toolroll 0.9.77 → 0.9.78

package/dist/operate.js

@@ -44,6 +44,7 @@ import { createConnectionChecker } from "./provider-connection.js";
 import { checkIntegrations, integrationsBrokenLine, integrationsNow, renderIntegrations } from "./integrations.js";
 import { buildHandoff, handoffLines, loginAccount, runOnboard } from "./agent-onboard.js";
 import { backupFiles, backupFolderOf, backupOwner, backupNow, restoreDatabase, startBackups } from "./backup.js";
+import { startLiveBackups } from "./live-backup.js";
 import { pushLimitSink } from "./provider-limits.js";
 import { heuristicSizing, installFilingSizer, ownerSizer, refineFiledSizing, settleSizings } from "./task-sizing.js";
 import { tierLines, tierReport } from "./tier-report.js";
@@ -57,7 +58,7 @@ import { readHooksBase, scheduleFromWords } from "./flow-triggers.js";
 import { sendSubagentSummaries } from "./subagent-admin.js";
 import { runRequestedUndos, sendSubagentWeeklies } from "./subagent-week.js";
 import { refreshConnections } from "./mcp-connect.js";
-import { releaseTermsFor } from "./release-carry.js";
+import { releaseCheckPurposeFor, releaseTermsFor } from "./release-carry.js";
 import { refreshTrustedMains, settleReleaseChecks } from "./nightly-check.js";
 import { SECRETS_FIRST, startToolSecrets, toolSecretStorage } from "./project-tools.js";
 import { followDiscord } from "./discord.js";
@@ -100,7 +101,7 @@ import { taskReviewBrief, renderReviewBrief } from "./task-review-brief.js";
 import { homedir, hostname } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
 import { releaseStalledUpdate, waitingUpdate } from "./toolroll-update.js";
-import { openStore, openStoreNoMigrate, CONCURRENT_WRITER_WAIT_MS, isDatabaseBusy, databasePath, BUILT_IN, parseCapabilityKey, verifiedAuthor, isDigestTime, predecessorWatches, RESULT_SCREENSHOTS, } from "./store.js";
+import { openStore, openStoreNoMigrate, CONCURRENT_WRITER_WAIT_MS, isDatabaseBusy, databasePath, BUILT_IN, parseCapabilityKey, verifiedAuthor, isDigestTime, predecessorWatches, RESULT_SCREENSHOTS, lifecycleOf, reportLifecycle, beatLifecycle, } from "./store.js";
 import { createHash, randomBytes, randomInt, randomUUID } from "node:crypto";
 import { claimInstance, clearInstance, openInstanceSocket } from "./console-instance.js";
 import { authorizePlanUnderMode } from "./plan-auto.js";
@@ -194,7 +195,9 @@ import { acquire, acquireIfReady, heartbeat, release, reap, currentClaim, DEFAUL
 import { disposeBuildOutcome, holdStaleApproval, regateTask } from "./dispose.js";
 import { proposeGrant, describeGrant, describeWithheld, permits, MUTATION_CLASSES, DEFAULT_MUTATIONS, } from "./grant.js";
 import { builtIn, guarded } from "./backend.js";
-import { register, authenticate, heartbeat as heartbeatRunner, isAlive, recoverDead, recoveredAnything, acquireWatchLeaseAuthed, heartbeatWatchLeaseAuthed, addRunnerReposAuthed, removeRunnerRepoAuthed, registerRunnerIfIdle, retireRunnerIfCurrent, normalizeRunnerName, validRunnerName, canonicalRepos, RUNNER_NAME_MAX, RUNNER_CAPACITY_MAX, parseRunnerCapacity, } from "./runner.js";
+import { register, authenticate, heartbeat as heartbeatRunner, isAlive, recoverDead, recoveredAnything, acquireWatchLeaseAuthed, heartbeatWatchLeaseAuthed, addRunnerReposAuthed, removeRunnerRepoAuthed, registerRunnerIfIdle, retireRunnerIfCurrent, drainRunnerIfCurrent, RUNNER_HEARTBEAT_MS, MAX_WATCH_LEASE_MS, normalizeRunnerName, validRunnerName, canonicalRepos, RUNNER_NAME_MAX, RUNNER_CAPACITY_MAX, parseRunnerCapacity, hashToken as hashRunnerToken, } from "./runner.js";
+import { credentialDigest, recordedHolderProvedGone, processGone, processStart, readRunnerProcessRecord, runnerProcessFile, sealRunnerProcessRecord, writeRunnerProcessRecord } from "./runner-process.js";
+import { stopProcessTree } from "./process-tree.js";
 import { mintCoordinator, revokeCoordinator, listCoordinators } from "./coordinator.js";
 import { serveMcp } from "./mcp.js";
 import { createInterface } from "node:readline";
@@ -1542,6 +1545,10 @@ function claimCommand(positional, flags, context) {
             return fail(write, json, "claim", "coordinator-filed", "a coordinator filed this — nothing runs until the operator signs its scope", EXIT.refused);
         if (result.reason === "sweep-limit")
             return fail(write, json, "claim", "sweep-limit", `its sweep already has ${result.limit} running at once — it starts when one finishes`, EXIT.refused, { sweep: result.sweep, limit: result.limit });
+        if (result.reason === "watch-custody")
+            return fail(write, json, "claim", "watch-custody", "This worker no longer holds the project; restart the watch", EXIT.refused);
+        if (result.reason === "draining")
+            return fail(write, json, "claim", "draining", `Toolroll is restarting (draining): ${runner} takes no new work until it is back (by ${result.until})`, EXIT.refused, { until: result.until });
         return fail(write, json, "claim", result.reason, `held by ${result.by} until ${result.until}`, EXIT.refused, { holder: result.by, until: result.until });
     }
     // Taking a task is what makes it running; leaving that to the caller would
@@ -3948,6 +3955,7 @@ async function startConsole(options) {
         ...(options.upConsole === undefined ? {} : { upConsole: options.upConsole }),
         ...(options.editorLinks === undefined ? {} : { editorLinks: options.editorLinks }),
         ...(options.instanceSecret === undefined ? {} : { instanceSecret: options.instanceSecret }),
+        ...(options.draining === undefined ? {} : { draining: options.draining }),
     });
     await new Promise((resolve, reject) => {
         server.once("error", reject);
@@ -6004,8 +6012,10 @@ async function daemonCommand(positional, flags, context) {
     return fail(write, json, "daemon", "usage", "`toolroll daemon [install|status|uninstall|logs]`", EXIT.usage);
 }
 // ---- the watch loop --------------------------------------------------------
-const WATCH_LEASE_MS = 90_000;
-const WATCH_HEARTBEAT_MS = 30_000;
+// A watch lease lasts at most a minute and is renewed every 15 s (docs/plans/actors-lessons.md): a crashed worker's
+// projects are free within a minute, and a clean stop hands them back at once (retireRunnerIfCurrent).
+const WATCH_LEASE_MS = MAX_WATCH_LEASE_MS;
+const WATCH_HEARTBEAT_MS = RUNNER_HEARTBEAT_MS;
 /** The start repair runs once per process, not once per project loop. */
 /**
  * The Telegram follower: one actor on the wire that sends notifications and
@@ -7110,8 +7120,13 @@ async function upCommand(flags, context) {
         probe.once("error", () => resolveProbe(false));
         probe.listen(port, "127.0.0.1", () => resolveProbe(true));
     });
-    if (!reserved)
+    if (!reserved) {
+        // The console that holds it said it is stopping: a restart is under way, so say that instead of "another one runs".
+        const holder = lifecycleOf(store, `console:${port}`);
+        if (holder?.state === "draining")
+            return fail(write, json, "up", "port-busy", `Toolroll is restarting (draining): the console on port ${port} is stopping — try again in a few seconds`, EXIT.refused);
         return fail(write, json, "up", "port-busy", `port ${port} is taken — another \`up\` or \`serve\` may already be running; stop it, or pick a different --port`, EXIT.refused);
+    }
     // Under a coding agent nothing is asked and no secret is printed, even in a real terminal: what is shown lands in
     // its transcript.
     const agentRunning = underAgent(context.upSeams?.env ?? process.env);
@@ -7143,21 +7158,47 @@ async function upCommand(flags, context) {
             // The runner's authority is BOUND to the canonical roots this up
             // serves (MCP spec v6): the claim gate enforces membership, so an
             // unbound registration would deny-all its own dispatches.
-            const answer = registerRunnerIfIdle(store, { name, host: hostname(), repos, now: clock() });
+            // A holder whose every process is proved gone (its record beside the database) no longer blocks the name: an
+            // `up` killed outright can't leave a fresh heartbeat in the way of the next start (the 2026-10-29 deploy).
+            const tryRegister = () => registerRunnerIfIdle(store, { name, host: hostname(), repos, now: clock(),
+                previousGone: holder => recordedHolderProvedGone(runnerProcessFile(context.databaseFile, name), holder, hostname()) });
+            let answer = tryRegister();
+            // Wait for a draining holder to sign off or be proved gone, never just for its deadline to elapse.
+            const drainWaitUntil = Date.now() + 2 * 60_000;
+            let saidDraining = false;
+            while (!answer.ok && answer.reason === "runner-draining" && Date.now() < drainWaitUntil) {
+                if (!saidDraining)
+                    progress(`${answer.detail}; waiting for it to stop`);
+                saidDraining = true;
+                await new Promise(resolveWait => setTimeout(resolveWait, 1_000));
+                answer = tryRegister();
+            }
             if (answer.ok) {
                 runnerName = name;
                 runnerToken = answer.token;
+                if (answer.signedOff !== null)
+                    progress(`signed off the previous ${name}: its processes had already exited`);
                 if (answer.recoveredRuns > 0)
                     progress(`recovered ${answer.recoveredRuns} interrupted attempt(s) left by the previous ${name}`);
+                // Every process given this credential is recorded (pid and start time) before it gets it: this one now, each
+                // role child as it is spawned. A later start proves them gone by this record.
+                if (!recordRunnerProcess(context.databaseFile, { runner: answer.runner, credentialHash: hashRunnerToken(answer.token) }, "up", process.pid)) {
+                    retireRunnerIfCurrent(store, runnerName, runnerToken, clock());
+                    return fail(write, json, "up", "runner-alive", "The worker process record could not be saved; nothing started", EXIT.refused);
+                }
                 doorAnswer = answer;
                 break;
             }
             doorAnswer = answer;
             if (runnerFlag !== undefined)
                 break; // an explicit name is never suffixed around
+            if (answer.reason === "runner-draining")
+                break; // a restart under way keeps its name
         }
         if (runnerName === "") {
             const detail = doorAnswer !== null && !doorAnswer.ok ? doorAnswer.detail : "no worker name could be taken";
+            if (doorAnswer !== null && !doorAnswer.ok && doorAnswer.reason === "runner-draining")
+                return fail(write, json, "up", "runner-alive", `${detail}, and it hasn't yet — try again shortly`, EXIT.refused);
             return fail(write, json, "up", "runner-alive", `${detail} — that worker looks alive; stop the other \`up\` or watch, or name a different worker with --runner`, EXIT.refused);
         }
         // 6. Enrollment: repositories and project roots are one atomic machine
@@ -7203,6 +7244,13 @@ async function upCommand(flags, context) {
     let currentRepos = [...repos];
     let consoleRole = null;
     let workerRole = null;
+    // A stop that can't finish (a role that ignores its stop, a drain that hangs) still signs off: past the worker's own
+    // drain bound and a margin, both roles' process trees are stopped outright, the runner is retired, and `up` ends. A
+    // service's launchd window (ExitTimeOut 60 s, controller-service's 55 s) is longer than this at the default grace.
+    let resolveForced = () => { };
+    const forced = new Promise(resolveForce => (resolveForced = resolveForce));
+    let forceTimer;
+    const stopDeadlineMs = Math.max(1, stopGraceMs) + 20_000;
     const stop = () => {
         if (stopping) {
             workerRole?.hardStop();
@@ -7210,6 +7258,20 @@ async function upCommand(flags, context) {
         }
         stopping = true;
         resolveStopped();
+        // Draining, durably: no new work is admitted for this runner from now, and a restart waits for this drain's end
+        // (now + the forced-stop bound) instead of a heartbeat window.
+        try {
+            if (runnerName !== "")
+                drainRunnerIfCurrent(store, runnerName, runnerToken, clock(), new Date(clock().getTime() + stopDeadlineMs));
+        }
+        catch { /* the heartbeat bound still holds */ }
+        forceTimer = setTimeout(() => {
+            fatal ??= `stopping took longer than ${Math.round(stopDeadlineMs / 1000)} s; its console and worker were stopped outright`;
+            workerRole?.kill();
+            consoleRole?.kill();
+            resolveForced();
+        }, stopDeadlineMs);
+        forceTimer.unref?.();
         // The coding owner record is released first, whatever else is still finishing: launchd kills a service that
         // outlasts its exit window, and a killed process cannot release it. The console keeps serving until the end.
         consoleRole?.send({ type: "stopping" });
@@ -7217,12 +7279,34 @@ async function upCommand(flags, context) {
     };
     process.on("SIGINT", stop);
     process.on("SIGTERM", stop);
+    // The process that started `up` gone (its service supervisor killed, or the IPC parent that ran it): nobody is left to
+    // forward a stop, so `up` stops itself — it drains, retires its runner and ends instead of running on as an orphan.
+    let parentGone = false;
+    const parentAtStart = process.ppid;
+    const parentWatch = context.upSeams === undefined && parentAtStart > 1 ? setInterval(() => {
+        if (process.ppid === parentAtStart || parentGone)
+            return;
+        parentGone = true;
+        progress("the process that started Toolroll is gone; stopping");
+        stop();
+    }, 1_000) : undefined;
+    parentWatch?.unref?.();
+    const onDisconnect = () => { if (!parentGone) {
+        parentGone = true;
+        progress("the process that started Toolroll closed its channel; stopping");
+        stop();
+    } };
+    if (context.upSeams === undefined && process.channel !== undefined && process.channel !== null)
+        process.once("disconnect", onDisconnect);
     // A log (a service, an agent, --json or --verbose) says whose each line is; a person at a terminal reads plain lines.
     const labelled = split && (json || flags.has("verbose") || !(context.upSeams?.terminal ?? process.stdout.isTTY === true));
     const roleLine = (role) => (line) => progress(labelled ? `[${role}] ${line}` : line);
     const dropSignals = () => {
         process.removeListener("SIGINT", stop);
         process.removeListener("SIGTERM", stop);
+        process.removeListener("disconnect", onDisconnect);
+        if (parentWatch !== undefined)
+            clearInterval(parentWatch);
     };
     const consoleConfig = {
         host: hostFlag, port, allowedHosts: allowFlag === undefined ? null : allowFlag.split(",").map(one => one.trim()).filter(one => one !== ""),
@@ -7230,8 +7314,12 @@ async function upCommand(flags, context) {
     };
     const pendingLinks = new Map();
     let linkRequests = 0;
+    const roleSpawned = (role, pid) => {
+        const held = store.getRunner(runnerName);
+        return held !== null && held.credentialHash === hashRunnerToken(runnerToken) && recordRunnerProcess(context.databaseFile, held, role, pid);
+    };
     consoleRole = startUpRole({
-        role: "console", split, context, build, shutdownMs: 15_000,
+        role: "console", split, context, build, shutdownMs: 15_000, onSpawned: pid => roleSpawned("console", pid),
         start: () => ({ type: "start", role: "console", databaseFile: context.databaseFile, containment: containmentFlag, build, config: { ...consoleConfig, repos: [...currentRepos] } }),
         onMessage: message => {
             if (message.type === "log")
@@ -7266,7 +7354,7 @@ async function upCommand(flags, context) {
     const url = consoleReady.url;
     if (!stopping) {
         workerRole = startUpRole({
-            role: "worker", split, context, build,
+            role: "worker", split, context, build, onSpawned: pid => roleSpawned("worker", pid),
             // The worker drains its builds for the stop grace, then stops them; past that it is stopped outright.
             shutdownMs: Math.max(1, stopGraceMs) + 15_000,
             start: generation => ({
@@ -7275,7 +7363,7 @@ async function upCommand(flags, context) {
                     runner: runnerName, token: runnerToken, repos: generation === 1 ? [...repos] : [...currentRepos], pinnedRepos: [...pinnedRepos], projectRoots, registryPath, pool,
                     forMs: forGiven === undefined ? null : Number(forGiven), publicUrl: publicUrlFlag ?? null, stopGraceMs, verbose: flags.has("verbose"),
                     terminal: context.upSeams?.terminal ?? process.stdout.isTTY === true,
-                    // A restart waits out a crashed predecessor's lease (90 s), then recovers it: as a fresh `up` after a crash.
+                    // A restart waits out a crashed predecessor's lease (at most a minute), then recovers it: as a fresh `up` after a crash.
                     leaseWaitMs: split ? WATCH_LEASE_MS + 15_000 : 0,
                 },
             }),
@@ -7319,7 +7407,7 @@ async function upCommand(flags, context) {
             fatal = `the builder identity changed (${beat.reason})`;
             stop();
         }
-    }, 60_000);
+    }, RUNNER_HEARTBEAT_MS);
     runnerHeartbeat.unref?.();
     // 9. Readiness, then the ONE startup envelope / greeting (finding 11/20).
     const approverPlan2 = approver;
@@ -7391,14 +7479,19 @@ async function upCommand(flags, context) {
     // only then does the console stop serving.
     await stopped;
     if (workerRole !== null)
-        await workerRole.done;
+        await Promise.race([workerRole.done, forced]);
     clearInterval(runnerHeartbeat);
     if (runTimer !== undefined)
         clearTimeout(runTimer);
     dropSignals();
     retireRunnerIfCurrent(store, runnerName, runnerToken, clock());
     consoleRole.stop();
-    const closed = await consoleRole.done;
+    const closed = await Promise.race([consoleRole.done, forced.then(() => ({ problem: null }))]);
+    if (forceTimer !== undefined)
+        clearTimeout(forceTimer);
+    // With nobody left to wait for it, `up` ends once it has signed off, whatever handle lingers.
+    if (parentGone)
+        setTimeout(() => process.exit(fatal === null ? EXIT.ok : EXIT.failed), 1_000).unref?.();
     // A live terminal that couldn't be proved stopped (or any other close failure) is said, never "stopped".
     if (closed.problem !== null && fatal === null)
         fatal = closed.problem;
@@ -9596,6 +9689,7 @@ async function scopeTask(positional, flags, context) {
     // sandbox, say) file the scope without them: every later commit then asks again, as before.
     const releaseGiven = text(flags, "release");
     let releaseTerms;
+    let releaseCheck;
     let releaseNote = null;
     if (releaseGiven !== undefined) {
         const spec = /^(\d+\.\d+\.\d+):([1-9][0-9]*):([A-Za-z0-9._/-]+)$/.exec(releaseGiven);
@@ -9607,8 +9701,15 @@ async function scopeTask(positional, flags, context) {
         const made = releaseTermsFor(store, { repo, version: spec[1], pr: Number(spec[2]), branch: spec[3], candidate: candidateGiven, now, noCarry: flags.get("no-carry") === true });
         if (made.ok)
             releaseTerms = made.terms;
-        else
+        else {
             releaseNote = `Later commits on this release will each ask for approval: ${made.why}.`;
+            // Without terms the candidate is still a release's check (pipeline-speed.md, P0): its purpose is sealed with the
+            // scope, from the plane's own records, so the check runs under the release's rules and the plane may rerun it on
+            // this same candidate after confirmed infrastructure. It never carries a later commit.
+            const purpose = releaseCheckPurposeFor(store, { repo, version: spec[1], pr: Number(spec[2]), branch: spec[3], candidate: candidateGiven });
+            if (purpose.ok)
+                releaseCheck = purpose.purpose;
+        }
     }
     if (acceptanceParse.criteria.length === 0)
         return fail(write, json, "task scope", "acceptance-required", "--acceptance named no valid criteria", EXIT.usage);
@@ -9676,7 +9777,8 @@ async function scopeTask(positional, flags, context) {
             : null;
         const proposed = propose(store, {
             ...(candidateGiven === undefined ? {} : { candidate: candidateGiven }),
-            ...(releaseTerms === undefined ? {} : { releaseTerms }),
+            ...(releaseTerms === undefined ? {} : { releaseTerms, releaseCheck: null }),
+            ...(releaseCheck === undefined ? {} : { releaseCheck, releaseTerms: null }),
             taskId: id,
             goal,
             outOfScope: text(flags, "not") ?? null,
@@ -11604,6 +11706,35 @@ function upNeedsOneProcess(options) {
         options.now !== undefined;
 }
 /** The entry a role child runs: the built sibling when installed, the TypeScript source through tsx in a checkout. */
+/**
+ * Add one process to the record of who holds this runner's credential (runner-process.ts), replacing that role's
+ * earlier processes once they are gone. A complete authenticated record is required before delivering credentials.
+ */
+function recordRunnerProcess(databaseFile, holder, role, pid) {
+    try {
+        const started = processStart(pid);
+        if (started === null)
+            return false;
+        const file = runnerProcessFile(databaseFile, holder.runner.name);
+        const credential = credentialDigest(holder.credentialHash);
+        const current = readRunnerProcessRecord(file);
+        const same = current !== null && current.runner === holder.runner.name && current.registeredAt === holder.runner.registeredAt && current.credential === credential;
+        // Never bless a tampered or incomplete earlier list while appending a credential holder.
+        if (role !== "up" && (!same || current.signature !== sealRunnerProcessRecord(current, holder.credentialHash).signature))
+            return false;
+        // Keep every possibly live generation; truncating this list would erase custody.
+        const kept = same ? current.processes.filter(one => one.role !== role || !processGone(one)) : [];
+        const record = { v: 1, runner: holder.runner.name, host: holder.runner.host, registeredAt: holder.runner.registeredAt, credential,
+            processes: [...kept.filter(one => one.pid !== pid), { pid, role, started }] };
+        if (record.processes.length > 64)
+            return false;
+        writeRunnerProcessRecord(file, sealRunnerProcessRecord(record, holder.credentialHash));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 function upRoleChildCommand(role) {
     const source = import.meta.url.endsWith(".ts");
     const entry = fileURLToPath(new URL(source ? "./up-role-child.ts" : "./up-role-child.js", import.meta.url));
@@ -11693,6 +11824,7 @@ function startUpRole(args) {
             send: message => channel.parent.send(message),
             stop: () => { stopping = true; channel.parent.stop(false); },
             hardStop: () => { channel.parent.stop(true); },
+            kill: () => { stopping = true; channel.parent.stop(true); },
             pid: () => livePid,
         };
     }
@@ -11710,6 +11842,20 @@ function startUpRole(args) {
             generations.spawned();
             owned.on("message", raw => receive(raw, () => controller.abort()));
             owned.on("error", () => { });
+            let recorded = false;
+            try {
+                recorded = owned.pid !== undefined && (args.onSpawned?.(owned.pid) ?? true);
+            }
+            catch { /* refuse credential delivery */ }
+            if (!recorded) {
+                fatal = "The worker process record could not be saved";
+                failed = { reason: "start", detail: fatal };
+                generations.refused(fatal);
+                owned.kill("SIGKILL");
+                controller.abort();
+                resolveReady({ ok: false, ...failed });
+                return;
+            }
             // The start, including the runner token for the worker, goes over the private channel only.
             owned.send(args.start(generation), error => { if (error !== null && error !== undefined)
                 owned.kill("SIGTERM"); });
@@ -11775,6 +11921,14 @@ function startUpRole(args) {
                 catch { /* ending */ }
             }
         },
+        kill: () => {
+            stopping = true;
+            controller.abort();
+            const owned = child;
+            // Only the still-owned ChildProcess is signalled, never a recorded pid.
+            if (owned !== null && owned.exitCode === null && owned.signalCode === null && !stopProcessTree(owned))
+                owned.kill("SIGKILL");
+        },
         pid: () => livePid,
     };
 }
@@ -11805,10 +11959,14 @@ async function runUpConsoleRole(context, config, port, build) {
     const activeRepos = new Set(config.repos);
     // Cockpit B1: this start's instance secret, minted once it is listening; the console answers its challenges with it.
     let instanceSecret = null;
+    // v137: this console's lifecycle (service_lifecycle "console:<port>"): started, a short heartbeat, draining once
+    // its `up` stops, stopped at the end. While draining, /healthz and every page say Toolroll is restarting.
+    let draining = false;
     let console_;
     try {
         console_ = await startConsole({
             instanceSecret: () => instanceSecret,
+            draining: () => draining,
             context,
             host: config.host,
             port: config.port,
@@ -11839,14 +11997,31 @@ async function runUpConsoleRole(context, config, port, build) {
     let resolveStopped = () => { };
     const stopped = new Promise(resolveStop => (resolveStopped = resolveStop));
     port.onStop(() => resolveStopped());
+    const lifecycleComponent = `console:${console_.port}`;
+    const lifecycleHolder = `${process.pid}:${randomUUID().slice(0, 8)}`;
+    try {
+        reportLifecycle(store, lifecycleComponent, "started", lifecycleHolder, clock(), { pid: process.pid });
+    }
+    catch { /* reporting never stops the console */ }
+    const lifecycleBeat = setInterval(() => { try {
+        beatLifecycle(store, lifecycleComponent, lifecycleHolder, clock());
+    }
+    catch { /* the next beat tries again */ } }, RUNNER_HEARTBEAT_MS);
+    lifecycleBeat.unref?.();
     port.onMessage(message => {
         if (message.type === "repos") {
             activeRepos.clear();
             for (const repo of message.repos)
                 activeRepos.add(repo);
         }
-        else if (message.type === "stopping")
+        else if (message.type === "stopping") {
+            draining = true;
+            try {
+                reportLifecycle(store, lifecycleComponent, "draining", lifecycleHolder, clock(), { drainUntil: new Date(clock().getTime() + 60_000) });
+            }
+            catch { /* the flag above still answers */ }
             closeCoding();
+        }
         else if (message.type === "sign-in-link") {
             let link = null;
             try {
@@ -11874,13 +12049,19 @@ async function runUpConsoleRole(context, config, port, build) {
         progress(`attach: ${instanceSocket.problem} — \`toolroll\` in a repository won't find this console`);
     port.send({ type: "ready", role: "console", build, pid: process.pid, url: console_.url, port: console_.port });
     await stopped;
+    draining = true;
     closeCoding();
+    clearInterval(lifecycleBeat);
     if (instanceSocket.ok)
         instanceSocket.close();
     if (mintedSecret !== null)
         clearInstance(store, mintedSecret);
     let closeProblem = null;
     await new Promise(done => console_.server.close(error => { closeProblem = error === undefined || error === null ? null : error.message; done(); }));
+    try {
+        reportLifecycle(store, lifecycleComponent, "stopped", lifecycleHolder, clock());
+    }
+    catch { /* a stale row lapses with its heartbeat */ }
     port.send({ type: "closed", problem: closeProblem });
     return closeProblem === null ? EXIT.ok : EXIT.failed;
 }
@@ -12165,12 +12346,18 @@ async function runUpWorkerRole(context, config, port, build) {
     }
     catch { /* A display fact; never blocks the worker. */ }
     recordRunnerVersion(dirname(context.databaseFile), runnerName, PACKAGE_VERSION, clock());
+    // v137: the continuous database copy, off the hot path (live-backup.ts: a worker thread copies, checks and hashes).
+    // Never inside a project or a build checkout. A test's injected agent runner means a test: no background copies.
+    const stopLiveBackups = context.agentRunner === undefined
+        ? startLiveBackups(store, context.databaseFile, () => [...new Set([...activeRepos, ...store.knownRepos(), pool])])
+        : null;
     // Ready once every project's loop holds its lease; a loop that failed to start ends this worker instead.
     if (fatal === null && !stopping)
         port.send({ type: "ready", role: "worker", build, pid: process.pid, url: null, port: null });
     await stopped;
     await registrySupervisor;
     await Promise.all([...loopResults.values()]);
+    await stopLiveBackups?.();
     // The follower was aborted with the stop. A send or a chat turn it is still finishing keeps its own durable record;
     // the service does not wait past this for it.
     await new Promise(done => {

package/dist/planner.js

@@ -23,7 +23,7 @@ import { run } from "./exec.js";
 import { checkoutGit } from "./teardown-git.js";
 import { auditOf, isProviderId } from "./provider.js";
 import { currentClaim, heartbeat } from "./claim.js";
-import { heartbeat as runnerHeartbeat } from "./runner.js";
+import { heartbeat as runnerHeartbeat, RUNNER_HEARTBEAT_MS } from "./runner.js";
 import { parseDecision } from "./decision.js";
 import { parsePlan } from "./plan.js";
 import { PLAN_MODEL_SCHEMA } from "./contracts/plan.js";
@@ -44,7 +44,7 @@ const GIT = "git";
 const AGENT_ENV_DENYLIST = [...TELEGRAM_TOKEN_ENVS];
 const DEFAULT_PLAN_TIMEOUT_MS = 20 * 60_000;
 const DEFAULT_PLAN_TURNS = CLAUDE_LIMITS.maxTurns;
-const DEFAULT_PULSE_MS = 60_000;
+const DEFAULT_PULSE_MS = RUNNER_HEARTBEAT_MS;
 /**
  * One line of untrusted text made inert for the planner's brief (Codex
  * M5-M8 audit, IV-4): controls and separators collapse, protocol-shaped

package/dist/release-adapters.d.ts

@@ -70,6 +70,33 @@ export type AdapterOptions = {
 export declare const BRANCH_GONE_LOOKS = 5;
 export declare const BRANCH_GONE_PAUSE_MS = 2000;
 export declare function releaseAdapters(options: AdapterOptions): ReleaseAdapters;
+/**
+ * Why a tap change isn't exactly the formula bump this release proposed (security scan), or null when it is: the tap's
+ * own open pull request number `pr` at exactly `head`, from its version branch into the default branch; compared with
+ * the default branch's head it is one commit on top of exactly that head, changing exactly one file, the formula; and
+ * the formula there is exactly today's with npm's published tarball and that tarball's own sha256.
+ */
+export declare function tapChangeProblem(input: {
+    tap: string;
+    pr: number;
+    head: string;
+    version: string;
+    formula: string;
+    defaultBranch: string;
+    baseHead: string;
+    baseVersion: string | null;
+    view: Json;
+    compare: Json;
+    expected: string;
+    atHead: string;
+    sha256: string;
+}): string | null;
+/** Whether a pull request's head is a branch of the tap itself (never a fork's). */
+export declare function tapOwnHead(pr: Json, tap: string): boolean;
+/** The version a formula's tarball url names (`…/toolroll-<x.y.z>.tgz`), or null. */
+export declare function formulaVersion(text: string): string | null;
+/** Whether version `a` comes after `b` (both x.y.z). */
+export declare function versionAfter(a: string, b: string): boolean;
 /**
  * Whether a workflow's triggers (its top-level `on:` as a name, a list or a map) include a change to the repository.
  * A file that doesn't parse, or whose triggers aren't one of those shapes, counts as running, so the release waits
@@ -103,7 +130,11 @@ export type AutoObservers = {
  * lists only the latest of each), every page — with its id, app, check suite and the commit it is filed under, oldest
  * first. A row that doesn't parse stops the read: a partial answer is never taken for the whole.
  */
-export declare function readCheckRuns(run: Exec, gh: string, repo: string, sha: string): Promise<CheckRun[]>;
+export declare function readCheckRuns(run: Exec, gh: string, repo: string, sha: string, 
+/** A release tag (pipeline-speed.md, item 3): a push of exactly this tag binds its workflow file too. */
+options?: {
+    tag?: string;
+}): Promise<CheckRun[]>;
 /** One job's step outcomes as GitHub's Actions API reports them. */
 export type JobRecord = {
     id: number;