toolroll 0.9.77 → 0.9.78

package/dist/browser-workspace.d.ts

@@ -804,6 +804,8 @@ export type BrowserResultView = {
         efficiency?: import("./run-efficiency.js").RunEfficiency | null;
         /** What its network was and what its proxy saw (egress.ts): display only. */
         network?: import("./egress.js").RunNetworkRecord | null;
+        /** Where the time went: its release check's parts and the task's deploys (latency-timeline.ts), display only. */
+        timing?: import("./latency-timeline.js").TimingView | null;
         /** Words for the result's Accept: Accept and finish when offered, else the Needs you acceptance. */
         decision: BrowserResultDecision | null;
         checks: {

package/dist/builder.d.ts

@@ -174,10 +174,11 @@ export declare const REPAIR_MAX_TURNS = 4;
 export declare const REPAIR_TIMEOUT_MS: number;
 /**
  * How often a running build says "still here" — extending its lease and its
- * runner's liveness in one beat. A minute against a three-minute liveness
- * window means two beats can be lost to load before anything looks dead.
+ * runner's liveness in one beat. Every 15 s against a one-minute liveness
+ * window (runner.ts) means three beats can be lost to load before anything
+ * looks dead.
  */
-export declare const DEFAULT_PULSE_MS = 60000;
+export declare const DEFAULT_PULSE_MS = 15000;
 /** Branches an unattended agent may never commit to, whatever it was asked. */
 export declare const PROTECTED: Set<string>;
 /**

package/dist/builder.js

@@ -56,12 +56,13 @@ import { witnessedRunner } from "./process-custody.js";
 import { runWithIsolatedDatabase } from "./child-database.js";
 import { recordWorktreeProcess, saveWorkPatch } from "./worktree.js";
 import { launchSandboxOf, protectedChanges, protectedLinks } from "./agent-fence.js";
-import { approvalOf, digestOf, idleClock, isAcpProfile, profileDigestOf, routeParityProblem, watchdogsOf } from "./scope.js";
+import { approvalOf, digestOf, idleClock, isAcpProfile, profileDigestOf, releaseCheckScope, routeParityProblem, watchdogsOf } from "./scope.js";
 import { legOf, routeDigestOf, routeFromJson } from "./phase-routing.js";
 import { execFileSync } from "node:child_process";
 import { currentClaim, heartbeat, SYNC_MAX_AGE_MS, finalize } from "./claim.js";
 import { missingCapability } from "./dispatch.js";
-import { heartbeat as runnerHeartbeat } from "./runner.js";
+import { heartbeat as runnerHeartbeat, RUNNER_HEARTBEAT_MS } from "./runner.js";
+import { keepCheckTimeline } from "./latency-timeline.js";
 import { MARKER as LEASE_MARKER } from "./worktree.js";
 import { parseDecision, parseHandoff, repairPrompt, HEADLESS_RULE, HANDOFF_CONCLUSION_CAP, HANDOFF_ITEM_CAP, HANDOFF_LIST_CAP, HANDOFF_PAYLOAD_CAP } from "./decision.js";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
@@ -191,10 +192,11 @@ export const REPAIR_MAX_TURNS = 4;
 export const REPAIR_TIMEOUT_MS = 5 * 60_000;
 /**
  * How often a running build says "still here" — extending its lease and its
- * runner's liveness in one beat. A minute against a three-minute liveness
- * window means two beats can be lost to load before anything looks dead.
+ * runner's liveness in one beat. Every 15 s against a one-minute liveness
+ * window (runner.ts) means three beats can be lost to load before anything
+ * looks dead.
  */
-export const DEFAULT_PULSE_MS = 60_000;
+export const DEFAULT_PULSE_MS = RUNNER_HEARTBEAT_MS;
 /** Branches an unattended agent may never commit to, whatever it was asked. */
 export const PROTECTED = new Set(["main", "master", "trunk", "develop", "release"]);
 const GIT = "git";
@@ -378,12 +380,13 @@ export function proveApprovedProfile(scope, given) {
                 acceptance: scope.acceptance, candidate: scope.candidate ?? null,
                 qualityMode: scope.qualityMode ?? "default",
                 releaseTerms: scope.releaseTerms ?? null,
+                releaseCheck: scope.releaseCheck ?? null,
             }, snapshot, 
             // v47: the SEALED route is part of the signed bytes whenever it
             // says more than the legacy resolution — re-derived here from
             // the seal's own snapshot, never from mutable configuration.
             routeFromJson(scope.approvedRouteJson ?? null))
-            : digestOf({ goal: scope.goal, outOfScope: scope.outOfScope, touches: scope.touches, budgetMicrousd: scope.budgetMicrousd, acceptance: scope.acceptance, candidate: scope.candidate ?? null, releaseTerms: scope.releaseTerms ?? null });
+            : digestOf({ goal: scope.goal, outOfScope: scope.outOfScope, touches: scope.touches, budgetMicrousd: scope.budgetMicrousd, acceptance: scope.acceptance, candidate: scope.candidate ?? null, releaseTerms: scope.releaseTerms ?? null, releaseCheck: scope.releaseCheck ?? null });
         if (rederived !== scope.approvedDigest) {
             return { ok: false, message: "the approval record does not verify against the stored terms — re-approve (stale-approval)" };
         }
@@ -2372,7 +2375,8 @@ async function settleProof(captured, statArtifactId, sealedHead) {
             const access = checkLaunchOf(store, runId, captured.effective.profile).access;
             const decision = planTargetedRecheck(store, root, { runId, taskId: request.taskId, repo, head: sealedHead, command: configured, access, now: now() });
             // A release's check (signed terms or an open authority): CI never stands in for its unit suite.
-            const release = decision.authority !== null || (store.getScope(request.taskId)?.releaseTerms ?? null) !== null;
+            // A release's check: signed terms, a release check purpose (pipeline-speed.md, P0) or an open authority.
+            const release = decision.authority !== null || releaseCheckScope(store.getScope(request.taskId));
             try {
                 checkAttempt = prepareCheckAttempt(store, root, { runId, repo, head: sealedHead, command: configured, access, authority: decision.authority,
                     ...(decision.mode === "targeted" ? { plan: decision.plan, snapshot: decision.snapshot } : {}), watch: decision.watch, release }, now());
@@ -2618,6 +2622,8 @@ async function settleProof(captured, statArtifactId, sealedHead) {
         let sealedReport = null;
         if (checkAttempt !== null && last !== null && !last.notFound) {
             sealedReport = sealCheckOutcome(store, root, checkAttempt, { stdout: last.stdout, exitCode: last.timedOut ? null : last.code }, now());
+            // Where the check's time went (latency-timeline.ts): each part's start and end, display only.
+            keepCheckTimeline(store, { runId, taskId: request.taskId, report: sealedReport, stdout: last.stdout, now: now() });
         }
         // What the check covered (receipt version 3): full, composed from the release's last full check, partial, or
         // identity-removed (which stops the release carrying).
@@ -2630,7 +2636,7 @@ async function settleProof(captured, statArtifactId, sealedHead) {
             verifyCommand = effective.result;
             releaseFacts = effective.facts;
         }
-        else if (verifyCommand.configured && verifyCommand.ran && chosenCheck?.level === "full" && (store.getScope(request.taskId)?.releaseTerms ?? null) !== null) {
+        else if (verifyCommand.configured && verifyCommand.ran && chosenCheck?.level === "full" && releaseCheckScope(store.getScope(request.taskId))) {
             // A release's Full check that couldn't be sealed before it ran (no nonce, no inventory) has no result it can count.
             verifyCommand = { configured: true, ran: false, attemptFailed: true, failure: "no-result" };
             recordCheckNote("The release check ran without a sealed attempt (its commit couldn't be read before it ran), so it has no result that can count.");

package/dist/check-failure.js

@@ -22,6 +22,7 @@ import { CHECK_REPORT_CAPTURE, readSealedJson } from "./check-report.js";
 import { readCheckReport } from "./contracts/release-check.js";
 import { regateTask } from "./dispose.js";
 import { INFRA_RERUNS_PER_CANDIDATE, INFRA_RERUNS_PER_INCIDENT } from "./release.js";
+import { releaseCheckScope } from "./scope.js";
 import { verificationEvidence } from "./verification-evidence.js";
 /** The plane's limits for confirmed infrastructure failures (one rerun per incident, two per candidate). */
 export { INFRA_RERUNS_PER_CANDIDATE, INFRA_RERUNS_PER_INCIDENT };
@@ -235,10 +236,37 @@ export const classWords = (kind) => ({
 export function recheckReleaseTask(store, root, taskId, now) {
     const ref = store.lookupRef(taskId);
     const scope = store.getScope(taskId);
-    if (ref === null || scope === null || (scope.releaseTerms ?? null) === null || (scope.candidate ?? null) === null)
+    if (ref === null || scope === null || !releaseCheckScope(scope) || (scope.candidate ?? null) === null)
         return { action: "stop", class: null, why: `${taskId} isn't a release task`, source: null };
-    // One transaction: the rerun and its ledger row land together, or neither does.
-    return store.transact(() => recheckInside(store, root, taskId, ref.repo, String(scope.candidate), now));
+    // One transaction: the binding, the rerun and its ledger row are read and land together, or nothing does.
+    return store.transact(() => {
+        const bound = releasePurposeBinding(store, store.getScope(taskId) ?? scope, ref.repo);
+        if (bound !== null)
+            return { action: "stop", class: null, why: bound, source: null };
+        return recheckInside(store, root, taskId, ref.repo, String(scope.candidate), now);
+    });
+}
+/**
+ * Why the release's sealed purpose no longer names this exact check, or null when it does (pipeline-speed.md, P0). A
+ * release check purpose (a release that can't carry) authorizes a rerun only of the identical approved candidate: its
+ * sealed commit is the scope's candidate, its project is the task's, the project's live release check grant is the one
+ * sealed and its check access is the one sealed. Signed terms keep their own rules (a carried commit's candidate is
+ * not the terms' first commit) and are held to the same project and grant.
+ */
+function releasePurposeBinding(store, scope, repo) {
+    const sealed = scope.releaseTerms ?? scope.releaseCheck ?? null;
+    if (sealed === null)
+        return "it carries no release terms or release check purpose";
+    if (repo === null || sealed.repo !== repo)
+        return "its sealed release names another project";
+    if (scope.releaseTerms == null && scope.releaseCheck.approvedSha !== scope.candidate)
+        return "its sealed release check names another commit";
+    const grant = store.liveVerifyCommand(repo);
+    if (grant === null || grant.id !== sealed.grant.id || grant.digest !== sealed.grant.digest)
+        return "the project's release check changed since the approval";
+    if (scope.releaseTerms == null && store.projectCheckAccess(repo) !== scope.releaseCheck.access)
+        return "the project's check access changed since the approval";
+    return null;
 }
 function recheckInside(store, root, taskId, repo, candidate, now) {
     const ref = store.lookupRef(taskId);

package/dist/check-report.d.ts

@@ -52,8 +52,8 @@ export declare const FULL_PARTS: readonly CheckPart[];
 export declare const NOTHING_PATHS: readonly RegExp[];
 /** Model-facing code, whose change runs the real-model journeys: the plane's copy of scripts/release-check.mjs MODEL. */
 export declare const MODEL_PATHS: readonly RegExp[];
-/** Whether a changed path can affect an upgrade: the plane's copy of scripts/release-check.mjs needsUpgrade, without its
- * version-only exception (the plane counts a version bump as a change, so it owes more, never less). */
+/** Whether a changed path can affect an upgrade: the plane's copy of scripts/release-check.mjs needsUpgrade. Its
+ * version-only exception is decided apart, from verified blobs (versionOnlyChange), never from the path alone. */
 export declare function upgradeRelevant(file: string): boolean;
 /** The paths that differ between two verified trees: added, removed, or with another mode or blob. */
 export declare function changedPaths(facts: TreeFacts, base: TreeFacts): string[];
@@ -65,7 +65,10 @@ export declare function changedPaths(facts: TreeFacts, base: TreeFacts): string[
  * changed; the upgrade path when a change can affect an upgrade and the tree has it. With no base every one the tree
  * can run is owed. The check is told these on its handshake and runs at least them.
  */
-export declare function fullObligationsOf(facts: TreeFacts, base: TreeFacts | null): CheckPart[];
+export declare function fullObligationsOf(facts: TreeFacts, base: TreeFacts | null, 
+/** package.json / package-lock.json paths whose change since `base` is only the project's own version, proved by the
+ * plane from both verified blobs (versionBumpsOf): such a change alone doesn't owe the upgrade path. */
+versionBumps?: readonly string[]): CheckPart[];
 /** What a check must account for, sealed before it runs: every unit file of the tree, whatever runs (a targeted
  * check accounts for the rest through its base), and the parts it owes (a full check's from fullObligationsOf), and
  * whether CI may stand in for its unit suite. */
@@ -153,3 +156,15 @@ export declare function fullCheckProblem(input: {
     inventory: SealedInventory | null;
     exitCode: number | null;
 }): string | null;
+/** Where a release bumps the project's own version: the plane's copy of scripts/release-check.mjs VERSIONED. */
+export declare const VERSIONED_PATHS: readonly string[];
+/**
+ * Whether `path` changed from `before` to `after` only in the project's own version (pipeline-speed.md, item 4): the
+ * plane's copy of scripts/release-check.mjs versionOnly — the top-level "version", and in the lockfile the root
+ * package's. Anything else (a dependency, a script, a reordering, a duplicate key, a file added or removed, bytes that
+ * aren't one JSON object) is a real change.
+ */
+export declare function versionOnlyChange(path: string, before: Buffer | null, after: Buffer | null): boolean;
+/** The versioned files whose change from `base` to `facts` is only the version, read from verified blobs in the
+ * project's own Git directory. Anything unreadable is a real change (owes more, never less). */
+export declare function versionBumpsOf(gitDir: string, base: TreeFacts, facts: TreeFacts): string[];

package/dist/check-report.js

@@ -20,7 +20,7 @@
 import { createHash, randomBytes } from "node:crypto";
 import { lstatSync, realpathSync } from "node:fs";
 import { join } from "node:path";
-import { readVerifiedCommit, verifiedTreeEntries } from "./commit-extract.js";
+import { readVerifiedCommit, verifiedBlobs, verifiedTreeEntries } from "./commit-extract.js";
 import { CHECK_PARTS, CHECK_REPORT_MAX_BYTES, CHECK_REPORT_PREFIX, readCheckReport, } from "./contracts/release-check.js";
 import { readVerifiedArtifact, storeEvidence } from "./evidence.js";
 import { releaseBaselineRecord } from "./release-card.js";
@@ -107,8 +107,8 @@ export const MODEL_PATHS = Object.freeze([
     /^src\/(subagents|subagent-work|task-sizing|flow-sort|flow-draft)\.ts$/,
     /^src\/(provider|provider-[a-z-]+|invoke|exec|attest|coding-provider|assignment-adapters|subscription-[a-z-]+)\.ts$/,
 ]);
-/** Whether a changed path can affect an upgrade: the plane's copy of scripts/release-check.mjs needsUpgrade, without its
- * version-only exception (the plane counts a version bump as a change, so it owes more, never less). */
+/** Whether a changed path can affect an upgrade: the plane's copy of scripts/release-check.mjs needsUpgrade. Its
+ * version-only exception is decided apart, from verified blobs (versionOnlyChange), never from the path alone. */
 export function upgradeRelevant(file) {
     if (/^(docs|evidence|design|output)\//.test(file) || /\.md$/.test(file) || file === "LICENSE")
         return false;
@@ -134,7 +134,10 @@ export function changedPaths(facts, base) {
  * changed; the upgrade path when a change can affect an upgrade and the tree has it. With no base every one the tree
  * can run is owed. The check is told these on its handshake and runs at least them.
  */
-export function fullObligationsOf(facts, base) {
+export function fullObligationsOf(facts, base, 
+/** package.json / package-lock.json paths whose change since `base` is only the project's own version, proved by the
+ * plane from both verified blobs (versionBumpsOf): such a change alone doesn't owe the upgrade path. */
+versionBumps = []) {
     // What the tree can run is read from the candidate AND the last release (security scan): a candidate that deletes a
     // journey script, the upgrade path or its unit files doesn't take away what was owed at the base — the part stays
     // owed, and a check that can't run it has no result. Any entry counts, a symlink included, never only a regular file.
@@ -146,7 +149,8 @@ export function fullObligationsOf(facts, base) {
     const code = changed?.filter(path => !NOTHING_PATHS.some(re => re.test(path))) ?? null;
     const checks = code === null || code.length > 0;
     const real = code === null || code.some(path => !/\.test\.[cm]?[jt]s$/.test(path) && MODEL_PATHS.some(re => re.test(path)));
-    const upgrade = has("scripts/upgrade-path.mjs") && (changed === null || changed.some(upgradeRelevant));
+    const bumped = (path) => VERSIONED_PATHS.includes(path) && versionBumps.includes(path);
+    const upgrade = has("scripts/upgrade-path.mjs") && (changed === null || changed.some(path => !bumped(path) && upgradeRelevant(path)));
     return [
         "typecheck", "build",
         ...(checks && units ? ["unit"] : []),
@@ -195,7 +199,7 @@ export function prepareCheckAttempt(store, root, input, now) {
         }
         baseFacts = baseRead.facts;
     }
-    const owed = fullObligationsOf(read.facts, baseFacts);
+    const owed = fullObligationsOf(read.facts, baseFacts, baseFacts === null ? [] : versionBumpsOf(gitDir, baseFacts, read.facts));
     const release = input.release !== false;
     const ciSubstitute = !release;
     const inventory = inventoryOf(read.facts, plan, { owed, release });
@@ -213,7 +217,9 @@ export function prepareCheckAttempt(store, root, input, now) {
         inventoryDigest: payloadDigest(inventory), contextDigest: payloadDigest(context), nonceHash: sha256(nonce),
     }, now);
     // The command's own limit rides along, so the check ends itself (logs and report printed) before the plane stops it.
-    const stdin = JSON.stringify({ nonce, mode, plan, watch: [...(input.watch ?? [])], limitMs: input.command.timeoutMs, ...(plan === null ? { owed, ciSubstitute } : {}) });
+    // `reportBytes`: the largest report this plane reads back once sealed. A plane that doesn't say (0.9.77 and older) reads
+    // only 64 KiB, so the check gives it no larger report rather than one that poisons the receipt (scripts/release-check.mjs).
+    const stdin = JSON.stringify({ nonce, mode, plan, watch: [...(input.watch ?? [])], limitMs: input.command.timeoutMs, reportBytes: CHECK_ARTIFACT_CAP, ...(plan === null ? { owed, ciSubstitute } : {}) });
     return { runId: input.runId, nonce, stdin, mode, inventory, context, plan, snapshot, watch: [...(input.watch ?? [])] };
 }
 /** Seal one JSON payload as a structured-output artifact under its capture label. */
@@ -388,3 +394,57 @@ export function fullCheckProblem(input) {
     }
     return null;
 }
+/** Where a release bumps the project's own version: the plane's copy of scripts/release-check.mjs VERSIONED. */
+export const VERSIONED_PATHS = Object.freeze(["package.json", "package-lock.json"]);
+/**
+ * Whether `path` changed from `before` to `after` only in the project's own version (pipeline-speed.md, item 4): the
+ * plane's copy of scripts/release-check.mjs versionOnly — the top-level "version", and in the lockfile the root
+ * package's. Anything else (a dependency, a script, a reordering, a duplicate key, a file added or removed, bytes that
+ * aren't one JSON object) is a real change.
+ */
+export function versionOnlyChange(path, before, after) {
+    if (!VERSIONED_PATHS.includes(path) || before === null || after === null)
+        return false;
+    const rest = (bytes) => {
+        const text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+        const json = JSON.parse(text);
+        // Parsing is lossy for duplicate keys and rounded numbers. Such bytes never earn an exemption.
+        const tokens = (value) => JSON.stringify(value.match(/"(?:\\.|[^"\\])*"|[^\s"{}\[\]:,]+|[{}\[\]:,]/g));
+        if (tokens(text) !== tokens(JSON.stringify(json)))
+            throw new Error("ambiguous JSON");
+        if (json === null || typeof json !== "object" || Array.isArray(json))
+            throw new Error("not an object");
+        const object = json;
+        if (typeof object["version"] !== "string")
+            throw new Error("not a version string");
+        delete object["version"];
+        const packages = object["packages"];
+        if (path === "package-lock.json" && packages !== null && typeof packages === "object" && !Array.isArray(packages)) {
+            const root = packages[""];
+            if (root !== null && typeof root === "object" && !Array.isArray(root)) {
+                if (typeof root["version"] !== "string")
+                    throw new Error("not a root version string");
+                delete root["version"];
+            }
+        }
+        return JSON.stringify(object);
+    };
+    try {
+        return rest(before) === rest(after);
+    }
+    catch {
+        return false;
+    }
+}
+/** The versioned files whose change from `base` to `facts` is only the version, read from verified blobs in the
+ * project's own Git directory. Anything unreadable is a real change (owes more, never less). */
+export function versionBumpsOf(gitDir, base, facts) {
+    const before = verifiedBlobs(gitDir, base.tree, VERSIONED_PATHS);
+    const after = verifiedBlobs(gitDir, facts.tree, VERSIONED_PATHS);
+    if (!before.ok || !after.ok)
+        return [];
+    return VERSIONED_PATHS.filter(path => {
+        const a = before.value.get(path), b = after.value.get(path);
+        return a !== undefined && b !== undefined && a.id !== b.id && versionOnlyChange(path, a.bytes, b.bytes);
+    });
+}

package/dist/claim.d.ts

@@ -103,6 +103,15 @@ export type AcquireResult = {
  | {
     ok: false;
     reason: "coordinator-filed";
+} | {
+    ok: false;
+    reason: "watch-custody";
+}
+/** The runner reported draining (v137 lifecycle): its stop has begun, so it takes no new work. */
+ | {
+    ok: false;
+    reason: "draining";
+    until: string;
 };
 /** `fenced` means the lease was superseded; `unknown` means it never existed. */
 export type FenceResult = {

package/dist/claim.js

@@ -28,7 +28,7 @@
  * rather than probable.
  */
 import { randomUUID } from "node:crypto";
-import { authenticate } from "./runner.js";
+import { authenticate, drainOf } from "./runner.js";
 import { pauseForAuth } from "./provider-auth.js";
 import { DEFAULT_MAX_OPEN_DECISIONS, missingCapability, scopeApprovedForDispatch, taskReadinessBlocker, } from "./dispatch.js";
 import { BUILT_IN, } from "./store.js";
@@ -85,6 +85,10 @@ function acquireLocked(store, taskRef, runner, options) {
         const gate = authenticate(store, runner, options.token);
         if (!gate.ok)
             return { ok: false, reason: "unauthenticated", detail: gate.reason };
+        // DRAINING (v137): a runner whose stop has begun admits nothing new, on every claim road.
+        const drain = drainOf(store, gate.runner, now);
+        if (drain !== null)
+            return { ok: false, reason: "draining", until: drain.until };
         const placedRef = store.refForId(taskRef);
         const placedRepo = placedRef?.repo ?? null;
         if (placedRepo === null)
@@ -92,6 +96,10 @@ function acquireLocked(store, taskRef, runner, options) {
         if (!gate.runner.repos.includes(placedRepo)) {
             return { ok: false, reason: "unauthorized-repo", repo: placedRepo };
         }
+        // The watch may have lapsed while this pass awaited I/O, before its heartbeat callback ran. Runner tokens
+        // survive a role restart, so prove this exact watch in the claim transaction as well.
+        if (options.incarnation !== undefined && db.prepare("SELECT 1 FROM watch_lease WHERE runner = ? AND repo = ? AND owner = ? AND expires_at > ?").get(runner, placedRepo, options.incarnation, stamp) === undefined)
+            return { ok: false, reason: "watch-custody" };
         // THE COORDINATOR QUARANTINE in the one primitive every claim road
         // shares (MCP spec v6, round-3 f1): a coordinator-filed task whose
         // scope has not been sealed by the password ceremony claims for

package/dist/contracts/console-api.d.ts

@@ -98,7 +98,7 @@ export declare const CONSOLE_FORMS: {
     readonly storage: FormContract<"cleanup" | "password" | "path" | "preview">;
     readonly pullRequests: FormContract<"act" | "base" | "github" | "method" | "password" | "repo" | "when-green">;
     readonly checks: FormContract<"act" | "command" | "level" | "on" | "password" | "repo" | "timeout">;
-    readonly backups: FormContract<"every" | "folder" | "keep" | "password">;
+    readonly backups: FormContract<"every" | "folder" | "keep" | "live_every" | "live_folder" | "password">;
     readonly data: FormContract<"password">;
     readonly flowsOn: FormContract<"repo" | "starter">;
     readonly integrationsTest: FormContract<"key">;

package/dist/contracts/console-api.js

@@ -107,7 +107,7 @@ export const CONSOLE_FORMS = {
     storage: formContract("POST /settings/storage, /settings/storage/clean, /settings/storage/discard", ["password", "cleanup", "preview", "path"]),
     pullRequests: formContract("POST /settings/pull-requests", ["repo", "act", "password", "github", "base", "method", "when-green"]),
     checks: formContract("POST /settings/checks", ["repo", "password", "act", "on", "level", "command", "timeout"]),
-    backups: formContract("POST /settings/backups", ["password", "every", "keep", "folder"]),
+    backups: formContract("POST /settings/backups", ["password", "every", "keep", "folder", "live_every", "live_folder"]),
     data: formContract("POST /settings/data", ["password"]),
     flowsOn: formContract("POST /settings/flows/on", ["repo", "starter"]),
     integrationsTest: formContract("POST /settings/integrations/test", ["key"]),

package/dist/contracts/release-terms.d.ts

@@ -64,3 +64,44 @@ export declare function storedReleaseTerms(raw: unknown): {
     ok: false;
     problem: string;
 };
+/**
+ * A release check's purpose (docs/plans/pipeline-speed.md, P0): what a person agrees to when they approve a release
+ * whose later commits can't carry (its checks run outside the sandbox, or carrying is off) — this exact candidate is a
+ * release's check. It never carries a later commit, never lets CI stand in for the check's units and never approves
+ * itself; it lets the plane hold the check to the release's strict report rules and rerun it, on this identical
+ * candidate under this same approval, after a failure the plane itself confirmed as infrastructure. Part of the scope
+ * digest when present; read strictly. A scope carries terms or this purpose, never both.
+ */
+export declare const releaseCheckPurposeSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    purpose: z.ZodLiteral<"release-check">;
+    repo: z.ZodString;
+    packageVersion: z.ZodString;
+    branch: z.ZodString;
+    pr: z.ZodInt;
+    base: z.ZodLiteral<"main">;
+    approvedSha: z.ZodString;
+    approvedTree: z.ZodString;
+    grant: z.ZodObject<{
+        id: z.ZodInt;
+        digest: z.ZodString;
+    }, z.core.$strict>;
+    access: z.ZodEnum<{
+        sandboxed: "sandboxed";
+        "sign-ins": "sign-ins";
+        unsandboxed: "unsandboxed";
+    }>;
+}, z.core.$strict>;
+export type ReleaseCheckPurpose = z.infer<typeof releaseCheckPurposeSchema>;
+export declare function readReleaseCheckPurpose(input: unknown): ContractResult<ReleaseCheckPurpose>;
+/** The digest a scope binds for its release check purpose, domain-separated from the terms' and every other input. */
+export declare function releaseCheckPurposeDigest(purpose: ReleaseCheckPurpose): string;
+/** Strict stored purpose: null column → null; anything that isn't exactly a purpose, as written → a problem. */
+export declare function storedReleaseCheckPurpose(raw: unknown): {
+    ok: true;
+    purpose: ReleaseCheckPurpose | null;
+} | {
+    ok: false;
+    problem: string;
+};
+export declare function serializeReleaseCheckPurpose(purpose: ReleaseCheckPurpose): string;

package/dist/contracts/release-terms.js

@@ -72,3 +72,56 @@ export function storedReleaseTerms(raw) {
         return { ok: false, problem: "the release terms are not stored exactly as written" };
     return { ok: true, terms: read.value };
 }
+/**
+ * A release check's purpose (docs/plans/pipeline-speed.md, P0): what a person agrees to when they approve a release
+ * whose later commits can't carry (its checks run outside the sandbox, or carrying is off) — this exact candidate is a
+ * release's check. It never carries a later commit, never lets CI stand in for the check's units and never approves
+ * itself; it lets the plane hold the check to the release's strict report rules and rerun it, on this identical
+ * candidate under this same approval, after a failure the plane itself confirmed as infrastructure. Part of the scope
+ * digest when present; read strictly. A scope carries terms or this purpose, never both.
+ */
+export const releaseCheckPurposeSchema = versioned(1, {
+    purpose: z.literal("release-check"),
+    repo: z.string().min(1).max(4096),
+    packageVersion: z.string().regex(/^\d+\.\d+\.\d+$/),
+    branch: z.string().min(1).max(255).regex(/^[A-Za-z0-9._/-]+$/),
+    pr: z.int().min(1),
+    base: z.literal("main"),
+    approvedSha: sha,
+    approvedTree: sha,
+    grant: z.strictObject({ id: z.int(), digest: z.string().min(1).max(128) }),
+    access: z.enum(["sandboxed", "sign-ins", "unsandboxed"]),
+});
+export function readReleaseCheckPurpose(input) {
+    return readVersioned(releaseCheckPurposeSchema, input);
+}
+/** The digest a scope binds for its release check purpose, domain-separated from the terms' and every other input. */
+export function releaseCheckPurposeDigest(purpose) {
+    return createHash("sha256").update(`release-check-purpose:${JSON.stringify(purpose)}`).digest("hex");
+}
+/** Strict stored purpose: null column → null; anything that isn't exactly a purpose, as written → a problem. */
+export function storedReleaseCheckPurpose(raw) {
+    if (raw === null || raw === undefined)
+        return { ok: true, purpose: null };
+    if (typeof raw !== "string")
+        return { ok: false, problem: "the release check purpose is not stored as text" };
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return { ok: false, problem: "the release check purpose can't be read" };
+    }
+    const read = readReleaseCheckPurpose(parsed);
+    if (!read.ok)
+        return { ok: false, problem: `the release check purpose doesn't match its contract (${read.issues[0]?.line ?? "invalid"})` };
+    if (JSON.stringify(read.value) !== raw)
+        return { ok: false, problem: "the release check purpose is not stored exactly as written" };
+    return { ok: true, purpose: read.value };
+}
+export function serializeReleaseCheckPurpose(purpose) {
+    const read = readReleaseCheckPurpose(purpose);
+    if (!read.ok)
+        throw new Error(`The release check purpose doesn't match its contract: ${read.issues[0]?.line ?? "invalid"}`);
+    return JSON.stringify(read.value);
+}

package/dist/controller-service.js

@@ -8,7 +8,10 @@ const stop = () => stopping.abort();
 process.on("SIGTERM", stop);
 process.on("SIGINT", stop);
 try {
-    await superviseController({ file, argv, signal: stopping.signal, onState: state => {
+    // A stop is forwarded to the controller (SIGTERM) and waited for. Past 55 s its whole tree is stopped outright: before
+    // launchd's own ExitTimeOut (60 s) kills this process and could leave the controller running without it. `up` signs
+    // off within 50 s at its default grace and stops itself if this process dies first (operate.ts upCommand).
+    await superviseController({ file, argv, signal: stopping.signal, shutdownMs: 55_000, onState: state => {
             if (state.phase === "backoff")
                 process.stderr.write(`Controller exited (${state.exit?.signal ?? state.exit?.code ?? "unknown"}); restart in ${state.retryMs} ms.\n`);
         } });

package/dist/deploy-rescue.d.ts

@@ -0,0 +1,41 @@
+/** Phases where the new service may be running: recovery leaves them to the release, which resumes forward. */
+export declare const FORWARD_ONLY: readonly string[];
+export type RescueWorld = {
+    /** The live database. */
+    database: string;
+    /** The installation's state folder: deployments stage under staged-upgrades/ there. */
+    stateDir: string;
+    /** Every deployment journal under staged-upgrades/: its stage and contents, null when unreadable. */
+    journals(): {
+        stage: string;
+        journal: Record<string, unknown> | null;
+    }[];
+    /** The builder run's worktree, from the plane's records (the deploy script's --source), or null. */
+    runWorktree(run: number): string | null;
+    /** The deployment's own recovery for that stage (release-adapters.ts recoverDeploy). */
+    recover(input: {
+        run: number;
+        worktree: string;
+        stage: string;
+    }): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        message: string;
+    }>;
+};
+export type RescueOutcome = {
+    ok: true;
+    acted: boolean;
+    stage: string | null;
+    phase: string | null;
+    words: string[];
+} | {
+    ok: false;
+    reason: "usage" | "conflict" | "damaged" | "forward" | "failed";
+    message: string;
+};
+/** What recovery will do from a phase, in a few words. */
+export declare function rescuePlan(phase: string, journal: Record<string, unknown>): string[];
+/** Find the one unfinished deployment (or the named stage), verify its journal, and recover it (with `yes`). */
+export declare function rescueDeployment(stageArg: string | undefined, yes: boolean, world: RescueWorld): Promise<RescueOutcome>;