toolroll 0.9.82 → 0.9.84

package/dist/operate.js

@@ -110,7 +110,7 @@ import { claimInstance, clearInstance, openInstanceSocket } from "./console-inst
 import { authorizePlanUnderMode } from "./plan-auto.js";
 import { ghDispatchAdapter, mirrorTaskId, syncPass } from "./sync.js";
 import { LIVE_FILE_BOUND, LIVE_RETAIN_MS, sweepLiveLogs } from "./live.js";
-import { addRepos, removeRepos, updateRepos, loadRepos, loadProjectRegistry, updateProjectRegistry } from "./repos.js";
+import { addRepos, removeRepos, updateRepos, loadRepos, loadProjectRegistry, updateProjectRegistry, registryRemovals } from "./repos.js";
 import { deleteProject, holdingsWords, projectHoldings, projectRunning } from "./project-delete.js";
 import { pushPass } from "./push.js";
 import { chmodSync, closeSync, constants as fsConstants, existsSync, fstatSync, fsyncSync, openSync, readFileSync, readSync, realpathSync, renameSync, unlinkSync, writeSync, writeFileSync } from "node:fs";
@@ -181,6 +181,8 @@ import { createDecisionServer } from "./serve.js";
 import { readTailnetNames } from "./tailnet.js";
 import { daemonLaunchCommand, daemonStatus, installReplacingLegacy, installedLegacyDaemon, planDaemon, uninstallDaemon, awaitFreshHeartbeat, } from "./daemon.js";
 import { bridgePass, clearBotToken, createTransport, followBridge, hashPairingCode, loadBotToken, mintPairingCode, networkFence, networkFenceLine, redactToken, saveBotToken, PAIRING_TTL_MS, TOKEN_ENV, telegramHookSecret, telegramPushUrl, } from "./telegram.js";
+import { projectIdentities } from "./project-identity.js";
+import { lookIdentities } from "./folder-look.js";
 import { scanRepo } from "./capscan.js";
 import { computeGaps, describeCapability } from "./gaps.js";
 import { ask as promptAsk, askHidden as promptHidden, confirm as promptConfirm, interactive as promptInteractive, underAgent } from "./prompt.js";
@@ -220,6 +222,7 @@ import { fileTaskProposal, validateTaskText } from "./proposal.js";
 import { TEMPLATES, templateByName } from "./templates.js";
 import { isDirectChatProvider, isSubscriptionChatProvider, priceOf, PRICED_MODELS } from "./converse.js";
 import { resolvePhaseAgent, resolveScopeProfile, resolveRouteCandidates, routeOfTask, INSTALLATION_SCOPE } from "./agentconfig.js";
+import { applyModelChoices, stateDigest } from "./model-choices.js";
 import { isTaskSize, legOf, projectRoute, routeDigestOf, routeWords, TASK_SIZES, PHASES as ROUTE_PHASES } from "./phase-routing.js";
 import { observeProviderReadiness, reportProviderReadinessAuthed } from "./runner.js";
 import { parseDemoUrl, projectDemoUrl, saveProjectDemo } from "./project-demo.js";
@@ -965,6 +968,7 @@ async function dispatchOn(command, positional, flags, repoList, base, options, e
             ...(options.onboardSeams === undefined ? {} : { onboardSeams: options.onboardSeams }),
             ...(options.upSeams === undefined ? {} : { upSeams: options.upSeams }),
             ...(options.upRole === undefined ? {} : { upRole: options.upRole }),
+            ...(options.folderLook === undefined ? {} : { folderLook: options.folderLook }),
             ...(upNeedsOneProcess(options) ? { upOneProcess: true } : {}),
             ...(activeRemote() === null ? {} : { principal: activeRemote() }),
         });
@@ -3939,7 +3943,13 @@ async function startConsole(options) {
     const { context } = options;
     // A git incident (teardown-git.ts) raises an attention notification in this console's outbox.
     noticeGitIncidents(context.store, context.clock);
+    // Every project folder this console starts with is resolved off its thread, under a deadline, after it is listening
+    // (consoleIdentitiesInBackground): the console answers at once, and a project shows up once its folder answers. Until
+    // then it is unresolved and kept restrictive; one that doesn't answer (a drive away, an iCloud folder macOS is
+    // holding) is looked at again by the background pass (project-identity.ts).
+    const identities = projectIdentities(context.folderLook);
     const server = createDecisionServer({
+        identities,
         store: context.store,
         // Sign-in, integration and model checks, and the tidy-ups no page visit does (docs/plans/get-side-effects.md).
         backgroundChecks: true,
@@ -3974,6 +3984,7 @@ async function startConsole(options) {
     }).catch(error => {
         throw new Error(`could not listen on ${options.host}:${options.port} — ${describe(error)}`);
     });
+    consoleIdentitiesInBackground(identities, [...options.repos ?? [], ...options.projectRoots ?? [], ...context.store.listProjects().map(one => one.path), ...context.store.knownRepos()]);
     // v104: monitoring runs beside the console (every setup has one): one loop sends the audit stream and traces where
     // Settings → Monitoring says, and stops when the console does. A lease keeps a second process from sending too.
     const stopMonitoring = startMonitoring({
@@ -5034,6 +5045,9 @@ async function configCommand(positional, flags, context) {
     if (phase === undefined || !["plan", "build", "repair", "review"].includes(phase))
         return fail(write, json, `config ${action}`, "usage", "which phase? plan, build, repair, review — or chat", EXIT.usage);
     const acting = await askCredentials(flags, context);
+    // The credential generation the proof below is checked against, read BEFORE it: a rotation after this read makes
+    // the write refuse (model-choices.ts re-checks it inside the transaction), never borrow the new generation.
+    const provedGeneration = acting === null ? -1 : store.accountOf(acting.name)?.generation ?? -1;
     const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
     if (acting === null || !verified?.ok)
         return refuseApprover(context, `config ${action}`, verified, "changing spend routing takes `--as <you> --token <t>`", phase);
@@ -5049,6 +5063,18 @@ async function configCommand(positional, flags, context) {
     // Clearing one left from before stays possible.
     if (tierGiven === "light" && phase !== "build" && !(action === "clear" && phase === "plan" && !flag(flags, "also")))
         return fail(write, json, `config ${action}`, "usage", "--tier light is for build only — a small change makes no plan, and repairs resume the builder's session", EXIT.usage);
+    // Every row below — plain, tier, `--also`, and a leftover light planner's removal — is written through the one write
+    // path (model-choices.ts): one transaction, the actor re-proved as an instance operator at the credential generation
+    // proved above by a proof that still stands, the target and the resulting configuration checked, every row ledgered.
+    // A project named with --repo must be one Toolroll knows (the editor's own rule).
+    const projectKnown = repoGiven === undefined || (await knownProject(context, repoGiven, { listed: true, canonical: true })) !== undefined;
+    const proof = { actor: acting.name, generation: provedGeneration, method: verified.method };
+    const written = (slot, to, extra = []) => writeModelRow(store, proof, scope, () => projectKnown, slot, to, clock(), extra);
+    // A configuration still missing a role's model is saved, and said (JSON: `incomplete`).
+    const said = (command, result, payload, lines) => {
+        const incomplete = result.ok ? result.unresolved : null;
+        return succeed(write, json, command, { ...payload, ...(incomplete === null ? {} : { incomplete }) }, () => [...lines(), ...(incomplete === null ? [] : [`  ! new tasks can't be filed here yet: ${incomplete}`])]);
+    };
     // Another provider's candidate on the same tier (`--also`): one per provider, and at filing the one whose plan
     // has more room runs.
     if (flag(flags, "also")) {
@@ -5059,8 +5085,11 @@ async function configCommand(positional, flags, context) {
         if (alsoProvider !== undefined && !isProviderId(alsoProvider))
             return fail(write, json, `config ${action}`, "usage", `--provider is one of ${PROVIDER_IDS.join(", ")}`, EXIT.usage);
         if (action === "clear") {
-            const removed = store.clearPhaseTierAlternates(scope, phase, tier, alsoProvider ?? null);
-            return succeed(write, json, "config clear", { scope, phase, tier, also: true, provider: alsoProvider ?? null, cleared: removed }, () => [
+            const alsoClear = written(null, null, [{ kind: "also-clear", phase, tier, provider: alsoProvider ?? null }]);
+            if (!alsoClear.ok)
+                return fail(write, json, "config clear", alsoClear.reason, alsoClear.problem, EXIT.refused);
+            const removed = alsoClear.extra;
+            return said("config clear", alsoClear, { scope, phase, tier, also: true, provider: alsoProvider ?? null, cleared: removed }, () => [
                 removed > 0 ? `Removed ${removed} other-provider ${tier} ${phase} agent${removed === 1 ? "" : "s"} at ${scope}; sealed routes are untouched.` : `No other-provider ${tier} ${phase} agent${alsoProvider === undefined ? "" : ` on ${alsoProvider}`} was configured at ${scope}.`,
             ]);
         }
@@ -5070,10 +5099,12 @@ async function configCommand(positional, flags, context) {
         const alsoValid = validateSpec({ provider: alsoProvider, model: alsoModel });
         if (!alsoValid.ok)
             return fail(write, json, "config set", "invalid", alsoValid.problem, EXIT.usage);
-        store.setPhaseTierAlternate(scope, phase, tier, alsoProvider, alsoModel, acting.name, clock());
+        const alsoSet = written(null, null, [{ kind: "also-set", phase, tier, provider: alsoProvider, model: alsoModel }]);
+        if (!alsoSet.ok)
+            return fail(write, json, "config set", alsoSet.reason, alsoSet.problem, EXIT.refused);
         const resolvedNow = resolveRouteCandidates(store, scope === INSTALLATION_SCOPE ? null : scope);
         const own = !resolvedNow.ok ? null : tier === "routine" ? resolvedNow.candidates[phase].routine : tier === "light" ? resolvedNow.candidates[phase].light ?? null : resolvedNow.candidates[phase].strong;
-        return succeed(write, json, "config set", { scope, phase, tier, also: true, provider: alsoProvider, model: alsoModel }, () => [
+        return said("config set", alsoSet, { scope, phase, tier, also: true, provider: alsoProvider, model: alsoModel }, () => [
             `${tier} ${phase} at ${scope === INSTALLATION_SCOPE ? "the installation" : scope} can also run ${alsoProvider} · ${alsoModel}, set by ${acting.name}.`,
             own !== null && own.provider === alsoProvider && !own.source.includes("also")
                 ? `  ! the ${tier} ${phase} agent already runs ${alsoProvider} (${own.model}) — this one is not used while it does.`
@@ -5081,20 +5112,39 @@ async function configCommand(positional, flags, context) {
         ]);
     }
     if (action === "clear") {
+        if (tierGiven === "light" && phase === "build") {
+            const lightWrite = written({ phase, tier: "light" }, null);
+            if (!lightWrite.ok)
+                return fail(write, json, "config clear", lightWrite.reason, lightWrite.problem, EXIT.refused);
+            const clearedLight = lightWrite.diff.length > 0;
+            return said("config clear", lightWrite, { scope, phase, tier: "light", cleared: clearedLight }, () => [
+                clearedLight ? `Cleared the light ${phase} agent at ${scope} — small changes keep the default and say so; sealed routes are untouched.` : `No light ${phase} agent was configured at ${scope}.`,
+            ]);
+        }
         if (tierGiven === "light") {
-            const clearedLight = store.clearPhaseTierConfig(scope, phase, "light");
-            return succeed(write, json, "config clear", { scope, phase, tier: "light", cleared: clearedLight }, () => [
+            // A light planner from before light became build-only: removed here, never written.
+            const legacyClear = written(null, null, [{ kind: "legacy-light-clear", phase: phase }]);
+            if (!legacyClear.ok)
+                return fail(write, json, "config clear", legacyClear.reason, legacyClear.problem, EXIT.refused);
+            const clearedLight = legacyClear.extra > 0;
+            return said("config clear", legacyClear, { scope, phase, tier: "light", cleared: clearedLight }, () => [
                 clearedLight ? `Cleared the light ${phase} agent at ${scope} — small changes keep the default and say so; sealed routes are untouched.` : `No light ${phase} agent was configured at ${scope}.`,
             ]);
         }
         if (tierGiven === "strong") {
-            const clearedStrong = store.clearPhaseTierConfig(scope, phase, "strong");
-            return succeed(write, json, "config clear", { scope, phase, tier: "strong", cleared: clearedStrong }, () => [
+            const strongWrite = written({ phase: phase, tier: "strong" }, null);
+            if (!strongWrite.ok)
+                return fail(write, json, "config clear", strongWrite.reason, strongWrite.problem, EXIT.refused);
+            const clearedStrong = strongWrite.diff.length > 0;
+            return said("config clear", strongWrite, { scope, phase, tier: "strong", cleared: clearedStrong }, () => [
                 clearedStrong ? `Cleared the strong ${phase} agent at ${scope} — demanding routes keep the default and say so; sealed routes are untouched.` : `No strong ${phase} agent was configured at ${scope}.`,
             ]);
         }
-        const cleared = store.clearPhaseConfig(scope, phase);
-        return succeed(write, json, "config clear", { scope, phase, cleared }, () => [
+        const routineWrite = written({ phase: phase, tier: "routine" }, null);
+        if (!routineWrite.ok)
+            return fail(write, json, "config clear", routineWrite.reason, routineWrite.problem, EXIT.refused);
+        const cleared = routineWrite.diff.length > 0;
+        return said("config clear", routineWrite, { scope, phase, cleared }, () => [
             cleared ? `Cleared ${phase} at ${scope} — it resolves one layer down now.` : `Nothing was configured for ${phase} at ${scope}.`,
         ]);
     }
@@ -5108,8 +5158,10 @@ async function configCommand(positional, flags, context) {
     if (tierGiven === "light") {
         if (modelGiven === null)
             return fail(write, json, "config set", "usage", `a light ${phase} agent names an exact --model — approvals bind exact routing`, EXIT.usage);
-        store.setPhaseTierConfig(scope, phase, "light", providerGiven, modelGiven, acting.name, clock());
-        return succeed(write, json, "config set", { scope, phase, tier: "light", provider: providerGiven, model: modelGiven }, () => [
+        const lightSet = written({ phase: phase, tier: "light" }, { provider: providerGiven, model: modelGiven });
+        if (!lightSet.ok)
+            return fail(write, json, "config set", lightSet.reason, lightSet.problem, EXIT.refused);
+        return said("config set", lightSet, { scope, phase, tier: "light", provider: providerGiven, model: modelGiven }, () => [
             `light ${phase} at ${scope === INSTALLATION_SCOPE ? "the installation" : scope} is ${providerGiven} · ${modelGiven}, set by ${acting.name}.`,
             "  small changes filed from now on build on it with no plan; sealed routes are untouched.",
         ]);
@@ -5119,14 +5171,19 @@ async function configCommand(positional, flags, context) {
             return fail(write, json, "config set", "invalid", "gemini has no isolation posture for the review phase yet — name claude or codex as the strong reviewer", EXIT.usage);
         if (modelGiven === null)
             return fail(write, json, "config set", "usage", `a strong ${phase} agent names an exact --model — approvals bind exact routing`, EXIT.usage);
-        store.setPhaseTierConfig(scope, phase, "strong", providerGiven, modelGiven, acting.name, clock());
-        return succeed(write, json, "config set", { scope, phase, tier: "strong", provider: providerGiven, model: modelGiven }, () => [
+        const strongSet = written({ phase: phase, tier: "strong" }, { provider: providerGiven, model: modelGiven });
+        if (!strongSet.ok)
+            return fail(write, json, "config set", strongSet.reason, strongSet.problem, EXIT.refused);
+        return said("config set", strongSet, { scope, phase, tier: "strong", provider: providerGiven, model: modelGiven }, () => [
             `strong ${phase} at ${scope === INSTALLATION_SCOPE ? "the installation" : scope} is ${providerGiven}${modelGiven === null ? "" : ` · ${modelGiven}`}, set by ${acting.name}.`,
             "  large or risky, strict, screenshot-proof, and automerge routes filed from now on reach for it; sealed routes are untouched.",
             ...(phase === "repair" ? ["  a strong repair agent applies only when its provider is the build's — cross-provider repair does not exist."] : []),
         ]);
     }
-    store.setPhaseConfig(scope, phase, providerGiven, modelGiven, acting.name, clock());
+    // A routine row may still name no model on the command line (said below); the editor never writes one.
+    const routineSet = written({ phase: phase, tier: "routine" }, { provider: providerGiven, model: modelGiven });
+    if (!routineSet.ok)
+        return fail(write, json, "config set", routineSet.reason, routineSet.problem, EXIT.refused);
     const warnings = [];
     if (modelGiven === null) {
         warnings.push(`no --model named: approvals bind exact routing, so scopes cannot file until ${phase} has an exact model — \`config set ${phase} --provider ${providerGiven} --model <model>\``);
@@ -5137,7 +5194,7 @@ async function configCommand(positional, flags, context) {
     if (providerGiven !== "claude") {
         warnings.push(`${providerGiven} does not report dollar cost: its runs land as UNMEASURED, and any schedule with a weekly limit fails closed on them by design.`);
     }
-    return succeed(write, json, "config set", { scope, phase, provider: providerGiven, model: modelGiven, warnings }, () => [
+    return said("config set", routineSet, { scope, phase, provider: providerGiven, model: modelGiven, warnings }, () => [
         `${phase} at ${scope === INSTALLATION_SCOPE ? "the installation" : scope} now runs ${providerGiven}${modelGiven === null ? "" : ` · ${modelGiven}`}, set by ${acting.name}.`,
         ...warnings.map(one => `  ! ${one}`),
     ]);
@@ -7055,6 +7112,8 @@ async function upCommand(flags, context) {
     // folders they may be added from are installation state, not arguments a
     // person must repeat on every start.
     const registryPath = registryPathOf(context);
+    // Read before the list itself: a line removed after this (even if saved again) counts differently from now on.
+    const removalsAtStart = registryRemovals(registryPath);
     const loadedRegistry = await loadProjectRegistry(registryPath);
     if ("error" in loadedRegistry)
         return fail(write, json, "up", "registry", loadedRegistry.error, EXIT.refused);
@@ -7078,23 +7137,28 @@ async function upCommand(flags, context) {
     // soon as a projects folder or saved repository exists.
     const repos = [];
     const proveRepo = async (input) => {
-        const top = await gitRun("git", ["rev-parse", "--show-toplevel"], { cwd: resolve(input) });
-        if (top.code !== 0)
-            return null;
-        try {
-            return realpathSync(top.stdout.trim());
-        }
-        catch {
-            return null;
-        }
+        // The checkout's real path is read off the thread, under a deadline (folder-look.ts): a folder that doesn't answer
+        // is unavailable, never a wait.
+        return (await upProveSaved(gitRun, input))?.root ?? null;
     };
+    // A saved project that doesn't answer now (a drive not connected, a folder macOS is holding) is looked at again
+    // while this start runs, and connects once it answers (upDeferredRetry).
+    const deferredRepos = [];
+    const deferredGenerations = {};
+    // The saved line(s) each project was proved from, so its removal is judged by its own line alone.
+    const repoLines = {};
     for (const input of loadedRegistry.repos) {
         const root = await proveRepo(input);
         if (root === null) {
-            progress(`saved project unavailable — skipped ${input}`);
+            progress(`saved project unavailable — skipped ${input}; it connects when it's back`);
+            deferredRepos.push(input);
+            // An unreadable removal record leaves no count that could match later: the authority can't be used.
+            deferredGenerations[input] = removalsAtStart === null ? -1 : removalsAtStart[input] ?? 0;
         }
-        else if (!repos.includes(root)) {
-            repos.push(root);
+        else {
+            if (!repos.includes(root))
+                repos.push(root);
+            (repoLines[root] ??= []).push(input);
         }
     }
     const explicitRepos = context.repoList ?? [];
@@ -7118,7 +7182,9 @@ async function upCommand(flags, context) {
         if (cwdRepo !== null)
             pinnedRepos.add(cwdRepo);
     }
-    if (repos.length === 0 && projectRoots.length === 0)
+    // Saved projects that are only away for now still start the service: it serves an empty, restrictive set until they
+    // answer (never the unscoped mode), and connects each as it comes back.
+    if (repos.length === 0 && projectRoots.length === 0 && deferredRepos.length === 0)
         return fail(write, json, "up", "no-projects", "choose where your projects live once: `toolroll up --project-root <dir>`", EXIT.refused);
     // A person at a terminal reads three lines (onboarding); the folders are for --verbose, a service log, or an agent.
     const quietStart = !json && !flags.has("verbose") && (context.upSeams?.terminal ?? process.stdout.isTTY === true) && !underAgent(context.upSeams?.env ?? process.env);
@@ -7376,6 +7442,9 @@ async function upCommand(flags, context) {
                 type: "start", role: "worker", databaseFile: context.databaseFile, containment: containmentFlag, build,
                 config: {
                     runner: runnerName, token: runnerToken, repos: generation === 1 ? [...repos] : [...currentRepos], pinnedRepos: [...pinnedRepos], projectRoots, registryPath, pool,
+                    // What this start still holds for its saved projects that were away: a restarted worker never gets back an
+                    // authority an earlier one gave up (connected, or removed from the saved list).
+                    deferredRepos: [...deferredRepos], deferredGenerations: { ...deferredGenerations }, repoLines,
                     forMs: forGiven === undefined ? null : Number(forGiven), publicUrl: publicUrlFlag ?? null, stopGraceMs, verbose: flags.has("verbose"),
                     terminal: context.upSeams?.terminal ?? process.stdout.isTTY === true,
                     // A restart waits out a crashed predecessor's lease (at most a minute), then recovers it: as a fresh `up` after a crash.
@@ -7385,6 +7454,12 @@ async function upCommand(flags, context) {
             onMessage: message => {
                 if (message.type === "log")
                     roleLine("worker")(message.line);
+                else if (message.type === "deferred") {
+                    // Only ever narrows: a worker's word can't give back an authority this start no longer holds.
+                    const narrowed = upNarrowDeferred(deferredRepos, message.repos);
+                    deferredRepos.length = 0;
+                    deferredRepos.push(...narrowed);
+                }
                 else if (message.type === "repos") {
                     // The console's admitted projects widen only to what the builder is bound to in the store (the worker binds
                     // through the authenticated door before it reports): a worker's word alone admits nothing.
@@ -7467,11 +7542,14 @@ async function upCommand(flags, context) {
                 pendingLinks.set(id, value => { clearTimeout(timer); resolveLink(value); });
                 consoleRole?.send({ type: "sign-in-link", id, account });
             });
-            const home = homedir();
-            const file = approverPlan2.passwordFile === null ? null : approverPlan2.passwordFile.startsWith(`${home}/`) ? `~${approverPlan2.passwordFile.slice(home.length)}` : approverPlan2.passwordFile;
+            // Every start says where the saved password is and the exact command that shows it, browser or not (Settings
+            // revamp S4, D2). Only the path is printed, never what the file holds: absolute (a relative --db names this
+            // directory), single-quoted (no ~ or $ expands), after `--` (a leading dash is never an option).
+            const saved = approverPlan2.passwordFile === null ? null : resolve(approverPlan2.passwordFile);
+            const showCommand = saved === null ? null : `cat -- '${saved.replaceAll("'", "'\\''")}'`;
             const signInWords = account === null
                 ? `sign in as one of ${approverPlan2.approvers.join(", ")}`
-                : file === null ? `sign in as ${account} with your password` : `sign in as ${account}: the password is in ${file}`;
+                : showCommand === null ? `sign in as ${account} with your password` : `sign in as ${account}`;
             write("");
             write(`Toolroll is on ${url}`);
             if (link !== null) {
@@ -7481,8 +7559,11 @@ async function upCommand(flags, context) {
             }
             else {
                 write(`${signInWords.charAt(0).toUpperCase()}${signInWords.slice(1)}.`);
-                write("Ctrl-C stops it.");
             }
+            if (showCommand !== null)
+                write(`Your password: run \`${showCommand}\``);
+            if (link === null)
+                write("Ctrl-C stops it.");
         }
     }
     // A bounded run (--for) counts from readiness, so a slow start never eats the window it asked for.
@@ -11718,7 +11799,7 @@ function upNeedsOneProcess(options) {
         options.flowEveryMs !== undefined || options.platform !== undefined || options.fenceAvailable !== undefined || options.flowFetch !== undefined ||
         options.integrationIo !== undefined || options.shouldStop !== undefined || options.leadSeams !== undefined || options.waitSleep !== undefined ||
         options.releaseIo !== undefined || options.installBin !== undefined || options.tempRoots !== undefined || options.filingSizer !== undefined ||
-        options.now !== undefined;
+        options.now !== undefined || options.folderLook !== undefined;
 }
 /** The entry a role child runs: the built sibling when installed, the TypeScript source through tsx in a checkout. */
 /**
@@ -12093,15 +12174,9 @@ async function runUpWorkerRole(context, config, port, build) {
     const pinnedRepos = new Set(config.pinnedRepos);
     const gitRun = context.gitRunner ?? ((file, args, opts) => run(file, [...args], { ...(opts?.cwd === undefined ? {} : { cwd: opts.cwd }), timeoutMs: 10_000 }));
     const proveRepo = async (input) => {
-        const top = await gitRun("git", ["rev-parse", "--show-toplevel"], { cwd: resolve(input) });
-        if (top.code !== 0)
-            return null;
-        try {
-            return realpathSync(top.stdout.trim());
-        }
-        catch {
-            return null;
-        }
+        // The checkout's real path is read off the thread, under a deadline (folder-look.ts): a folder that doesn't answer
+        // is unavailable, never a wait.
+        return (await upProveSaved(gitRun, input))?.root ?? null;
     };
     // The proved set this worker builds; `up` relays each change to the console.
     const activeRepos = new Set(config.repos);
@@ -12286,8 +12361,17 @@ async function runUpWorkerRole(context, config, port, build) {
             await pause(follower === null ? 2_000 : 5_000);
         }
     })();
-    const dynamicCeiling = resolveCeiling(config.repos, config.projectRoots).ceiling;
+    // The start's own projects and folders were resolved by `up`: taken as they are, never read again on this thread.
+    const dynamicCeiling = resolveCeiling(config.repos, config.projectRoots, path => resolve(path)).ceiling;
     const rejected = new Set();
+    // Saved lines' identities, resolved off the thread under a deadline (project-identity.ts): a line whose folder
+    // doesn't answer is skipped this pass, and never holds up the others.
+    const lineIdentities = projectIdentities();
+    /** The saved line(s) each active project came from: `up`'s proof for the start's own, the line admitted for later ones. */
+    const admittedLines = new Map(Object.entries(config.repoLines ?? {}));
+    const deferred = upDeferredRetry(config.deferredRepos ?? [], input => upProveSaved(gitRun, input));
+    const deferredGenerations = config.deferredGenerations ?? {};
+    const reportDeferred = () => port.send({ type: "deferred", repos: deferred.list() });
     const registrySupervisor = (async () => {
         const sleep = (ms) => new Promise(resolveSleep => setTimeout(resolveSleep, ms));
         while (!stopping) {
@@ -12297,11 +12381,19 @@ async function runUpWorkerRole(context, config, port, build) {
                 stop();
                 break;
             }
+            // A saved line removed while this start runs takes the start's authority for it with it, for good.
+            if (deferred.keepOnly(loaded.repos))
+                reportDeferred();
+            const plain = loaded.repos.filter(one => !deferred.has(one));
+            await lineIdentities.refresh(plain);
             // Removed from the saved list: stop building it and take it out of the console. A pinned start keeps its own.
-            const saved = new Set(loaded.repos.map(one => canonicalProject(one) ?? one));
+            // Each project is judged by its own saved line (the one it was proved or admitted from, or itself), never by
+            // whether some other folder answered: an unrelated folder that is away never keeps a removed project building.
+            const saved = new Set(loaded.repos);
             let removed = false;
             for (const repo of [...activeRepos]) {
-                if (stopping || pinnedRepos.has(repo) || saved.has(repo))
+                const lines = admittedLines.get(repo) ?? [repo];
+                if (stopping || pinnedRepos.has(repo) || saved.has(repo) || lines.some(line => saved.has(line)))
                     continue;
                 activeRepos.delete(repo);
                 removed = true;
@@ -12314,12 +12406,23 @@ async function runUpWorkerRole(context, config, port, build) {
             for (const candidate of loaded.repos) {
                 if (stopping)
                     break;
-                const canonical = canonicalProject(candidate);
+                // Skipped at start because it didn't answer: connected on the start's own authority once it does.
+                if (deferred.has(candidate)) {
+                    await connectDeferred(candidate);
+                    continue;
+                }
+                const canonical = lineIdentities.known(candidate);
+                // Not answered yet: looked at again on the next pass.
+                if (canonical === undefined)
+                    continue;
                 // Still letting go of an earlier removal: it rejoins on the next pass after its watch has stopped.
                 if (canonical !== null && (activeRepos.has(canonical) || releasedRepos.has(canonical)))
                     continue;
                 const approvedAdditions = context.additionalProjectRepos?.() ?? [];
-                const admittedCeiling = resolveCeiling([...dynamicCeiling.repos, ...approvedAdditions], dynamicCeiling.roots).ceiling;
+                // A start serving nothing yet (its saved projects all away) is an empty ceiling, never the unscoped mode: a
+                // name that matches no path stands in, so a line saved later still needs its recorded admission.
+                const admittedRepos = [...dynamicCeiling.repos, ...approvedAdditions];
+                const admittedCeiling = { repos: admittedRepos.length === 0 && dynamicCeiling.roots.length === 0 ? ["/\0nothing-admitted"] : admittedRepos, roots: dynamicCeiling.roots, canon: (path) => lineIdentities.known(path) ?? null };
                 // A project added after this start (`repos add`, the lead, the console) carries its recorded admission; a
                 // registry line alone is not authority. Either way the folder is proved to be that Git checkout again.
                 const allowed = canonical !== null &&
@@ -12333,6 +12436,7 @@ async function runUpWorkerRole(context, config, port, build) {
                     continue;
                 }
                 rejected.delete(candidate);
+                admittedLines.set(canonical, [...new Set([...admittedLines.get(canonical) ?? [], candidate])]);
                 await launchRepo(canonical, true);
             }
             if (!stopping)
@@ -12342,6 +12446,61 @@ async function runUpWorkerRole(context, config, port, build) {
         fatal = `the project registry stopped (${describe(error)})`;
         stop();
     });
+    /**
+     * A saved project the start couldn't reach, back now: connected only as the very folder that was saved (a parent
+     * checkout found because the saved one lost its .git is another project, needing its own admission), and only while
+     * the line is still saved, checked under the saved list's lock with the binding made inside it, so a removal racing
+     * the proof always wins.
+     */
+    async function connectDeferred(candidate) {
+        const proved = await deferred.retry(candidate);
+        if (proved === null || stopping)
+            return;
+        // Only the very folder that was saved: the saved line must still resolve to itself, and git's checkout must be that
+        // folder. A parent checkout, or the saved path now leading somewhere else, is another project needing admission.
+        if (proved.line !== candidate || proved.root !== candidate) {
+            deferred.revoke(candidate);
+            reportDeferred();
+            progress(proved.root !== proved.line
+                ? `saved project not connected — ${candidate} came back as part of ${proved.root}; add it again to connect it`
+                : `saved project not connected — ${candidate} now leads to ${proved.line}; add it again to connect it`);
+            return;
+        }
+        const root = candidate;
+        if (activeRepos.has(root) || releasedRepos.has(root)) {
+            deferred.revoke(candidate);
+            reportDeferred();
+            return;
+        }
+        // Bound under the saved list's lock: the line is still saved AND has not been removed since this start read it
+        // (its removal count unchanged, so a removal and a save again during the proof still counts as removed).
+        let launching = null;
+        let removedSince = false;
+        await updateProjectRegistry(registryPath, current => {
+            if (stopping || !deferred.has(candidate))
+                return current;
+            const count = registryRemovals(registryPath)?.[candidate] ?? (registryRemovals(registryPath) === null ? -2 : 0);
+            if (!current.repos.includes(candidate) || count !== deferredGenerations[candidate]) {
+                deferred.revoke(candidate);
+                removedSince = true;
+                return current;
+            }
+            deferred.revoke(candidate);
+            admittedLines.set(root, [candidate]);
+            launching = launchRepo(root, true);
+            return current;
+        });
+        if (removedSince) {
+            reportDeferred();
+            progress(`saved project not connected — ${candidate} was removed while it was away; add it again to connect it`);
+            return;
+        }
+        if (launching === null)
+            return;
+        reportDeferred();
+        progress(`saved project is back — connecting ${root}`);
+        await launching;
+    }
     // Provider readiness (v47): this machine's non-spending observations, recorded under its own runner name ONCE at
     // start — so every route projection can say ready / unavailable / unknown per provider, and the dispatch gate can
     // halt a leg this machine cannot run. Production only: a test's injected agent runner is a fake, and its readiness
@@ -12530,3 +12689,72 @@ async function evalsAbandonCommand(flags, context) {
         return fail(write, json, command, ended.reason, ended.message, EXIT.refused);
     return succeed(write, json, command, { campaign: id, state: "incomplete", attempts: ended.attempts, spending: "unknown" }, () => [`Campaign ${id} ended incomplete. ${ended.attempts} unfinished attempt${ended.attempts === 1 ? "" : "s"} recorded as errors; what it spent is unknown. Nothing was stopped: check for its processes yourself.`]);
 }
+/**
+ * The saved projects an `up` start couldn't reach (upCommand): each is proved again every `everyMs` while the worker
+ * runs, by `prove` (upProveSaved), so a folder that answers again connects without a restart. Only what the start itself
+ * read from the saved list is here, and the set only shrinks: a line connected, removed from the saved list
+ * (`keepOnly`) or come back as some other checkout (`revoke`) is gone for good, so a line saved again later needs its
+ * recorded admission like any other addition. `retry` answers the proof when one is due and answered, else null.
+ */
+export function upDeferredRetry(inputs, prove, everyMs = 5_000, now = Date.now) {
+    // Wall time, not the store's clock (a test's may stand still): this is only how often a folder is asked.
+    const nextAt = new Map(inputs.map(input => [input, now() + everyMs]));
+    return {
+        has: input => nextAt.has(input),
+        list: () => [...nextAt.keys()],
+        retry: async (input) => {
+            const due = nextAt.get(input);
+            if (due === undefined || now() < due)
+                return null;
+            nextAt.set(input, now() + everyMs);
+            return prove(input);
+        },
+        revoke: input => { nextAt.delete(input); },
+        keepOnly: saved => {
+            const keep = new Set(saved);
+            let changed = false;
+            for (const input of [...nextAt.keys()])
+                if (!keep.has(input)) {
+                    nextAt.delete(input);
+                    changed = true;
+                }
+            return changed;
+        },
+    };
+}
+/**
+ * Whether a saved project's folder is a Git checkout now, read without blocking this thread: `git rev-parse
+ * --show-toplevel` (bounded, its own process), then the real paths of the saved line and of the checkout, resolved off
+ * the thread under a deadline (folder-look.ts). Null when it isn't one, or didn't answer.
+ */
+export async function upProveSaved(gitRun, input, look = {}) {
+    const top = await gitRun("git", ["rev-parse", "--show-toplevel"], { cwd: resolve(input) });
+    if (top.code !== 0)
+        return null;
+    const answered = await lookIdentities([resolve(input), top.stdout.trim()], look);
+    if (!answered.ok)
+        return null;
+    const line = answered.value.get(resolve(input)) ?? null, root = answered.value.get(top.stdout.trim()) ?? null;
+    return line === null || root === null ? null : { line, root };
+}
+/** What `up` hands its next worker after the worker reports which saved projects it still holds start authority for:
+ * only what both still hold. A worker's report can give up an authority, never add or give back one. */
+export function upNarrowDeferred(held, reported) {
+    const kept = new Set(reported);
+    return held.filter(one => kept.has(one));
+}
+/** Resolve the console's project identities after it is listening, never before: the deploy's health check and every
+ * page answer at once, and each project shows up as its folder answers (project-identity.ts `refresh`, its looks a
+ * few at a time under their deadline). Nothing waits on it; a pass that fails leaves those paths unresolved, which
+ * fails closed, for the background pass to try again. */
+export function consoleIdentitiesInBackground(identities, paths) {
+    void identities.refresh(paths).catch(() => false);
+}
+/** `config set` and `config clear` on the command line, through Settings → Models' one write path (model-choices.ts,
+ * docs/plans/spend-dashboard.md slice 3), under the same target and resulting-configuration checks as the editor: the
+ * person proved themselves with their own password or login at `proved.generation`; a machine credential (a remote
+ * token, the lead's token) never changes which models run. The write re-proves them inside its transaction: still an
+ * unrestricted instance operator, at that very generation, by a proof that still stands. */
+export function writeModelRow(store, proved, scope, knownProject, slot, to, now, extra = []) {
+    return applyModelChoices(store, { scope, change: slot === null ? [] : [{ slot, to }], expected: null, strict: false, knownProject, extra }, { ...proved, live: () => true }, now);
+}

package/dist/project-admission.d.ts

@@ -21,7 +21,7 @@ export type AdmissionActor = {
 };
 export type AdmissionFailure = {
     ok: false;
-    reason: "unavailable" | "not-git" | "locked" | "registry" | "abandoned" | "failed";
+    reason: "unavailable" | "not-git" | "locked" | "registry" | "abandoned" | "failed" | "moved";
     message: string;
 };
 /** `remote`: the origin URL this add recorded as the project's trusted remote (null: none), and why one wasn't. */
@@ -60,6 +60,9 @@ export declare function admitProject(store: Store, input: {
     captureOrigin?: boolean;
     /** Explicit value from the owner/instance-operator CLI boundary. */
     remoteUrl?: string;
+    /** The caller's authority, asked again about the proved repo inside the locked registry update and inside the
+     * database transaction (the console: nothing it proved before an await moved, and the repo is still visible). */
+    stillAllowed?: (repo: string) => boolean;
 }): Promise<Admitted | AdmissionFailure>;
 /**
  * Remove one project from the lists and the builder. Its tasks, results and

package/dist/project-admission.js

@@ -61,13 +61,29 @@ export async function admitProject(store, input) {
         ? await originOf(repo, input.exec ?? run) : null;
     let remote = { url: store.projectRemote(repo), why: null };
     let registryHad = true;
+    const allowed = () => input.stillAllowed === undefined || input.stillAllowed(repo);
+    const moved = { ok: false, reason: "moved", message: `${projectName(repo)} wasn't added: a project folder changed while it was being checked. Try again.` };
     if (input.registryFile !== null) {
-        const enrolled = await updateRepos(input.registryFile, repos => addRepos(repos, [repo]));
+        let refused = false;
+        let had = false;
+        const enrolled = await updateRepos(input.registryFile, repos => {
+            had = repos.includes(repo);
+            if (!allowed()) {
+                refused = true;
+                return repos;
+            }
+            return addRepos(repos, [repo]);
+        });
         if (!enrolled.ok)
             return { ok: false, reason: enrolled.reason, message: `${projectName(repo)} wasn't added: ${enrolled.message}` };
-        registryHad = before !== null && !("error" in before) && before.repos.includes(repo);
+        if (refused)
+            return moved;
+        registryHad = had;
     }
     const added = store.transact(() => {
+        // Re-asked with the write; a refusal writes nothing here and takes back the registry line this call added below.
+        if (!allowed())
+            return null;
         const rowHad = store.listProjects().some(one => one.path === repo);
         const previous = store.projectRemote(repo);
         const first = !known && !store.projectAdmissionKnown(repo);
@@ -81,6 +97,11 @@ export async function admitProject(store, input) {
         store.recordAction({ at: input.now.toISOString(), actor: input.actor.label, repo, taskId: null, runId: null, action: PROJECT_ADDED, outcome: "added", source: "access", detail: `from ${input.actor.origin}` });
         return true;
     });
+    if (added === null) {
+        if (input.registryFile !== null && !registryHad)
+            await updateRepos(input.registryFile, repos => removeRepos(repos, [repo]));
+        return moved;
+    }
     return { ok: true, repo, name: projectName(repo), added, remote };
 }
 /**