v6): the claim gate enforces membership, so an
             // unbound registration would deny-all its own dispatches.
-            const answer = registerRunnerIfIdle(store, { name, host: hostname(), repos, now: clock() });
+            // A holder whose every process is proved gone (its record beside the database) no longer blocks the name: an
+            // `up` killed outright can't leave a fresh heartbeat in the way of the next start (the 2026-10-29 deploy).
+            const tryRegister = () => registerRunnerIfIdle(store, { name, host: hostname(), repos, now: clock(),
+                previousGone: holder => recordedHolderProvedGone(runnerProcessFile(context.databaseFile, name), holder, hostname()) });
+            let answer = tryRegister();
+            // Wait for a draining holder to sign off or be proved gone, never just for its deadline to elapse.
+            const drainWaitUntil = Date.now() + 2 * 60_000;
+            let saidDraining = false;
+            while (!answer.ok && answer.reason === "runner-draining" && Date.now() < drainWaitUntil) {
+                if (!saidDraining)
+                    progress(`${answer.detail}; waiting for it to stop`);
+                saidDraining = true;
+                await new Promise(resolveWait => setTimeout(resolveWait, 1_000));
+                answer = tryRegister();
+            }
             if (answer.ok) {
                 runnerName = name;
                 runnerToken = answer.token;
+                if (answer.signedOff !== null)
+                    progress(`signed off the previous ${name}: its processes had already exited`);
                 if (answer.recoveredRuns > 0)
                     progress(`recovered ${answer.recoveredRuns} interrupted attempt(s) left by the previous ${name}`);
+                // Every process given this credential is recorded (pid and start time) before it gets it: this one now, each
+                // role child as it is spawned. A later start proves them gone by this record.
+                if (!recordRunnerProcess(context.databaseFile, { runner: answer.runner, credentialHash: hashRunnerToken(answer.token) }, "up", process.pid)) {
+                    retireRunnerIfCurrent(store, runnerName, runnerToken, clock());
+                    return fail(write, json, "up", "runner-alive", "The worker process record could not be saved; nothing started", EXIT.refused);
+                }
                 doorAnswer = answer;
                 break;
             }
             doorAnswer = answer;
             if (runnerFlag !== undefined)
                 break; // an explicit name is never suffixed around
+            if (answer.reason === "runner-draining")
+                break; // a restart under way keeps its name
         }
         if (runnerName === "") {
             const detail = doorAnswer !== null && !doorAnswer.ok ? doorAnswer.detail : "no worker name could be taken";
+            if (doorAnswer !== null && !doorAnswer.ok && doorAnswer.reason === "runner-draining")
+                return fail(write, json, "up", "runner-alive", `${detail}, and it hasn't yet — try again shortly`, EXIT.refused);
             return fail(write, json, "up", "runner-alive", `${detail} — that worker looks alive; stop the other \`up\` or watch, or name a different worker with --runner`, EXIT.refused);
         }
         // 6. Enrollment: repositories and project roots are one atomic machine
@@ -7158,325 +7227,197 @@ async function upCommand(flags, context) {
     finally {
         await new Promise(done => probe.close(() => done()));
     }
-    // 7. The console, on the just-released port. The tiny window between the
-    // probe closing and this bind can lose a race; that failure tears down
-    // cleanly below instead of leaving identities half-claimed silently.
+    // 7–8. The console and the worker (docs/plans/isolated-checks.md, stage 1): two processes, each started and
+    // restarted by controller-supervisor, so a long check in the worker never holds a console response. With seams
+    // that can't cross a process (tests, the desktop host) or --single-process, the same two roles run in this one.
     const pool = join(dirname(context.databaseFile), "worktrees");
-    // Mutated only by the registry supervisor below. The console reads this
-    // proved set on each request, so its project rail and unified chat move
-    // with the live builder instead of freezing at process start.
-    const activeRepos = new Set(repos);
-    // Cockpit B1: this start's instance secret, minted once it is listening; the console answers its challenges with it.
-    let instanceSecret = null;
-    let console_;
-    try {
-        console_ = await startConsole({
-            instanceSecret: () => instanceSecret,
-            context,
-            host: hostFlag,
-            port,
-            ...(allowFlag === undefined ? {} : { allowedHosts: allowFlag.split(",").map(one => one.trim()).filter(one => one !== "") }),
-            ...(publicUrlFlag === undefined ? {} : { publicUrl: publicUrlFlag }),
-            localRunner: runnerName,
-            poolRoot: pool,
-            repos,
-            currentRepos: () => [...activeRepos],
-            admittedRepos: () => [...activeRepos],
-            upConsole: true,
-            registryPath,
-            projectRoots,
-            ...(text(flags, "public-url") === undefined ? {} : { publicUrl: text(flags, "public-url") }),
-            ...(text(flags, "editor") === undefined ? {} : { editorLinks: "vscode" }),
-        });
-    }
-    catch (error) {
-        retireRunnerIfCurrent(store, runnerName, runnerToken, clock());
-        return fail(write, json, "up", "port-busy", `${describe(error)} — the port was taken while starting; try again`, EXIT.refused);
-    }
-    // 8. The project supervisor: one watch loop per proved repository, plus a
-    // tiny registry poll that can add more while this process stays up. The
-    // poll is deliberately plain filesystem I/O (portable across macOS,
-    // Linux, and Windows) and never invokes an agent while nothing changed.
+    const split = !flags.has("single-process") && context.upOneProcess !== true;
+    const build = upBuildIdentity();
+    const containmentFlag = text(flags, "containment") ?? null;
+    const stopGraceMs = Number(text(flags, "stop-grace") ?? 30_000);
     let stopping = false;
     let fatal = null;
-    let graceTimer;
     let runTimer;
-    const followControllers = [];
     let resolveStopped = () => { };
     const stopped = new Promise(resolveStop => (resolveStopped = resolveStop));
-    const stopGraceMs = Number(text(flags, "stop-grace") ?? 30_000);
-    const hardStop = () => {
-        const terminated = terminateLiveProviders();
-        if (terminated > 0)
-            progress(`Stopped ${terminated} running build(s). Their work is saved, and each resumes when the builder starts again.`);
-    };
+    // What the worker serves now: relayed to the console (its project rail and chat), and a restarted worker's start.
+    let currentRepos = [...repos];
+    let consoleRole = null;
+    let workerRole = null;
+    // A stop that can't finish (a role that ignores its stop, a drain that hangs) still signs off: past the worker's own
+    // drain bound and a margin, both roles' process trees are stopped outright, the runner is retired, and `up` ends. A
+    // service's launchd window (ExitTimeOut 60 s, controller-service's 55 s) is longer than this at the default grace.
+    let resolveForced = () => { };
+    const forced = new Promise(resolveForce => (resolveForced = resolveForce));
+    let forceTimer;
+    const stopDeadlineMs = Math.max(1, stopGraceMs) + 20_000;
     const stop = () => {
         if (stopping) {
-            hardStop();
+            workerRole?.hardStop();
             return;
         }
         stopping = true;
         resolveStopped();
-        for (const controller of followControllers)
-            controller.abort();
-        // The coding owner record is released first, whatever else is still
-        // finishing: launchd kills a service that outlasts its exit window, and a
-        // killed process cannot release it. Its outcome is read again at close.
-        console_.server.closeCoding().catch(() => { });
-        const building = store.liveClaimCount(runnerName, clock());
-        if (building > 0) {
-            progress(`Stopping: ${building} build(s) running. Waiting up to ${Math.round(stopGraceMs / 1000)}s for them to finish; any still running then is saved and resumes when the builder starts again.`);
-        }
-        graceTimer = setTimeout(hardStop, stopGraceMs);
-        graceTimer.unref?.();
+        // Draining, durably: no new work is admitted for this runner from now, and a restart waits for this drain's end
+        // (now + the forced-stop bound) instead of a heartbeat window.
+        try {
+            if (runnerName !== "")
+                drainRunnerIfCurrent(store, runnerName, runnerToken, clock(), new Date(clock().getTime() + stopDeadlineMs));
+        }
+        catch { /* the heartbeat bound still holds */ }
+        forceTimer = setTimeout(() => {
+            fatal ??= `stopping took longer than ${Math.round(stopDeadlineMs / 1000)} s; its console and worker were stopped outright`;
+            workerRole?.kill();
+            consoleRole?.kill();
+            resolveForced();
+        }, stopDeadlineMs);
+        forceTimer.unref?.();
+        // The coding owner record is released first, whatever else is still finishing: launchd kills a service that
+        // outlasts its exit window, and a killed process cannot release it. The console keeps serving until the end.
+        consoleRole?.send({ type: "stopping" });
+        workerRole?.stop();
     };
     process.on("SIGINT", stop);
     process.on("SIGTERM", stop);
-    if (forGiven !== undefined) {
-        runTimer = setTimeout(stop, Number(forGiven));
-        runTimer.unref?.();
-    }
-    const loopFlagsFor = (repo) => {
-        const copy = new Map();
-        // A bounded `up` must not advertise its child watches as an unbounded sweep service either.
-        if (forGiven !== undefined)
-            copy.set("for", forGiven);
-        copy.set("runner", runnerName);
-        copy.set("token", runnerToken);
-        copy.set("repo", repo);
-        copy.set("pool", pool);
-        // The co-hosted console's stated origin rides into each loop's follower:
-        // a phone link must name THIS console, or not exist.
-        const publicUrl = text(flags, "public-url");
-        if (publicUrl !== undefined)
-            copy.set("public-url", publicUrl);
-        return copy;
+    // The process that started `up` gone (its service supervisor killed, or the IPC parent that ran it): nobody is left to
+    // forward a stop, so `up` stops itself — it drains, retires its runner and ends instead of running on as an orphan.
+    let parentGone = false;
+    const parentAtStart = process.ppid;
+    const parentWatch = context.upSeams === undefined && parentAtStart > 1 ? setInterval(() => {
+        if (process.ppid === parentAtStart || parentGone)
+            return;
+        parentGone = true;
+        progress("the process that started Toolroll is gone; stopping");
+        stop();
+    }, 1_000) : undefined;
+    parentWatch?.unref?.();
+    const onDisconnect = () => { if (!parentGone) {
+        parentGone = true;
+        progress("the process that started Toolroll closed its channel; stopping");
+        stop();
+    } };
+    if (context.upSeams === undefined && process.channel !== undefined && process.channel !== null)
+        process.once("disconnect", onDisconnect);
+    // A log (a service, an agent, --json or --verbose) says whose each line is; a person at a terminal reads plain lines.
+    const labelled = split && (json || flags.has("verbose") || !(context.upSeams?.terminal ?? process.stdout.isTTY === true));
+    const roleLine = (role) => (line) => progress(labelled ? `[${role}] ${line}` : line);
+    const dropSignals = () => {
+        process.removeListener("SIGINT", stop);
+        process.removeListener("SIGTERM", stop);
+        process.removeListener("disconnect", onDisconnect);
+        if (parentWatch !== undefined)
+            clearInterval(parentWatch);
     };
-    const prefix = (repo) => (activeRepos.size > 1 ? `[${projectName(repo)}] ` : "");
-    // Containment at start: one plain sentence, once, for a person at a
-    // terminal; the exact status line with --verbose, in a service log (no
-    // terminal), and always when a required policy will refuse spawns.
-    const containmentDetail = flags.has("verbose") || !(context.upSeams?.terminal ?? process.stdout.isTTY === true);
-    let containmentSaid = false;
-    const containmentLines = (effective) => {
-        const notice = containmentNotice(effective);
-        if (notice !== null && !containmentSaid)
-            progress(notice);
-        containmentSaid = true;
-        return containmentDetail || effective.refusal !== null ? [`watch: ${describeContainment(effective)}`] : [];
+    const consoleConfig = {
+        host: hostFlag, port, allowedHosts: allowFlag === undefined ? null : allowFlag.split(",").map(one => one.trim()).filter(one => one !== ""),
+        publicUrl: publicUrlFlag ?? null, localRunner: runnerName, poolRoot: pool, repos: [...repos], projectRoots, registryPath, editor: editorGiven !== undefined,
     };
-    const loopResults = new Map();
-    // One record of project passes for the whole service: fair scheduling
-    // across its projects (project-concurrency.ts).
-    const projectPasses = new ProjectPasses();
-    // Projects removed while running: each one's watch stops admitting work, finishes what it holds, then lets go.
-    const releasedRepos = new Set();
-    const launchRepo = async (repo, bind) => {
-        if (loopResults.has(repo) || stopping)
-            return;
-        if (bind) {
-            const bound = addRunnerReposAuthed(store, { name: runnerName, token: runnerToken, repos: [repo] }, clock());
-            if (!bound.ok) {
-                fatal = `the builder identity changed while adding ${repo} (${bound.reason})`;
-                stop();
-                return;
+    const pendingLinks = new Map();
+    let linkRequests = 0;
+    const roleSpawned = (role, pid) => {
+        const held = store.getRunner(runnerName);
+        return held !== null && held.credentialHash === hashRunnerToken(runnerToken) && recordRunnerProcess(context.databaseFile, held, role, pid);
+    };
+    consoleRole = startUpRole({
+        role: "console", split, context, build, shutdownMs: 15_000, onSpawned: pid => roleSpawned("console", pid),
+        start: () => ({ type: "start", role: "console", databaseFile: context.databaseFile, containment: containmentFlag, build, config: { ...consoleConfig, repos: [...currentRepos] } }),
+        onMessage: message => {
+            if (message.type === "log")
+                roleLine("console")(message.line);
+            else if (message.type === "sign-in-link") {
+                pendingLinks.get(message.id)?.(message.link);
+                pendingLinks.delete(message.id);
             }
-            activeRepos.add(repo);
-            if (!store.listProjects().some(one => one.path === repo)) {
-                store.upsertProject(repo, projectName(repo), clock());
+        },
+        // A restarted console is told what the worker serves now.
+        onReady: (_, again) => { if (again) {
+            roleLine("console")("started again");
+            consoleRole?.send({ type: "repos", repos: [...currentRepos] });
+        } },
+        onEnded: (detail, restarting) => {
+            if (restarting)
+                roleLine("console")(`${detail}; starting it again`);
+            else if (!stopping) {
+                fatal = detail;
+                stop();
             }
-        }
-        let markReady = () => { };
-        const ready = new Promise(resolveReady => (markReady = resolveReady));
-        const loop = runWatchLoop({
-            flags: loopFlagsFor(repo),
-            context,
-            runner: runnerName,
-            token: runnerToken,
-            repo,
-            progress: line => progress(`${prefix(repo)}${line}`),
-            isStopping: () => stopping || releasedRepos.has(repo),
-            onFollowController: controller => followControllers.push(controller),
-            containmentLines,
-            passes: projectPasses,
-            serviceBridge: true,
-            onReady: () => {
-                markReady();
-                if (bind)
-                    progress(`${prefix(repo)}builder connected — queued work can start`);
+        },
+    });
+    const consoleReady = await consoleRole.ready;
+    if (!consoleReady.ok) {
+        dropSignals();
+        retireRunnerIfCurrent(store, runnerName, runnerToken, clock());
+        if (consoleReady.reason === "port-busy")
+            return fail(write, json, "up", "port-busy", `${consoleReady.detail} — the port was taken while starting; try again`, EXIT.refused);
+        return fail(write, json, "up", "failed", `the console could not start (${consoleReady.detail}) — nothing was left running`, EXIT.failed);
+    }
+    const url = consoleReady.url;
+    if (!stopping) {
+        workerRole = startUpRole({
+            role: "worker", split, context, build, onSpawned: pid => roleSpawned("worker", pid),
+            // The worker drains its builds for the stop grace, then stops them; past that it is stopped outright.
+            shutdownMs: Math.max(1, stopGraceMs) + 15_000,
+            start: generation => ({
+                type: "start", role: "worker", databaseFile: context.databaseFile, containment: containmentFlag, build,
+                config: {
+                    runner: runnerName, token: runnerToken, repos: generation === 1 ? [...repos] : [...currentRepos], pinnedRepos: [...pinnedRepos], projectRoots, registryPath, pool,
+                    forMs: forGiven === undefined ? null : Number(forGiven), publicUrl: publicUrlFlag ?? null, stopGraceMs, verbose: flags.has("verbose"),
+                    terminal: context.upSeams?.terminal ?? process.stdout.isTTY === true,
+                    // A restart waits out a crashed predecessor's lease (at most a minute), then recovers it: as a fresh `up` after a crash.
+                    leaseWaitMs: split ? WATCH_LEASE_MS + 15_000 : 0,
+                },
+            }),
+            onMessage: message => {
+                if (message.type === "log")
+                    roleLine("worker")(message.line);
+                else if (message.type === "repos") {
+                    // The console's admitted projects widen only to what the builder is bound to in the store (the worker binds
+                    // through the authenticated door before it reports): a worker's word alone admits nothing.
+                    const bound = new Set(store.getRunner(runnerName)?.runner.repos ?? []);
+                    currentRepos = message.repos.filter(repo => bound.has(repo));
+                    consoleRole?.send({ type: "repos", repos: [...currentRepos] });
+                }
             },
-        }).then(result => ({ repo, result }), error => ({ repo, result: { ok: false, reason: "loop-failed", detail: describe(error), ticks: 0, built: 0, broke: 0 } }));
-        loopResults.set(repo, loop);
-        void loop.then(({ repo: endedRepo, result }) => {
-            if (releasedRepos.has(endedRepo) && !stopping) {
-                // A removed project's watch has stopped: only now does the builder let go of it.
-                const unbound = removeRunnerRepoAuthed(store, { name: runnerName, token: runnerToken, repo: endedRepo }, clock());
-                if (!unbound.ok) {
-                    fatal = `the builder identity changed while removing ${endedRepo} (${unbound.reason})`;
+            onReady: (_, again) => { if (again)
+                roleLine("worker")("started again: its builds and checks continue"); },
+            onEnded: (detail, restarting) => {
+                // A builder whose credential no longer proves can't come back by restarting: the whole `up` stops, and the
+                // service's next start registers it again, as before the split.
+                if (restarting && authenticate(store, runnerName, runnerToken).ok) {
+                    roleLine("worker")(`${detail}; starting it again — its interrupted builds are recovered first`);
+                    return;
+                }
+                if (!stopping) {
+                    fatal = restarting ? `the builder identity changed (${detail})` : detail;
                     stop();
                 }
-                loopResults.delete(endedRepo);
-                releasedRepos.delete(endedRepo);
-                progress(`project removed — ${projectName(endedRepo)} is no longer built here`);
-                markReady();
-                return;
-            }
-            // A loop that dies while its siblings live must not leave a partial
-            // cockpit standing silently (finding 5).
-            if (!result.ok && !stopping) {
-                fatal = `${prefix(endedRepo)}${result.detail}`;
-                stop();
-            }
-            markReady(); // acquisition failures must not strand startup readiness
-        });
-        await ready;
-    };
-    await Promise.all(repos.map(repo => launchRepo(repo, false)));
-    // Telegram: one follower for the whole service, never one per project
-    // loop. Replies and notifications go out from it, over the same transport
-    // in the same cycle (Oct 2: a reply sent by a project loop's own follower
-    // failed "fetch failed" while notifications went out). A token saved
-    // while the service runs connects within seconds; a follower that dies
-    // is started again.
-    const telegramController = new AbortController();
-    followControllers.push(telegramController);
-    const telegramSupervisor = (async () => {
-        const pause = (ms) => new Promise(resolvePause => {
-            const timer = setTimeout(done, ms);
-            function done() { clearTimeout(timer); telegramController.signal.removeEventListener("abort", done); resolvePause(); }
-            // An aborted signal never fires again: without this a stop waited the whole pause.
-            if (telegramController.signal.aborted)
-                done();
-            else
-                telegramController.signal.addEventListener("abort", done, { once: true });
+            },
         });
-        while (!stopping && !telegramController.signal.aborted) {
-            const follower = startTelegramFollower({
-                context, publicUrl: text(flags, "public-url"), signal: telegramController.signal, progress, label: "telegram:",
-                died: { prefix: "", then: "starting it again" }, owner: `service-${randomUUID()}`,
-            });
-            if (follower !== null)
-                await follower;
-            // Without a token (or on a fenced network) look again shortly; the fence line is said once.
-            if (follower === null && loadBotToken(process.env, context.telegramTokenFile) !== null)
-                break;
-            await pause(follower === null ? 2_000 : 5_000);
-        }
-    })();
-    const dynamicCeiling = resolveCeiling(repos, projectRoots).ceiling;
-    const rejected = new Set();
-    const registrySupervisor = (async () => {
-        const sleep = (ms) => new Promise(resolveSleep => setTimeout(resolveSleep, ms));
-        while (!stopping) {
-            const loaded = await loadProjectRegistry(registryPath);
-            if ("error" in loaded) {
-                fatal = loaded.error;
-                stop();
-                break;
-            }
-            // Removed from the saved list: stop building it and take it out of the console. A pinned start keeps its own.
-            const saved = new Set(loaded.repos.map(one => canonicalProject(one) ?? one));
-            for (const repo of [...activeRepos]) {
-                if (stopping || pinnedRepos.has(repo) || saved.has(repo))
-                    continue;
-                activeRepos.delete(repo);
-                releasedRepos.add(repo);
-                if (!loopResults.has(repo))
-                    releasedRepos.delete(repo);
-            }
-            for (const candidate of loaded.repos) {
-                if (stopping)
-                    break;
-                const canonical = canonicalProject(candidate);
-                // Still letting go of an earlier removal: it rejoins on the next pass after its watch has stopped.
-                if (canonical !== null && (activeRepos.has(canonical) || releasedRepos.has(canonical)))
-                    continue;
-                const approvedAdditions = context.additionalProjectRepos?.() ?? [];
-                const admittedCeiling = resolveCeiling([...dynamicCeiling.repos, ...approvedAdditions], dynamicCeiling.roots).ceiling;
-                // A project added after this start (`repos add`, the lead, the console) carries its recorded admission; a
-                // registry line alone is not authority. Either way the folder is proved to be that Git checkout again.
-                const allowed = canonical !== null &&
-                    ((await authorizedProject(admittedCeiling, canonical)) || admissionRecorded(store, canonical)) &&
-                    (await proveRepo(canonical)) === canonical;
-                if (!allowed) {
-                    if (!rejected.has(candidate)) {
-                        rejected.add(candidate);
-                        progress(`project not connected — ${candidate} isn't a Git repository added with \`toolroll repos add\` or the console`);
-                    }
-                    continue;
-                }
-                rejected.delete(candidate);
-                await launchRepo(canonical, true);
-            }
-            if (!stopping)
-                await sleep(500);
+        const workerReady = await workerRole.ready;
+        if (!workerReady.ok && fatal === null) {
+            fatal = workerReady.detail;
+            stop();
         }
-    })().catch(error => {
-        fatal = `the project registry stopped (${describe(error)})`;
-        stop();
-    });
-    // A runner with no projects still stays visibly alive while the UI waits
-    // for the first addition. Watch loops heartbeat during their passes; this
-    // machine-level pulse also covers the intentionally empty state.
-    // Provider readiness (v47): this machine's non-spending observations,
-    // recorded under its own runner name ONCE at start — so every route
-    // projection can say ready / unavailable / unknown per provider, and
-    // the dispatch gate can halt a leg this machine cannot run. There is no
-    // periodic readiness daemon: startup, an explicit `providers --report`,
-    // and the narrow pre-dispatch observation are the roads. Production
-    // only: a test's injected agent runner is a fake, and its readiness
-    // would be a fiction.
-    const observeReadiness = () => {
-        if (context.agentRunner !== undefined)
-            return;
-        void observeProviderReadiness((file, args, options) => run(file, args, { timeoutMs: options?.timeoutMs ?? 5_000, ...(options?.omitEnv === undefined ? {} : { omitEnv: options.omitEnv }) }), process.env, PROVIDER_IDS, provider => store.acpAttestationFor(provider, runnerName))
-            .then(observed => {
-            if (!stopping)
-                reportProviderReadinessAuthed(store, { name: runnerName, token: runnerToken, observations: observed }, clock());
-        })
-            .catch(() => {
-            // A probe that cannot run leaves readiness unknown — never a fiction.
-        });
-    };
-    observeReadiness();
-    try {
-        notifyVersionLive(context.store, dirname(context.databaseFile), PACKAGE_VERSION, clock());
     }
-    catch { /* A display fact; never blocks the worker. */ }
-    recordRunnerVersion(dirname(context.databaseFile), runnerName, PACKAGE_VERSION, clock());
+    // A runner with no projects still stays visibly alive while the UI waits for the first addition; the worker's
+    // loops also renew it with their leases. Across a worker restart this keeps the name held.
     const runnerHeartbeat = setInterval(() => {
         const beat = heartbeatRunner(store, runnerName, runnerToken, clock());
         if (!beat.ok && !stopping) {
             fatal = `the builder identity changed (${beat.reason})`;
             stop();
         }
-    }, 60_000);
+    }, RUNNER_HEARTBEAT_MS);
     runnerHeartbeat.unref?.();
     // 9. Readiness, then the ONE startup envelope / greeting (finding 11/20).
     const approverPlan2 = approver;
-    const url = console_.url;
     const terminal = !agentRunning && (context.upSeams?.terminal ?? process.stdout.isTTY === true);
     const upHandoff = buildHandoff({
         url,
         login: { account: approverPlan2.passwordFile === null ? approverPlan2.approver : loginAccount(approverPlan2.passwordFile) ?? approverPlan2.approver, file: approverPlan2.passwordFile },
     });
     recordUpConsoleUrl(dirname(context.databaseFile), url, clock());
-    // Cockpit B1: who this console is, for bare `toolroll` to prove before it attaches: a fresh secret in the database
-    // (behind the agent fence), and a discovery-only socket beside it. A socket that can't open only means attaching
-    // isn't offered; the console runs either way.
-    // The socket is taken FIRST: only the console that owns it publishes a record. A second console on the same database
-    // (another port) never replaces the first one's record; it runs, but isn't attached to.
-    let mintedSecret = null;
-    const instanceSocket = await openInstanceSocket(context.databaseFile, { pid: process.pid, build: packageVersion(), database: context.databaseFile, port: console_.port }, () => mintedSecret);
-    if (instanceSocket.ok) {
-        mintedSecret = await claimInstance(store, context.databaseFile, { pid: process.pid, port: console_.port, build: packageVersion(), socket: instanceSocket.name }, clock());
-        instanceSecret = mintedSecret;
-        if (mintedSecret === null)
-            progress("attach: another console is running on this database — `toolroll` in a repository opens that one");
-    }
-    else
-        progress(`attach: ${instanceSocket.problem} — \`toolroll\` in a repository won't find this console`);
-    if (fatal === null) {
+    if (fatal === null && !stopping) {
         if (json) {
             write(envelopeJson({
                 ok: true,
@@ -7504,7 +7445,13 @@ async function upCommand(flags, context) {
             // one-time sign-in link (single use, ten minutes, this computer only); it is never printed. The password stays
             // saved beside the database, for later and for other devices, and is never printed either.
             const account = approverPlan2.approver;
-            const link = account === null || flags.has("no-open") ? null : console_.server.mintSignInLink(account);
+            // The console mints it (its sign-in secrets stay there); it comes back only to be opened, never printed.
+            const link = account === null || flags.has("no-open") ? null : await new Promise(resolveLink => {
+                const id = ++linkRequests;
+                const timer = setTimeout(() => { pendingLinks.delete(id); resolveLink(null); }, 10_000);
+                pendingLinks.set(id, value => { clearTimeout(timer); resolveLink(value); });
+                consoleRole?.send({ type: "sign-in-link", id, account });
+            });
             const home = homedir();
             const file = approverPlan2.passwordFile === null ? null : approverPlan2.passwordFile.startsWith(`${home}/`) ? `~${approverPlan2.passwordFile.slice(home.length)}` : approverPlan2.passwordFile;
             const signInWords = account === null
@@ -7523,35 +7470,31 @@ async function upCommand(flags, context) {
             }
         }
     }
-    // 10. Supervise to the end.
+    // A bounded run (--for) counts from readiness, so a slow start never eats the window it asked for.
+    if (forGiven !== undefined && !stopping) {
+        runTimer = setTimeout(stop, Number(forGiven));
+        runTimer.unref?.();
+    }
+    // 10. Supervise to the end: the worker drains first (its builds finish or are saved), the builder retires, and
+    // only then does the console stop serving.
     await stopped;
-    await registrySupervisor;
-    await Promise.all([...loopResults.values()]);
-    // The follower was aborted with the stop. A send or a chat turn it is still
-    // finishing keeps its own durable record; the service does not wait past
-    // this for it.
-    await new Promise(done => {
-        const timer = setTimeout(done, TELEGRAM_STOP_WAIT_MS);
-        const finish = () => { clearTimeout(timer); done(); };
-        void telegramSupervisor.then(finish, finish);
-    });
+    if (workerRole !== null)
+        await Promise.race([workerRole.done, forced]);
     clearInterval(runnerHeartbeat);
     if (runTimer !== undefined)
         clearTimeout(runTimer);
-    if (graceTimer !== undefined)
-        clearTimeout(graceTimer);
-    process.removeListener("SIGINT", stop);
-    process.removeListener("SIGTERM", stop);
+    dropSignals();
     retireRunnerIfCurrent(store, runnerName, runnerToken, clock());
-    if (instanceSocket.ok)
-        instanceSocket.close();
-    if (mintedSecret !== null)
-        clearInstance(store, mintedSecret);
-    let closeProblem = null;
-    await new Promise(done => console_.server.close(error => { closeProblem = error ?? null; done(); }));
+    consoleRole.stop();
+    const closed = await Promise.race([consoleRole.done, forced.then(() => ({ problem: null }))]);
+    if (forceTimer !== undefined)
+        clearTimeout(forceTimer);
+    // With nobody left to wait for it, `up` ends once it has signed off, whatever handle lingers.
+    if (parentGone)
+        setTimeout(() => process.exit(fatal === null ? EXIT.ok : EXIT.failed), 1_000).unref?.();
     // A live terminal that couldn't be proved stopped (or any other close failure) is said, never "stopped".
-    if (closeProblem !== null && fatal === null)
-        fatal = closeProblem.message;
+    if (closed.problem !== null && fatal === null)
+        fatal = closed.problem;
     if (fatal !== null) {
         // The startup envelope (when json) already went out; the exit code is
         // the health signal (finding 11/20) — never a second envelope.
@@ -9746,6 +9689,7 @@ async function scopeTask(positional, flags, context) {
     // sandbox, say) file the scope without them: every later commit then asks again, as before.
     const releaseGiven = text(flags, "release");
     let releaseTerms;
+    let releaseCheck;
     let releaseNote = null;
     if (releaseGiven !== undefined) {
         const spec = /^(\d+\.\d+\.\d+):([1-9][0-9]*):([A-Za-z0-9._/-]+)$/.exec(releaseGiven);
@@ -9757,8 +9701,15 @@ async function scopeTask(positional, flags, context) {
         const made = releaseTermsFor(store, { repo, version: spec[1], pr: Number(spec[2]), branch: spec[3], candidate: candidateGiven, now, noCarry: flags.get("no-carry") === true });
         if (made.ok)
             releaseTerms = made.terms;
-        else
+        else {
             releaseNote = `Later commits on this release will each ask for approval: ${made.why}.`;
+            // Without terms the candidate is still a release's check (pipeline-speed.md, P0): its purpose is sealed with the
+            // scope, from the plane's own records, so the check runs under the release's rules and the plane may rerun it on
+            // this same candidate after confirmed infrastructure. It never carries a later commit.
+            const purpose = releaseCheckPurposeFor(store, { repo, version: spec[1], pr: Number(spec[2]), branch: spec[3], candidate: candidateGiven });
+            if (purpose.ok)
+                releaseCheck = purpose.purpose;
+        }
     }
     if (acceptanceParse.criteria.length === 0)
         return fail(write, json, "task scope", "acceptance-required", "--acceptance named no valid criteria", EXIT.usage);
@@ -9826,7 +9777,8 @@ async function scopeTask(positional, flags, context) {
             : null;
         const proposed = propose(store, {
             ...(candidateGiven === undefined ? {} : { candidate: candidateGiven }),
-            ...(releaseTerms === undefined ? {} : { releaseTerms }),
+            ...(releaseTerms === undefined ? {} : { releaseTerms, releaseCheck: null }),
+            ...(releaseCheck === undefined ? {} : { releaseCheck, releaseTerms: null }),
             taskId: id,
             goal,
             outOfScope: text(flags, "not") ?? null,
@@ -11732,3 +11684,692 @@ async function projectSandboxCommand(positional, flags, context) {
         "Scopes written from now on use this; scopes already approved keep what they were approved with.",
     ]);
 }
+/** Starting the console or the worker on a git older than Toolroll's floor (git-floor.ts): refused, with one message
+ * naming the installed and the required version. Other commands aren't held. */
+function gitTooOld(command, context) {
+    const problem = installedGitFloorProblem();
+    return problem === null ? null : fail(context.write, context.json, command, "git-too-old", problem, EXIT.refused);
+}
+/** This build's identity, as each role reports it: the version and the code of this module. */
+function upBuildIdentity() {
+    return buildIdentity(PACKAGE_VERSION, fileURLToPath(import.meta.url));
+}
+/** Seams that live in this process's memory (a test's fake runner, a store wrapper, the desktop host's proof key): a
+ * child process can't receive them, so `up` keeps both of its roles in this process rather than drop them. */
+function upNeedsOneProcess(options) {
+    return options.openDatabase !== undefined || options.desktopIdentity !== undefined || options.additionalProjectRepos !== undefined ||
+        options.agentRunner !== undefined || options.gitRunner !== undefined || options.telegramTransport !== undefined || options.telegramEnv !== undefined ||
+        options.publishExec !== undefined || options.dispatchAdapter !== undefined || options.flowTriggerIo !== undefined || options.flowStepIo !== undefined ||
+        options.flowEveryMs !== undefined || options.platform !== undefined || options.fenceAvailable !== undefined || options.flowFetch !== undefined ||
+        options.integrationIo !== undefined || options.shouldStop !== undefined || options.leadSeams !== undefined || options.waitSleep !== undefined ||
+        options.releaseIo !== undefined || options.installBin !== undefined || options.tempRoots !== undefined || options.filingSizer !== undefined ||
+        options.now !== undefined;
+}
+/** The entry a role child runs: the built sibling when installed, the TypeScript source through tsx in a checkout. */
+/**
+ * Add one process to the record of who holds this runner's credential (runner-process.ts), replacing that role's
+ * earlier processes once they are gone. A complete authenticated record is required before delivering credentials.
+ */
+function recordRunnerProcess(databaseFile, holder, role, pid) {
+    try {
+        const started = processStart(pid);
+        if (started === null)
+            return false;
+        const file = runnerProcessFile(databaseFile, holder.runner.name);
+        const credential = credentialDigest(holder.credentialHash);
+        const current = readRunnerProcessRecord(file);
+        const same = current !== null && current.runner === holder.runner.name && current.registeredAt === holder.runner.registeredAt && current.credential === credential;
+        // Never bless a tampered or incomplete earlier list while appending a credential holder.
+        if (role !== "up" && (!same || current.signature !== sealRunnerProcessRecord(current, holder.credentialHash).signature))
+            return false;
+        // Keep every possibly live generation; truncating this list would erase custody.
+        const kept = same ? current.processes.filter(one => one.role !== role || !processGone(one)) : [];
+        const record = { v: 1, runner: holder.runner.name, host: holder.runner.host, registeredAt: holder.runner.registeredAt, credential,
+            processes: [...kept.filter(one => one.pid !== pid), { pid, role, started }] };
+        if (record.processes.length > 64)
+            return false;
+        writeRunnerProcessRecord(file, sealRunnerProcessRecord(record, holder.credentialHash));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function upRoleChildCommand(role) {
+    const source = import.meta.url.endsWith(".ts");
+    const entry = fileURLToPath(new URL(source ? "./up-role-child.ts" : "./up-role-child.js", import.meta.url));
+    // tsx by its resolved address: the child keeps this process's working directory, which may hold no node_modules.
+    // The role's name is the one argument: a process listing tells the two apart, and carries nothing secret.
+    return { file: process.execPath, argv: [...(source ? ["--import", import.meta.resolve("tsx")] : []), entry, role] };
+}
+/**
+ * One role of `up`: a supervised child process (split), or the same role function in this process. Either way its
+ * messages pass the same checks (up-processes.ts), and its build must be this one's.
+ * - onReady fires on every readiness; `again` after a restart.
+ * - onEnded: the role ended while not stopping. `restarting` (split only) when the supervisor will start it again.
+ */
+function startUpRole(args) {
+    const { role } = args;
+    let resolveReady = () => { };
+    const ready = new Promise(resolve => (resolveReady = resolve));
+    // Readiness per generation (Codex review round 1, finding 5): a replacement's refusal is never hidden by an earlier
+    // generation having been ready.
+    const generations = new RoleGenerations();
+    let stopping = false;
+    // Reported once: the role ended for good (onEnded with restarting false), whichever path saw it first.
+    let endedForGood = false;
+    const endForGood = (detail) => {
+        if (stopping || endedForGood)
+            return;
+        endedForGood = true;
+        args.onEnded(detail, false);
+    };
+    let failed = null;
+    let fatal = null;
+    let closedProblem = null;
+    let livePid = null;
+    // Shared by both transports: every message is checked against this role before anything acts on it.
+    const receive = (raw, abort) => {
+        const message = roleMessage(raw, role);
+        if (message === null)
+            return;
+        if (message.type === "ready") {
+            if (message.build !== args.build) {
+                // Never a console and a worker from different builds: stop rather than run a mixed pair.
+                fatal = `the ${role} is a different build (${message.build}) from this one (${args.build}) — restart Toolroll`;
+                failed = { reason: "start", detail: fatal };
+                generations.refused(fatal);
+                abort();
+                return;
+            }
+            livePid = message.pid;
+            const again = !generations.ready();
+            if (!again)
+                resolveReady({ ok: true, url: message.url ?? "", port: message.port, pid: message.pid });
+            args.onReady(message, again);
+            return;
+        }
+        if (message.type === "failed") {
+            failed = { reason: message.reason, detail: message.detail };
+            generations.refused(message.detail);
+            return;
+        }
+        if (message.type === "fatal") {
+            fatal = message.detail;
+            return;
+        }
+        if (message.type === "closed") {
+            closedProblem = message.problem;
+            return;
+        }
+        args.onMessage(message);
+    };
+    if (!args.split) {
+        const channel = memoryChannel(role);
+        channel.parent.onMessage(message => receive(message, () => channel.parent.stop(false)));
+        const running = upRoleCommand(args.context, { start: args.start(1), port: channel.port }).catch(error => {
+            fatal = describe(error);
+            return EXIT.failed;
+        });
+        const done = running.then(code => {
+            livePid = null;
+            if (!generations.wasReady())
+                resolveReady({ ok: false, ...(failed ?? { reason: "start", detail: fatal ?? `the ${role} stopped while starting (exit ${code})` }) });
+            else
+                endForGood(fatal ?? `the ${role} stopped (exit ${code})`);
+            return { problem: closedProblem };
+        });
+        return {
+            ready, done,
+            send: message => channel.parent.send(message),
+            stop: () => { stopping = true; channel.parent.stop(false); },
+            hardStop: () => { channel.parent.stop(true); },
+            kill: () => { stopping = true; channel.parent.stop(true); },
+            pid: () => livePid,
+        };
+    }
+    const controller = new AbortController();
+    let child = null;
+    const command = upRoleChildCommand(role);
+    const supervised = superviseController({
+        file: command.file, argv: command.argv, signal: controller.signal, ipc: true, shutdownMs: args.shutdownMs,
+        // Each role's own output carries its name; a JSON log stays one JSON object a line.
+        label: envValue(process.env, "LOG_FORMAT") === "json" ? "" : `[${role}]`,
+        onSpawn: (owned, generation) => {
+            child = owned;
+            fatal = null;
+            failed = null;
+            generations.spawned();
+            owned.on("message", raw => receive(raw, () => controller.abort()));
+            owned.on("error", () => { });
+            let recorded = false;
+            try {
+                recorded = owned.pid !== undefined && (args.onSpawned?.(owned.pid) ?? true);
+            }
+            catch { /* refuse credential delivery */ }
+            if (!recorded) {
+                fatal = "The worker process record could not be saved";
+                failed = { reason: "start", detail: fatal };
+                generations.refused(fatal);
+                owned.kill("SIGKILL");
+                controller.abort();
+                resolveReady({ ok: false, ...failed });
+                return;
+            }
+            // The start, including the runner token for the worker, goes over the private channel only.
+            owned.send(args.start(generation), error => { if (error !== null && error !== undefined)
+                owned.kill("SIGTERM"); });
+        },
+        onState: state => {
+            if (state.phase !== "backoff")
+                return;
+            child = null;
+            livePid = null;
+            const exit = state.exit?.signal ?? state.exit?.code ?? "unknown";
+            if (stopping && generations.wasReady())
+                return;
+            const verdict = generations.ended();
+            if (verdict === "fail-start") {
+                // A role that never became ready is not retried: the start fails as one, as before the split.
+                controller.abort();
+                resolveReady({ ok: false, ...(failed ?? { reason: "start", detail: fatal ?? `the ${role} stopped while starting (exit ${exit})` }) });
+                return;
+            }
+            if (verdict === "end") {
+                // A replacement that refused its start (another build or database), or kept ending before it was ready: a
+                // restart can't fix that, so the whole `up` stops instead of looping with the other role still running.
+                controller.abort();
+                endForGood(generations.refusedWith() ?? fatal ?? `the ${role} kept stopping before it was ready (exit ${exit})`);
+                return;
+            }
+            // A build mismatch already aborted: that is the end, not a restart.
+            if (controller.signal.aborted) {
+                endForGood(fatal ?? `the ${role} stopped (exit ${exit})`);
+                return;
+            }
+            args.onEnded(`${fatal === null ? "" : `${fatal} — `}the ${role} stopped unexpectedly (exit ${exit})`, true);
+        },
+    }).catch(error => { if (!generations.wasReady())
+        resolveReady({ ok: false, reason: "start", detail: describe(error) }); });
+    const done = supervised.then(() => {
+        if (!generations.wasReady())
+            resolveReady({ ok: false, ...(failed ?? { reason: "start", detail: fatal ?? `the ${role} did not start` }) });
+        // The supervisor ended without `up` stopping it (an abort on a refusal emits no backoff): `up` hears it either way.
+        else
+            endForGood(generations.refusedWith() ?? fatal ?? `the ${role} stopped`);
+        return { problem: closedProblem };
+    });
+    return {
+        ready, done,
+        send: message => {
+            const owned = child;
+            if (owned !== null && owned.connected) {
+                try {
+                    owned.send(message, () => { });
+                }
+                catch { /* it is ending; the supervisor sees it */ }
+            }
+        },
+        // The supervisor's stop is SIGTERM, which a role takes as "drain"; past shutdownMs its whole tree is stopped.
+        stop: () => { stopping = true; controller.abort(); },
+        hardStop: () => {
+            const owned = child;
+            if (owned !== null && owned.connected) {
+                try {
+                    owned.send({ type: "hard-stop" }, () => { });
+                }
+                catch { /* ending */ }
+            }
+        },
+        kill: () => {
+            stopping = true;
+            controller.abort();
+            const owned = child;
+            // Only the still-owned ChildProcess is signalled, never a recorded pid.
+            if (owned !== null && owned.exitCode === null && owned.signalCode === null && !stopProcessTree(owned))
+                owned.kill("SIGKILL");
+        },
+        pid: () => livePid,
+    };
+}
+/** A role child's whole run (up-role-child.ts): the ordinary command prelude (containment, secrets, limits), then the
+ * role itself. Only a process started by `up` gets here; no command line selects a role. */
+export async function runUpRole(start, port) {
+    return runOperate("up", ["--db", start.databaseFile, ...(start.containment === null ? [] : ["--containment", start.containment])], line => port.send({ type: "log", line }), { upRole: { start, port } });
+}
+async function upRoleCommand(context, host) {
+    const { start, port } = host;
+    // A role runs exactly this build, on exactly this database: anything else ends it before it touches either.
+    if (start.build !== upBuildIdentity()) {
+        port.send({ type: "failed", reason: "start", detail: `this ${start.role} is a different build (${upBuildIdentity()}) from the \`up\` that started it (${start.build})` });
+        return EXIT.refused;
+    }
+    if (resolve(start.databaseFile) !== resolve(context.databaseFile)) {
+        port.send({ type: "failed", reason: "start", detail: `the ${start.role} opened a different database` });
+        return EXIT.refused;
+    }
+    return start.role === "console" ? runUpConsoleRole(context, start.config, port, start.build) : runUpWorkerRole(context, start.config, port, start.build);
+}
+/** The console role: HTTP only — serving, reading, and the person's ceremonies. It never holds the runner token. */
+async function runUpConsoleRole(context, config, port, build) {
+    const { store, clock } = context;
+    const progress = (line) => port.send({ type: "log", line });
+    // Mutated only by the worker's word (relayed by `up`): the console's project rail and unified chat follow the live
+    // builder instead of freezing at process start.
+    const activeRepos = new Set(config.repos);
+    // Cockpit B1: this start's instance secret, minted once it is listening; the console answers its challenges with it.
+    let instanceSecret = null;
+    // v137: this console's lifecycle (service_lifecycle "console:<port>"): started, a short heartbeat, draining once
+    // its `up` stops, stopped at the end. While draining, /healthz and every page say Toolroll is restarting.
+    let draining = false;
+    let console_;
+    try {
+        console_ = await startConsole({
+            instanceSecret: () => instanceSecret,
+            draining: () => draining,
+            context,
+            host: config.host,
+            port: config.port,
+            ...(config.allowedHosts === null ? {} : { allowedHosts: config.allowedHosts }),
+            ...(config.publicUrl === null ? {} : { publicUrl: config.publicUrl }),
+            localRunner: config.localRunner,
+            poolRoot: config.poolRoot,
+            repos: config.repos,
+            currentRepos: () => [...activeRepos],
+            admittedRepos: () => [...activeRepos],
+            upConsole: true,
+            registryPath: config.registryPath,
+            projectRoots: config.projectRoots,
+            ...(config.editor ? { editorLinks: "vscode" } : {}),
+        });
+    }
+    catch (error) {
+        port.send({ type: "failed", reason: "port-busy", detail: describe(error) });
+        return EXIT.refused;
+    }
+    let codingClosed = false;
+    const closeCoding = () => {
+        if (codingClosed)
+            return;
+        codingClosed = true;
+        console_.server.closeCoding().catch(() => { });
+    };
+    let resolveStopped = () => { };
+    const stopped = new Promise(resolveStop => (resolveStopped = resolveStop));
+    port.onStop(() => resolveStopped());
+    const lifecycleComponent = `console:${console_.port}`;
+    const lifecycleHolder = `${process.pid}:${randomUUID().slice(0, 8)}`;
+    try {
+        reportLifecycle(store, lifecycleComponent, "started", lifecycleHolder, clock(), { pid: process.pid });
+    }
+    catch { /* reporting never stops the console */ }
+    const lifecycleBeat = setInterval(() => { try {
+        beatLifecycle(store, lifecycleComponent, lifecycleHolder, clock());
+    }
+    catch { /* the next beat tries again */ } }, RUNNER_HEARTBEAT_MS);
+    lifecycleBeat.unref?.();
+    port.onMessage(message => {
+        if (message.type === "repos") {
+            activeRepos.clear();
+            for (const repo of message.repos)
+                activeRepos.add(repo);
+        }
+        else if (message.type === "stopping") {
+            draining = true;
+            try {
+                reportLifecycle(store, lifecycleComponent, "draining", lifecycleHolder, clock(), { drainUntil: new Date(clock().getTime() + 60_000) });
+            }
+            catch { /* the flag above still answers */ }
+            closeCoding();
+        }
+        else if (message.type === "sign-in-link") {
+            let link = null;
+            try {
+                link = console_.server.mintSignInLink(message.account);
+            }
+            catch {
+                link = null;
+            }
+            port.send({ type: "sign-in-link", id: message.id, link });
+        }
+    });
+    // Cockpit B1: who this console is, for bare `toolroll` to prove before it attaches: a fresh secret in the database
+    // (behind the agent fence), and a discovery-only socket beside it. A socket that can't open only means attaching
+    // isn't offered; the console runs either way. The socket is taken FIRST: only the console that owns it publishes a
+    // record. A second console on the same database (another port) never replaces the first one's record.
+    let mintedSecret = null;
+    const instanceSocket = await openInstanceSocket(context.databaseFile, { pid: process.pid, build: packageVersion(), database: context.databaseFile, port: console_.port }, () => mintedSecret);
+    if (instanceSocket.ok) {
+        mintedSecret = await claimInstance(store, context.databaseFile, { pid: process.pid, port: console_.port, build: packageVersion(), socket: instanceSocket.name }, clock());
+        instanceSecret = mintedSecret;
+        if (mintedSecret === null)
+            progress("attach: another console is running on this database — `toolroll` in a repository opens that one");
+    }
+    else
+        progress(`attach: ${instanceSocket.problem} — \`toolroll\` in a repository won't find this console`);
+    port.send({ type: "ready", role: "console", build, pid: process.pid, url: console_.url, port: console_.port });
+    await stopped;
+    draining = true;
+    closeCoding();
+    clearInterval(lifecycleBeat);
+    if (instanceSocket.ok)
+        instanceSocket.close();
+    if (mintedSecret !== null)
+        clearInstance(store, mintedSecret);
+    let closeProblem = null;
+    await new Promise(done => console_.server.close(error => { closeProblem = error === undefined || error === null ? null : error.message; done(); }));
+    try {
+        reportLifecycle(store, lifecycleComponent, "stopped", lifecycleHolder, clock());
+    }
+    catch { /* a stale row lapses with its heartbeat */ }
+    port.send({ type: "closed", problem: closeProblem });
+    return closeProblem === null ? EXIT.ok : EXIT.failed;
+}
+/** The worker role: one watch loop per proved repository (builds, checks, batch checks, follow-ups, reconcilers, the
+ * storage sweep and checkout sizing), the project registry, and the service's one Telegram follower. It opens no
+ * port and mints no console secret. */
+async function runUpWorkerRole(context, config, port, build) {
+    const { store, clock } = context;
+    const progress = (line) => port.send({ type: "log", line });
+    const runnerName = config.runner;
+    const runnerToken = config.token;
+    const pool = config.pool;
+    const registryPath = config.registryPath;
+    const pinnedRepos = new Set(config.pinnedRepos);
+    const gitRun = context.gitRunner ?? ((file, args, opts) => run(file, [...args], { ...(opts?.cwd === undefined ? {} : { cwd: opts.cwd }), timeoutMs: 10_000 }));
+    const proveRepo = async (input) => {
+        const top = await gitRun("git", ["rev-parse", "--show-toplevel"], { cwd: resolve(input) });
+        if (top.code !== 0)
+            return null;
+        try {
+            return realpathSync(top.stdout.trim());
+        }
+        catch {
+            return null;
+        }
+    };
+    // The proved set this worker builds; `up` relays each change to the console.
+    const activeRepos = new Set(config.repos);
+    const reportRepos = () => port.send({ type: "repos", repos: [...activeRepos] });
+    // The historical signal shell: the first stop ends admission and starts the grace clock; the second — or the
+    // clock — stops every live provider group (M6.12).
+    let stopping = false;
+    let fatal = null;
+    let graceTimer;
+    const followControllers = [];
+    let resolveStopped = () => { };
+    const stopped = new Promise(resolveStop => (resolveStopped = resolveStop));
+    const hardStop = () => {
+        const terminated = terminateLiveProviders();
+        if (terminated > 0)
+            progress(`Stopped ${terminated} running build(s). Their work is saved, and each resumes when the builder starts again.`);
+    };
+    const stop = () => {
+        if (stopping) {
+            hardStop();
+            return;
+        }
+        stopping = true;
+        resolveStopped();
+        for (const controller of followControllers)
+            controller.abort();
+        const building = store.liveClaimCount(runnerName, clock());
+        if (building > 0) {
+            progress(`Stopping: ${building} build(s) running. Waiting up to ${Math.round(config.stopGraceMs / 1000)}s for them to finish; any still running then is saved and resumes when the builder starts again.`);
+        }
+        graceTimer = setTimeout(hardStop, config.stopGraceMs);
+        graceTimer.unref?.();
+    };
+    port.onStop(hard => {
+        if (!stopping)
+            stop();
+        if (hard)
+            hardStop();
+    });
+    const loopFlagsFor = (repo) => {
+        const copy = new Map();
+        // A bounded `up` must not advertise its child watches as an unbounded sweep service either.
+        if (config.forMs !== null)
+            copy.set("for", String(config.forMs));
+        copy.set("runner", runnerName);
+        copy.set("token", runnerToken);
+        copy.set("repo", repo);
+        copy.set("pool", pool);
+        // The co-hosted console's stated origin rides into each loop's follower: a phone link must name THIS console, or not exist.
+        if (config.publicUrl !== null)
+            copy.set("public-url", config.publicUrl);
+        return copy;
+    };
+    const prefix = (repo) => (activeRepos.size > 1 ? `[${projectName(repo)}] ` : "");
+    // Containment at start: one plain sentence, once, for a person at a terminal; the exact status line with --verbose,
+    // in a service log (no terminal), and always when a required policy will refuse spawns.
+    const containmentDetail = config.verbose || !config.terminal;
+    let containmentSaid = false;
+    const containmentLines = (effective) => {
+        const notice = containmentNotice(effective);
+        if (notice !== null && !containmentSaid)
+            progress(notice);
+        containmentSaid = true;
+        return containmentDetail || effective.refusal !== null ? [`watch: ${describeContainment(effective)}`] : [];
+    };
+    const loopResults = new Map();
+    // One record of project passes for the whole service: fair scheduling across its projects (project-concurrency.ts).
+    const projectPasses = new ProjectPasses();
+    // Projects removed while running: each one's watch stops admitting work, finishes what it holds, then lets go.
+    const releasedRepos = new Set();
+    const launchRepo = async (repo, bind, drain = false) => {
+        if (loopResults.has(repo) || stopping)
+            return;
+        // A predecessor's watch on a project this start doesn't name (it was being removed): take it over, recovering what
+        // the predecessor held, and let it go (round 1, finding 2).
+        if (drain)
+            releasedRepos.add(repo);
+        if (bind) {
+            const bound = addRunnerReposAuthed(store, { name: runnerName, token: runnerToken, repos: [repo] }, clock());
+            if (!bound.ok) {
+                fatal = `the builder identity changed while adding ${repo} (${bound.reason})`;
+                stop();
+                return;
+            }
+            activeRepos.add(repo);
+            reportRepos();
+            if (!store.listProjects().some(one => one.path === repo)) {
+                store.upsertProject(repo, projectName(repo), clock());
+            }
+        }
+        let markReady = () => { };
+        const ready = new Promise(resolveReady => (markReady = resolveReady));
+        const loop = runWatchLoop({
+            flags: loopFlagsFor(repo),
+            context,
+            runner: runnerName,
+            token: runnerToken,
+            repo,
+            progress: line => progress(`${prefix(repo)}${line}`),
+            isStopping: () => stopping || releasedRepos.has(repo),
+            onFollowController: controller => followControllers.push(controller),
+            containmentLines,
+            passes: projectPasses,
+            serviceBridge: true,
+            leaseWaitMs: config.leaseWaitMs,
+            ...(drain ? { leaseWaitStopping: () => stopping } : {}),
+            onReady: () => {
+                markReady();
+                if (bind)
+                    progress(`${prefix(repo)}builder connected — queued work can start`);
+            },
+        }).then(result => ({ repo, result }), error => ({ repo, result: { ok: false, reason: "loop-failed", detail: describe(error), ticks: 0, built: 0, broke: 0 } }));
+        loopResults.set(repo, loop);
+        void loop.then(({ repo: endedRepo, result }) => {
+            if (releasedRepos.has(endedRepo) && !stopping && !result.ok) {
+                // A removed project's watch that never held its lease (or lost it) has recovered nothing: keep the project
+                // bound so the next worker recovers it, and stop rather than strand its work (round 1, finding 2).
+                fatal = `${prefix(endedRepo)}${result.detail}`;
+                stop();
+                markReady();
+                return;
+            }
+            if (releasedRepos.has(endedRepo) && !stopping) {
+                // A removed project's watch has stopped: only now does the builder let go of it.
+                const unbound = removeRunnerRepoAuthed(store, { name: runnerName, token: runnerToken, repo: endedRepo }, clock());
+                if (!unbound.ok) {
+                    fatal = `the builder identity changed while removing ${endedRepo} (${unbound.reason})`;
+                    stop();
+                }
+                loopResults.delete(endedRepo);
+                releasedRepos.delete(endedRepo);
+                progress(`project removed — ${projectName(endedRepo)} is no longer built here`);
+                markReady();
+                return;
+            }
+            // A loop that dies while its siblings live must not leave a partial cockpit standing silently (finding 5).
+            if (!result.ok && !stopping) {
+                fatal = `${prefix(endedRepo)}${result.detail}`;
+                stop();
+            }
+            markReady(); // acquisition failures must not strand startup readiness
+        });
+        await ready;
+    };
+    // Before any new work: every watch a predecessor left needing recovery on a project this start doesn't name — one
+    // being removed when it died — is taken over (its incarnation recovered in that step) and let go. Only projects the
+    // store still binds to this runner; the start's own projects recover in their own loops below (round 1, finding 2).
+    const named = new Set(config.repos);
+    const boundNow = new Set(store.getRunner(runnerName)?.runner.repos ?? []);
+    const draining = [...new Set(predecessorWatches(store, runnerName, clock()).map(one => one.repo))].filter(repo => !named.has(repo) && boundNow.has(repo));
+    for (const repo of draining)
+        progress(`${projectName(repo)} was being removed when the previous worker stopped: recovering its work first`);
+    await Promise.all(draining.map(repo => launchRepo(repo, false, true)));
+    await Promise.all(config.repos.map(repo => launchRepo(repo, false)));
+    // Telegram: one follower for the whole service, never one per project loop. Replies and notifications go out from
+    // it, over the same transport in the same cycle. A token saved while the service runs connects within seconds; a
+    // follower that dies is started again.
+    const telegramController = new AbortController();
+    followControllers.push(telegramController);
+    if (stopping)
+        telegramController.abort();
+    const telegramSupervisor = (async () => {
+        const pause = (ms) => new Promise(resolvePause => {
+            const timer = setTimeout(done, ms);
+            function done() { clearTimeout(timer); telegramController.signal.removeEventListener("abort", done); resolvePause(); }
+            // An aborted signal never fires again: without this a stop waited the whole pause.
+            if (telegramController.signal.aborted)
+                done();
+            else
+                telegramController.signal.addEventListener("abort", done, { once: true });
+        });
+        while (!stopping && !telegramController.signal.aborted) {
+            const follower = startTelegramFollower({
+                context, publicUrl: config.publicUrl ?? undefined, signal: telegramController.signal, progress, label: "telegram:",
+                died: { prefix: "", then: "starting it again" }, owner: `service-${randomUUID()}`,
+            });
+            if (follower !== null)
+                await follower;
+            // Without a token (or on a fenced network) look again shortly; the fence line is said once.
+            if (follower === null && loadBotToken(process.env, context.telegramTokenFile) !== null)
+                break;
+            await pause(follower === null ? 2_000 : 5_000);
+        }
+    })();
+    const dynamicCeiling = resolveCeiling(config.repos, config.projectRoots).ceiling;
+    const rejected = new Set();
+    const registrySupervisor = (async () => {
+        const sleep = (ms) => new Promise(resolveSleep => setTimeout(resolveSleep, ms));
+        while (!stopping) {
+            const loaded = await loadProjectRegistry(registryPath);
+            if ("error" in loaded) {
+                fatal = loaded.error;
+                stop();
+                break;
+            }
+            // Removed from the saved list: stop building it and take it out of the console. A pinned start keeps its own.
+            const saved = new Set(loaded.repos.map(one => canonicalProject(one) ?? one));
+            let removed = false;
+            for (const repo of [...activeRepos]) {
+                if (stopping || pinnedRepos.has(repo) || saved.has(repo))
+                    continue;
+                activeRepos.delete(repo);
+                removed = true;
+                releasedRepos.add(repo);
+                if (!loopResults.has(repo))
+                    releasedRepos.delete(repo);
+            }
+            if (removed)
+                reportRepos();
+            for (const candidate of loaded.repos) {
+                if (stopping)
+                    break;
+                const canonical = canonicalProject(candidate);
+                // Still letting go of an earlier removal: it rejoins on the next pass after its watch has stopped.
+                if (canonical !== null && (activeRepos.has(canonical) || releasedRepos.has(canonical)))
+                    continue;
+                const approvedAdditions = context.additionalProjectRepos?.() ?? [];
+                const admittedCeiling = resolveCeiling([...dynamicCeiling.repos, ...approvedAdditions], dynamicCeiling.roots).ceiling;
+                // A project added after this start (`repos add`, the lead, the console) carries its recorded admission; a
+                // registry line alone is not authority. Either way the folder is proved to be that Git checkout again.
+                const allowed = canonical !== null &&
+                    ((await authorizedProject(admittedCeiling, canonical)) || admissionRecorded(store, canonical)) &&
+                    (await proveRepo(canonical)) === canonical;
+                if (!allowed) {
+                    if (!rejected.has(candidate)) {
+                        rejected.add(candidate);
+                        progress(`project not connected — ${candidate} isn't a Git repository added with \`toolroll repos add\` or the console`);
+                    }
+                    continue;
+                }
+                rejected.delete(candidate);
+                await launchRepo(canonical, true);
+            }
+            if (!stopping)
+                await sleep(500);
+        }
+    })().catch(error => {
+        fatal = `the project registry stopped (${describe(error)})`;
+        stop();
+    });
+    // Provider readiness (v47): this machine's non-spending observations, recorded under its own runner name ONCE at
+    // start — so every route projection can say ready / unavailable / unknown per provider, and the dispatch gate can
+    // halt a leg this machine cannot run. Production only: a test's injected agent runner is a fake, and its readiness
+    // would be a fiction.
+    if (context.agentRunner === undefined) {
+        void observeProviderReadiness((file, args, options) => run(file, args, { timeoutMs: options?.timeoutMs ?? 5_000, ...(options?.omitEnv === undefined ? {} : { omitEnv: options.omitEnv }) }), process.env, PROVIDER_IDS, provider => store.acpAttestationFor(provider, runnerName))
+            .then(observed => {
+            if (!stopping)
+                reportProviderReadinessAuthed(store, { name: runnerName, token: runnerToken, observations: observed }, clock());
+        })
+            .catch(() => {
+            // A probe that cannot run leaves readiness unknown — never a fiction.
+        });
+    }
+    try {
+        notifyVersionLive(context.store, dirname(context.databaseFile), PACKAGE_VERSION, clock());
+    }
+    catch { /* A display fact; never blocks the worker. */ }
+    recordRunnerVersion(dirname(context.databaseFile), runnerName, PACKAGE_VERSION, clock());
+    // v137: the continuous database copy, off the hot path (live-backup.ts: a worker thread copies, checks and hashes).
+    // Never inside a project or a build checkout. A test's injected agent runner means a test: no background copies.
+    const stopLiveBackups = context.agentRunner === undefined
+        ? startLiveBackups(store, context.databaseFile, () => [...new Set([...activeRepos, ...store.knownRepos(), pool])])
+        : null;
+    // Ready once every project's loop holds its lease; a loop that failed to start ends this worker instead.
+    if (fatal === null && !stopping)
+        port.send({ type: "ready", role: "worker", build, pid: process.pid, url: null, port: null });
+    await stopped;
+    await registrySupervisor;
+    await Promise.all([...loopResults.values()]);
+    await stopLiveBackups?.();
+    // The follower was aborted with the stop. A send or a chat turn it is still finishing keeps its own durable record;
+    // the service does not wait past this for it.
+    await new Promise(done => {
+        const timer = setTimeout(done, TELEGRAM_STOP_WAIT_MS);
+        const finish = () => { clearTimeout(timer); done(); };
+        void telegramSupervisor.then(finish, finish);
+    });
+    if (graceTimer !== undefined)
+        clearTimeout(graceTimer);
+    if (fatal !== null) {
+        port.send({ type: "fatal", detail: fatal });
+        return EXIT.failed;
+    }
+    return EXIT.ok;
+}