toolroll 0.9.76 → 0.9.78

package/dist/store.js

@@ -1,3 +1,4 @@
+import { mintSecret } from "./secret-mint.js";
 import { WRITES_DEFAULT } from "./writes-mode.js";
 import { checkAccessOf, widerThan } from "./check-access.js";
 import { PROJECT_SANDBOX_DEFAULT, sandboxOf } from "./project-sandbox.js";
@@ -72,6 +73,7 @@ import { hasDisguisedText, hasForbiddenControls, validateNote } from "./decision
 import { parseReviewContext, reviewContextCustodyProblem } from "./review-context.js";
 import { foldReview, manualReviewOnly } from "./proof.js";
 import { liveReleaseOf } from "./scope.js";
+import { releaseCiHoldOf, releaseCiRunningOf } from "./release-ci-hold.js";
 import { APPROVAL_BASES, approvalOf, machineActing, personProof, proofDetailOf, quarantinedAuthor, sealOriginOf, digestOf, canonicalProfileJson, chainFromJson, profileDigestOf, profileFromJson, scopeAuthorityOf, routeParityProblem, parseAcceptanceCriteria, exactAcceptance, exactStringList, exactSafeIntegerOrNull } from "./scope.js";
 import { resolveScopeProfile, resolveRouteCandidates, exactPinOf, routeOfTask, agentChoicesFor } from "./agentconfig.js";
 import { canonicalOverridesJson, canonicalRouteJson, isRiskLevel, isTaskSize, headroomFrom, makesNoPlan, legOf, overridesFromJson, phaseOfRole, recommendRoute, routeDigestOf, routeFromJson, routeProblems, routeStampProblem, ROUTE_ERA, PROVIDER_ID_LIST, } from "./phase-routing.js";
@@ -83,7 +85,7 @@ import { authenticate as runnerAuthenticate } from "./runner.js";
 import { stampNewProjectLevel } from "./check-levels.js";
 import { parseCheckProgressSnapshot } from "./check-progress.js";
 import { authorityStandsSql } from "./approval-authority.js";
-import { releasePolicyDigest, storedReleaseTerms, readReleaseTerms, readReleasePolicy } from "./contracts/release-terms.js";
+import { releasePolicyDigest, serializeReleaseCheckPurpose, storedReleaseCheckPurpose, storedReleaseTerms, readReleaseTerms, readReleasePolicy } from "./contracts/release-terms.js";
 import { accountReachesSql, normalizeProjectAccess, projectAccessAllows, readProjectAccess } from "./project-access.js";
 import { LEDGER_COLUMNS, LEDGER_SCHEMA, LEDGER_TABLE, LEDGER_V99_TABLE, installLedgerTriggers } from "./action-ledger.js";
 import { PLAN_AUTO_SCHEMA } from "./plan-auto.js";
@@ -457,6 +459,49 @@ CREATE TABLE IF NOT EXISTS run_live_detail (
 CREATE INDEX IF NOT EXISTS run_live_open ON run (id) WHERE outcome IS NULL AND id > 0;
 CREATE INDEX IF NOT EXISTS run_live_recent ON run (finished_at) WHERE outcome IS NOT NULL AND id > 0;
 `;
+/** v137 (docs/plans/actors-lessons.md): explicit lifecycle, latency timelines and the continuous database copy. New
+ * tables only. A lifecycle row's `holder` binds it to one registration (a worker's registered_at) or one console
+ * process; a row whose holder no longer matches says nothing. Timelines are bounded and pruned as they are written. */
+export const V137_SCHEMA = `
+CREATE TABLE IF NOT EXISTS service_lifecycle (
+  component   TEXT PRIMARY KEY,
+  state       TEXT NOT NULL CHECK (state IN ('started','draining','stopped')),
+  holder      TEXT NOT NULL,
+  pid         INTEGER,
+  changed_at  TEXT NOT NULL,
+  beat_at     TEXT NOT NULL,
+  drain_until TEXT
+);
+CREATE TABLE IF NOT EXISTS latency_timeline (
+  id              INTEGER PRIMARY KEY AUTOINCREMENT,
+  kind            TEXT NOT NULL CHECK (kind IN ('console','release-check','deploy')),
+  subject         TEXT NOT NULL,
+  task_id         TEXT,
+  run_id          INTEGER,
+  started_at      TEXT NOT NULL,
+  total_ms        INTEGER NOT NULL,
+  milestones_json TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS latency_timeline_by_kind ON latency_timeline (kind, id);
+CREATE INDEX IF NOT EXISTS latency_timeline_by_run ON latency_timeline (run_id) WHERE run_id IS NOT NULL;
+CREATE INDEX IF NOT EXISTS latency_timeline_by_task ON latency_timeline (task_id) WHERE task_id IS NOT NULL;
+CREATE TABLE IF NOT EXISTS live_backup (
+  id            INTEGER PRIMARY KEY CHECK (id = 1),
+  enabled       INTEGER NOT NULL DEFAULT 1,
+  every_minutes INTEGER NOT NULL DEFAULT 5,
+  keep          INTEGER NOT NULL DEFAULT 24,
+  folder        TEXT,
+  holder        TEXT,
+  held_until    TEXT,
+  latest_file   TEXT,
+  latest_sha256 TEXT,
+  latest_at     TEXT,
+  latest_schema INTEGER,
+  latest_bytes  INTEGER,
+  tried_at      TEXT,
+  problem       TEXT
+);
+`;
 /** A project's "Show commands in the live view" (live-detail.ts): absent means off. */
 export const LIVE_DETAIL_SCHEMA = `
 CREATE TABLE IF NOT EXISTS live_detail_setting (
@@ -754,7 +799,14 @@ const REGISTERED_AT_FILING = "again, as it was filed";
 // v136 adds, and changes no saved row: each run's own "Show commands in the live view" answer, captured once before its
 // live file opens (run_live_detail; docs/plans/agents-view.md §2.4). Saved runs have none, which every reader takes as
 // commands off: permission is never recovered from a transcript or the project's current setting.
-export const SCHEMA_VERSION = 136;
+// v137 adds, and changes no saved row (docs/plans/actors-lessons.md): each service component's lifecycle
+// (service_lifecycle: started, draining or stopped, with a short heartbeat), bounded per-operation latency timelines
+// (latency_timeline: slow console requests, release check parts, deploy phases) and the continuous database copy's
+// settings and latest verified copy (live_backup, one row; absent reads every 5 minutes, keep 24, beside the database).
+// v138 adds, and changes no saved row: a release check's purpose (task_scope.release_check_json; docs/plans/
+// pipeline-speed.md, P0) — this exact candidate is a release's check, for a release that can't carry. Saved rows read
+// NULL: no purpose (a termsless release task stays exactly as it was approved).
+export const SCHEMA_VERSION = 138;
 /** v118: the tables merged into `credential`, in the order they move (a person's API tokens keep their ids first). */
 export const V118_MERGED_TABLES = Object.freeze({ api_token: "person", coordinator_credential: "coordinator", lead_credential: "lead" });
 /** The foreign keys that named a merged table, exactly as their DDL wrote them; each names `credential(id)` instead. */
@@ -887,7 +939,7 @@ const V115_DROPPED_REFERENCES = /\s+REFERENCES (?:contestant|contest|tournament_
  * unchanged), and adds the nullable column in V125_ADDED_COLUMNS, checked the same way. v126 only adds a new table
  * (task_source) and the columns in V126_ADDED_COLUMNS (null or 0), checked the same way.
  */
-export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136]);
+export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138]);
 /** v119: the columns it adds, by table, with the value every row saved before it reads (toolroll-update's HISTORY_RULES). */
 export const V119_ADDED_COLUMNS = Object.freeze({
     task_ref: { planning_generation: { definition: "INTEGER NOT NULL DEFAULT 0", saved: "0" } },
@@ -1008,6 +1060,11 @@ export const V134_ADDED_COLUMNS = Object.freeze({
 export const V135_ADDED_COLUMNS = Object.freeze({
     task_scope: { release_terms_json: { definition: "TEXT", saved: "NULL" } },
 });
+/** v138 (docs/plans/pipeline-speed.md, P0): a scope's release check purpose, part of its digest when present. Saved
+ * rows read NULL. */
+export const V138_ADDED_COLUMNS = Object.freeze({
+    task_scope: { release_check_json: { definition: "TEXT", saved: "NULL" } },
+});
 /**
  * v135: one approval per release (docs/plans/release-once.md). `release_authority` is the single source of truth for a
  * release a person approved: one row per generation, changed only by compare-and-swap on `rev`, with a lease whose
@@ -4238,6 +4295,13 @@ CREATE INDEX IF NOT EXISTS run_checkpoint_by_task ON run_checkpoint (task_ref, i
     }
     // v136: each run's own live-view answer (a new table only; saved runs have none: commands off).
     db.exec(RUN_LIVE_DETAIL_SCHEMA);
+    // v137: lifecycle, latency timelines and the continuous copy (new tables only).
+    db.exec(V137_SCHEMA);
+    // v138: a scope's release check purpose (V138_ADDED_COLUMNS: saved rows NULL, no purpose).
+    for (const [table, columns] of Object.entries(V138_ADDED_COLUMNS)) {
+        for (const [column, { definition }] of Object.entries(columns))
+            addColumn(db, table, column, definition);
+    }
     // Keep the epoch until reclamation succeeds, including a retry after compaction already committed. A new file has
     // nothing to reclaim.
     if (!fresh)
@@ -6667,7 +6731,7 @@ export class Store {
     saveScope(scope, mutation = {}, options = {}) {
         this.once(mutation, "saveScope", () => this.transact(() => {
             // The text's current author mark, read before this write (approval policy §1.4).
-            const prior = this.db.prepare("SELECT proposed_via, release_terms_json FROM task_scope WHERE task_id = ?").get(scope.taskId);
+            const prior = this.db.prepare("SELECT proposed_via, release_terms_json, release_check_json FROM task_scope WHERE task_id = ?").get(scope.taskId);
             // THE filing invariant (foundations findings 5/13/19): every scope
             // row leaves this method either RESOLVED (working profile stamped,
             // digest recomputed to bind it, version 2) or UNRESOLVED with its
@@ -6831,6 +6895,12 @@ export class Store {
             // v135: release terms the caller names, else the ones this scope already carries (a refile keeps them bound).
             const priorTerms = storedReleaseTerms(prior?.["release_terms_json"]);
             const releaseTerms = options.releaseTerms !== undefined ? options.releaseTerms : priorTerms.ok ? priorTerms.terms : null;
+            // v138: the release check purpose likewise; terms named now replace a kept purpose (a scope carries one or the other).
+            const priorPurpose = storedReleaseCheckPurpose(prior?.["release_check_json"]);
+            const releaseCheck = options.releaseCheck !== undefined ? options.releaseCheck
+                : options.releaseTerms != null ? null : priorPurpose.ok ? priorPurpose.purpose : null;
+            if (releaseTerms !== null && releaseCheck !== null)
+                throw new Error("A scope carries release terms or a release check purpose, never both.");
             const digestInput = {
                 goal: scope.goal,
                 outOfScope: scope.outOfScope,
@@ -6840,6 +6910,7 @@ export class Store {
                 qualityMode,
                 candidate: scope.candidate ?? null,
                 releaseTerms,
+                releaseCheck,
             };
             // EVERY route filed since v47 binds into the digest — routine-shaped
             // ones included — so approval freezes exactly which agent runs each
@@ -6869,8 +6940,8 @@ export class Store {
                 .prepare(`INSERT INTO task_scope
              (task_id, goal, out_of_scope, touches, budget_microusd, proposed_at, digest, approved_at, approved_by, approved_digest,
               profile_json, profile_state, unresolved_reason, digest_version, profile_provenance, proposed_chain_json, acceptance_json, quality_mode,
-              risk_level, proposed_route_json, route_era, candidate, release_terms_json)
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+              risk_level, proposed_route_json, route_era, candidate, release_terms_json, release_check_json)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
            ON CONFLICT (task_id) DO UPDATE SET
              goal = excluded.goal, out_of_scope = excluded.out_of_scope,
              touches = excluded.touches, budget_microusd = excluded.budget_microusd,
@@ -6882,7 +6953,7 @@ export class Store {
              profile_provenance = excluded.profile_provenance, proposed_chain_json = excluded.proposed_chain_json,
              acceptance_json = excluded.acceptance_json, quality_mode = excluded.quality_mode,
              risk_level = excluded.risk_level, proposed_route_json = excluded.proposed_route_json, route_era = excluded.route_era,
-             candidate = excluded.candidate, release_terms_json = excluded.release_terms_json`)
+             candidate = excluded.candidate, release_terms_json = excluded.release_terms_json, release_check_json = excluded.release_check_json`)
                 .run(scope.taskId, scope.goal, scope.outOfScope, JSON.stringify(scope.touches), scope.budgetMicrousd ?? null, scope.proposedAt, boundDigest, scope.approvedAt, scope.approvedBy, scope.approvedDigest, profile === null ? null : canonicalProfileJson(profile), profile === null ? "unresolved" : "resolved", unresolvedReason, profile === null ? 1 : 2, provenance, 
             // Fallback chains (v30-v114) are gone: no filing names one.
             null, scope.acceptance.length === 0 ? null : JSON.stringify(scope.acceptance), qualityMode, 
@@ -6890,7 +6961,7 @@ export class Store {
             // routine risk, the value its signed terms always carried.
             "routine", route === null ? null : canonicalRouteJson(route), 
             // The durable era: every row this method writes is a routed row.
-            ROUTE_ERA, scope.candidate ?? null, releaseTerms === null ? null : serializeReleaseTerms(releaseTerms));
+            ROUTE_ERA, scope.candidate ?? null, releaseTerms === null ? null : serializeReleaseTerms(releaseTerms), releaseCheck === null ? null : serializeReleaseCheckPurpose(releaseCheck));
             // Who wrote THIS text (mate arc, ruling 2): set per write, so a human
             // rewrite clears the lead's mark and a mate rewrite sets it — but only a
             // person's write clears one (approval policy §1.4): the lead (its token)
@@ -6932,6 +7003,10 @@ export class Store {
             // road it came by.
             if (basis === undefined && machineActing())
                 return false;
+            // A RELEASE WAITING FOR CI (Codex review round 1, finding 4): filed while its pull request's checks still ran,
+            // only the automatic road (which proves CI itself) seals it until the plane read exact-head CI passing.
+            if (basis?.kind !== "auto-check" && basis?.kind !== "auto-green" && releaseCiHoldOf(this, taskId) !== null)
+                return false;
             // `carried` is written by the carry transaction alone (carryReleaseApproval), never through a seal.
             if (basis?.kind === "carried")
                 return false;
@@ -7011,7 +7086,14 @@ export class Store {
             // A DEPLOY GATE FROM CHAT (chat-management.md §0a.5): a signed candidate or release terms seal from chat only
             // with the release card's evidence (its act and card digest), never through the plain plan card or a generic
             // one. Read from the raw row, so a terms column that doesn't parse is a deploy gate too.
-            const deployGate = (typeof working["candidate"] === "string" && working["candidate"] !== "") || working["release_terms_json"] != null;
+            const deployGate = (typeof working["candidate"] === "string" && working["candidate"] !== "") || working["release_terms_json"] != null || working["release_check_json"] != null;
+            // A RELEASE CHECK PURPOSE (v138) seals, like terms, only on a person's own yes: the ceremony or a paired-chat tap
+            // through the release card — never a mode, a grant, a carry or an automatic seal (those need terms).
+            const purpose = storedReleaseCheckPurpose(working["release_check_json"]);
+            if (!purpose.ok)
+                return false;
+            if (purpose.purpose !== null && basis !== undefined && basis.kind !== "chat")
+                return false;
             if (deployGate && basis?.kind === "chat" && !(basis.card === "release" && typeof basis.cardDigest === "string" && /^[0-9a-f]{64}$/.test(basis.cardDigest)))
                 return false;
             // AUTOMATIC RELEASE SEALS (auto-approve-green.md): only on a release task (a candidate and release terms signed
@@ -8018,7 +8100,7 @@ export class Store {
     /** A single-use door into the instance (U2): 128-bit token, sha256
      * stored, role pinned at mint, 72 hours. Only the caller's own
      * authentication gates this — an approver mints; a viewer cannot. */
-    mintInvite(role, mintedBy, now, token = () => randomBytes(16).toString("base64url"), projects = null) {
+    mintInvite(role, mintedBy, now, token = () => mintSecret(16), projects = null) {
         const access = normalizeProjectAccess(projects);
         return this.transact(() => {
             if (!this.isInstanceOperator(mintedBy))
@@ -11646,7 +11728,7 @@ export class Store {
         if (route === null) {
             return { ok: false, reason: "unreadable", detail: scope.approvedRouteJson == null ? "the approval sealed no agent route — re-file the scope and approve it again" : "the approval's sealed agent route cannot be read — re-file the scope and approve it again" };
         }
-        const fields = { goal: scope.goal, outOfScope: scope.outOfScope, touches: scope.touches, budgetMicrousd: scope.budgetMicrousd, acceptance: scope.acceptance, candidate: scope.candidate ?? null, qualityMode: scope.qualityMode ?? "default", releaseTerms: scope.releaseTerms ?? null };
+        const fields = { goal: scope.goal, outOfScope: scope.outOfScope, touches: scope.touches, budgetMicrousd: scope.budgetMicrousd, acceptance: scope.acceptance, candidate: scope.candidate ?? null, qualityMode: scope.qualityMode ?? "default", releaseTerms: scope.releaseTerms ?? null, releaseCheck: scope.releaseCheck ?? null };
         const chain = scope.approvalKind === "chain" ? chainFromJson(scope.approvedChainJson ?? null) : null;
         const target = chain !== null ? { chain } : (scope.approvedProfile ?? null);
         if (target === null)
@@ -17502,7 +17584,8 @@ export class Store {
     acquireWatchLease(runner, repo, owner, ttlMs, now) {
         return this.transact(() => {
             const stamp = now.toISOString();
-            const expires = new Date(now.getTime() + ttlMs).toISOString();
+            // Never longer than MAX_WATCH_LEASE_MS, whatever a caller asks: a crashed holder's project is free within a minute.
+            const expires = new Date(now.getTime() + Math.min(ttlMs, MAX_WATCH_LEASE_MS)).toISOString();
             const row = this.db
                 .prepare("SELECT * FROM watch_lease WHERE runner = ? AND repo = ?")
                 .get(runner, repo);
@@ -17539,7 +17622,7 @@ export class Store {
         const { changes } = this.db
             .prepare(`UPDATE watch_lease SET expires_at = ?, heartbeat_at = ?
           WHERE runner = ? AND repo = ? AND owner = ? AND expires_at > ?`)
-            .run(new Date(now.getTime() + ttlMs).toISOString(), now.toISOString(), runner, repo, owner, now.toISOString());
+            .run(new Date(now.getTime() + Math.min(ttlMs, MAX_WATCH_LEASE_MS)).toISOString(), now.toISOString(), runner, repo, owner, now.toISOString());
         return Number(changes) > 0;
     }
     releaseWatchLease(runner, repo, owner, now) {
@@ -17547,6 +17630,12 @@ export class Store {
             .prepare("UPDATE watch_lease SET expires_at = ? WHERE runner = ? AND repo = ? AND owner = ?")
             .run(now.toISOString(), runner, repo, owner);
     }
+    /** Lapse every watch lease a runner holds now: its holder was proved gone (runner.ts registerRunnerIfIdle). The rows
+     * stay, so the next acquire takes them over and recovers the superseded incarnation as after any crash. */
+    expireWatchLeasesOf(runner, now) {
+        const stamp = now.toISOString();
+        return Number(this.db.prepare("UPDATE watch_lease SET expires_at = ? WHERE runner = ? AND expires_at > ?").run(stamp, runner, stamp).changes);
+    }
     /** The first still-unexpired watch lease this runner holds, if any (arc 2:
      * the takeover door refuses while one exists). */
     liveWatchLeaseOf(runner, now) {
@@ -20183,6 +20272,14 @@ export function scopeTermsProblem(row) {
         if (!terms.ok)
             return terms.problem;
     }
+    // v138: likewise the release check purpose, and never beside terms.
+    if ("release_check_json" in row) {
+        const purpose = storedReleaseCheckPurpose(row["release_check_json"]);
+        if (!purpose.ok)
+            return purpose.problem;
+        if (purpose.purpose !== null && row["release_terms_json"] != null)
+            return "the scope carries both release terms and a release check purpose";
+    }
     for (const column of ["approved_at", "approved_by", "approved_digest", "profile_json", "approved_profile_json", "proposed_chain_json", "approved_chain_json", "proposed_route_json", "approved_route_json", "unresolved_reason"]) {
         if (row[column] !== null && row[column] !== undefined && typeof row[column] !== "string")
             return `${column.replace(/_/g, " ")} is not stored as text`;
@@ -20228,6 +20325,7 @@ function readScope(row) {
         routeEra: row["route_era"] === null || row["route_era"] === undefined ? null : Number(row["route_era"]),
         candidate: typeof row["candidate"] === "string" && row["candidate"] !== "" ? row["candidate"] : null,
         releaseTerms: (() => { const read = storedReleaseTerms(row["release_terms_json"]); return read.ok ? read.terms : null; })(),
+        releaseCheck: (() => { const read = storedReleaseCheckPurpose(row["release_check_json"]); return read.ok ? read.purpose : null; })(),
         proposedVia: row["proposed_via"] === "mate" || row["proposed_via"] === "coordinator" || row["proposed_via"] === "scout" || row["proposed_via"] === "lead" ? row["proposed_via"] : null,
     };
 }
@@ -20507,6 +20605,9 @@ export function reserveRelease(store, input) {
         const a = releaseAuthority(store, input.authority);
         if (a === null)
             return { ok: false, why: `No release ${input.authority}.` };
+        // Early approval authorizes the check, never an irreversible operation before the plane confirms exact-head CI.
+        if (releaseCiRunningOf(store, input.taskId) !== null)
+            return { ok: false, why: "This release still waits for GitHub CI. Resume it with `toolroll release`." };
         const at = input.now.toISOString();
         // Expiry stops every live state; an operation already reserved settles only through reconciliation.
         if (a.expiresAt <= at)
@@ -20548,6 +20649,8 @@ export function runReleaseOperation(store, id, epoch, now, issuer = currentRelea
         const a = op === null ? null : releaseAuthority(store, op.authority);
         if (op === null || a === null || op.state !== "reserved" || op.epoch !== epoch || a.leaseEpoch !== epoch)
             return false;
+        if (releaseCiRunningOf(store, op.taskId) !== null)
+            return false;
         // Past the expiry nothing new starts; the reserved operation is settled by reconciliation instead.
         if (a.expiresAt <= now.toISOString())
             return false;
@@ -20858,3 +20961,162 @@ export function agentsLiveRuns(store, endedSince) {
         repo: row["live_task_repo"] === null || row["live_task_repo"] === undefined ? null : String(row["live_task_repo"]),
     }));
 }
+/**
+ * This runner's watches a predecessor left needing recovery (Codex review round 1, finding 2): a watch lease still
+ * live, or one whose holder left a claim open (or a run open under a claim a reaper already released). A replacement
+ * worker takes each over — recovering the holder's incarnation in the same transaction — before it admits new work,
+ * whichever projects its start names (a project being removed when the predecessor died is in none of them).
+ */
+export function predecessorWatches(store, runner, now) {
+    return store.handle.prepare(`SELECT w.repo AS repo, w.owner AS owner FROM watch_lease w
+      WHERE w.runner = ? AND (w.expires_at > ? OR EXISTS (
+        SELECT 1 FROM claim c WHERE c.runner = w.runner AND c.incarnation = w.owner
+          AND (c.released_at IS NULL OR EXISTS (SELECT 1 FROM run r WHERE r.lease_id = c.lease_id AND r.outcome IS NULL))))
+      ORDER BY w.repo`).all(runner, now.toISOString()).map(row => ({ repo: String(row["repo"]), owner: String(row["owner"]) }));
+}
+// ---- v137: lifecycle, latency timelines, the continuous copy (docs/plans/actors-lessons.md) ----------------------
+/** The longest a watch lease is taken or renewed for (durable-actors' MAX_HOST_LEASE_DURATION_MS). */
+export const MAX_WATCH_LEASE_MS = 60_000;
+function lifecycleRowOf(row) {
+    return { component: String(row["component"]), state: String(row["state"]), holder: String(row["holder"]), pid: row["pid"] == null ? null : Number(row["pid"]),
+        changedAt: String(row["changed_at"]), beatAt: String(row["beat_at"]), drainUntil: row["drain_until"] == null ? null : String(row["drain_until"]) };
+}
+/** One component's lifecycle row, or null (never reported: a component from before v137 says nothing). */
+export function lifecycleOf(store, component) {
+    const row = store.handle.prepare("SELECT * FROM service_lifecycle WHERE component = ?").get(component);
+    return row === undefined ? null : lifecycleRowOf(row);
+}
+/** Every reported component, by name. */
+export function lifecycles(store) {
+    return store.handle.prepare("SELECT * FROM service_lifecycle ORDER BY component").all().map(lifecycleRowOf);
+}
+/**
+ * Report a component's state. `started` replaces whatever an earlier holder left; `draining` and `stopped` only move the
+ * current holder's row (a stale process can't mark its successor draining), and never back from stopped. Returns
+ * whether the row now says what was asked.
+ */
+export function reportLifecycle(store, component, state, holder, now, extra = {}) {
+    const stamp = now.toISOString();
+    const until = extra.drainUntil == null ? null : extra.drainUntil.toISOString();
+    if (state === "started") {
+        store.handle.prepare(`INSERT INTO service_lifecycle (component, state, holder, pid, changed_at, beat_at, drain_until) VALUES (?, 'started', ?, ?, ?, ?, NULL)
+      ON CONFLICT(component) DO UPDATE SET state = 'started', holder = excluded.holder, pid = excluded.pid, changed_at = excluded.changed_at, beat_at = excluded.beat_at, drain_until = NULL`)
+            .run(component, holder, extra.pid ?? null, stamp, stamp);
+        return true;
+    }
+    const changed = store.handle.prepare(`UPDATE service_lifecycle SET state = ?, changed_at = ?, beat_at = ?, drain_until = CASE WHEN ? = 'draining' THEN ? ELSE drain_until END
+    WHERE component = ? AND holder = ? AND state <> 'stopped'`).run(state, stamp, stamp, state, until, component, holder).changes;
+    return Number(changed) === 1;
+}
+/** The short heartbeat: the current holder's row, while it is not stopped. False means another holder took it. */
+export function beatLifecycle(store, component, holder, now) {
+    return Number(store.handle.prepare("UPDATE service_lifecycle SET beat_at = ? WHERE component = ? AND holder = ? AND state <> 'stopped'")
+        .run(now.toISOString(), component, holder).changes) === 1;
+}
+/** At most this many milestones per timeline (the rest are dropped, the last kept), and timelines kept per kind. */
+export const MAX_MILESTONES = 40;
+export const TIMELINES_KEPT = 200;
+/** Timelines older than this go whatever their count. */
+export const TIMELINE_DAYS = 14;
+const plainText = (value, max) => value.replace(/[\u0000-\u001f\u007f]+/g, " ").trim().slice(0, max);
+/** Milestones made safe to keep: bounded in number and length, offsets whole non-negative milliseconds, in order. */
+export function boundedMilestones(milestones) {
+    const clean = milestones.filter(one => typeof one.name === "string" && Number.isFinite(one.ms)).map(one => ({
+        name: plainText(one.name, 80), ms: Math.max(0, Math.round(one.ms)),
+        ...(typeof one.detail === "string" && one.detail.trim() !== "" ? { detail: plainText(one.detail, 160) } : {}),
+    })).filter(one => one.name !== "");
+    return clean.length <= MAX_MILESTONES ? clean : [...clean.slice(0, MAX_MILESTONES - 1), clean[clean.length - 1]];
+}
+/** Keep one timeline, then prune its kind to the newest TIMELINES_KEPT within TIMELINE_DAYS. */
+export function recordLatencyTimeline(store, entry, now) {
+    return store.transact(() => {
+        const id = Number(store.handle.prepare(`INSERT INTO latency_timeline (kind, subject, task_id, run_id, started_at, total_ms, milestones_json) VALUES (?, ?, ?, ?, ?, ?, ?)`)
+            .run(entry.kind, plainText(entry.subject, 120), entry.taskId ?? null, entry.runId ?? null, entry.startedAt.toISOString(), Math.max(0, Math.round(entry.totalMs)), JSON.stringify(boundedMilestones(entry.milestones))).lastInsertRowid);
+        const cutoff = new Date(now.getTime() - TIMELINE_DAYS * 86_400_000).toISOString();
+        store.handle.prepare(`DELETE FROM latency_timeline WHERE kind = ? AND (started_at < ? OR id <= (SELECT id FROM latency_timeline WHERE kind = ? ORDER BY id DESC LIMIT 1 OFFSET ?))`)
+            .run(entry.kind, cutoff, entry.kind, TIMELINES_KEPT);
+        return id;
+    });
+}
+/** Timelines, newest first: of one kind, one run's, or one task's. A row that doesn't read is left out. */
+export function latencyTimelines(store, filter) {
+    const where = [], args = [];
+    if (filter.kind !== undefined) {
+        where.push("kind = ?");
+        args.push(filter.kind);
+    }
+    if (filter.runId !== undefined && filter.taskId !== undefined) {
+        where.push("(run_id = ? OR task_id = ?)");
+        args.push(filter.runId, filter.taskId);
+    }
+    else if (filter.runId !== undefined) {
+        where.push("run_id = ?");
+        args.push(filter.runId);
+    }
+    else if (filter.taskId !== undefined) {
+        where.push("task_id = ?");
+        args.push(filter.taskId);
+    }
+    const rows = store.handle.prepare(`SELECT * FROM latency_timeline${where.length === 0 ? "" : ` WHERE ${where.join(" AND ")}`} ORDER BY id DESC LIMIT ?`).all(...args, Math.min(200, Math.max(1, filter.limit ?? 20)));
+    return rows.flatMap(row => {
+        let milestones;
+        try {
+            const parsed = JSON.parse(String(row["milestones_json"]));
+            milestones = Array.isArray(parsed) ? boundedMilestones(parsed) : [];
+        }
+        catch {
+            return [];
+        }
+        return [{ id: Number(row["id"]), kind: String(row["kind"]), subject: String(row["subject"]), taskId: row["task_id"] == null ? null : String(row["task_id"]),
+                runId: row["run_id"] == null ? null : Number(row["run_id"]), startedAt: String(row["started_at"]), totalMs: Number(row["total_ms"]), milestones }];
+    });
+}
+export const DEFAULT_LIVE_BACKUP = { enabled: true, everyMinutes: 5, keep: 24, folder: null };
+export function liveBackupState(store) {
+    const row = store.handle.prepare("SELECT * FROM live_backup WHERE id = 1").get();
+    if (row === undefined)
+        return { settings: { ...DEFAULT_LIVE_BACKUP }, latest: null, triedAt: null, problem: null };
+    const latest = row["latest_file"] == null || row["latest_sha256"] == null || row["latest_at"] == null || row["latest_schema"] == null ? null
+        : { file: String(row["latest_file"]), sha256: String(row["latest_sha256"]), madeAt: String(row["latest_at"]), schemaVersion: Number(row["latest_schema"]), bytes: Number(row["latest_bytes"] ?? 0) };
+    return { settings: { enabled: Number(row["enabled"]) === 1, everyMinutes: Number(row["every_minutes"]), keep: Number(row["keep"]), folder: row["folder"] == null ? null : String(row["folder"]) },
+        latest, triedAt: row["tried_at"] == null ? null : String(row["tried_at"]), problem: row["problem"] == null ? null : String(row["problem"]) };
+}
+const liveBackupWords = (one) => `${one.enabled ? `every ${one.everyMinutes} min` : "off"}, keep ${one.keep}, ${one.folder ?? "the default folder"}`;
+/** Change the continuous copy's settings; the ledger keeps before → after. A new folder forgets the latest copy (it is
+ * in the old one). */
+export function setLiveBackupSettings(store, next, by, now) {
+    return store.transact(() => {
+        const before = liveBackupState(store).settings;
+        store.handle.prepare(`INSERT INTO live_backup (id, enabled, every_minutes, keep, folder) VALUES (1, ?, ?, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET enabled = excluded.enabled, every_minutes = excluded.every_minutes, keep = excluded.keep, folder = excluded.folder`)
+            .run(next.enabled ? 1 : 0, next.everyMinutes, next.keep, next.folder);
+        if (before.folder !== next.folder)
+            store.handle.prepare("UPDATE live_backup SET latest_file = NULL, latest_sha256 = NULL, latest_at = NULL, latest_schema = NULL, latest_bytes = NULL WHERE id = 1").run();
+        if (liveBackupWords(before) !== liveBackupWords(next)) {
+            store.recordAction({ at: now.toISOString(), actor: by, repo: null, taskId: null, runId: null, action: "continuous backup settings changed", outcome: "changed", source: "policy", detail: `${liveBackupWords(before)} → ${liveBackupWords(next)}` });
+        }
+        return liveBackupState(store).settings;
+    });
+}
+/** Take (or keep) the continuous copy's lease until `until`: one process copies at a time. */
+export function holdLiveBackup(store, holder, now, until) {
+    return store.transact(() => {
+        store.handle.prepare("INSERT OR IGNORE INTO live_backup (id) VALUES (1)").run();
+        return Number(store.handle.prepare("UPDATE live_backup SET holder = ?, held_until = ? WHERE id = 1 AND (holder IS NULL OR holder = ? OR held_until IS NULL OR held_until < ?)")
+            .run(holder, until.toISOString(), holder, now.toISOString()).changes) === 1;
+    });
+}
+export function releaseLiveBackup(store, holder) {
+    store.handle.prepare("UPDATE live_backup SET holder = NULL, held_until = NULL WHERE id = 1 AND holder = ?").run(holder);
+}
+/** A copy's outcome: a verified copy becomes the latest; a failure is kept as the problem (the latest stays). */
+export function recordLiveBackup(store, outcome, now) {
+    store.handle.prepare("INSERT OR IGNORE INTO live_backup (id) VALUES (1)").run();
+    if (outcome.ok) {
+        store.handle.prepare("UPDATE live_backup SET latest_file = ?, latest_sha256 = ?, latest_at = ?, latest_schema = ?, latest_bytes = ?, tried_at = ?, problem = NULL WHERE id = 1")
+            .run(outcome.copy.file, outcome.copy.sha256, outcome.copy.madeAt, outcome.copy.schemaVersion, outcome.copy.bytes, now.toISOString());
+    }
+    else {
+        store.handle.prepare("UPDATE live_backup SET tried_at = ?, problem = ? WHERE id = 1").run(now.toISOString(), plainText(outcome.problem, 300));
+    }
+}

package/dist/surface.js

@@ -110,7 +110,9 @@ const GUIDE_ROWS = [
             { name: "limit", takesValue: true, meaning: "<step>=<minutes>: one waiting step's time limit" },
             { name: "tap", takesValue: true, meaning: "the Homebrew tap, owner/name" },
             { name: "release-gate", takesValue: true, meaning: "<id>: show why an update pause left before a deployment's swap is safe to lift" },
-            { name: "yes", takesValue: false, meaning: "with --release-gate: lift that one pause once it is proved" }],
+            { name: "yes", takesValue: false, meaning: "with --release-gate: lift that one pause once it is proved; with --recover-deploy: recover" },
+            { name: "recover-deploy", takesValue: false, meaning: "put back a deployment that stopped half way: stop only its own proved leftovers, restart the previous service, lift the pause" },
+            { name: "stage", takesValue: true, meaning: "with --recover-deploy: the deployment's staging folder" }],
         notableReasons: ["usage", "ambiguous", "drift", "timeout", "check-failed", "ci-failed", "tree-mismatch", "conflict", "mixed-runtime", "gate-held", "after-swap"] },
     operator("demo", "a seeded throwaway sandbox"),
     ...KNOWLEDGE_DESCRIPTORS.map(spec => ({ invocation: `knowledge ${spec.action}`, synopsis: spec.synopsis, audience: "audience" in spec ? spec.audience : "agent", agentMayInvoke: !("audience" in spec), mutation: spec.mutation, flags: spec.flags, ...(spec.takesQuery ? { positionals: [{ name: "query", required: true, meaning: "search text or source file for impact" }] } : {}) })),

package/dist/task-base.d.ts

@@ -33,3 +33,7 @@ export declare function freshBaseFor(store: Store, taskId: string, branch: strin
     };
 } | Record<string, never>;
 export declare function taskBaseOf(store: Store, taskId: string, git?: GitRead): TaskBaseView | null;
+/** `git`'s answers kept for `ttlMs` (at most `entries` of them), for a page that shows the base line on every refresh:
+ * each read still goes through the same frozen view when it runs; only its answer is reused for a moment. Display only —
+ * never for a decision. */
+export declare function recentGitReads(git?: GitRead, ttlMs?: number, entries?: number, now?: () => number): GitRead;

package/dist/task-base.js

@@ -4,10 +4,13 @@
  * branch's pinned origin, or the newest plan's base — and the behind count is
  * read from Git now. Reads only.
  */
-import { execFileSync } from "node:child_process";
+import { viewedGitSync } from "./teardown-git.js";
 export const readGit = (cwd, args) => {
     try {
-        return execFileSync("git", ["--no-optional-locks", "--no-lazy-fetch", "-c", "core.fsmonitor=false", "-c", "core.hooksPath=/dev/null", ...args], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5_000, maxBuffer: 65_536 }).trim();
+        // Every git version through a frozen read view, bounded (eval-harness review 1, finding 7): a partial clone, an
+        // include or a command-naming key is refused from the config git then runs with.
+        const ran = viewedGitSync(cwd, args, { timeoutMs: 5_000, maxBuffer: 65_536 });
+        return ran.status === 0 ? ran.stdout.trim() : null;
     }
     catch {
         return null;
@@ -49,3 +52,20 @@ export function taskBaseOf(store, taskId, git = readGit) {
     const view = { base, branch, main: behind === null ? null : main, behind };
     return { ...view, words: `Base ${baseStandingWords(view)}` };
 }
+/** `git`'s answers kept for `ttlMs` (at most `entries` of them), for a page that shows the base line on every refresh:
+ * each read still goes through the same frozen view when it runs; only its answer is reused for a moment. Display only —
+ * never for a decision. */
+export function recentGitReads(git = readGit, ttlMs = 15_000, entries = 64, now = Date.now) {
+    const kept = new Map();
+    return (cwd, args) => {
+        const key = JSON.stringify([cwd, args]), at = now(), hit = kept.get(key);
+        if (hit !== undefined && at - hit.at < ttlMs && at >= hit.at)
+            return hit.value;
+        const value = git(cwd, args);
+        kept.delete(key);
+        if (kept.size >= entries)
+            kept.delete(kept.keys().next().value);
+        kept.set(key, { at, value });
+        return value;
+    };
+}

package/dist/teardown-git.d.ts

@@ -38,7 +38,7 @@ export declare function teardownGit(runner?: Runner, binding?: GitBinding): Git;
  * git at any file, a pipe that never ends among them. Each file is read only as the regular file it is, bounded; one
  * that can't be read so counts as including.
  */
-export declare function checkoutIncludes(checkout: string): boolean;
+export declare function checkoutIncludes(checkout: string, gitFile?: string): boolean;
 export type GitBinding = {
     repo?: string | null;
 };
@@ -50,7 +50,7 @@ export declare const WRITE_VIEW_FLAGS: readonly string[];
 /** Whether the checkout's .lfsconfig (read as git parses it, that file only) sets any git-lfs key that could name a
  * program (anything but INERT_LFS). A file that
  * isn't a plain one, or doesn't parse, counts as naming one. */
-export declare function lfsExtensionIn(checkout: string): boolean;
+export declare function lfsExtensionIn(checkout: string, gitFile?: string): boolean;
 /** Every command runs against a view of the checkout's repository (gitView) whose config and info are copies the
  * plane made, inspected there, so neither can change between the inspection and the run. `mode` "read" is for reading
  * a checkout an agent may still be writing (the code page): every command also takes readFlags(), and the view holds
@@ -69,7 +69,7 @@ export declare const PAGE_READ_FLAGS: readonly string[];
  * its config as it starts, so the flags alone don't stop a filter planted in both after the inspection: every read
  * also runs against a view of the checkout's repository (gitView; checkoutGitSync, checkoutGit "read"), whose config and info are the plane's. The cost is cosmetic: a checkout's line-ending or encoding rules are not applied, so
  * a file they would normalize can read as changed (fail closed: shipping then asks for a clean commit). */
-export declare function readFlags(): readonly string[];
+export declare function readFlags(gitFile?: string): readonly string[];
 /**
  * checkoutGit, synchronously, for reads a page shows from a checkout an agent writes (docs/plans/get-side-effects.md):
  * the same refusals (an include, an .lfsconfig extension, a config key that can run a command), no system or global
@@ -81,6 +81,30 @@ export declare function checkoutGitSync(cwd: string, args: readonly string[], op
     maxBuffer?: number;
     binding?: GitBinding;
 }): string;
+/**
+ * checkoutGitSync's run, answering git's exit status instead of throwing on a non-zero one (a refusal, or a repository
+ * that changed while git ran, still throws): for reads whose "no" is an exit code (`merge-base --is-ancestor`), and,
+ * with `buffer`, for blobs read as bytes (their output is never rewritten).
+ */
+export declare function viewedGitSync(cwd: string, args: readonly string[], options: {
+    timeoutMs?: number;
+    maxBuffer?: number;
+    binding?: GitBinding;
+}): {
+    status: number | null;
+    stdout: string;
+};
+export declare function viewedGitSync(cwd: string, args: readonly string[], options: {
+    timeoutMs?: number;
+    maxBuffer?: number;
+    binding?: GitBinding;
+    buffer: true;
+    input?: Buffer;
+    git?: string;
+}): {
+    status: number | null;
+    stdout: Buffer;
+};
 /**
  * checkoutGit ("build": the repository written through its view) for callers that name the repository with a leading
  * `git -C <dir>` instead of a cwd: worktree add and remove in a project's repository, a merge in a checkout of it.
@@ -88,3 +112,28 @@ export declare function checkoutGitSync(cwd: string, args: readonly string[], op
  * what they name. Anything but git goes to `inner` as given.
  */
 export declare function hardenedGit(inner?: Runner, mode?: "build" | "read", binding?: GitBinding): Runner;
+/** Asked once per git executable (eval-harness review 2, follow-up): a fixed git given to viewedGitSync is probed
+ * itself, never answered for by the one PATH names. */
+export declare function lazyFetchSupported(gitFile?: string): boolean;
+/** For tests: forget the probes' answers, or set one for every executable (null forgets). */
+export declare function setLazyFetchSupportedForTest(value: boolean | null): void;
+/** The words for a partial clone refused on a git without `--no-lazy-fetch`. */
+export declare const PARTIAL_CLONE_REFUSAL = "this project is a partial clone; protected reads need git 2.45 or newer";
+/** `--no-lazy-fetch` where the installed git has it, else nothing (and lazyFetchSetting refuses partial clones). */
+export declare function noLazyFetch(): readonly string[];
+/**
+ * The repository setting (local or worktree scope of a `git config --list --show-scope -z` listing) that makes lazy
+ * fetching possible, or null: `extensions.partialClone` set at all, any `remote.<name>.promisor` not plainly false, or
+ * any `remote.<name>.partialCloneFilter` set (git makes that remote a promisor). Fails closed: a listing that can't be
+ * read names a setting. `remote.<name>.vcs` (a foreign-VCS helper) is named too, though the classifier already refuses
+ * it (commandSetting: not in the remote allowlist), as it does every `protocol.*` key and every include.
+ */
+export declare function lazyFetchSetting(listing: string): string | null;
+/**
+ * For the reads that run git directly on a repository rather than through a view: with `--no-lazy-fetch` they run as
+ * they always have (the flag stops any fetch). Without it, they must not check a repository's config and then run git
+ * on it (the config could change in between, or an include could set what the check never saw): `inner`, wrapped so
+ * every git command runs through a frozen read view (checkoutGit "read"), whose own config listing (includes refused,
+ * command and protocol settings refused, a partial clone refused) is the config git then runs with.
+ */
+export declare function lazyFetchSafeGit(inner?: Runner): Runner;