toolroll 0.9.83 → 0.9.85

package/dist/project-admission.d.ts

@@ -21,7 +21,7 @@ export type AdmissionActor = {
 };
 export type AdmissionFailure = {
     ok: false;
-    reason: "unavailable" | "not-git" | "locked" | "registry" | "abandoned" | "failed";
+    reason: "unavailable" | "not-git" | "locked" | "registry" | "abandoned" | "failed" | "moved";
     message: string;
 };
 /** `remote`: the origin URL this add recorded as the project's trusted remote (null: none), and why one wasn't. */
@@ -60,6 +60,9 @@ export declare function admitProject(store: Store, input: {
     captureOrigin?: boolean;
     /** Explicit value from the owner/instance-operator CLI boundary. */
     remoteUrl?: string;
+    /** The caller's authority, asked again about the proved repo inside the locked registry update and inside the
+     * database transaction (the console: nothing it proved before an await moved, and the repo is still visible). */
+    stillAllowed?: (repo: string) => boolean;
 }): Promise<Admitted | AdmissionFailure>;
 /**
  * Remove one project from the lists and the builder. Its tasks, results and

package/dist/project-admission.js

@@ -61,13 +61,29 @@ export async function admitProject(store, input) {
         ? await originOf(repo, input.exec ?? run) : null;
     let remote = { url: store.projectRemote(repo), why: null };
     let registryHad = true;
+    const allowed = () => input.stillAllowed === undefined || input.stillAllowed(repo);
+    const moved = { ok: false, reason: "moved", message: `${projectName(repo)} wasn't added: a project folder changed while it was being checked. Try again.` };
     if (input.registryFile !== null) {
-        const enrolled = await updateRepos(input.registryFile, repos => addRepos(repos, [repo]));
+        let refused = false;
+        let had = false;
+        const enrolled = await updateRepos(input.registryFile, repos => {
+            had = repos.includes(repo);
+            if (!allowed()) {
+                refused = true;
+                return repos;
+            }
+            return addRepos(repos, [repo]);
+        });
         if (!enrolled.ok)
             return { ok: false, reason: enrolled.reason, message: `${projectName(repo)} wasn't added: ${enrolled.message}` };
-        registryHad = before !== null && !("error" in before) && before.repos.includes(repo);
+        if (refused)
+            return moved;
+        registryHad = had;
     }
     const added = store.transact(() => {
+        // Re-asked with the write; a refusal writes nothing here and takes back the registry line this call added below.
+        if (!allowed())
+            return null;
         const rowHad = store.listProjects().some(one => one.path === repo);
         const previous = store.projectRemote(repo);
         const first = !known && !store.projectAdmissionKnown(repo);
@@ -81,6 +97,11 @@ export async function admitProject(store, input) {
         store.recordAction({ at: input.now.toISOString(), actor: input.actor.label, repo, taskId: null, runId: null, action: PROJECT_ADDED, outcome: "added", source: "access", detail: `from ${input.actor.origin}` });
         return true;
     });
+    if (added === null) {
+        if (input.registryFile !== null && !registryHad)
+            await updateRepos(input.registryFile, repos => removeRepos(repos, [repo]));
+        return moved;
+    }
     return { ok: true, repo, name: projectName(repo), added, remote };
 }
 /**

package/dist/project-cli.d.ts

@@ -12,6 +12,7 @@ export declare function runProjectCommand(positional: readonly string[], flags:
     write: (line: string) => void;
     json: boolean;
     registryFile?: string;
+    now?: Date;
 }): Promise<number>;
 /** Only known credential-aware adapters consume the remembered reference.
  * Explicit credentials always win; no legacy action gains implicit authority. */

package/dist/project-cli.js

@@ -8,6 +8,7 @@ import { configPath, loadRepos } from './repos.js';
 import { authenticateCoordinator } from './coordinator.js';
 import { canonicalProject } from './project.js';
 import { envelopeJson } from './envelope.js';
+import { projectOutcomes } from './project-outcomes.js';
 export const projectProfilePath = (databaseFile) => join(dirname(databaseFile), 'cli-project.json');
 export function readProjectProfile(databaseFile) {
     const file = projectProfilePath(databaseFile);
@@ -25,11 +26,29 @@ export function readProjectProfile(databaseFile) {
         throw new Error('The saved CLI project is invalid. Select it again with project use.');
     return { version: 1, repo: p['repo'], tokenFile: p['tokenFile'] };
 }
+function scopedCredentialRefusal(store, tokenFile, repo) {
+    let token;
+    try {
+        const info = statSync(tokenFile);
+        if (!info.isFile() || info.size > 16_384)
+            return { reason: 'unauthenticated', message: 'The scoped credential file is unavailable.' };
+        token = readFileSync(tokenFile, 'utf8').trim();
+    }
+    catch {
+        return { reason: 'unauthenticated', message: 'The scoped credential file is unavailable.' };
+    }
+    const auth = authenticateCoordinator(store, token);
+    if (!auth.ok)
+        return { reason: 'unauthenticated', message: 'The scoped credential is invalid or revoked.' };
+    if (!auth.who.repos.includes(repo))
+        return { reason: 'not-found', message: 'That project is unavailable to this credential.' };
+    return null;
+}
 export async function runProjectCommand(positional, flags, context) {
     const action = positional[0] ?? 'show', command = `project ${action}`;
     const fail = (reason, message) => { context.write(context.json ? envelopeJson({ ok: false, command, reason, message }) : message); return reason === 'usage' ? 2 : 3; };
-    if (!['use', 'show'].includes(action) || positional.length > (action === 'use' ? 2 : 1))
-        return fail('usage', 'Use project use <saved checkout path> [--token-file PATH], or project show.');
+    if (!['use', 'show', 'activity'].includes(action) || positional.length > (action === 'use' ? 2 : 1))
+        return fail('usage', 'Use project use <saved checkout path> [--token-file PATH], project show, or project activity [--json].');
     const allowed = new Set(['db', 'json', ...(action === 'use' ? ['token-file'] : [])]);
     for (const name of flags.keys())
         if (!allowed.has(name))
@@ -57,23 +76,9 @@ export async function runProjectCommand(positional, flags, context) {
         if (credential !== undefined && (typeof credential !== 'string' || !credential || /[\x00-\x1f]/.test(credential)))
             return fail('usage', '--token-file requires a path.');
         const tokenFile = typeof credential === 'string' ? resolve(credential) : null;
-        if (tokenFile !== null) {
-            let token;
-            try {
-                const info = statSync(tokenFile);
-                if (!info.isFile() || info.size > 16_384)
-                    return fail('unauthenticated', 'The scoped credential file is unavailable.');
-                token = readFileSync(tokenFile, 'utf8').trim();
-            }
-            catch {
-                return fail('unauthenticated', 'The scoped credential file is unavailable.');
-            }
-            const auth = authenticateCoordinator(context.store, token);
-            if (!auth.ok)
-                return fail('unauthenticated', 'The scoped credential is invalid or revoked.');
-            if (!auth.who.repos.includes(repo))
-                return fail('not-found', 'That project is unavailable to this credential.');
-        }
+        const refused = tokenFile === null ? null : scopedCredentialRefusal(context.store, tokenFile, repo);
+        if (refused)
+            return fail(refused.reason, refused.message);
         profile = { version: 1, repo, tokenFile };
         const file = projectProfilePath(context.databaseFile), temp = `${file}.${randomBytes(6).toString('hex')}.tmp`;
         mkdirSync(dirname(file), { recursive: true });
@@ -82,6 +87,18 @@ export async function runProjectCommand(positional, flags, context) {
     }
     else
         profile = readProjectProfile(context.databaseFile);
+    if (action === 'activity') {
+        if (profile === null || !repos.includes(profile.repo))
+            return fail('not-found', 'Select a saved project with project use first.');
+        const refused = profile.tokenFile === null ? null : scopedCredentialRefusal(context.store, profile.tokenFile, profile.repo);
+        if (refused)
+            return fail(refused.reason, refused.message);
+        // Like assignment brief, an uncredentialed local database read has the
+        // local operator's access. A saved scoped credential is always re-proved.
+        const result = projectOutcomes(context.store, profile.repo, context.now ?? new Date(), { principal: 'operator', repos: [profile.repo] });
+        context.write(context.json ? envelopeJson({ ok: true, command, result }) : JSON.stringify(result, null, 2));
+        return 0;
+    }
     const result = { profile, saved: profile !== null && repos.includes(profile.repo) };
     context.write(context.json ? envelopeJson({ ok: true, command, result }) : profile === null ? 'No project selected. Use project use <saved checkout path>.' : `${profile.repo}${result.saved ? '' : ' (no longer saved)'}\n${profile.tokenFile === null ? 'Uses your existing local sign-in for operator actions.' : `Scoped credential reference: ${profile.tokenFile}`}`);
     return 0;

package/dist/project-identity.d.ts

@@ -2,7 +2,8 @@
  * Project identities as the console uses them, without touching a person's folders on its thread.
  *
  * A project's identity is its real path (project.ts canonicalProject). Resolving one reads the folder, and a folder can
- * stop answering (folder-look.ts), so the console never resolves one on a page or at startup on its own thread:
+ * stop answering (folder-look.ts), so the console never resolves one on a page or at startup on its own thread, and
+ * never waits for one before it answers:
  *
  * - `hot` (display and grouping only): the last answer, else the path as saved. Nothing is started by asking.
  * - `strict` (visibility and authorization): only a resolved identity; an unknown one fails closed until the next
@@ -10,7 +11,8 @@
  * - `vouched` (a path a request names): only a path whose identity is known, or one that is exactly a saved identity.
  *   Anything else is refused this time and resolved by the next background pass, never resolved inline.
  * - `resolveNow` (an action that needs a path checked now, a POST): resolved off the thread under the look's deadline.
- * - `refresh` (the console's start and its background pass): resolves what was asked about and what has gone stale.
+ * - `refresh` (the console's background pass, the first started right after it listens): resolves what was asked about
+ *   and what has gone stale. The console answers before any of it does; until a path answers it fails closed.
  *
  * An embedder or test that passes no identities gets `syncProjectIdentities`: the old synchronous reads, unchanged.
  */
@@ -31,7 +33,12 @@ export type ProjectIdentities = {
     resolveNow: (path: string) => Promise<string | null | "no-answer">;
     /** Resolve `paths`, everything asked about since, and answers older than a minute. False when some didn't answer. */
     refresh: (paths: Iterable<string>) => Promise<boolean>;
+    /** Moves whenever a known identity changes or goes: a decision made before an await is re-checked against it right
+     * before its write. */
+    generation: () => number;
 };
+/** How many folders a pass looks at side by side when they're looked at one by one (within FOLDER_LOOK_CHILDREN). */
+export declare const IDENTITY_LOOKS = 4;
 export declare function projectIdentities(look?: FolderLookOptions, now?: () => number): ProjectIdentities;
 /** The synchronous reads, as before: for embedders and tests that pass no identities. */
 export declare function syncProjectIdentities(): ProjectIdentities;

package/dist/project-identity.js

@@ -2,7 +2,8 @@
  * Project identities as the console uses them, without touching a person's folders on its thread.
  *
  * A project's identity is its real path (project.ts canonicalProject). Resolving one reads the folder, and a folder can
- * stop answering (folder-look.ts), so the console never resolves one on a page or at startup on its own thread:
+ * stop answering (folder-look.ts), so the console never resolves one on a page or at startup on its own thread, and
+ * never waits for one before it answers:
  *
  * - `hot` (display and grouping only): the last answer, else the path as saved. Nothing is started by asking.
  * - `strict` (visibility and authorization): only a resolved identity; an unknown one fails closed until the next
@@ -10,7 +11,8 @@
  * - `vouched` (a path a request names): only a path whose identity is known, or one that is exactly a saved identity.
  *   Anything else is refused this time and resolved by the next background pass, never resolved inline.
  * - `resolveNow` (an action that needs a path checked now, a POST): resolved off the thread under the look's deadline.
- * - `refresh` (the console's start and its background pass): resolves what was asked about and what has gone stale.
+ * - `refresh` (the console's background pass, the first started right after it listens): resolves what was asked about
+ *   and what has gone stale. The console answers before any of it does; until a path answers it fails closed.
  *
  * An embedder or test that passes no identities gets `syncProjectIdentities`: the old synchronous reads, unchanged.
  */
@@ -19,27 +21,86 @@ import { lookIdentities } from "./folder-look.js";
 import { canonicalProject } from "./project.js";
 /** How long an answer stands before the background pass resolves the path again. */
 const STALE_MS = 60_000;
+/** How many folders a pass looks at side by side when they're looked at one by one (within FOLDER_LOOK_CHILDREN). */
+export const IDENTITY_LOOKS = 4;
 export function projectIdentities(look = {}, now = Date.now) {
+    /** Each answer with when the look that answered it started (folder-look.ts `started`, kept across joined looks): an
+     * answer from a look started earlier never overwrites one from a look started later. */
     const answers = new Map();
     const wanted = new Set();
+    /** Paths whose last look didn't answer: looked at only on their own (joining a look still under way), never in a
+     * batch, so one folder that never answers holds one child, not one per differently made-up batch. */
+    const suspect = new Set();
+    let generation = 0;
     const known = (path) => answers.get(resolve(path))?.real;
-    const store = (found) => {
+    const put = (key, real, at, seq) => {
+        const before = answers.get(key);
+        // A known identity that changes (or goes) moves authority: anything decided on the old one is out of date.
+        if (before !== undefined && before.real !== real)
+            generation++;
+        answers.set(key, { real, at, seq });
+    };
+    const store = (found, seq) => {
         const at = now();
         for (const [path, real] of found) {
-            answers.set(resolve(path), { real, at });
-            wanted.delete(resolve(path));
+            const key = resolve(path);
+            // Superseded: a later lookup already answered for this path. Its real path's entry goes with it.
+            if ((answers.get(key)?.seq ?? -1) > seq)
+                continue;
+            put(key, real, at, seq);
+            wanted.delete(key);
             // A real path is its own identity.
-            if (real !== null)
-                answers.set(real, { real, at });
+            if (real !== null && (answers.get(real)?.seq ?? -1) <= seq)
+                put(real, real, at, seq);
         }
     };
     const resolveNow = async (path) => {
-        const looked = await lookIdentities([resolve(path)], look);
-        if (!looked.ok)
+        const key = resolve(path);
+        const looked = await lookIdentities([key], look);
+        if (!looked.ok) {
+            suspect.add(key);
             return "no-answer";
-        store(looked.value);
-        return looked.value.get(resolve(path)) ?? null;
+        }
+        suspect.delete(key);
+        // No start known: older than every answer, so it only fills what nothing answered yet.
+        store(looked.value, looked.started ?? 0);
+        return answers.get(key)?.real ?? null;
+    };
+    const refreshNow = async (paths) => {
+        const at = now();
+        const due = new Set(wanted);
+        for (const one of paths) {
+            const key = resolve(one);
+            const answer = answers.get(key);
+            if (answer === undefined || at - answer.at >= STALE_MS)
+                due.add(key);
+        }
+        for (const [key, answer] of answers)
+            if (at - answer.at >= STALE_MS)
+                due.add(key);
+        if (due.size === 0)
+            return true;
+        const alone = [...due].filter(one => suspect.has(one));
+        const batched = [...due].filter(one => !suspect.has(one));
+        if (batched.length > 0) {
+            const batch = await lookIdentities(batched, look);
+            if (batch.ok)
+                store(batch.value, batch.started ?? 0);
+            else
+                alone.push(...batched);
+        }
+        // One folder that doesn't answer mustn't hold the others: each on its own, a few at a time (inside the looks'
+        // child cap, leaving room for a person's actions), each under its deadline, each stored as soon as it answers.
+        let missed = false;
+        const worker = async () => {
+            for (let one = alone.shift(); one !== undefined; one = alone.shift())
+                if (await resolveNow(one) === "no-answer")
+                    missed = true;
+        };
+        await Promise.all(Array.from({ length: Math.min(IDENTITY_LOOKS, alone.length) }, worker));
+        return !missed;
     };
+    let passes = Promise.resolve();
     return {
         hot: path => {
             const key = resolve(path);
@@ -68,28 +129,13 @@ export function projectIdentities(look = {}, now = Date.now) {
             return undefined;
         },
         resolveNow,
-        refresh: async (paths) => {
-            const at = now();
-            const due = new Set(wanted);
-            for (const one of paths) {
-                const key = resolve(one);
-                const answer = answers.get(key);
-                if (answer === undefined || at - answer.at >= STALE_MS)
-                    due.add(key);
-            }
-            for (const [key, answer] of answers)
-                if (at - answer.at >= STALE_MS)
-                    due.add(key);
-            if (due.size === 0)
-                return true;
-            const batch = await lookIdentities([...due], look);
-            if (batch.ok) {
-                store(batch.value);
-                return true;
-            }
-            // One folder that doesn't answer mustn't hold the others: each on its own, in parallel (the looks are capped).
-            const each = await Promise.all([...due].map(one => resolveNow(one)));
-            return each.every(one => one !== "no-answer");
+        generation: () => generation,
+        refresh: paths => {
+            // One pass at a time: a pass asked for while another runs waits for it, then resolves only what is still due.
+            const asked = [...paths];
+            const pass = passes.then(() => refreshNow(asked));
+            passes = pass.then(() => undefined, () => undefined);
+            return pass;
         },
     };
 }
@@ -101,6 +147,7 @@ export function syncProjectIdentities() {
         strict: path => canonicalProject(path),
         vouched: path => canonicalProject(path) ?? undefined,
         resolveNow: async (path) => canonicalProject(path),
+        generation: () => 0,
         refresh: async () => true,
     };
 }

package/dist/project-knowledge.d.ts

@@ -22,18 +22,19 @@ export type KnowledgeView = ReturnType<typeof knowledgeView>;
 export declare function knowledgeVersion(store: Store, repo: string, actor: string, revision: number): Knowledge;
 /** Chat reads only an admitted project. Keep the full source in the project UI. */
 export declare function conversationKnowledge(store: Store, repo: string, actor: string, reference?: string, decision?: number): {
-    history?: never;
+    title?: never;
+    content?: never;
     revision: number;
     stale: boolean;
     notice: string;
     decision?: never;
-    title?: never;
-    content?: never;
+    history?: never;
     instructions?: never;
     references?: never;
     decisions?: never;
 } | {
-    history?: never;
+    title?: never;
+    content?: never;
     stale?: never;
     decision: {
         repo: string;
@@ -50,28 +51,27 @@ export declare function conversationKnowledge(store: Store, repo: string, actor:
         id: number;
     };
     notice: string;
-    title?: never;
-    content?: never;
     revision?: never;
+    history?: never;
     instructions?: never;
     references?: never;
     decisions?: never;
 } | {
-    history?: never;
     stale?: never;
     decision?: never;
     revision: number;
     title: string;
     content: string;
     notice: string;
+    history?: never;
     instructions?: never;
     references?: never;
     decisions?: never;
 } | {
-    stale?: never;
-    decision?: never;
     title?: never;
     content?: never;
+    stale?: never;
+    decision?: never;
     revision: number;
     history: {
         revision: number;

package/dist/project-outcomes.d.ts

@@ -0,0 +1,119 @@
+import type { Store } from './store.js';
+import type { WorkSummaryAccess } from './work-summary.js';
+export declare const ACTIVITY_DAYS = 60;
+export declare const ACTIVITY_LIMIT = 500;
+export type CompletionActor = 'human' | 'lead' | 'landed' | 'machine-or-unknown';
+export type ActivityFamily = {
+    root: string;
+    task: string;
+    title: string;
+    run: number | null;
+    href: string;
+    state: 'ready' | 'completed' | 'history-unavailable';
+    kind: string;
+    finishedAt: string | null;
+    completedAt: string | null;
+    actor: CompletionActor | null;
+    checks: string;
+    revisions: number | null;
+    elapsedMs: number | null;
+    runs: number;
+    /** Runs whose amount is known (reported-usage.ts runAmountOf): API dollars or subscription usage. */
+    knownCostRuns: number;
+    subscriptionRuns: number;
+    /** API dollars only; subscription usage is never added to them. */
+    recordedUsd: number | null;
+    subscriptionReportedUsd: number | null;
+    /** Every attempt billed in known API dollars; otherwise the family's dollar total is unknown. */
+    totalUsd: number | null;
+};
+export type ProjectOutcomes = {
+    asOf: string;
+    since: string;
+    days: number;
+    limit: number;
+    truncated: boolean;
+    ready: {
+        count: number;
+        oldestFinishedAgeMs: number | null;
+        dated: number;
+    };
+    completed: {
+        count: number;
+        actors: Record<CompletionActor, number>;
+        scouts: number;
+        failedChecks: number;
+    };
+    finishedToDecision: {
+        meanMs: number | null;
+        samples: number;
+    };
+    revisions: {
+        count: number;
+        perCompletedFamily: number | null;
+        samples: number;
+    };
+    cost: {
+        recordedUsd: number | null;
+        recordedPerCompletedFamilyUsd: number | null;
+        runs: number;
+        knownRuns: number;
+        subscriptionRuns: number;
+        subscriptionReportedUsd: number | null;
+        fullyCostedFamilies: number;
+        families: number;
+    };
+    incompleteHistory: number;
+    families: ActivityFamily[];
+};
+/** Callers supply their current authenticated ceiling. A path alone grants no access. */
+export declare function projectOutcomes(store: Store, project: string, now: Date, access: WorkSummaryAccess): ProjectOutcomes;
+/** The lead's page of one report: every aggregate unchanged, family rows in pages bounded by count AND by their
+ * serialized size, so the reply always fits the tool-result cap (lead.ts, converse.ts LEAD_TOOL_RESULT_CAP_BYTES) and
+ * the lead reads further with nextOffset. Long ids and titles are shortened; an over-long link is left out. */
+export declare const ACTIVITY_LEAD_PAGE = 10;
+export declare const ACTIVITY_LEAD_PAGE_BYTES = 12000;
+export declare function projectOutcomesPage(report: ProjectOutcomes, offset?: number): {
+    asOf: string;
+    since: string;
+    days: number;
+    limit: number;
+    truncated: boolean;
+    ready: {
+        count: number;
+        oldestFinishedAgeMs: number | null;
+        dated: number;
+    };
+    completed: {
+        count: number;
+        actors: Record<CompletionActor, number>;
+        scouts: number;
+        failedChecks: number;
+    };
+    finishedToDecision: {
+        meanMs: number | null;
+        samples: number;
+    };
+    revisions: {
+        count: number;
+        perCompletedFamily: number | null;
+        samples: number;
+    };
+    cost: {
+        recordedUsd: number | null;
+        recordedPerCompletedFamilyUsd: number | null;
+        runs: number;
+        knownRuns: number;
+        subscriptionRuns: number;
+        subscriptionReportedUsd: number | null;
+        fullyCostedFamilies: number;
+        families: number;
+    };
+    incompleteHistory: number;
+    families: (Omit<ActivityFamily, "href"> & {
+        href: string | null;
+    })[];
+    familiesTotal: number;
+    familiesOffset: number;
+    nextOffset: number | null;
+};

package/dist/project-outcomes.js

@@ -0,0 +1,79 @@
+/** Read-only Activity. A completion is a saved decision, never a claim of
+ * passing checks, deployment, review labor, or improved productivity. */
+import { chatResultHref } from './chat-controls.js';
+import { workOutcomeRows } from './work-index.js';
+import { COMPLETION_BY_PERSON, LANDED_ACTOR } from './result-completion.js';
+export const ACTIVITY_DAYS = 60;
+export const ACTIVITY_LIMIT = 500;
+const text = (value) => value == null ? null : String(value);
+const duration = (from, to) => {
+    const delta = from === null ? NaN : Date.parse(to) - Date.parse(from);
+    return Number.isFinite(delta) && delta >= 0 ? delta : null;
+};
+const actorOf = (actor, detail, byLead) => actor === LANDED_ACTOR ? 'landed'
+    : byLead || actor?.startsWith('lead:') ? 'lead'
+        : actor?.startsWith('operator:') && detail === COMPLETION_BY_PERSON ? 'human' : 'machine-or-unknown';
+/** Callers supply their current authenticated ceiling. A path alone grants no access. */
+export function projectOutcomes(store, project, now, access) {
+    if (access.repos !== null && !access.repos.includes(project))
+        throw new Error('Project activity is outside your access.');
+    const asOf = now.toISOString(), since = new Date(now.getTime() - ACTIVITY_DAYS * 86400000).toISOString();
+    const rows = workOutcomeRows(store, now, access, project, since, ACTIVITY_LIMIT);
+    const families = rows.slice(0, ACTIVITY_LIMIT).map(row => {
+        const state = row['code'] === 'complete' ? 'completed' : row['code'] === 'ready-to-check' ? 'ready' : 'history-unavailable';
+        const finishedAt = text(row['finished_at']), completedAt = text(row['checked_at']);
+        const runs = Number(row['runs']), apiRuns = Number(row['api_runs']), subscriptionRuns = Number(row['subscription_runs']);
+        const recordedUsd = apiRuns > 0 && Number.isFinite(Number(row['api_microusd'])) ? Number(row['api_microusd']) / 1_000_000 : null;
+        const subscriptionReportedUsd = row['subscription_usd'] != null && Number.isFinite(Number(row['subscription_usd'])) ? Number(row['subscription_usd']) : null;
+        const knownCostRuns = apiRuns + subscriptionRuns;
+        const task = String(row['task_id']);
+        return { root: String(row['root_id']), task, title: String(row['title']), run: row['result_id'] == null ? null : Number(row['result_id']),
+            href: row['result_id'] == null ? `/t/${encodeURIComponent(task)}` : chatResultHref(task, Number(row['result_id'])), state, kind: text(row['result_role']) ?? 'unknown',
+            finishedAt, completedAt, actor: state === 'completed' ? actorOf(text(row['checked_actor']), text(row['checked_detail']), Number(row['completed_by_lead']) === 1) : null,
+            checks: text(row['check_status']) ?? 'not-recorded', revisions: state === 'history-unavailable' ? null : Number(row['version_count']) - 1,
+            elapsedMs: duration(finishedAt, completedAt ?? asOf), runs, knownCostRuns, subscriptionRuns, recordedUsd, subscriptionReportedUsd,
+            totalUsd: runs > 0 && runs === apiRuns ? recordedUsd : null };
+    });
+    const ready = families.filter(one => one.state === 'ready'), completed = families.filter(one => one.state === 'completed');
+    const times = completed.flatMap(one => one.elapsedMs === null ? [] : [one.elapsedMs]);
+    const ages = ready.flatMap(one => one.elapsedMs === null ? [] : [one.elapsedMs]);
+    const actors = { human: 0, lead: 0, landed: 0, 'machine-or-unknown': 0 };
+    for (const one of completed)
+        actors[one.actor]++;
+    const knownRuns = completed.reduce((sum, one) => sum + one.knownCostRuns, 0);
+    const recordedUsd = completed.some(one => one.recordedUsd !== null) ? completed.reduce((sum, one) => sum + (one.recordedUsd ?? 0), 0) : null;
+    const subscriptionRuns = completed.reduce((sum, one) => sum + one.subscriptionRuns, 0);
+    const subscriptionReportedUsd = completed.some(one => one.subscriptionReportedUsd !== null) ? completed.reduce((sum, one) => sum + (one.subscriptionReportedUsd ?? 0), 0) : null;
+    const revisions = completed.reduce((sum, one) => sum + (one.revisions ?? 0), 0);
+    return { asOf, since, days: ACTIVITY_DAYS, limit: ACTIVITY_LIMIT, truncated: rows.length > ACTIVITY_LIMIT,
+        ready: { count: ready.length, oldestFinishedAgeMs: ages.length ? Math.max(...ages) : null, dated: ages.length },
+        completed: { count: completed.length, actors, scouts: completed.filter(one => one.kind === 'scout').length, failedChecks: completed.filter(one => one.checks === 'failed').length },
+        finishedToDecision: { meanMs: times.length ? times.reduce((a, b) => a + b, 0) / times.length : null, samples: times.length },
+        revisions: { count: revisions, perCompletedFamily: completed.length ? revisions / completed.length : null, samples: completed.length },
+        cost: { recordedUsd, recordedPerCompletedFamilyUsd: completed.length && recordedUsd !== null ? recordedUsd / completed.length : null,
+            runs: completed.reduce((sum, one) => sum + one.runs, 0), knownRuns, subscriptionRuns, subscriptionReportedUsd, fullyCostedFamilies: completed.filter(one => one.totalUsd !== null).length, families: completed.length },
+        incompleteHistory: families.filter(one => one.state === 'history-unavailable').length, families };
+}
+/** The lead's page of one report: every aggregate unchanged, family rows in pages bounded by count AND by their
+ * serialized size, so the reply always fits the tool-result cap (lead.ts, converse.ts LEAD_TOOL_RESULT_CAP_BYTES) and
+ * the lead reads further with nextOffset. Long ids and titles are shortened; an over-long link is left out. */
+export const ACTIVITY_LEAD_PAGE = 10;
+export const ACTIVITY_LEAD_PAGE_BYTES = 12_000;
+const shorten = (value, max) => [...value].length > max ? `${[...value].slice(0, max - 1).join('')}…` : value;
+const embeddedBytes = (value) => Buffer.byteLength(JSON.stringify(JSON.stringify(value)), 'utf8');
+export function projectOutcomesPage(report, offset = 0) {
+    const start = Math.max(0, Math.min(Number.isSafeInteger(offset) ? offset : 0, report.families.length));
+    const page = [];
+    const base = { ...report, families: page, familiesTotal: report.families.length, familiesOffset: start, nextOffset: null };
+    for (const one of report.families.slice(start, start + ACTIVITY_LEAD_PAGE)) {
+        const row = { ...one, root: shorten(one.root, 200), task: shorten(one.task, 200), title: shorten(one.title, 80), href: Buffer.byteLength(one.href) > 512 ? null : one.href };
+        page.push(row);
+        if (page.length > 1 && embeddedBytes(base) > ACTIVITY_LEAD_PAGE_BYTES) {
+            page.pop();
+            break;
+        }
+    }
+    const next = start + page.length;
+    base.nextOffset = next < report.families.length ? next : null;
+    return base;
+}

package/dist/result-actions.d.ts

@@ -1,4 +1,5 @@
 import type { Store } from "./store.js";
+import { type FeedbackImage } from "./result-review.js";
 export type RevisionResult = {
     ok: true;
     id: string;
@@ -8,6 +9,8 @@ export type RevisionResult = {
     message: string;
 };
 type RevisionInput = Parameters<typeof createResultRevision>[2];
+/** Re-prove image custody and current result at each write. No file paths supplied by callers. */
+export declare function feedbackImageProblem(store: Store, root: string, runId: number, image: FeedbackImage | null | undefined): string | null;
 /** One user action: add the typed change and seal exactly the displayed
  * saved notes. A refusal rolls back the note; a replay returns the same task. */
 export declare function requestResultChanges(store: Store, evidenceRoot: string, input: RevisionInput & {
@@ -15,6 +18,7 @@ export declare function requestResultChanges(store: Store, evidenceRoot: string,
     path: string;
     line: string;
     request: string | null;
+    image?: FeedbackImage | null;
 }, now: Date): RevisionResult;
 export declare function createResultRevision(store: Store, evidenceRoot: string, input: {
     run: number;