toolroll 0.9.91 → 0.9.92

package/dist/store.js

@@ -35,6 +35,7 @@ import { actorLabel, currentActor } from "./actor.js";
 import { scanForSecrets } from "./evidence.js";
 import { LIVE_ACTIVITY_KINDS } from "./live.js";
 import { hashSecret, mintLeadToken, parseCredential, secretMatches, tokenPurpose, tokenRotationProblem } from "./api-tokens.js";
+import { admitTrialRun, bumpModelsGeneration, forgetProjectRoutes, liveEarnedRules, liveTrialFor, noteExposureCancelled, noteExposureFiled, noteExposureSealed, releaseTrialPlaces, reserveTrialPlace, ruleHoldOf, settleTrialPlaces, trialSealProblem, writeRunCohort } from "./route-store.js";
 /**
  * The database: a small task store, and the operational overlay beside it.
  *
@@ -1110,7 +1111,10 @@ const REGISTERED_AT_FILING = "again, as it was filed";
 // read 1), a browser session's authority (web_session.authority; saved rows read 'full'), its local generation, key
 // epoch and key hash (saved rows read NULL: no local binding, and a stale key), and the running console's key epoch
 // (console_instance.key_epoch; NULL). V147_ADDED_COLUMNS.
-export const SCHEMA_VERSION = 147;
+// v148 adds, and changes no saved row (docs/plans/results-routing.md): the results-routing tables (V148_SCHEMA, new
+// tables only) and a run's execution class, a revision's origin and a project's "Suggest cheaper models" switch
+// (V148_ADDED_COLUMNS: saved rows read NULL, NULL and 1).
+export const SCHEMA_VERSION = 148;
 /** v118: the tables merged into `credential`, in the order they move (a person's API tokens keep their ids first). */
 export const V118_MERGED_TABLES = Object.freeze({ api_token: "person", coordinator_credential: "coordinator", lead_credential: "lead" });
 /** The foreign keys that named a merged table, exactly as their DDL wrote them; each names `credential(id)` instead. */
@@ -1243,7 +1247,7 @@ const V115_DROPPED_REFERENCES = /\s+REFERENCES (?:contestant|contest|tournament_
  * unchanged), and adds the nullable column in V125_ADDED_COLUMNS, checked the same way. v126 only adds a new table
  * (task_source) and the columns in V126_ADDED_COLUMNS (null or 0), checked the same way.
  */
-export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147]);
+export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148]);
 /** v119: the columns it adds, by table, with the value every row saved before it reads (toolroll-update's HISTORY_RULES). */
 export const V119_ADDED_COLUMNS = Object.freeze({
     task_ref: { planning_generation: { definition: "INTEGER NOT NULL DEFAULT 0", saved: "0" } },
@@ -1498,6 +1502,154 @@ export const V147_ADDED_COLUMNS = Object.freeze({
 });
 /** The v147 migration's steps after the epoch, in order: a test seam (OpenOptions.migrationStep) may stop after each. */
 export const V147_STEPS = Object.freeze(["epoch", "local-mode", "password-set", "web-session", "console-instance"]);
+/**
+ * v148 (docs/plans/results-routing.md): every table the results-routing arc uses, landed at once because a current
+ * store runs no DDL. Slice 1 writes run_cohort, route_record and models_generation; route_rule, route_exposure* and
+ * route_trial_reservation are written from later slices. src/route-store.ts is the only writer of all of them (the
+ * migration aside), which release-auto.ts's routing scan (route-hooks.ts) holds a release to.
+ *
+ * - run_cohort: one row per code-writing run (builder, repair), written in the run's admission transaction beside its
+ *   route stamp and never updated: the sealed facts its eligibility was decided from. cohort_size NULL = not eligible,
+ *   with the reason in `ineligible`.
+ * - route_record: a task family's result record (keyed by its root task_ref), recomputed by the reconcile pass.
+ *   `settled` = its verdict (state, reason, result, acceptance, decision time) is final; its spending and counts keep
+ *   accumulating through later revision and repair runs until `closed` (the family is quiet, or 90 days after its
+ *   first run: route-results.ts ACCUMULATE_FOR_MS).
+ * - route_rule: an earned rule or a trial, with its sealed grant, price snapshot and the configuration generations it
+ *   depends on; one live winner per project and size (route_rule_one_winner).
+ * - route_exposure / route_exposure_event: one exposure per task and rule, its events append-only.
+ * - route_trial_reservation: a trial's place, reserved, then consumed (once, at admission) or released.
+ * - models_generation: a counter per (scope, phase), moved by every Models row writer in the same transaction.
+ */
+export const V148_SCHEMA = `
+CREATE TABLE IF NOT EXISTS run_cohort (
+  run              INTEGER PRIMARY KEY REFERENCES run(id) ON DELETE CASCADE,
+  task_ref         INTEGER NOT NULL REFERENCES task_ref(id) ON DELETE CASCADE,
+  root_ref         INTEGER NOT NULL REFERENCES task_ref(id) ON DELETE CASCADE,
+  repo             TEXT,
+  role             TEXT NOT NULL CHECK (role IN ('builder','repair')),
+  size             TEXT CHECK (size IS NULL OR size IN ('small','medium','large')),
+  risky            INTEGER CHECK (risky IS NULL OR risky IN (0,1)),
+  quality_mode     TEXT NOT NULL CHECK (quality_mode IN ('default','strict')),
+  evidence_demands INTEGER NOT NULL CHECK (evidence_demands IN (0,1)),
+  publication      TEXT NOT NULL CHECK (publication IN ('none','notify','automerge')),
+  release          INTEGER NOT NULL CHECK (release IN (0,1)),
+  protected        INTEGER NOT NULL CHECK (protected IN (0,1)),
+  selection_json   TEXT NOT NULL,
+  route_digest     TEXT NOT NULL,
+  provider         TEXT NOT NULL,
+  model            TEXT,
+  cohort_size      TEXT CHECK (cohort_size IS NULL OR cohort_size IN ('small','medium')),
+  ineligible       TEXT,
+  started_at       TEXT NOT NULL,
+  CHECK ((cohort_size IS NULL) = (ineligible IS NOT NULL))
+);
+CREATE INDEX IF NOT EXISTS run_cohort_by_task ON run_cohort (task_ref);
+CREATE INDEX IF NOT EXISTS run_cohort_by_root ON run_cohort (repo, root_ref);
+CREATE TABLE IF NOT EXISTS route_record (
+  task_ref            INTEGER PRIMARY KEY REFERENCES task_ref(id) ON DELETE CASCADE,
+  repo                TEXT,
+  cohort_size         TEXT CHECK (cohort_size IS NULL OR cohort_size IN ('small','medium')),
+  provider            TEXT,
+  model               TEXT,
+  state               TEXT NOT NULL CHECK (state IN ('pending','provisional','mature','rejected','not-counted')),
+  reason              TEXT,
+  result_run          INTEGER REFERENCES run(id) ON DELETE SET NULL,
+  first_started_at    TEXT,
+  accepted_at         TEXT,
+  decided_at          TEXT,
+  model_failures      INTEGER NOT NULL DEFAULT 0 CHECK (model_failures >= 0),
+  infra_failures      INTEGER NOT NULL DEFAULT 0 CHECK (infra_failures >= 0),
+  api_microusd        INTEGER NOT NULL DEFAULT 0 CHECK (api_microusd >= 0),
+  subscription_runs   INTEGER NOT NULL DEFAULT 0 CHECK (subscription_runs >= 0),
+  subscription_tokens INTEGER NOT NULL DEFAULT 0 CHECK (subscription_tokens >= 0),
+  unknown_runs        INTEGER NOT NULL DEFAULT 0 CHECK (unknown_runs >= 0),
+  remediation_runs    INTEGER NOT NULL DEFAULT 0 CHECK (remediation_runs >= 0),
+  person_revisions    INTEGER NOT NULL DEFAULT 0 CHECK (person_revisions >= 0),
+  first_check_passed  INTEGER CHECK (first_check_passed IS NULL OR first_check_passed IN (0,1)),
+  agent_turns         INTEGER NOT NULL DEFAULT 0 CHECK (agent_turns >= 0),
+  turns_unknown_runs  INTEGER NOT NULL DEFAULT 0 CHECK (turns_unknown_runs >= 0),
+  provenance_json     TEXT NOT NULL DEFAULT '[]',
+  settled             INTEGER NOT NULL DEFAULT 0 CHECK (settled IN (0,1)),
+  closed              INTEGER NOT NULL DEFAULT 0 CHECK (closed IN (0,1)),
+  evaluated_at        TEXT NOT NULL,
+  CHECK ((state IN ('rejected','not-counted')) = (reason IS NOT NULL)),
+  CHECK (closed = 0 OR settled = 1)
+);
+CREATE INDEX IF NOT EXISTS route_record_by_cohort ON route_record (repo, cohort_size, state, first_started_at);
+CREATE INDEX IF NOT EXISTS route_record_open ON route_record (evaluated_at) WHERE closed = 0;
+CREATE TABLE IF NOT EXISTS route_rule (
+  id                  INTEGER PRIMARY KEY AUTOINCREMENT,
+  repo                TEXT NOT NULL,
+  cohort_size         TEXT NOT NULL CHECK (cohort_size IN ('small','medium')),
+  kind                TEXT NOT NULL CHECK (kind IN ('rule','trial')),
+  provider            TEXT NOT NULL,
+  model               TEXT NOT NULL,
+  configured_provider TEXT NOT NULL,
+  configured_model    TEXT,
+  state               TEXT NOT NULL CHECK (state IN ('active','trialling','paused','switched-off','turned-off','expired','dropped','finished')),
+  generation          INTEGER NOT NULL DEFAULT 1 CHECK (generation >= 1),
+  grant_json          TEXT NOT NULL,
+  prices_json         TEXT NOT NULL,
+  depends_json        TEXT NOT NULL,
+  trial_limit         INTEGER CHECK (trial_limit IS NULL OR trial_limit >= 1),
+  accepted_by         TEXT NOT NULL,
+  accepted_at         TEXT NOT NULL,
+  ended_at            TEXT,
+  ended_by            TEXT,
+  end_reason          TEXT,
+  CHECK ((kind = 'trial') = (trial_limit IS NOT NULL))
+);
+CREATE UNIQUE INDEX IF NOT EXISTS route_rule_one_winner ON route_rule (repo, cohort_size) WHERE state IN ('active','trialling','paused');
+CREATE TABLE IF NOT EXISTS route_exposure (
+  id         INTEGER PRIMARY KEY AUTOINCREMENT,
+  task_ref   INTEGER NOT NULL REFERENCES task_ref(id) ON DELETE CASCADE,
+  rule       INTEGER NOT NULL REFERENCES route_rule(id) ON DELETE CASCADE,
+  created_at TEXT NOT NULL,
+  closed_at  TEXT,
+  UNIQUE (task_ref, rule)
+);
+CREATE TABLE IF NOT EXISTS route_exposure_event (
+  id       INTEGER PRIMARY KEY AUTOINCREMENT,
+  exposure INTEGER NOT NULL REFERENCES route_exposure(id) ON DELETE CASCADE,
+  kind     TEXT NOT NULL CHECK (kind IN ('proposed','refiled','approved-as-proposed','approved-with-other','cancelled')),
+  model    TEXT,
+  at       TEXT NOT NULL,
+  CHECK ((kind = 'approved-with-other') = (model IS NOT NULL))
+);
+CREATE INDEX IF NOT EXISTS route_exposure_event_by_exposure ON route_exposure_event (exposure, id);
+CREATE TABLE IF NOT EXISTS route_trial_reservation (
+  id           INTEGER PRIMARY KEY AUTOINCREMENT,
+  rule         INTEGER NOT NULL REFERENCES route_rule(id) ON DELETE CASCADE,
+  task_ref     INTEGER NOT NULL REFERENCES task_ref(id) ON DELETE CASCADE,
+  scope_digest TEXT NOT NULL,
+  state        TEXT NOT NULL CHECK (state IN ('reserved','consumed','released')),
+  consumed_run INTEGER REFERENCES run(id) ON DELETE SET NULL,
+  created_at   TEXT NOT NULL,
+  updated_at   TEXT NOT NULL,
+  UNIQUE (rule, task_ref),
+  CHECK (state = 'consumed' OR consumed_run IS NULL)
+);
+CREATE TABLE IF NOT EXISTS models_generation (
+  scope      TEXT NOT NULL,
+  phase      TEXT NOT NULL,
+  generation INTEGER NOT NULL CHECK (generation >= 1),
+  changed_at TEXT NOT NULL,
+  PRIMARY KEY (scope, phase)
+);
+`;
+/** The tables V148_SCHEMA adds, in the order a test drops them to make the v147 shape. */
+export const V148_TABLES = Object.freeze(["route_trial_reservation", "route_exposure_event", "route_exposure", "route_rule", "route_record", "run_cohort", "models_generation"]);
+/** v148: a run's execution class (saved runs read NULL: none kept, which the records count as the model's), a
+ * revision's origin (saved revisions read NULL: not recorded, never a person), and a project's "Suggest cheaper models"
+ * switch (saved projects read 1: on). */
+export const V148_ADDED_COLUMNS = Object.freeze({
+    run: { exec_class: { definition: "TEXT CHECK (exec_class IS NULL OR exec_class IN ('model','infrastructure'))", saved: "NULL" } },
+    task_ref: { revision_origin: { definition: "TEXT CHECK (revision_origin IS NULL OR revision_origin IN ('person','automatic-review','flow','lead','machine'))", saved: "NULL" } },
+    project: { suggest_models: { definition: "INTEGER NOT NULL DEFAULT 1 CHECK (suggest_models IN (0,1))", saved: "1" } },
+});
+/** The v148 migration's steps after v147's, in order (OpenOptions.migrationStep may stop after each). */
+export const V148_STEPS = Object.freeze(["results-tables", "exec-class", "revision-origin", "suggest-models"]);
 /**
  * v135: one approval per release (docs/plans/release-once.md). `release_authority` is the single source of truth for a
  * release a person approved: one row per generation, changed only by compare-and-swap on `rev`, with a lease whose
@@ -4776,6 +4928,19 @@ CREATE INDEX IF NOT EXISTS run_checkpoint_by_task ON run_checkpoint (task_ref, i
     for (const [column, { definition }] of Object.entries(V147_ADDED_COLUMNS["console_instance"]))
         addColumn(db, "console_instance", column, definition);
     step("console-instance");
+    // v148: the results-routing tables (new tables only) and the execution class, revision origin and suggestion switch
+    // (V148_ADDED_COLUMNS: saved rows read their declared values). Each step is idempotent, as v147's are.
+    db.exec(V148_SCHEMA);
+    step("results-tables");
+    for (const [column, { definition }] of Object.entries(V148_ADDED_COLUMNS["run"]))
+        addColumn(db, "run", column, definition);
+    step("exec-class");
+    for (const [column, { definition }] of Object.entries(V148_ADDED_COLUMNS["task_ref"]))
+        addColumn(db, "task_ref", column, definition);
+    step("revision-origin");
+    for (const [column, { definition }] of Object.entries(V148_ADDED_COLUMNS["project"]))
+        addColumn(db, "project", column, definition);
+    step("suggest-models");
     // Keep the epoch until reclamation succeeds, including a retry after compaction already committed. A new file has
     // nothing to reclaim.
     if (!fresh)
@@ -6166,6 +6331,12 @@ export class Store {
         }
         if (ref !== undefined && prior?.["state"] !== "cancelled")
             this.noteTaskAct(Number(ref["id"]), "cancelled", now);
+        // Results routing: a cancel closes the task's open exposure to an earned rule.
+        if (ref !== undefined)
+            noteExposureCancelled(this, Number(ref["id"]), now);
+        // …and gives up any trial place it holds unconsumed (a consumed place is never released).
+        if (ref !== undefined)
+            releaseTrialPlaces(this, Number(ref["id"]), now);
         // A cancelled task's pending steering settles superseded in the SAME
         // transaction, whichever road cancelled it — a note silently waiting
         // for a build that can no longer happen is wrong on every road, not
@@ -7293,6 +7464,9 @@ export class Store {
                     const problems = routeProblems(route);
                     if (problems.length > 0)
                         unresolvedReason = problems.join("; ");
+                    // A trial's place is one task's (results routing slice 3): a frozen route never carries one to another.
+                    else if (legOf(route, "build").selection?.kind === "trial")
+                        unresolvedReason = "a frozen agent route can't try a cheaper model — a trial place belongs to the task it was reserved for";
                 }
             }
             else if (!candidatesResolved.ok) {
@@ -7308,7 +7482,16 @@ export class Store {
                 unresolvedReason = planPin.problem;
             }
             else {
-                route = recommendRoute({
+                // Results routing (route v3): the project's live earned rules and trial, and the two eligibility facts the
+                // route doesn't carry. A release or candidate is read conservatively: terms this filing may still drop count.
+                const earnedBase = ref === null || ref.backend !== BUILT_IN || ref.repo === null ? null : {
+                    rules: liveEarnedRules(this, ref.repo),
+                    release: (scope.candidate ?? null) !== null || options.releaseTerms != null || options.releaseCheck != null
+                        || prior?.["release_terms_json"] != null || prior?.["release_check_json"] != null || releaseTaskRef(this, ref.id) || nightlyTaskRef(this, ref.id),
+                    protected: isProtectedWork(this.approvalRules(ref.repo), scope.touches),
+                };
+                const trial = earnedBase === null || ref === null ? null : liveTrialFor(this, ref.repo, ref.sizing?.size);
+                const routeWith = (reservation) => recommendRoute({
                     qualityMode,
                     evidence: [...new Set(scope.acceptance.flatMap(one => one.evidence))],
                     publication: this.publicationAuthorityOf(ref?.repo ?? null, new Date(scope.proposedAt)),
@@ -7319,7 +7502,19 @@ export class Store {
                     // with the route like every other input.
                     size: ref?.sizing ?? null,
                     headroom: this.planHeadroom(new Date(scope.proposedAt)),
+                    earned: earnedBase === null ? null : { ...earnedBase, ...(trial === null ? {} : { trial: { ...trial, reservation } }) },
                 });
+                // A TRIAL'S PLACE (results routing slice 3): asked first whether this filing would take the trial at all (a
+                // pure probe, nothing written), then its place reserved here, in this write transaction, and the route made
+                // with that place (or with none left: the configured builder runs it). A pin, an override or an ineligible
+                // task never takes a place.
+                route = routeWith(trial === null ? null : Number.MAX_SAFE_INTEGER);
+                if (trial !== null && ref !== null && legOf(route, "build").selection?.kind === "trial") {
+                    route = routeWith(reserveTrialPlace(this, trial.id, ref.id, new Date(scope.proposedAt)));
+                }
+                else if (trial !== null) {
+                    route = routeWith(null);
+                }
                 const problems = routeProblems(route);
                 if (problems.length > 0)
                     unresolvedReason = problems.join("; ");
@@ -7463,6 +7658,16 @@ export class Store {
             // or a remote API run keeps any mark already there and never erases a
             // quarantine by refiling, and the lead's own text is marked `lead`.
             this.db.prepare("UPDATE task_scope SET proposed_via = ? WHERE task_id = ?").run(provenanceAfter(prior?.["proposed_via"], options.proposedVia ?? null), scope.taskId);
+            // Results routing (exposure, route-store.ts): a build leg under an earned rule opens the task's one exposure to
+            // it; a re-filing adds an event to an open one, never a row.
+            if (ref !== null && route !== null)
+                noteExposureFiled(this, ref.id, legOf(route, "build").selection, new Date(scope.proposedAt));
+            // Results routing (trials, route-store.ts): the place this route seals is bound to the digest it was filed under
+            // (repeated saves reuse it); any other place this task held unconsumed is released.
+            if (ref !== null) {
+                const selection = route === null ? undefined : legOf(route, "build").selection;
+                settleTrialPlaces(this, ref.id, options.route !== undefined ? undefined : selection, boundDigest, new Date(scope.proposedAt));
+            }
             return null;
         }));
     }
@@ -7584,6 +7789,17 @@ export class Store {
                 return false;
             if (routeProblems(authority.route).length > 0)
                 return false;
+            // RESULTS ROUTING (route v3): a build leg selected by an earned rule that switched itself off since it was
+            // filed seals nothing — re-filing routes it on the configured builder (route-rules.ts holds what was approved).
+            const sealedSelection = legOf(authority.route, "build").selection;
+            if (sealedSelection?.kind === "rule" && this.db.prepare("SELECT state FROM route_rule WHERE id = ?").get(sealedSelection.rule)?.["state"] === "switched-off")
+                return false;
+            // A TRIAL (results routing slice 3): only a person's own yes seals it — the ceremony or their paired-chat tap,
+            // never a mode, a grant, a schedule, an automatic seal, a carry or the lead — and only while its place stands.
+            const trialRef = this.db.prepare("SELECT id FROM task_ref WHERE backend = ? AND external_id = ?").get(BUILT_IN, taskId);
+            if (trialSealProblem(this, { taskRef: trialRef === undefined ? null : Number(trialRef["id"]), selection: sealedSelection, digest: String(working["digest"] ?? ""),
+                basis: basis === undefined ? null : basis.kind, by, machine: machineActing() }) !== null)
+                return false;
             // RELEASE TERMS (release-once.md): only a person's own yes (the ceremony or a paired-chat tap) seals them, and
             // that yes opens the release's authority record in this same transaction — or the seal doesn't stand.
             const terms = storedReleaseTerms(working["release_terms_json"]);
@@ -7650,6 +7866,10 @@ export class Store {
                     if (basis === undefined || basis.kind === "chat")
                         this.noteTaskAct(Number(ref["id"]), "approved", now);
                     this.db.prepare("DELETE FROM hold WHERE owner_kind = 'backoff' AND owner_id = ?").run(`stale:${Number(ref["id"])}`);
+                    // Results routing: this yes closes the task's open exposure (as proposed, or with the model it sealed),
+                    // and lifts the hold a switched-off rule put on the approval it replaces.
+                    noteExposureSealed(this, Number(ref["id"]), { selection: sealedSelection, model: legOf(authority.route, "build").model }, now);
+                    this.db.prepare("DELETE FROM hold WHERE owner_kind = 'backoff' AND owner_id = ?").run(`rule-off:${Number(ref["id"])}`);
                     this.db
                         .prepare("UPDATE notification SET resolved_at = ? WHERE dedupe_key LIKE ? AND resolved_at IS NULL")
                         .run(now.toISOString(), `stale-approval:${Number(ref["id"])}:%`);
@@ -11778,22 +11998,32 @@ export class Store {
     }
     /** Write one complete pair. Audited: who changed spend routing, and when. */
     setPhaseConfig(scope, phase, provider, model, by, now) {
-        const was = this.phaseConfig(scope, phase);
-        const words = (agent) => agent === null ? "not set" : `${agent.provider} · ${agent.model ?? "its default model"}`;
-        this.recordPolicy(by, scope === "installation" ? null : scope, `agent for ${phase} changed`, words(was), words({ provider, model }), now);
-        this.db
-            .prepare(`INSERT INTO phase_config (scope, phase, provider, model, updated_at, updated_by)
-         VALUES (?, ?, ?, ?, ?, ?)
-         ON CONFLICT (scope, phase) DO UPDATE SET
-           provider = excluded.provider, model = excluded.model,
-           updated_at = excluded.updated_at, updated_by = excluded.updated_by`)
-            .run(scope, phase, provider, model, now.toISOString(), by);
+        // Results routing (v148): a changed row moves its (scope, phase) generation in the same transaction, which pauses
+        // any rule that depended on it (route-store.ts bumpModelsGeneration).
+        this.transact(() => {
+            const was = this.phaseConfig(scope, phase);
+            const words = (agent) => agent === null ? "not set" : `${agent.provider} · ${agent.model ?? "its default model"}`;
+            this.recordPolicy(by, scope === "installation" ? null : scope, `agent for ${phase} changed`, words(was), words({ provider, model }), now);
+            this.db
+                .prepare(`INSERT INTO phase_config (scope, phase, provider, model, updated_at, updated_by)
+           VALUES (?, ?, ?, ?, ?, ?)
+           ON CONFLICT (scope, phase) DO UPDATE SET
+             provider = excluded.provider, model = excluded.model,
+             updated_at = excluded.updated_at, updated_by = excluded.updated_by`)
+                .run(scope, phase, provider, model, now.toISOString(), by);
+            if (was === null || was.provider !== provider || was.model !== model)
+                bumpModelsGeneration(this, scope, phase, now);
+        });
     }
     clearPhaseConfig(scope, phase) {
-        const { changes } = this.db
-            .prepare("DELETE FROM phase_config WHERE scope = ? AND phase = ?")
-            .run(scope, phase);
-        return Number(changes) > 0;
+        return this.transact(() => {
+            const { changes } = this.db
+                .prepare("DELETE FROM phase_config WHERE scope = ? AND phase = ?")
+                .run(scope, phase);
+            if (Number(changes) > 0)
+                bumpModelsGeneration(this, scope, phase, new Date());
+            return Number(changes) > 0;
+        });
     }
     // ---- phase routing (v47) -----------------------------------------------
     /** The operator's named STRONG candidate for a phase at a scope, or null.
@@ -11827,16 +12057,25 @@ export class Store {
         // A small change makes no plan and repairs resume the builder: only the build phase has a light agent.
         if (tier === "light" && phase !== "build")
             throw new Error(`a light agent is for the build phase only, not ${phase}`);
-        this.db
-            .prepare(`INSERT INTO phase_tier_config (scope, phase, tier, provider, model, updated_at, updated_by)
-         VALUES (?, ?, ?, ?, ?, ?, ?)
-         ON CONFLICT (scope, phase, tier) DO UPDATE SET provider = excluded.provider, model = excluded.model,
-                                                        updated_at = excluded.updated_at, updated_by = excluded.updated_by`)
-            .run(scope, phase, tier, provider, model, now.toISOString(), by);
+        this.transact(() => {
+            const was = this.phaseTierConfig(scope, phase, tier);
+            this.db
+                .prepare(`INSERT INTO phase_tier_config (scope, phase, tier, provider, model, updated_at, updated_by)
+           VALUES (?, ?, ?, ?, ?, ?, ?)
+           ON CONFLICT (scope, phase, tier) DO UPDATE SET provider = excluded.provider, model = excluded.model,
+                                                          updated_at = excluded.updated_at, updated_by = excluded.updated_by`)
+                .run(scope, phase, tier, provider, model, now.toISOString(), by);
+            if (was === null || was.provider !== provider || was.model !== model)
+                bumpModelsGeneration(this, scope, phase, now);
+        });
     }
     clearPhaseTierConfig(scope, phase, tier) {
-        const { changes } = this.db.prepare("DELETE FROM phase_tier_config WHERE scope = ? AND phase = ? AND tier = ?").run(scope, phase, tier);
-        return Number(changes) > 0;
+        return this.transact(() => {
+            const { changes } = this.db.prepare("DELETE FROM phase_tier_config WHERE scope = ? AND phase = ? AND tier = ?").run(scope, phase, tier);
+            if (Number(changes) > 0)
+                bumpModelsGeneration(this, scope, phase, new Date());
+            return Number(changes) > 0;
+        });
     }
     /** A tier's candidates on other providers at a scope, in provider order (sized routing). */
     phaseTierAlternates(scope, phase, tier) {
@@ -11863,19 +12102,28 @@ export class Store {
     setPhaseTierAlternate(scope, phase, tier, provider, model, by, now) {
         if (tier === "light" && phase !== "build")
             throw new Error(`a light agent is for the build phase only, not ${phase}`);
-        this.db
-            .prepare(`INSERT INTO phase_tier_alternate (scope, phase, tier, provider, model, updated_at, updated_by)
-         VALUES (?, ?, ?, ?, ?, ?, ?)
-         ON CONFLICT (scope, phase, tier, provider) DO UPDATE SET model = excluded.model,
-                                                                  updated_at = excluded.updated_at, updated_by = excluded.updated_by`)
-            .run(scope, phase, tier, provider, model, now.toISOString(), by);
+        this.transact(() => {
+            const was = this.phaseTierAlternates(scope, phase, tier).find(one => one.provider === provider) ?? null;
+            this.db
+                .prepare(`INSERT INTO phase_tier_alternate (scope, phase, tier, provider, model, updated_at, updated_by)
+           VALUES (?, ?, ?, ?, ?, ?, ?)
+           ON CONFLICT (scope, phase, tier, provider) DO UPDATE SET model = excluded.model,
+                                                                    updated_at = excluded.updated_at, updated_by = excluded.updated_by`)
+                .run(scope, phase, tier, provider, model, now.toISOString(), by);
+            if (was === null || was.model !== model)
+                bumpModelsGeneration(this, scope, phase, now);
+        });
     }
     /** Remove one provider's candidate from a tier, or every one when no provider is named; how many went. */
     clearPhaseTierAlternates(scope, phase, tier, provider) {
-        const { changes } = provider === null
-            ? this.db.prepare("DELETE FROM phase_tier_alternate WHERE scope = ? AND phase = ? AND tier = ?").run(scope, phase, tier)
-            : this.db.prepare("DELETE FROM phase_tier_alternate WHERE scope = ? AND phase = ? AND tier = ? AND provider = ?").run(scope, phase, tier, provider);
-        return Number(changes);
+        return this.transact(() => {
+            const { changes } = provider === null
+                ? this.db.prepare("DELETE FROM phase_tier_alternate WHERE scope = ? AND phase = ? AND tier = ?").run(scope, phase, tier)
+                : this.db.prepare("DELETE FROM phase_tier_alternate WHERE scope = ? AND phase = ? AND tier = ? AND provider = ?").run(scope, phase, tier, provider);
+            if (Number(changes) > 0)
+                bumpModelsGeneration(this, scope, phase, new Date());
+            return Number(changes);
+        });
     }
     /** Each provider's plan headroom right now, from the latest readings of
      * its usage windows — the routing policy's headroom input at filing. */
@@ -13288,6 +13536,14 @@ export class Store {
         const problem = this.routeAdmissionProblem({ taskRef: run.taskRef, role, provider: provider ?? "claude", model }, run.route, run.now);
         if (problem !== null)
             refuse(problem);
+        // RESULTS ROUTING (route v3): a task approved under an earned rule that then switched itself off on its sealed
+        // trigger is held — its first build never starts on that model (no strike: nothing ran). A rule a person turned
+        // off, or one that expired, keeps the sealed model; a started task's later attempts finish under it.
+        if (role === "builder") {
+            const held = ruleHoldOf(this, taskId);
+            if (held !== null)
+                refuse(`rule-switched-off: results for ${held.model} dropped after this was approved — approve it again or re-file it`);
+        }
         const stamp = run.route;
         const qualityMode = role === "reviewer" && parent !== null
             ? parent.qualityMode ?? "default"
@@ -13319,6 +13575,16 @@ export class Store {
         // The provenance row lands in the same transaction as the run row —
         // proved above, written here; a run and its route are one fact.
         this.writeRunRoute(id, stamp, run.now);
+        // Results routing (v148): a code-writing run's cohort snapshot, beside its route in this same transaction and
+        // never updated (route-store.ts writeRunCohort; a snapshot it can't compute is recorded as not eligible).
+        if (role === "builder" || role === "repair") {
+            writeRunCohort(this, { run: id, taskRef: run.taskRef, role, routeDigest: stamp.routeDigest, provider: provider ?? "claude", model, qualityMode, startedAt: run.now.toISOString() });
+            // A TRIAL (results routing slice 3): a person's own approval, and its place consumed exactly once against the
+            // sealed digest (a retry or repair of the same task consumes nothing more). Refused → the row rolls back.
+            const trialProblem = admitTrialRun(this, { taskId, taskRef: run.taskRef, role, run: id, now: run.now });
+            if (trialProblem !== null)
+                refuse(trialProblem);
+        }
         if (role === "reviewer" && parent?.role === "reviewer" && parent.watchIncarnation != null) {
             this.db.prepare("UPDATE run SET watch_incarnation = ? WHERE id = ?").run(parent.watchIncarnation, id);
         }
@@ -22376,3 +22642,22 @@ export function laptopPortOf(store) {
 export function recordLaptopPort(store, port, now) {
     store.recordInstallationFact(LAPTOP_PORT_FACT, String(port), now);
 }
+// ---- v148: results routing (docs/plans/results-routing.md) ------------------------------------------------------
+/** The Models rows of a project being deleted (project-delete.ts), through the same counter as every other Models
+ * writer: each phase whose rows go moves its generation (pausing what depended on it), then the project's
+ * results-routing rows go (route-store.ts forgetProjectRoutes). One of the routing scan's named phase_* writers
+ * (route-hooks.ts). How many rows went. */
+export function forgetProjectModels(store, repo, now) {
+    return store.transact(() => {
+        const db = store.handle;
+        let rows = 0;
+        const phases = new Set(db.prepare(`SELECT phase FROM phase_config WHERE scope = ? UNION SELECT phase FROM phase_tier_config WHERE scope = ?
+      UNION SELECT phase FROM phase_tier_alternate WHERE scope = ?`).all(repo, repo, repo).map(row => String(row["phase"])));
+        rows += Number(db.prepare("DELETE FROM phase_config WHERE scope = ?").run(repo).changes);
+        rows += Number(db.prepare("DELETE FROM phase_tier_config WHERE scope = ?").run(repo).changes);
+        rows += Number(db.prepare("DELETE FROM phase_tier_alternate WHERE scope = ?").run(repo).changes);
+        for (const phase of [...phases].sort())
+            bumpModelsGeneration(store, repo, phase, now);
+        return rows + forgetProjectRoutes(store, repo);
+    });
+}

package/dist/surface.js

@@ -116,12 +116,12 @@ const GUIDE_ROWS = [
         notableReasons: ["usage", "ambiguous", "drift", "timeout", "check-failed", "ci-failed", "tree-mismatch", "conflict", "mixed-runtime", "gate-held", "after-swap"] },
     operator("demo", "a seeded throwaway sandbox"),
     ...KNOWLEDGE_DESCRIPTORS.map(spec => ({ invocation: `knowledge ${spec.action}`, synopsis: spec.synopsis, audience: "audience" in spec ? spec.audience : "agent", agentMayInvoke: !("audience" in spec), mutation: spec.mutation, flags: spec.flags, ...(spec.takesQuery ? { positionals: [{ name: "query", required: true, meaning: "search text or source file for impact" }] } : {}) })),
-    ...MEMORY_DESCRIPTORS.map(spec => ({ invocation: `memory ${spec.action}`, synopsis: spec.synopsis, audience: "agent", agentMayInvoke: true, mutation: spec.mutation, flags: spec.flags, ...(spec.takesQuery ? { positionals: [{ name: "query", required: true, meaning: "search text, a decision id, or the decision sentence" }] } : {}) })),
+    ...MEMORY_DESCRIPTORS.map(spec => ({ invocation: `memory ${spec.action}`, synopsis: spec.synopsis, audience: "audience" in spec ? spec.audience : "agent", agentMayInvoke: !("audience" in spec), mutation: spec.mutation, flags: spec.flags, ...(spec.takesQuery ? { positionals: [{ name: "query", required: true, meaning: "search text, a decision id, or the decision sentence" }] } : {}) })),
     // Flow writes carry an approver's credential: an agent runs them only as the person asked, after showing the preview.
     // Letting a flow run on its own raises authority: the owner's own password ceremony, never an agent's act.
     ...FLOWS_DESCRIPTORS.map(spec => ({ invocation: `flows ${spec.action}`, synopsis: spec.synopsis, audience: "audience" in spec ? spec.audience : "agent", agentMayInvoke: !("audience" in spec), mutation: spec.mutation, flags: spec.flags,
         ...("positionals" in spec ? { positionals: spec.positionals.map(name => ({ name, required: true, meaning: name === "flow" ? "a flow id from flows list" : name === "card" ? "a card id from flows show" : name === "on|off" ? "on signs the grant, off revokes it" : "a trigger id from flows show, or for trigger add its settings as JSON, a JSON file, or -" })) } : {}) })),
-    ...MODELS_DESCRIPTORS.map(spec => ({ invocation: `models ${spec.action}`, synopsis: spec.synopsis, audience: "agent", agentMayInvoke: true, mutation: spec.mutation, flags: spec.flags, ...(spec.takesQuery ? { positionals: [{ name: "target", required: true, meaning: "the CLI to update, or on/off" }] } : {}) })),
+    ...MODELS_DESCRIPTORS.map(spec => ({ invocation: `models ${spec.action}`, synopsis: spec.synopsis, audience: "agent", agentMayInvoke: true, mutation: spec.mutation, flags: spec.flags, ...(spec.takesQuery ? { positionals: [{ name: "target", required: true, meaning: "positional" in spec ? spec.positional : "the CLI to update, or on/off" }] } : {}) })),
     // ---- the queue (agent surface) ----
     { invocation: "status", synopsis: "running work, queued reasons, results to review, the latest release check and plan windows", audience: "agent", agentMayInvoke: true, mutation: "none", flags: [jsonFlag, dbFlag] },
     { invocation: 'health', synopsis: 'recent server latency, event-loop delay, SQLite writes and live streams from the saved connection; instance operators only', audience: 'agent', agentMayInvoke: true, mutation: 'none', flags: [jsonFlag, { name: 'profile', takesValue: true, meaning: 'saved server connection' }] },
@@ -460,6 +460,11 @@ const REMOTE_NO = [
     "serve", "serve check-public", "watch", "up", "onboard", "daemon", "background on", "background off", "background show", "stop", "open", "welcome", "password set", "doctor", "bridge", "setup show", "setup clear",
     // Provider keys and model tools on this machine.
     "providers", "keys status", "keys set", "keys clear", "keys verify", "keys auth", "models check", "models update", "models watch",
+    // Result records read with this machine's sign-in: project access, never a token's narrower scope.
+    "models results",
+    // Earned rules (results routing): the project's own results, and its rules' doors, with this machine's sign-in; a
+    // remote token never changes which models run (the rule door refuses it in the write too).
+    "models suggestions", "models accept", "models dismiss", "models turn-off", "models keep", "models try", "models stop",
     // Publication and release.
     "publish", "publish status", "publish merge", "publish refire", "publish unblock", "publish rearm", "publish grant", "publish revoke",
     // A repository's authority grants on this machine.
@@ -474,7 +479,9 @@ const REMOTE_NO = [
 const REMOTE_STEP_UP = [
     "proposals", "decide", "task regate", "task approve", "task accept", "task merge", "run settle",
     // Putting tasks away and restoring them: a person's act, in the console or on the server's machine.
-    "task archive", "task restore", "task tidy", "knowledge apply", "memory apply",
+    "task archive", "task restore", "task tidy", "knowledge apply",
+    // Changing project memory: a person's own password, never a token (the lead only proposes it in chat).
+    "memory decide", "memory retire", "memory apply",
     "flows card approve", "flows card send-back", "flows script approve", "flows unattended",
     "approver list", "approver add", "people list", "people invite", "people projects", "people revoke",
     // A person's own API tokens: a password step-up on the server's machine, or the console. Never with a token.
@@ -491,7 +498,7 @@ const REMOTE_YES = [
     "config show", "verify show", "intake show", "intake run", "intake preview", "intake pr-comments", "template list", "template show",
     "webhook status", "review show", "chat-approval show", "chat-approval off",
     "knowledge search", "knowledge impact", "knowledge refresh",
-    "memory search", "memory decisions", "memory show", "memory decide", "memory retire", "memory review", "memory status",
+    "memory search", "memory decisions", "memory show", "memory review", "memory status",
     "flows list", "flows show", "flows export", "flows create", "flows edit", "flows trigger add", "flows trigger pause", "flows trigger resume",
     "flows trigger remove", "flows card add", "flows archive",
     "models status", "models list",
@@ -530,6 +537,11 @@ const LOCAL_ALLOW = {
     "task archive": "archive-task",
     "task restore": "archive-task",
     "repos add": "add-project",
+    // Results routing: lowering only (route-store.ts proveRuleDoor checks the act is exactly this one).
+    "models suggestions": "read",
+    "models turn-off": "routing-turn-off",
+    "models dismiss": "dismiss-suggestion",
+    "models stop": "trial-stop",
 };
 /** Every guide row's local-owner mark, by invocation: `allow` with its act, else `deny`. Exported for the inventory test. */
 export const LOCAL_POLICY = new Map(GUIDE_ROWS.map(row => [row.invocation,

package/dist/task-outcome-cli.js

@@ -4,7 +4,8 @@ import { assignmentOf, checkAssignmentAsOperator } from './assignment.js';
 import { assignmentForCoordinator, coordinatorToken } from './assignment-adapters.js';
 import { authenticateCoordinator } from './coordinator.js';
 import { reproveApprover } from './principal.js';
-import { authenticateApprover, personProof } from './scope.js';
+import { authenticateApprover, machineActing, personProof } from './scope.js';
+import { currentActor } from './actor.js';
 import { requestResultChanges } from './result-actions.js';
 import { commentSourceKey, revisionSourceOf } from './result-review.js';
 import { envelopeJson } from './envelope.js';
@@ -110,7 +111,9 @@ export async function runTaskOutcomeCommand(action, positional, flags, context)
         // The shared action returns exact replays before stale-family checks. An
         // older result cannot create another child once a newer revision is current.
         const revised = requestResultChanges(store, evidenceRoot, { run: run.id, source, actor, repos,
-            batch: '', note: feedback, path: '', line: '', request: key, allowMode: operator !== null }, now);
+            batch: '', note: feedback, path: '', line: '', request: key, allowMode: operator !== null,
+            // A verified approver's own words; a scoped credential or the lead's token is the lead; a remote API run a machine.
+            origin: coordinator !== null || currentActor()?.lead === true ? 'lead' : machineActing() ? 'machine' : 'person' }, now);
         if (!revised.ok)
             return fail(revised.status === 400 ? 'usage' : 'stale-result', revised.message);
         const scope = store.getScope(revised.id);

package/dist/toolroll-update.js

@@ -39,7 +39,7 @@ import { installLaunchdService, launchdPlist, stopLaunchdService, writeFileDurab
 import { LAPTOP_LABEL_DARWIN, LAPTOP_LABEL_LINUX, unitFlag } from "./laptop-service.js";
 import { processGone, readRunnerProcessRecord, realProcessProbe, recordStandsFor, RUNNER_PROCESS_DIR } from "./runner-process.js";
 import { NAME } from "./names.js";
-import { orphanKey, updateSafeSchema, V117_RENAMED_COLUMNS, V117_RENAMED_TABLES, V118_MERGED_TABLES, V119_ADDED_COLUMNS, V120_ADDED_COLUMNS, V121_ADDED_COLUMNS, V122_ADDED_COLUMNS, V123_ADDED_COLUMNS, V125_ADDED_COLUMNS, V126_ADDED_COLUMNS, V128_ADDED_COLUMNS, V129_ADDED_COLUMNS, V134_ADDED_COLUMNS, V135_ADDED_COLUMNS, V138_ADDED_COLUMNS, V143_ADDED_COLUMNS, V147_ADDED_COLUMNS } from "./store.js";
+import { orphanKey, updateSafeSchema, V117_RENAMED_COLUMNS, V117_RENAMED_TABLES, V118_MERGED_TABLES, V119_ADDED_COLUMNS, V120_ADDED_COLUMNS, V121_ADDED_COLUMNS, V122_ADDED_COLUMNS, V123_ADDED_COLUMNS, V125_ADDED_COLUMNS, V126_ADDED_COLUMNS, V128_ADDED_COLUMNS, V129_ADDED_COLUMNS, V134_ADDED_COLUMNS, V135_ADDED_COLUMNS, V138_ADDED_COLUMNS, V143_ADDED_COLUMNS, V147_ADDED_COLUMNS, V148_ADDED_COLUMNS } from "./store.js";
 import { isNewer, REGISTRY } from "./releases.js";
 import { markNeverIndex } from "./never-index.js";
 import { readRuntimeUpdateJournal, RUNTIME_PHASES, RUNTIME_UPDATE_STEPS, stagedStartedAt, updaterStartingOf } from "./contracts/update-journal.js";
@@ -413,7 +413,8 @@ const HISTORY_RULES = {
     // v128: a lead message's pending flag reads waiting exactly for a team queue's unadmitted operator message.
     // v147: an account's password flag reads set (1), a browser session reads full with no local binding or key, and the
     // console record reads no key epoch.
-    ...Object.fromEntries(Object.entries(addedColumns(V119_ADDED_COLUMNS, V120_ADDED_COLUMNS, V121_ADDED_COLUMNS, V122_ADDED_COLUMNS, V123_ADDED_COLUMNS, V125_ADDED_COLUMNS, V126_ADDED_COLUMNS, V128_ADDED_COLUMNS, V129_ADDED_COLUMNS, V134_ADDED_COLUMNS, V135_ADDED_COLUMNS, V138_ADDED_COLUMNS, V143_ADDED_COLUMNS, V147_ADDED_COLUMNS))
+    // v148: a run's execution class and a revision's origin read none (NULL), and a project's suggestion switch reads on.
+    ...Object.fromEntries(Object.entries(addedColumns(V119_ADDED_COLUMNS, V120_ADDED_COLUMNS, V121_ADDED_COLUMNS, V122_ADDED_COLUMNS, V123_ADDED_COLUMNS, V125_ADDED_COLUMNS, V126_ADDED_COLUMNS, V128_ADDED_COLUMNS, V129_ADDED_COLUMNS, V134_ADDED_COLUMNS, V135_ADDED_COLUMNS, V138_ADDED_COLUMNS, V143_ADDED_COLUMNS, V147_ADDED_COLUMNS, V148_ADDED_COLUMNS))
         .map(([table, rule]) => [table, { ...EARLIER_RULES[table], ...rule }])),
 };
 /** The tables a migration may remove whole (v115's removed features). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.9.91",
+  "version": "0.9.92",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"