toolroll 0.9.91 → 0.9.92

package/dist/models-ui.js

@@ -59,7 +59,7 @@ ${formRow("Automatic checks", `${view.watch.enabled ? "On" : "Off"}. Every 6 hou
         : note(`Checked ${when(view.watch.checkedAt)}.`);
     const fresh = view.fresh.length === 0 ? "" : sec("new", "New models", "", view.fresh.map(model => formRow(model.name, `${priceWords(model)}${model.releasedAt === null ? "" : ` · released ${model.releasedAt.slice(0, 10)}`}`, chip("New", "", { dot: false }), "inline")));
     const chat = view.chat === null ? "" : formRow("Chat", view.chat.words, btn("Change", { sm: true, variant: "ghost", href: "/settings/lead" }), "inline");
-    const body = html `<div class="models">${outcome}${preview}${choiceSection(view, manage, previewing)}${recentSection(view)}${sec("tools", "AI tools on this computer", "", html `${tools}${checks}`)}${fresh}${chat}</div>`;
+    const body = html `<div class="models">${outcome}${preview}${choiceSection(view, manage, previewing)}${suggestedSection(view)}${recentSection(view)}${sec("tools", "AI tools on this computer", "", html `${tools}${checks}`)}${fresh}${chat}</div>`;
     return settingsShell({ group: "agents", sub: true, title: "Models", lead: "Which model plans, builds and reviews each task. Changes apply to tasks filed from now on.", body });
 }
 /** Filters one long picker as you type; the saved choice always stays listed. */
@@ -123,3 +123,46 @@ function recentSection(view) {
         return "";
     return sec("recent", "Recent work", "", view.recent.map(one => formRow(one.role, `Chosen ${one.chosen} → ran on ${one.ranOn}`, html `<a class="k-link k-mono" href="/t/${encodeURIComponent(one.taskId)}">${one.taskId}</a>`, "inline")));
 }
+/** Settings → Models → Suggested (docs/plans/results-routing.md slice 2): what a project's own results suggest, each
+ * reviewed before it's saved with a step-up; the rules in force with Turn off (Keep or Drop when paused); and the
+ * project's "Suggest cheaper models" switch. Turning off and Not now only take authority away: no password. */
+function suggestedSection(view) {
+    const s = view.suggested;
+    if (s === undefined)
+        return "";
+    const manage = view.csrf !== "";
+    const scoped = (repo) => `/settings/models?scope=${encodeURIComponent(repo)}`;
+    const review = s.review === null ? ""
+        : "stale" in s.review
+            ? html `${notice("This suggestion is out of date: its results, a price or Models changed since. Nothing was saved.")}${acts(btn("Back", { sm: true, href: `${scoped(s.review.repo)}#models-suggested` }))}`
+            : html `<div class="models-diff">${factList([
+                ["Change", s.review.title],
+                ["Evidence", html `${s.review.evidence.map(line => html `<span>${line}</span><br>`)}`],
+                ["Prices", s.review.prices],
+                ["Switches back", html `${s.review.terms.map(line => html `<span>${line}</span><br>`)}`],
+            ])}${manage ? postForm("/settings/models/accept", html `${note(`Every task is still approved, and keeps the model it was approved with. ${termsOf("step-up", factsOf(view))}`)}${password(view, "models-accept-pw")}${acts(btn(s.review.save, { variant: "primary", type: "submit" }), btn("Cancel", { variant: "ghost", href: `${scoped(s.review.repo)}#models-suggested` }))}`, { hidden: { scope: s.review.repo, id: s.review.id }, attrs: { class: "models-editor" } }) : ""}</div>`;
+    const offers = s.offers.map(one => formRow(s.repo === null ? `${one.title} · ${one.project}` : one.title, one.words, manage
+        ? acts(btn("Review change", { sm: true, href: `${scoped(one.repo)}&suggestion=${encodeURIComponent(one.id)}#models-suggested` }), postForm("/settings/models/not-now", btn("Not now", { sm: true, variant: "ghost", type: "submit" }), { hidden: { scope: one.repo, id: one.id } }))
+        : html ``, "top"));
+    const rules = s.rules.map(one => formRow(s.repo === null ? `${one.title} · ${one.project}` : one.title, one.words, !manage || one.state === "ended" ? html ``
+        : one.state === "paused"
+            ? acts(postForm("/settings/models/keep", html `${password(view, `models-keep-${one.id}`)}${btn("Keep", { sm: true, type: "submit" })}`, { hidden: { scope: one.repo, rule: String(one.id) } }), postForm("/settings/models/turn-off", btn("Drop", { sm: true, variant: "ghost", type: "submit" }), { hidden: { scope: one.repo, rule: String(one.id) } }))
+            : postForm("/settings/models/turn-off", btn("Turn off", { sm: true, type: "submit" }), { hidden: { scope: one.repo, rule: String(one.id) } }), "top"));
+    // Trials (slice 3): an offer to try a cheaper model on the next few tasks — started with a step-up, each task still
+    // approved by a person — and the trials in use, each with its progress and Stop (stopping only lowers: no password).
+    const trialOffers = (s.trialOffers ?? []).map(one => formRow(s.repo === null ? `${one.title} · ${one.project}` : one.title, one.words, manage
+        ? acts(postForm("/settings/models/try", html `${password(view, `models-try-${one.id.replace(/[^a-z0-9]/gi, "-")}`)}${btn(one.save, { sm: true, type: "submit" })}`, { hidden: { scope: one.repo, id: one.id } }), postForm("/settings/models/not-now", btn("Not now", { sm: true, variant: "ghost", type: "submit" }), { hidden: { scope: one.repo, id: one.id } }))
+        : html ``, "top"));
+    const trials = (s.trials ?? []).map(one => formRow(s.repo === null ? `${one.title} · ${one.project}` : one.title, one.words, !manage || !one.live ? html ``
+        : postForm("/settings/models/stop", btn("Stop", { sm: true, type: "submit" }), { hidden: { scope: one.repo, rule: String(one.id) } }), "top"));
+    const toggle = s.suggest === null || s.repo === null ? "" : formRow("Suggest cheaper models", s.suggest.on
+        ? "On. When a cheaper model does as well on this project's small or routine tasks, it's suggested here. Nothing changes until you accept it."
+        : "Off. No new suggestions for this project.", !manage ? html `` : s.suggest.on
+        ? postForm("/settings/models/suggest-off", btn("Turn off", { sm: true, type: "submit" }), { hidden: { scope: s.repo } })
+        : postForm("/settings/models/suggest-on", html `${password(view, "models-suggest-pw")}${btn("Turn on", { sm: true, type: "submit" })}`, { hidden: { scope: s.repo } }), "inline");
+    const emptyWords = s.repo === null ? "No suggestions yet. Choose a project above to see its own." : "No suggestions yet. When a cheaper model's results on this project's small or routine tasks match the configured model's, it's suggested here.";
+    const nothing = offers.length === 0 && rules.length === 0 && trialOffers.length === 0 && trials.length === 0 && s.review === null;
+    const body = html `${review}${nothing ? note(emptyWords) : ""}${offers}${trialOffers}${rules.length === 0 ? "" : html `${group("Rules in use")}${rules}`}${trials.length === 0 ? "" : html `${group("Trials")}${trials}`}${toggle}`;
+    const waiting = s.offers.length + trialOffers.length;
+    return sec("suggested", "Suggested", waiting === 0 ? "" : `${waiting} to review`, body);
+}

package/dist/operate-remote-arguments.js

@@ -57,10 +57,10 @@ export const REMOTE_ARGUMENTS = new Map([
     ['template show', args('name')],
     ...['search', 'impact'].map(action => [`knowledge ${action}`, args('query', 'base')]),
     ['knowledge refresh', args('', 'base')],
-    // Decision reads and supersession are already project-bound in project-memory.ts. Proposal IDs are
-    // accepted only by memory apply (step-up), never by the listing commands below.
-    ...['search', 'decisions', 'show', 'decide', 'retire', 'review', 'status'].map(action => [`memory ${action}`,
-        args(['search', 'decide'].includes(action) ? 'query*' : ['show', 'retire'].includes(action) ? 'query' : '', 'why reason supersedes source all decision sessions no-local')]),
+    // Decision reads are already project-bound in project-memory.ts. Memory writes (decide, retire, apply) are a person's
+    // step-up, never a token's act, so none is listed here.
+    ...['search', 'decisions', 'show', 'review', 'status'].map(action => [`memory ${action}`,
+        args(action === 'search' ? 'query*' : action === 'show' ? 'query' : '', 'why reason supersedes source all decision sessions no-local')]),
     ['flows list', args()],
     ['flows show', args('flow:flow')], ['flows export', args('flow:flow')],
     ['flows create', args('', 'yes name template', { steps: 'steps' })],

package/dist/operate-remote.js

@@ -50,7 +50,7 @@ export const REMOTE_SCOPES = new Map([
     // The person's own remote actions, or everyone's within their projects for an approver (remote-audit.ts).
     ["audit", self],
     ["knowledge search", repo], ["knowledge impact", repo], ["knowledge refresh", repo],
-    ...["search", "decisions", "show", "decide", "retire", "review", "status"].map(action => [`memory ${action}`, self]),
+    ...["search", "decisions", "show", "review", "status"].map(action => [`memory ${action}`, self]),
     ...["list", "show", "export", "create", "edit", "trigger add", "trigger pause", "trigger resume", "trigger remove", "card add", "archive"]
         .map(action => [`flows ${action}`, self]),
     ["models status", global], ["models list", global],

package/dist/operate.js

@@ -50,6 +50,7 @@ import { startLiveBackups } from "./live-backup.js";
 import { pushLimitSink } from "./provider-limits.js";
 import { heuristicSizing, installFilingSizer, ownerSizer, refineFiledSizing, settleSizings } from "./task-sizing.js";
 import { tierLines, tierReport } from "./tier-report.js";
+import { savingsLines, savingsReportOrError } from "./route-savings.js";
 import { limitsView } from "./limits-ui.js";
 import { startCodexLimits } from "./codex-limits.js";
 import { packageVersion, startMonitoring, targetOf } from "./monitoring.js";
@@ -262,6 +263,9 @@ import { latestRelease, newerRelease, notifySecurityRelease, notifyVersionLive,
 import { installMethod } from "./install-method.js";
 import { PACKAGE_VERSION } from "./version.js";
 import { machineActing } from "./scope.js";
+import { reevaluateResultRecords } from "./route-results.js";
+import { holdRuleOff, routeRulesPass, taskEvidenceWords } from "./route-rules.js";
+import { ruleHoldOf } from "./route-store.js";
 import { loginFileOf, migrateLegacyLogin, savedLoginFile, writableLoginFile } from "./login-secrets.js";
 /**
  * 0 done · 1 broke · 2 bad usage · 3 ran fine, the answer is no.
@@ -1296,14 +1300,25 @@ async function dispatch(command, positional, flags, context) {
             return runKnowledgeApply(flags, { ...context, now: context.clock(), actor: verified !== null && verified.ok ? acting.name : null });
         }
         case "models": {
-            const acting = await askCredentials(flags, context);
+            // A local owner's lowering act (models turn-off / dismiss, through the terminal UI) asks for no credential: the
+            // rule door re-checks the owner and its exact act itself.
+            const localOnly = currentLocalOwner() !== null && !flags.has("as") && !flags.has("token") && ["turn-off", "dismiss", "suggestions", "stop"].includes(positional[0] ?? "");
+            const acting = localOnly ? null : await askCredentials(flags, context);
+            // The credential generation the proof is checked against, read BEFORE it (as `config set` does): a rotation in
+            // between makes the rule door refuse, never borrow the new generation.
+            const provedGeneration = acting === null ? -1 : context.store.accountOf(acting.name)?.generation ?? -1;
             const verified = acting === null ? null : authenticateApprover(context.store, acting.name, acting.token);
-            return runModelsCommand(positional, flags, { store: context.store, write: context.write, json: context.json, now: context.clock(), actor: verified !== null && verified.ok ? acting.name : null });
+            const proof = verified !== null && verified.ok ? { actor: acting.name, generation: provedGeneration, method: verified.method } : null;
+            return runModelsCommand(positional, flags, { store: context.store, write: context.write, json: context.json, now: context.clock(), actor: proof?.actor ?? null, proof });
         }
         case "memory": {
             // The remembered local login (or --as/--token) names the person; reads
-            // and writes both record who asked.
+            // and writes both record who asked. Writes are a person's: never the lead's token or chain (like knowledge apply).
+            if (memoryWriteVerb(positional) && currentActor()?.lead === true)
+                return fail(context.write, context.json, `memory ${positional[0]}`, "unauthenticated", MEMORY_WRITE_REFUSAL, EXIT.refused);
             const acting = await askCredentials(flags, context);
+            if (memoryWriteVerb(positional) && acting !== null && parseLeadToken(acting.token) !== null)
+                return fail(context.write, context.json, `memory ${positional[0]}`, "unauthenticated", MEMORY_WRITE_REFUSAL, EXIT.refused);
             const verified = acting === null ? null : verifyApproverByPassword(context.store, acting.name, acting.token, context.store.knownRepos().filter(repo => context.store.accountCanAccess(acting.name, repo)));
             const who = verified !== null && verified.ok ? verified.who : null;
             return runMemoryCommand(positional, flags, { store: context.store, write: context.write, json: context.json, now: context.clock(), actor: who?.name ?? null, repos: who?.repos ?? [], configDir: dirname(context.databaseFile), ...(context.evidenceRoot === undefined ? {} : { evidenceRoot: context.evidenceRoot }) });
@@ -2703,6 +2718,17 @@ async function tickCommand(flags, context) {
                 continue;
             }
         }
+        // THE RULE HOLD, before any claim or row (results routing, route v3): a task approved under an earned rule that
+        // then switched itself off on its sealed trigger never starts on that model. Nothing opens, so nothing strikes;
+        // the task is held, in words, until a person approves it again (the hold goes with that yes).
+        if (!wantsPlan && !wantsScout) {
+            const ruleHeld = ruleHoldOf(store, id);
+            if (ruleHeld !== null) {
+                holdRuleOff(store, ref.id, id, ruleHeld.model, clock());
+                dispatched.push({ id, outcome: "skipped", reason: "rule-switched-off", detail: `${id}: results for ${ruleHeld.model} dropped after this was approved — approve it again or re-file it` });
+                continue;
+            }
+        }
         // THE READINESS HALT (v47): a provider THIS runner has reported
         // unavailable never claims and never spends — no substitution, no
         // second-best; the skip names the observation and the ways out.
@@ -3630,6 +3656,18 @@ async function reconcileCommand(flags, context) {
         tidied = runTidy(store, clock(), releaseFactsFor(context.databaseFile), TIDY_PASS_LIMIT, { principal: "operator", repos: [repo], includeUnplaced: false });
     }
     catch { /* the next pass tries again */ }
+    // Result records (results-routing.md, slice 1): each finished family's record is evaluated again from its rows —
+    // a completion, a follow-up check, a revision, a proof, a merge or the task ending each change what it says.
+    try {
+        reevaluateResultRecords(store, canonicalProject(repo) ?? resolve(repo), context.evidenceRoot, clock());
+    }
+    catch { /* the next pass tries again */ }
+    // Earned rules (results-routing.md, slice 2): each live rule checked against its sealed terms on the records just
+    // evaluated; tasks approved under one that switched itself off are held for a new approval.
+    try {
+        routeRulesPass(store, canonicalProject(repo) ?? resolve(repo), clock());
+    }
+    catch { /* the next pass tries again */ }
     // Checkout cleanup (Settings → Storage): finished work's clean checkouts go as the setting says (by default when
     // the task is complete or cancelled); their branches stay. Each removal is in the ledger.
     // Completing or cancelling a task stops anything still running from its checkout first.
@@ -9321,7 +9359,7 @@ function showTask(positional, context) {
         ...(detail.automaticReview === null ? reviewStatusLines(detail.review, latestFinished?.id ?? null) : buildReviewLines(detail.automaticReview)),
         ...(scope === null
             ? ["  no scope — nothing will build this until one is written and approved"]
-            : describeScope(scope, readiness)),
+            : describeScope(scope, readiness, taskEvidenceWords(store, task.id, now))),
         ...planContractLines(store, context.evidenceRoot, id),
         // The route's standing (v47): sealed, proposed, legacy, or unreadable —
         // the projection itself is in describeScope's lines above.
@@ -11132,12 +11170,15 @@ function spendCommand(flags, context) {
     const windows = limitsView(limits, [], { project: repo => basename(repo), subagent: id => String(id) }, context.clock())?.tiles ?? [];
     // Sized routing: each tier's tasks, time to a result and plan use, and what the tiers saved.
     const tiers = tierReport(context.store.handle, month.from, month.to, items);
-    return succeed(context.write, context.json, command, { month: month.name, totalMicrousd: total, unpriced, items: items.length, budgets, limits, tiers: { rows: tiers.rows, saved: tiers.saved } }, () => [
+    // Suggestions and rules (results-routing slice 4): what each rule, trial and suggestion observed, over 90 days a side.
+    const suggestions = savingsReportOrError(context.store, context.store.knownRepos(), context.clock());
+    return succeed(context.write, context.json, command, { month: month.name, totalMicrousd: total, unpriced, items: items.length, budgets, limits, tiers: { rows: tiers.rows, saved: tiers.saved }, suggestions }, () => [
         `${month.name}: ${spendUsd(total)} (${items.length} pieces of work${unpriced > 0 ? `, ${unpriced} unpriced` : ""}; subscription work is $0)`,
         ...windows.map(tile => `  ${`${tile.name} ${tile.window}`.padEnd(24)} ${tile.value}% · ${tile.detail}`),
         ...[...byProject.entries()].sort((a, b) => b[1] - a[1]).slice(0, 10).map(([repo, microusd]) => `  ${basename(repo).padEnd(24)} ${spendUsd(microusd)}`),
         ...budgets.map(one => `  budget ${budgetLabel(one, names.get(Number(one.key))).replace(/'s$/, "").padEnd(24)} ${spendUsd(one.spentMicrousd)} of ${spendUsd(one.limitMicrousd)} (${one.percent}%)${one.hardStop ? "" : " alerts only"}`),
         ...tierLines(tiers, spendUsd),
+        ...savingsLines(suggestions),
     ]);
 }
 /** `backup now | list` (sprint 8): back the database up now, or list backups and how the latest ones went. */
@@ -13418,3 +13459,10 @@ export function upLaptopPortCandidates(store, fromSeam) {
         return [range[0] ?? 4180];
     return [...range];
 }
+/** The memory verbs that change project memory (memory-cli.ts), and `propose`, which files the proposals a person then
+ * applies: a person's act, never the lead's. The reads stay as they are. */
+const MEMORY_WRITE_VERBS = new Set(["decide", "retire", "apply", "propose"]);
+function memoryWriteVerb(positional) {
+    return MEMORY_WRITE_VERBS.has(positional[0] ?? "");
+}
+const MEMORY_WRITE_REFUSAL = "Project memory is changed by a person with their own sign-in, not the lead. The lead proposes decisions in chat for you to confirm.";

package/dist/phase-routing.d.ts

@@ -49,7 +49,7 @@
  * a legacy approval governed by its sealed profile alone.
  */
 import type { EvidenceKind } from "./contracts/acceptance-terms.js";
-import { MODEL_ID_SHAPE, RISKS, ROUTE_VERSION, type PhaseRoute, type RouteLeg, type RouteOverride, type RouteVersion, type TaskSizing } from "./contracts/route.js";
+import { MODEL_ID_SHAPE, PLAIN_ROUTE_VERSION, RISKS, ROUTE_VERSION, type PhaseRoute, type RouteLeg, type RouteOverride, type RouteVersion, type TaskSizing } from "./contracts/route.js";
 import type { Phase, ProviderId } from "./provider.js";
 import type { QualityMode } from "./quality.js";
 /** The sealed route's shape is its contract (contracts/route.ts); these are its types. */
@@ -62,7 +62,7 @@ export declare function exactModelId(v: unknown): v is string;
 /** v2 adds the task's size (small / medium / large, risky or not), the
  * light tier, and plan headroom. A v1 route — sealed before sizing — still
  * reads back exactly and keeps its own digest domain. */
-export { ROUTE_VERSION };
+export { PLAIN_ROUTE_VERSION, ROUTE_VERSION };
 /** The durable route ERA a scope row carries once it was filed under this
  * policy: NULL on a row proven to predate v47 (legacy — the sealed profile
  * alone governs), this value on every row filed since. A row with an era
@@ -191,6 +191,37 @@ export type RouteInput = {
      * candidates on more than one provider, the one with more room runs; a
      * provider past its limits gives way even to a stronger tier. */
     headroom?: readonly ProviderRoom[];
+    /** Results routing (route v3, docs/plans/results-routing.md slice 2): the project's live earned rules, and the two
+     * eligibility facts the route itself doesn't carry (a release or candidate task; declared paths that touch the
+     * project's protected paths). Absent or null: no rule applies. */
+    earned?: EarnedInput | null;
+};
+/** One live earned rule, as routing reads it: which project-size cohort it covers, the exact Claude model it builds
+ * on, and the configured builder it was earned against (a configuration change pauses the rule; a mismatch here
+ * skips it all the same). */
+export type EarnedRule = {
+    id: number;
+    generation: number;
+    cohortSize: "small" | "medium";
+    provider: ProviderId;
+    model: string;
+    configured: {
+        provider: string;
+        model: string | null;
+    };
+};
+/** A live trial (results routing slice 3): try a cheaper Claude model on the next `limit` eligible tasks of one
+ * cohort, each still approved by a person. `reservation` is this filing's place in it (route-store.ts
+ * reserveTrialPlace): its id, or null when every place is taken, so the configured builder runs it. */
+export type EarnedTrial = EarnedRule & {
+    limit: number;
+    reservation: number | null;
+};
+export type EarnedInput = {
+    rules: readonly EarnedRule[];
+    release: boolean;
+    protected: boolean;
+    trial?: EarnedTrial | null;
 };
 export declare function specWords(spec: {
     provider: string;
@@ -203,6 +234,55 @@ export declare function specWords(spec: {
  * guess.
  */
 export declare function recommendRoute(input: RouteInput): PhaseRoute;
+/**
+ * THE BUILD LEG'S ONE PRECEDENCE ORDER (results routing, docs/plans/results-routing.md slice 2), pure:
+ *
+ *   pin > person override > trial > earned rule > configured row (light / routine / strong by size)
+ *   > headroom move
+ *
+ * Headroom moves only a configured leg, never a rule's or a trial's: their evidence is about one exact model. A rule
+ * or trial whose provider is past the headroom limits is skipped for this filing, and its reason says so. A trial
+ * applies only with a place reserved for this task (slice 3). A rule or trial applies only to an
+ * eligible task — small or medium, not risky, default quality, no screenshot or manual-review evidence, not a
+ * merging mode, not a release or candidate, nothing protected declared — and only over the configured builder it was
+ * earned against. Its leg says how it was selected (`selection`), so the route seals as version 3 and every later
+ * check reads the sealed selection, never the current rules or the reason text.
+ */
+export declare function selectBuildLeg(input: RouteInput, configured: {
+    spec: RouteCandidate;
+    tier: CandidateTier;
+    reasons: string[];
+}): {
+    leg: RouteLeg;
+    moved: boolean;
+};
+/** The earned rule this task's build takes (pure): null when none could apply (no rule for its size, or the task
+ * isn't eligible), or a rule skipped for this filing with the words why. */
+export declare function earnedRuleFor(input: RouteInput, configured: {
+    spec: RouteCandidate;
+    tier: CandidateTier;
+}): {
+    kind: "rule";
+    rule: EarnedRule;
+} | {
+    kind: "skipped";
+    reason: string;
+} | null;
+/** The trial this task's build takes (pure, results routing slice 3): null when none could apply (no live trial for
+ * its size, or the task isn't eligible: the same facts an earned rule needs), a trial with this task's place, or a
+ * trial skipped for this filing with the words why (another configured builder, no place left, no headroom). */
+export declare function trialFor(input: RouteInput, configured: {
+    spec: RouteCandidate;
+    tier: CandidateTier;
+}): {
+    kind: "trial";
+    trial: EarnedTrial & {
+        reservation: number;
+    };
+} | {
+    kind: "skipped";
+    reason: string;
+} | null;
 export declare function legOf(route: PhaseRoute, phase: Phase): RouteLeg;
 /** Every stated problem on the route, in phase order — a non-empty list
  * means the scope files unresolved with these words. */

package/dist/phase-routing.js

@@ -50,7 +50,7 @@
  */
 import { ACP_AGENTS, isAcpProvider } from "./acp-agents.js";
 import { createHash } from "node:crypto";
-import { MODEL_ID_SHAPE, postureOf, readRouteOverrides, readSealedRoute, RISKS, ROUTE_PHASES, ROUTE_PROVIDERS, ROUTE_VERSION, TASK_SIZE_WORDS, } from "./contracts/route.js";
+import { MODEL_ID_SHAPE, postureOf, readRouteOverrides, PLAIN_ROUTE_VERSION, readSealedRoute, RISKS, ROUTE_PHASES, ROUTE_PROVIDERS, ROUTE_VERSION, TASK_SIZE_WORDS, } from "./contracts/route.js";
 import { canonicalJson } from "./canonical-json.js";
 export { MODEL_ID_SHAPE };
 // Type-only imports from provider.ts: it sits under evidence.ts and scope.ts
@@ -72,7 +72,7 @@ export function exactModelId(v) {
 /** v2 adds the task's size (small / medium / large, risky or not), the
  * light tier, and plan headroom. A v1 route — sealed before sizing — still
  * reads back exactly and keeps its own digest domain. */
-export { ROUTE_VERSION };
+export { PLAIN_ROUTE_VERSION, ROUTE_VERSION };
 /** The durable route ERA a scope row carries once it was filed under this
  * policy: NULL on a row proven to predate v47 (legacy — the sealed profile
  * alone governs), this value on every row filed since. A row with an era
@@ -270,23 +270,13 @@ export function recommendRoute(input) {
             legs.push({ phase: "plan", provider: rec.spec.provider, model: rec.spec.model, tier: rec.tier, chosen: "recommended", recommended, reasons: rec.reasons, problem: planProblem(rec.spec) });
         }
     }
-    // build — pin > override > recommendation.
+    // build — one precedence order (selectBuildLeg): pin > override > trial > earned rule > configured > headroom.
     let buildMoved = false;
     const build = (() => {
-        const rec = pick("build");
-        buildMoved = rec.moved;
-        const pin = input.pins?.build ?? null;
-        const override = overrideFor("build");
-        const recommended = { provider: rec.spec.provider, model: rec.spec.model, tier: rec.tier };
-        if (pin !== null || override !== null)
-            buildMoved = false;
-        const leg = pin !== null
-            ? { phase: "build", provider: pin.provider, model: pin.model, tier: rec.tier, chosen: "pinned", recommended, reasons: [`pinned to ${specWords(pin)} by the firing that filed this task — nothing overrides a pin`], problem: null }
-            : override !== null
-                ? { phase: "build", provider: override.provider, model: override.model, tier: rec.tier, chosen: "override", recommended, reasons: [`overridden by ${override.by} to ${specWords(override)} (recommended ${specWords(rec.spec)})`], problem: null }
-                : { phase: "build", provider: rec.spec.provider, model: rec.spec.model, tier: rec.tier, chosen: "recommended", recommended, reasons: rec.reasons, problem: null };
-        legs.push(leg);
-        return leg;
+        const chosen = selectBuildLeg(input, pickTier("build"));
+        buildMoved = chosen.moved;
+        legs.push(chosen.leg);
+        return chosen.leg;
     })();
     // repair — ALWAYS the build provider (repair resumes the builder's
     // session; cross-provider repair does not exist). Only the model routes:
@@ -383,7 +373,8 @@ export function recommendRoute(input) {
         }
     }
     return {
-        version: ROUTE_VERSION,
+        // Version 3 only for a build leg that carries a selection: every other route's bytes stay version 2's.
+        version: build.selection !== undefined ? ROUTE_VERSION : PLAIN_ROUTE_VERSION,
         risk: "routine",
         qualityMode: input.qualityMode,
         publication: input.publication,
@@ -398,6 +389,127 @@ export function recommendRoute(input) {
         size: input.size ?? null,
     };
 }
+/**
+ * THE BUILD LEG'S ONE PRECEDENCE ORDER (results routing, docs/plans/results-routing.md slice 2), pure:
+ *
+ *   pin > person override > trial > earned rule > configured row (light / routine / strong by size)
+ *   > headroom move
+ *
+ * Headroom moves only a configured leg, never a rule's or a trial's: their evidence is about one exact model. A rule
+ * or trial whose provider is past the headroom limits is skipped for this filing, and its reason says so. A trial
+ * applies only with a place reserved for this task (slice 3). A rule or trial applies only to an
+ * eligible task — small or medium, not risky, default quality, no screenshot or manual-review evidence, not a
+ * merging mode, not a release or candidate, nothing protected declared — and only over the configured builder it was
+ * earned against. Its leg says how it was selected (`selection`), so the route seals as version 3 and every later
+ * check reads the sealed selection, never the current rules or the reason text.
+ */
+export function selectBuildLeg(input, configured) {
+    const pin = input.pins?.build ?? null;
+    const override = input.overrides.find(one => one.phase === "build") ?? null;
+    if (pin !== null || override !== null) {
+        // What would have run otherwise is said as it always was: the configured leg after headroom.
+        const rec = withHeadroom(input, "build", configured);
+        const recommended = { provider: rec.spec.provider, model: rec.spec.model, tier: rec.tier };
+        const leg = pin !== null
+            ? { phase: "build", provider: pin.provider, model: pin.model, tier: rec.tier, chosen: "pinned", recommended, reasons: [`pinned to ${specWords(pin)} by the firing that filed this task — nothing overrides a pin`], problem: null }
+            : { phase: "build", provider: override.provider, model: override.model, tier: rec.tier, chosen: "override", recommended, reasons: [`overridden by ${override.by} to ${specWords(override)} (recommended ${specWords(rec.spec)})`], problem: null };
+        return { leg, moved: false };
+    }
+    const trial = trialFor(input, configured);
+    if (trial !== null && trial.kind === "trial") {
+        const one = trial.trial;
+        const spec = { provider: one.provider, model: one.model };
+        return {
+            leg: {
+                phase: "build", provider: one.provider, model: one.model, tier: configured.tier, chosen: "recommended",
+                recommended: { ...spec, tier: configured.tier },
+                reasons: [...configured.reasons.slice(0, 1), `trial: ${specWords(spec)} is being tried on this project's next ${one.limit} eligible ${one.cohortSize === "small" ? "small" : "routine"} tasks instead of the configured ${specWords({ provider: one.configured.provider, model: one.configured.model ?? "default" })}; a person approves each one`],
+                problem: null,
+                selection: { kind: "trial", rule: one.id, reservation: one.reservation },
+            },
+            moved: false,
+        };
+    }
+    const earned = earnedRuleFor(input, configured);
+    if (earned !== null && earned.kind === "rule") {
+        const rule = earned.rule;
+        const spec = { provider: rule.provider, model: rule.model };
+        return {
+            leg: {
+                phase: "build", provider: rule.provider, model: rule.model, tier: configured.tier, chosen: "recommended",
+                recommended: { ...spec, tier: configured.tier },
+                reasons: [...configured.reasons.slice(0, 1), `earned rule: ${specWords(spec)} builds this project's eligible ${rule.cohortSize === "small" ? "small" : "routine"} tasks instead of the configured ${specWords({ provider: rule.configured.provider, model: rule.configured.model ?? "default" })}, on its recorded results here`],
+                problem: null,
+                selection: { kind: "rule", rule: rule.id, ruleGeneration: rule.generation },
+            },
+            moved: false,
+        };
+    }
+    const rec = withHeadroom(input, "build", configured);
+    const reasons = [...rec.reasons, ...(trial === null ? [] : [trial.reason]), ...(earned === null ? [] : [earned.reason])];
+    return {
+        leg: { phase: "build", provider: rec.spec.provider, model: rec.spec.model, tier: rec.tier, chosen: "recommended", recommended: { provider: rec.spec.provider, model: rec.spec.model, tier: rec.tier }, reasons, problem: null },
+        moved: rec.moved,
+    };
+}
+/** The earned rule this task's build takes (pure): null when none could apply (no rule for its size, or the task
+ * isn't eligible), or a rule skipped for this filing with the words why. */
+export function earnedRuleFor(input, configured) {
+    const earned = input.earned ?? null;
+    const size = input.size ?? null;
+    if (earned === null || size === null || size.risky || (size.size !== "small" && size.size !== "medium"))
+        return null;
+    const rule = earned.rules.find(one => one.cohortSize === size.size) ?? null;
+    if (rule === null)
+        return null;
+    if (earned.release || earned.protected || input.qualityMode !== "default" || input.publication === "automerge")
+        return null;
+    if (input.evidence.some(kind => kind === "screenshot" || kind === "manual-review"))
+        return null;
+    if (demandedTier(input, "build").tier !== "routine")
+        return null;
+    // Only Claude reports the model it ran, so only a Claude cohort can earn a rule.
+    if (rule.provider !== "claude" || !exactModel(rule.model))
+        return null;
+    if (configured.spec.provider !== rule.configured.provider || configured.spec.model !== rule.configured.model) {
+        return { kind: "skipped", reason: `the earned rule for ${size.size === "small" ? "small" : "routine"} tasks was earned against another configured builder — not applied` };
+    }
+    const room = (input.headroom ?? []).find(one => one.provider === rule.provider) ?? null;
+    const tight = room === null ? null : tightWords(room);
+    if (tight !== null)
+        return { kind: "skipped", reason: `earned rule skipped for this filing: ${tight} — the configured builder runs it` };
+    return { kind: "rule", rule };
+}
+/** The trial this task's build takes (pure, results routing slice 3): null when none could apply (no live trial for
+ * its size, or the task isn't eligible: the same facts an earned rule needs), a trial with this task's place, or a
+ * trial skipped for this filing with the words why (another configured builder, no place left, no headroom). */
+export function trialFor(input, configured) {
+    const trial = input.earned?.trial ?? null;
+    const size = input.size ?? null;
+    if (trial === null || size === null || size.risky || (size.size !== "small" && size.size !== "medium") || trial.cohortSize !== size.size)
+        return null;
+    if (input.earned.release || input.earned.protected || input.qualityMode !== "default" || input.publication === "automerge")
+        return null;
+    if (input.evidence.some(kind => kind === "screenshot" || kind === "manual-review"))
+        return null;
+    if (demandedTier(input, "build").tier !== "routine")
+        return null;
+    // Only Claude reports the model it ran, so only a Claude cohort runs a trial.
+    if (trial.provider !== "claude" || !exactModel(trial.model) || !Number.isSafeInteger(trial.limit) || trial.limit < 1)
+        return null;
+    const words = size.size === "small" ? "small" : "routine";
+    if (configured.spec.provider !== trial.configured.provider || configured.spec.model !== trial.configured.model) {
+        return { kind: "skipped", reason: `the trial for ${words} tasks was started against another configured builder — not applied` };
+    }
+    const room = (input.headroom ?? []).find(one => one.provider === trial.provider) ?? null;
+    const tight = room === null ? null : tightWords(room);
+    if (tight !== null)
+        return { kind: "skipped", reason: `trial skipped for this filing: ${tight} — the configured builder runs it` };
+    if (trial.reservation === null || !Number.isSafeInteger(trial.reservation) || trial.reservation < 1) {
+        return { kind: "skipped", reason: `every place in the trial for ${words} tasks is taken — the configured builder runs it` };
+    }
+    return { kind: "trial", trial: { ...trial, reservation: trial.reservation } };
+}
 /**
  * PLAN HEADROOM (v2), at filing:
  *
@@ -494,6 +606,8 @@ export function canonicalRouteJson(route) {
             recommended: leg.recommended,
             reasons: leg.reasons,
             problem: leg.problem,
+            // v3 (results routing): the build leg's selection is in the bytes, so in the digest; v1 and v2 bytes never change.
+            ...(route.version === 3 && leg.selection !== undefined ? { selection: leg.selection } : {}),
         })),
         overrides: route.overrides.map(one => ({ phase: one.phase, provider: one.provider, model: one.model, by: one.by, at: one.at })),
         // v2 carries the size it was routed for; a v1 snapshot's bytes never change.

package/dist/project-delete.d.ts

@@ -30,6 +30,10 @@ export type ProjectDeleteResult = {
     said: string;
     running?: string[];
 };
+/** The project's Models rows, counted with its settings and deleted by forgetProjectModels only. */
+export declare const MODEL_SETTINGS: readonly [table: string, column: string][];
+/** The project's settings tables, for the deletion test's inventory. */
+export declare const PROJECT_SETTINGS: readonly [table: string, column: string][];
 /** What Toolroll holds for a project, counted. */
 export declare function projectHoldings(store: Store, repo: string): ProjectHoldings;
 /** What's in it, in words: "12 tasks, 3 versions, 30 runs, …". Empty kinds are left out. */

package/dist/project-delete.js

@@ -15,7 +15,7 @@
 import { existsSync, lstatSync, rmSync } from "node:fs";
 import { isAbsolute, relative, resolve } from "node:path";
 import { teardownGit, refusal } from "./teardown-git.js";
-import { BUILT_IN } from "./store.js";
+import { BUILT_IN, forgetProjectModels } from "./store.js";
 import { BRANCH_PREFIXES, isOwnBranch } from "./names.js";
 /** The tables whose history is the audit record itself: never touched. */
 const KEPT = new Set(["action_ledger", "ledger_seal", "ledger_checkpoint"]);
@@ -42,13 +42,19 @@ function doomed(db, repo) {
     const subagents = ids(db, "SELECT id FROM subagent WHERE repo = ?", repo);
     return { refs, tasks, runs, artifacts, threads, turns, flows, cards, subagents };
 }
-/** A project's settings: one row per thing someone set for it. */
+/** A project's settings: one row per thing someone set for it. Its Models rows (phase_config, phase_tier_config,
+ * phase_tier_alternate) are settings too, but go only through store.ts forgetProjectModels, which moves their
+ * generations and takes the project's results-routing rows with them (MODEL_SETTINGS). */
 const SETTINGS = [
     ["approval_policy", "repo"], ["verify_command", "repo"], ["worktree_setup", "repo"], ["backend_grant", "repo"], ["publication_grant", "repo"],
-    ["intake_grant", "repo"], ["capability", "repo"], ["project_tool", "repo"], ["phase_config", "scope"], ["phase_tier_config", "scope"],
+    ["intake_grant", "repo"], ["capability", "repo"], ["project_tool", "repo"],
     ["learning_policy", "repo"], ["operating_mode", "repo"], ["project_knowledge", "repo"], ["live_detail_setting", "repo"],
     ["project_decision", "repo"], ["flow_script", "repo"], ["workflow_recipe", "repo"], ["team_lead_project", "project"],
 ];
+/** The project's Models rows, counted with its settings and deleted by forgetProjectModels only. */
+export const MODEL_SETTINGS = Object.freeze([["phase_config", "scope"], ["phase_tier_config", "scope"], ["phase_tier_alternate", "scope"]]);
+/** The project's settings tables, for the deletion test's inventory. */
+export const PROJECT_SETTINGS = Object.freeze(SETTINGS.map(one => [...one]));
 /** What Toolroll holds for a project, counted. */
 export function projectHoldings(store, repo) {
     const db = store.handle;
@@ -61,7 +67,7 @@ export function projectHoldings(store, repo) {
         checkouts: count("SELECT COUNT(*) AS n FROM worktree WHERE repo = ?", repo),
         chats: d.threads.length, flows: d.flows.length, cards: d.cards.length, subagents: d.subagents.length,
         budgets: count(`SELECT COUNT(*) AS n FROM budget WHERE removed_at IS NULL AND ((scope_kind = 'project' AND scope_key = ?) OR (scope_kind = 'subagent' AND scope_key IN (SELECT CAST(value AS TEXT) FROM json_each(?))))`, repo, json(d.subagents)),
-        settings: SETTINGS.filter(([table]) => tableExists(db, table)).reduce((sum, [table, column]) => sum + count(`SELECT COUNT(*) AS n FROM ${table} WHERE ${column} = ?`, repo), 0),
+        settings: [...SETTINGS, ...MODEL_SETTINGS].filter(([table]) => tableExists(db, table)).reduce((sum, [table, column]) => sum + count(`SELECT COUNT(*) AS n FROM ${table} WHERE ${column} = ?`, repo), 0),
     };
 }
 /** What's in it, in words: "12 tasks, 3 versions, 30 runs, …". Empty kinds are left out. */
@@ -315,6 +321,8 @@ function deleteRows(store, repo, d, now) {
     del("memory_sighting", "gap IN (SELECT id FROM memory_gap WHERE repo = ?) OR session IN (SELECT id FROM memory_session WHERE repo = ?)", repo, repo);
     for (const [table, column] of SETTINGS)
         del(table, `${column} = ?`, repo);
+    // Its Models rows and results-routing rows: through the Models counter, so whatever depended on them pauses.
+    rows += forgetProjectModels(store, repo, now);
     del("project_mute", "repo = ?", repo);
     for (const table of ["knowledge_change", "project_identity_carry", "project_skill_change", "memory_gap", "memory_proposal", "memory_rejection", "memory_session", "memory_search", "mode_rail", "side_spend", "watch_episode", "worktree", "coordinator_proposal", "lead_commitment"])
         del(table, "repo = ?", repo);

package/dist/project-knowledge.d.ts

@@ -22,18 +22,18 @@ export type KnowledgeView = ReturnType<typeof knowledgeView>;
 export declare function knowledgeVersion(store: Store, repo: string, actor: string, revision: number): Knowledge;
 /** Chat reads only an admitted project. Keep the full source in the project UI. */
 export declare function conversationKnowledge(store: Store, repo: string, actor: string, reference?: string, decision?: number): {
-    content?: never;
+    history?: never;
     revision: number;
     stale: boolean;
     notice: string;
     decision?: never;
     title?: never;
-    history?: never;
+    content?: never;
     instructions?: never;
     references?: never;
     decisions?: never;
 } | {
-    content?: never;
+    history?: never;
     stale?: never;
     decision: {
         repo: string;
@@ -51,27 +51,27 @@ export declare function conversationKnowledge(store: Store, repo: string, actor:
     };
     notice: string;
     title?: never;
+    content?: never;
     revision?: never;
-    history?: never;
     instructions?: never;
     references?: never;
     decisions?: never;
 } | {
+    history?: never;
     stale?: never;
     decision?: never;
     revision: number;
     title: string;
     content: string;
     notice: string;
-    history?: never;
     instructions?: never;
     references?: never;
     decisions?: never;
 } | {
-    content?: never;
     stale?: never;
     decision?: never;
     title?: never;
+    content?: never;
     revision: number;
     history: {
         revision: number;