toolroll 0.9.91 → 0.9.93

package/dist/server/tasks.js

@@ -44,6 +44,7 @@ import { validKeyTail } from "../live-records.js";
 import { runNotes } from "../live-notes.js";
 import { latestFinishedAttempt, retryNoteOf } from '../needs-you.js';
 import { REMOTE_MESSAGES } from "../operate-remote.js";
+import { proveRunStopped } from "../stop-proof.js";
 import { aggregateNewNames, observeWorktree, parseBaseTreeSnapshot, PEEK_LIMITS } from "../peek.js";
 import { isTaskSize, PHASES as ROUTE_PHASES } from "../phase-routing.js";
 import { applyModeToNewFiling, authorizePlanUnderMode } from "../plan-auto.js";
@@ -59,7 +60,7 @@ import { structuredHandoffView, terminalDiffView } from "../result-evidence-read
 import { fileAddTestsTask, requestFollowUpChecks } from '../result-follow-ups.js';
 import { commentSourceKey, isRevisionFeedback, parseResultTab, resultReturnTarget } from "../result-review.js";
 import { isAlive as runnerAlive } from "../runner.js";
-import { passwordlessSessionFor, acceptanceLinesToInput, acceptanceToLines, approvalOf, approve as approveScope, freshnessFor, localApprovalEligible, spendingOnlyOnSuccess, ssoNowAvailable, withFreshness, modeFilingCoverage, PLACEHOLDER_RUBRIC, proposeGuarded } from "../scope.js";
+import { passwordlessSessionFor, acceptanceLinesToInput, acceptanceToLines, approvalOf, approve as approveScope, freshnessFor, freshlyApprovable, localApprovalEligible, spendingOnlyOnSuccess, ssoNowAvailable, withFreshness, modeFilingCoverage, PLACEHOLDER_RUBRIC, proposeGuarded } from "../scope.js";
 import { subagentNames as subagentNamesOf } from "../spend.js";
 import { verifiedAuthor } from "../store.js";
 import { runCostWords } from "../summary.js";
@@ -78,6 +79,10 @@ import { timingFor } from "../latency-timeline.js";
 import { ACCEPT_ANYWAY_NEEDS_REASON, editorFileHref, proofBundleView, rankReviewQueue, RESULT_REFUSALS, REVIEW_QUEUE_CAP, reviewCockpitDetailParts, reviewCockpitPage, reviewPriorityOf, runFactsFragment, runOutcomeBadge, withRefusal } from "./render-results.js";
 import { approvalFormDigest, approveRefusalWords, checkProgressHtml, consentDoorOf, nonceHashOf, PermissionsWouldChange, requirementsFromEditor, resumeDigestOf, taskOf } from "./render-tasks.js";
 import {} from "./session.js";
+import { approveReleaseCard, releaseApprovalCard, releaseSheetHref, releaseTaskOf } from "../release-approval.js";
+import { releaseSheetPage } from "./render-release.js";
+import { approvalFactsNow } from "./kit.js";
+import { localOwnerRefusal } from "../local-owner.js";
 export function createTasksHandlers(runtime) {
     const { identities, store, peekSay, peekCache, PEEK_CACHE_TTL_MS, peekInFlight, PEEK_GLOBAL_INFLIGHT, peekBySession, PEEK_SESSION_INFLIGHT, clock, peekName, PEEK_FRAGMENT_BYTES, peekEvict, evidenceRoot, sendScreen, chromeFor, visible, consumeApprovalNonce, authenticateApprover, options, mintApprovalNonce, taskScreen, unscopedMode, admissionList, planViewOf, revisionViewOf, runIsTaskResult, leadPrincipal, familyOf, armTaskResume, runIsLive, revisionLedgerOf, resultDetailOf, reviewFactsFor, taskRepoOf, runVisible, restricted, codingActorAllowed, codingProjectAllowed, managedRepos, routeViewOf, workAccess, firstRunStepsNow, revisionDocOf, failureOf, dockedConversation, planContractViewOf, familiesInView, explainAttempt, taskChatFocus, familyTasksInView, liveCeiling, projectOf, ceiling, bustBadge, revisionDestination } = runtime;
     /** A row admitted the address but its path parameter does not parse: the console's unknown page. */
@@ -1284,14 +1289,14 @@ export function createTasksHandlers(runtime) {
         }
         return redirect(response, decisionBack);
     }
-    async function taskConfirmStopped(ctx) {
-        const { url, who, response, now, posted } = ctx;
-        const act = matchTaskPath(url.pathname, "/confirm-stopped$");
+    async function taskRecheckStopped(ctx) {
+        const { url, who, response, posted } = ctx;
+        const act = matchTaskPath(url.pathname, "/recheck-stopped$");
         if (act === null)
             return noPage(who, response);
-        const body = readForm(posted, CONSOLE_FORMS.confirmStopped);
-        // Confirming a finished build stopped is an approver's act behind the password, typed again — the same
-        // record as `toolroll run settle`, refused while anything of the run may still be running.
+        const body = readForm(posted, CONSOLE_FORMS.recheckStopped);
+        // Check again: Toolroll looks at this computer's processes for the build once more (stop-proof.ts) and settles it
+        // when none of them is the build's. Nobody vouches that a build stopped, so there is nothing to confirm here.
         const back = taskHref(act.taskId);
         const ref = store.lookupRef(act.taskId);
         if (ref === null || !visible(ref.repo))
@@ -1302,19 +1307,19 @@ export function createTasksHandlers(runtime) {
         if (run === null || runTask === null || familyOf(runTask)?.root.id !== (familyOf(act.taskId)?.root.id ?? act.taskId)) {
             return taskScreen(response, who, act.taskId, "That build isn't part of this task.", 409);
         }
-        if (!authenticateApprover(who, body.get("token") ?? "", ref.repo).ok || !store.accountCanAccess(who.name, ref.repo)) {
-            return taskScreen(response, who, act.taskId, "That password didn't match. Nothing changed.", 403);
-        }
-        // When Toolroll can't check at all, the approver also says they checked: never a one-click confirmation.
-        if (store.stopQuiescenceFact(run.id)?.kind === "unknown" && body.get("checked") !== "yes") {
-            return taskScreen(response, who, act.taskId, `Make sure nothing from build #${run.id} is running, then tick the box to confirm.`, 409);
-        }
-        const settled = store.settleRunWitnessesByApprover({ runId: run.id, by: who.name, why: "Confirmed in the console that nothing from this build is running." }, now);
-        if (!settled.ok) {
-            return taskScreen(response, who, act.taskId, settled.reason === "alive" || settled.reason === "still-running"
-                ? `Something from build #${run.id} may still be running, so it can't be confirmed stopped yet.` : `Build #${run.id} can't be confirmed stopped.`, 409);
-        }
+        if (!store.accountCanAccess(who.name, ref.repo))
+            return taskScreen(response, who, act.taskId, "You can't act on this project's tasks.", 403);
+        const proved = await proveRunStopped(store, run.id, clock);
         bustBadge();
+        const left = store.stopQuiescenceFact(run.id);
+        if (left !== null) {
+            const words = proved.outcome === "blocked" ? `Build #${proved.run} ${proved.words}.`
+                : left.kind === "alive" || left.kind === "open" ? `Something from build #${left.run} may still be running. Toolroll stops what it proves is the build's on its own.`
+                    : left.kind === "elsewhere" ? `Build #${left.run} ran on another computer; only that computer can check it stopped.`
+                        : left.kind === "unknown" ? `Toolroll still can't prove build #${left.run} stopped from this computer.`
+                            : `Toolroll is still making sure build #${left.run} stopped. This clears on its own.`;
+            return taskScreen(response, who, act.taskId, words, 409);
+        }
         const to = resultReturnTarget(body.get("return"), run.id, runTasks(run.taskRef));
         return redirect(response, body.get("return") ? to : back);
     }
@@ -1444,6 +1449,8 @@ export function createTasksHandlers(runtime) {
             const result = requestResultChanges(store, evidenceRoot, {
                 run: id, batch: body.get("batch"), source: body.get("source"), actor: who.name,
                 repos: admissionList(), includeUnplaced: visible(null), allowMode: who.via === "cookie",
+                // A browser session is a person's proof; a bearer credential is a machine's.
+                origin: who.via === "cookie" ? "person" : "machine",
                 note: body.get("note") ?? "", path: body.get("path") ?? "", line: body.get("line") ?? "", request: body.get("request"), image,
             }, now);
             if (!result.ok) {
@@ -1556,6 +1563,7 @@ export function createTasksHandlers(runtime) {
         const result = createResultRevision(store, evidenceRoot, {
             run: id, batch: body.get("batch"), source: body.get("source"), actor: who.name,
             repos: admissionList(), includeUnplaced: visible(null), allowMode: who.via === "cookie",
+            origin: who.via === "cookie" ? "person" : "machine",
         }, now);
         if (!result.ok)
             return refuse(response, who, result.status, result.message, back);
@@ -2455,7 +2463,11 @@ export function createTasksHandlers(runtime) {
                     : requestedReturn === null
                         ? taskHref(taskId)
                         : safeChatReturn(requestedReturn);
+                // The release sheet's Approve release (trusted-release-reports.md A7): the same door, its own page for words.
+                const sheet = body.get("sheet") === "release";
                 const approvalProblem = (message, status) => {
+                    if (sheet)
+                        return releaseSheet.sheetScreen({ who, response, project: null }, taskId, message, status);
                     if (requestedReturn !== null && requestedReturn !== "next") {
                         return redirect(response, chatReturnWithSaid(approvalBack, message));
                     }
@@ -2481,6 +2493,9 @@ export function createTasksHandlers(runtime) {
                     && !(who.authority === "local-owner" && localApprovalEligible(store, who.name, taskId).ok)) {
                     return approvalProblem("approval requires your password, typed again", 400);
                 }
+                // The sheet binds the release card's digest (the nonce was minted for it): the shared card wrapper decides.
+                if (sheet)
+                    return releaseSheet.approveFromSheet({ who, response, project: null }, taskId, digest, token);
                 const scopeRow = store.getScope(taskId);
                 if (scopeRow === null)
                     return approvalProblem("this task has no scope to approve", 409);
@@ -3075,6 +3090,7 @@ export function createTasksHandlers(runtime) {
         return live;
     }
     const tidyHandlers = createTidyHandlers(runtime);
+    const releaseSheet = createReleaseSheetHandlers(runtime);
     /** The question page, with a refusal in its box when an answer was refused (the box keeps the choice to make). */
     function decisionScreen(ctx, id, back, refusal, code, now, draft) {
         const { who, response, project } = ctx;
@@ -3092,6 +3108,7 @@ export function createTasksHandlers(runtime) {
     }
     const registrations = handlersOf("tasks", {
         ...tidyHandlers,
+        ...releaseSheet.routes,
         ...createAgentSignalHandlers(runtime),
         "code.page": showCode("workspace"),
         "code.session": showCode("session"),
@@ -3152,7 +3169,7 @@ export function createTasksHandlers(runtime) {
         "task.act.retry-review": taskAct("retry-review"),
         "task.act.complete": taskAct("complete"),
         "task.act.merge": taskMerge,
-        "task.act.confirm-stopped": taskConfirmStopped,
+        "task.act.recheck-stopped": taskRecheckStopped,
         "task.act.stop": taskAct("stop"),
         "task.act.stop-carrying": taskAct("stop-carrying"),
         "task.act.pause": taskAct("pause"),
@@ -3311,3 +3328,71 @@ export function createAgentSignalHandlers(runtime) {
     }
     return { "agents.seen": agentSeen, "agents.watch": agentWatch };
 }
+/**
+ * One-tap release approval (docs/plans/trusted-release-reports.md, slice A): the sheet (`/t/<id>/release`), the push's
+ * opaque locator (`/approve/<task ref>`, a GET that only redirects to the sheet) and the sheet's approval, which the
+ * task approval POST hands here once its shared checks (cookie session, CSRF and the browser key at admission, the
+ * single-use nonce, a password or a standing proof) passed. The approval itself is the shared card wrapper around the
+ * unchanged approve() (release-approval.ts approveReleaseCard).
+ */
+export function createReleaseSheetHandlers(runtime) {
+    const { store, sendScreen, chromeFor, visible, mintApprovalNonce, clock } = runtime;
+    const missing = (who, response) => refuse(response, who, 404, "There's no release waiting for approval at this address.", "/work");
+    /** The sheet, with a problem said where it happened. */
+    function sheetScreen(ctx, taskId, problem, status) {
+        const { who, response, project } = ctx;
+        const ref = store.lookupRef(taskId);
+        if (ref === null || !visible(ref.repo) || !store.accountCanAccess(who.name, ref.repo))
+            return missing(who, response);
+        const built = releaseApprovalCard(store, taskId);
+        if (!built.ok)
+            return missing(who, response);
+        const card = built.card;
+        const open = card.approved === null && card.refusal === null;
+        // This computer's local owner can't approve a release: the full sign-in comes first (scope.ts localApprovalEligible).
+        const local = who.via === "cookie" && who.authority === "local-owner" ? localOwnerRefusal(store.accountOf(who.name)?.passwordSet === true, releaseSheetHref(taskId)) : null;
+        const nonce = open && local === null && who.via === "cookie" && who.role === "approver" ? mintApprovalNonce(who.name, taskId, card.digest) : "";
+        const remembered = (() => {
+            if (!open || who.via !== "cookie")
+                return false;
+            const fresh = withFreshness("approve-standard", () => freshnessFor(who.name, Date.now(), true));
+            if (fresh === null)
+                return false;
+            const gate = store.approvalGate(taskId, who.name, "person");
+            return freshlyApprovable(store, taskId, card.scope, gate.verdict === "seal" && !gate.protectedWork);
+        })();
+        return sendScreen(response, status, releaseSheetPage(chromeFor(project ?? ref.repo, "work"), { card, nonce, facts: approvalFactsNow({ remembered }), local, problem }));
+    }
+    async function showSheet(ctx) {
+        const task = matchTaskPath(ctx.url.pathname, "/release$");
+        if (task === null)
+            return missing(ctx.who, ctx.response);
+        return sheetScreen(ctx, task.taskId, null, 200);
+    }
+    /** The push's locator: proved a release in the person's projects from the plane's own state, then only redirected. */
+    async function locate(ctx) {
+        const { who, response, url } = ctx;
+        const raw = /^\/approve\/([1-9][0-9]{0,14})$/.exec(url.pathname)?.[1];
+        const ref = raw === undefined ? null : store.refForId(Number(raw));
+        if (ref === null || ref.backend !== "built-in" || !visible(ref.repo) || !store.accountCanAccess(who.name, ref.repo) || releaseTaskOf(store, ref.externalId) === null)
+            return missing(who, response);
+        return redirect(response, releaseSheetHref(ref.externalId));
+    }
+    /** The sheet's Approve release, after the approval POST's shared checks. */
+    function approveFromSheet(ctx, taskId, cardDigest, token) {
+        const { who, response } = ctx;
+        const now = clock();
+        const answer = spendingOnlyOnSuccess(() => withFreshness("approve-standard", () => approveReleaseCard(store, { taskId, cardDigest, approveNow: scopeDigest => approveScope(store, taskId, who.name, now, scopeDigest, token) })), result => !result.ok && !(result.reason === "approve" && result.result.reason === "second-approver" && !result.result.already));
+        if (answer.ok)
+            return redirect(response, releaseSheetHref(taskId));
+        if (answer.reason !== "approve")
+            return sheetScreen(ctx, taskId, answer.message, answer.reason === "not-release" ? 404 : 409);
+        const refused = answer.result;
+        if (refused.reason === "second-approver")
+            return sheetScreen(ctx, taskId, gateWords({ verdict: "vote", have: refused.have, need: 2, already: refused.already }), 200);
+        if (refused.reason === "policy")
+            return sheetScreen(ctx, taskId, refused.message, 403);
+        return sheetScreen(ctx, taskId, approveRefusalWords(refused.reason), refused.reason === "changed" || refused.reason === "unrouted" ? 409 : 403);
+    }
+    return { routes: { "task.release": showSheet, "release.locate": locate }, sheetScreen, approveFromSheet };
+}

package/dist/settings-proofs.js

@@ -35,11 +35,13 @@ export const PROOF_INVENTORY = [
     { id: "google", action: "Connect or disconnect Google", routes: ["/settings/google", "/settings/google/disconnect"], form: "google", field: null, proof: "none", ...NONE, role: "any", secrets: ["clientSecret"], terms: [] },
     { id: "appearance", action: "Change the theme or accent", routes: ["/settings/appearance"], form: "appearance", field: null, proof: "none", ...NONE, role: "any", secrets: [], terms: [] },
     { id: "chat-approval-confirm", action: "Review approving from chat", routes: ["/settings/chat-approval/confirm", "/settings/chat-approval/off"], form: "chatApproval", field: null, proof: "none", ...NONE, role: "approver", secrets: [], terms: [] },
+    { id: "models-rules-off", action: "Turn an earned rule off, stop a trial, say Not now, or turn suggestions off", routes: ["/settings/models/turn-off", "/settings/models/not-now", "/settings/models/suggest-off", "/settings/models/stop"], form: "modelsRules", field: null, proof: "none", ...NONE, role: "operator", secrets: [], terms: [] },
     ...CHAT_APPS.map(([app, name, form]) => ({ id: `${app}-alerts`, action: `Send alerts to ${name}`, routes: [`/settings/${app}/alerts`], form, field: null, proof: "none", ...NONE, role: "approver", secrets: [], terms: [] })),
     // Step-up: a password typed now, the Passwordless session, or a one-use re-check.
     { id: "permission-default", action: "Start new tasks with Full access", routes: ["/settings/permission-default"], form: "permissionDefault", field: "password", proof: "step-up", when: "only when widening to Full access", ...ACCEPT, role: "any", secrets: [], terms: [] },
     { id: "spend-budget", action: "Set a monthly limit", routes: ["/spend/budget"], form: "spendBudget", field: "password", proof: "step-up", ...ACCEPT, role: "operator", secrets: [], terms: [] },
     { id: "models-agent", action: "Change which model does each job", routes: ["/settings/models/agent"], form: "modelsChange", field: "password", proof: "step-up", ...ACCEPT, role: "operator", secrets: [], terms: ["scope", "digest"] },
+    { id: "models-rules", action: "Accept a suggested model, try a cheaper one, keep a paused rule, or turn suggestions on", routes: ["/settings/models/accept", "/settings/models/keep", "/settings/models/suggest-on", "/settings/models/try"], form: "modelsRules", field: "password", proof: "step-up", ...ACCEPT, role: "operator", secrets: [], terms: ["scope", "id", "rule"], note: "the rule door re-proves the session and its generation in the write" },
     { id: "models-apply", action: "Apply a model preset or switch", routes: ["/settings/models/apply"], form: "modelsChange", field: "password", proof: "step-up", ...ACCEPT, role: "operator", secrets: [], terms: ["scope", "digest", "change"], note: "plus the previewed preset, or switch and to" },
     ...[
         ["policy", "Change the policy", "policy", "operator"],

package/dist/spend-ui.d.ts

@@ -10,6 +10,7 @@ import { type ApprovalFacts } from "./design/kit.js";
 import { type BudgetState, type SpendItem } from "./spend.js";
 import type { SpendReport } from "./spend-report.js";
 import type { BrowserLimits } from "./browser-workspace.js";
+import { type SavingsReport } from "./route-savings.js";
 /** The page's own layout: the limit rows and meters, the summary figures and the quiet bars. Colour from tokens only. */
 export declare const SPEND_CSS: string;
 /** What this page doesn't record, in plain words (docs/plans/spend-dashboard.md §2.2). */
@@ -53,6 +54,10 @@ export type SpendView = {
     facts?: ApprovalFacts;
     /** This month's name (YYYY-MM): the limits are this month's. */
     current?: string;
+    /** Suggestions and rules (route-savings.ts): what each rule, trial and suggestion observed, or that it can't be read. */
+    savings?: SavingsReport | {
+        error: string;
+    } | null;
 };
 /** Dollars for the page: a positive amount under a cent reads "<$0.01", never a false $0. */
 export declare const money: (microusd: number) => string;
@@ -62,6 +67,12 @@ export declare function spendHtml(view: SpendView, said: {
     said?: string | null;
     problem?: string | null;
 }): Html;
+/** Suggestions and rules (docs/plans/results-routing.md, slice 4): per project and size, each live or recently ended
+ * rule or trial, and each standing suggestion, with what it observed over matched 90-day windows. Labelled "observed,
+ * not a promise"; a median shows only from 5 API-priced results a side; unknown is "—", never $0. Read-only. */
+export declare function savingsSection(savings: SavingsReport | {
+    error: string;
+} | null): Html | "";
 /** Checks the amount next to its field before any password is asked or the form leaves the page; the server checks
  * it again. Remove skips it. */
 export declare function spendScript(): string;

package/dist/spend-ui.js

@@ -10,6 +10,7 @@ import { approvalAsk, termsOf } from "./design/kit.js";
 import { acts, btn, chip, disclose, dock, empty, field, input, note, notice, segLinks, settingsShell } from "./server/kit.js";
 import { budgetLabel, usd } from "./spend.js";
 import { runHref, taskHref } from "./server/http.js";
+import { notEnoughWords, pricesWords, sideWords, SAVINGS_LABEL } from "./route-savings.js";
 const projectName = (repo) => repo.split("/").filter(Boolean).pop() ?? repo;
 /** The page's own layout: the limit rows and meters, the summary figures and the quiet bars. Colour from tokens only. */
 export const SPEND_CSS = `.spend{display:grid;gap:24px;min-width:0}.spend-sec{display:grid;gap:0}.spend-sec .k-secthead{margin-bottom:0}.spend-sec .k-secthead small{font-weight:400;color:var(--so-muted);font-size:12.5px}` +
@@ -29,7 +30,14 @@ export const SPEND_CSS = `.spend{display:grid;gap:24px;min-width:0}.spend-sec{di
     `.spend-win.warning .spend-meter>i,.spend-win.danger .spend-meter>i{background:var(--so-danger)}.spend .k-disclose{padding-top:4px}.spend .k-disclose[open]>summary{margin-bottom:8px}` +
     `@media(max-width:760px){.spend-lim-h{grid-template-columns:minmax(0,1fr) auto}.spend-lim-a{grid-column:1/-1}.spend-lim-a .k-btn{width:100%}.spend-sum{grid-template-columns:minmax(0,1fr)}` +
     `.spend-sum>div+div{border-left:0;border-top:1px solid var(--so-line);padding-left:0}.spend-bar{grid-template-columns:minmax(0,120px) minmax(0,1fr) 68px;gap:8px;font-size:12.5px}` +
-    `.spend-edit-row .k-field{flex:1 1 100%}.spend .k-btn.k-btn-primary.k-docked{display:none}}`;
+    `.spend-edit-row .k-field{flex:1 1 100%}.spend .k-btn.k-btn-primary.k-docked{display:none}}` +
+    // Suggestions and rules (results-routing slice 4): each rule's two sides, side by side; stacked on a phone.
+    `.spend-rr{display:grid;gap:10px;padding:14px 0;border-bottom:1px solid var(--so-line);min-width:0}.spend-rr-h{display:flex;flex-wrap:wrap;align-items:center;gap:6px 10px;min-width:0}` +
+    `.spend-rr-t{font-weight:500;overflow-wrap:anywhere;min-width:0}.spend-rr-x{font-size:12.5px;color:var(--so-muted);overflow-wrap:anywhere}` +
+    `.spend-rr-g{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:12px}.spend-rr-s{display:grid;gap:4px;align-content:start;min-width:0;padding:12px;border:1px solid var(--so-line);border-radius:8px}` +
+    `.spend-rr-k{font-size:12px;color:var(--so-muted);overflow-wrap:anywhere}.spend-rr-v{font-size:18px;font-weight:600;font-variant-numeric:tabular-nums}.spend-rr-v small{font-size:12px;font-weight:400;color:var(--so-muted)}` +
+    `.spend-rr-p{display:grid;gap:2px;margin:0;padding:0;list-style:none;font-size:12.5px;color:var(--so-muted)}.spend-rr .k-note{margin:0}` +
+    `@media(max-width:760px){.spend-rr-g{grid-template-columns:minmax(0,1fr)}}`;
 const ROLE_WORDS = {
     builder: "Builds", repair: "Repairs", planner: "Plans", reviewer: "Reviews", scout: "Scouting",
     lead: "Lead chat", chat: "Chat", subagent: "Subagents", flow: "Flows", evals: "Evals",
@@ -148,10 +156,49 @@ export function spendHtml(view, said) {
     const docked = edit !== null && (rows.some(row => row.target === edit.target) || adding !== null)
         ? dock(btn("Save limit", { variant: "primary", type: "submit", attrs: { form: `limit-${edit.target.replace(/[^a-z0-9]+/gi, "-").replace(/^-|-$/g, "").slice(0, 60) || "new"}`, name: "action", value: "save" } }))
         : "";
-    const body = html `<div class="spend">${limits}${monthBar}${figures}${breakdowns}${windows}${notCounted}</div>${docked}`;
+    const body = html `<div class="spend">${limits}${monthBar}${figures}${breakdowns}${windows}${savingsSection(view.savings ?? null)}${notCounted}</div>${docked}`;
     return settingsShell({ group: "spend", title: "Spend", lead: "What agents cost, by project and by model, with the limits that stop them. Dates are UTC months.", body,
         flags: { spend: saved.some(one => one.budget !== null && limitNeedsYou(one.budget)) } });
 }
+const sizeWords = (size) => size === "small" ? "Small tasks" : "Routine tasks";
+const dateWords = (iso) => new Intl.DateTimeFormat("en-US", { month: "short", day: "numeric", year: "numeric", timeZone: "UTC" }).format(new Date(iso));
+const STATUS_TONE = { active: "live", trialling: "live", paused: "needs" };
+/** One side of a rule's comparison: its model and window, the median API dollars a task (— when hidden), and the
+ * completeness, plan usage, unknown cost and remediation counts, each on its own line. */
+function savingsSide(label, side) {
+    const words = sideWords(side);
+    const cap = (text) => text.charAt(0).toUpperCase() + text.slice(1);
+    return html `<div class="spend-rr-s" role="group" aria-label="${label}: ${side.name}" data-side="${label.toLowerCase()}"><span class="spend-rr-k">${label} · ${side.name} · ${dateWords(side.from)} to ${dateWords(side.to)}</span>\
+<span class="spend-rr-v" data-amount-kind="api" data-microusd="${side.medianApiMicrousd ?? ""}">${words.median} <small>median API dollars a task</small></span>\
+<ul class="spend-rr-p"><li data-priced="${side.apiPriced}" data-results="${side.results}">${words.parts[0]}</li><li data-amount-kind="subscription">${cap(words.parts[1])}</li><li data-amount-kind="unknown">${cap(words.parts[2])}</li><li>${cap(words.parts[3])}</li></ul></div>`;
+}
+function savingsRow(row) {
+    const suggestion = row.kind === "suggestion";
+    const what = `${row.cheaper.name} instead of ${row.configured.name}${row.kind === "trial" ? " (a trial)" : suggestion ? " (suggested, not in use)" : ""}`;
+    const href = `/settings/models?scope=${encodeURIComponent(row.repo)}#models-suggested`;
+    return html `<article class="spend-rr" data-savings-row data-kind="${row.kind}" data-state="${row.state}" data-enough="${row.enough ? "yes" : "no"}">\
+<div class="spend-rr-h"><span class="spend-rr-t">${row.project} · ${sizeWords(row.size)}</span>${chip(row.status, STATUS_TONE[row.state] ?? "")}</div><span class="spend-rr-x">${what}</span>\
+<div class="spend-rr-g">${savingsSide(suggestion ? "Configured" : "Before", row.configured)}${savingsSide(suggestion ? "Suggested" : "After", row.cheaper)}</div>\
+${row.enough ? "" : html `<p class="k-note" data-not-enough>${notEnoughWords(row)}</p>`}<p class="k-note" data-prices>${pricesWords(row)}</p>\
+<span><a class="k-link" href="${href}">${suggestion ? "Review in Models settings" : "Open Models settings"}</a></span></article>`;
+}
+/** Suggestions and rules (docs/plans/results-routing.md, slice 4): per project and size, each live or recently ended
+ * rule or trial, and each standing suggestion, with what it observed over matched 90-day windows. Labelled "observed,
+ * not a promise"; a median shows only from 5 API-priced results a side; unknown is "—", never $0. Read-only. */
+export function savingsSection(savings) {
+    if (savings === null)
+        return "";
+    const state = `${SAVINGS_LABEL} · 90 days a side`;
+    if ("error" in savings)
+        return sec("savings", "Suggestions and rules", state, notice("Suggestions and rules can't be read right now. Nothing else on this page is affected."), html ` data-savings="error"`);
+    if (savings.rows.length === 0) {
+        return sec("savings", "Suggestions and rules", state, empty({ title: "No suggestions or rules yet.",
+            text: "When a cheaper model does as well on a project's small or routine tasks, its suggestion shows here, and once it's in use, what it cost before and after." }), html ` data-savings="empty"`);
+    }
+    const stale = savings.staleSince === null ? "" : html `<p class="k-note" data-savings-stale>Some results were last checked on ${dateWords(savings.staleSince)}; they update while Toolroll runs.</p>`;
+    const lead = html `<p class="k-note">Median API dollars a task, including revision and repair runs. Plan usage and unknown cost are counted apart, never added in. A median shows once each side has ${savings.minPriced} results priced in API dollars.</p>`;
+    return sec("savings", "Suggestions and rules", state, html `${lead}${stale}${savings.rows.map(savingsRow)}`, html ` data-savings="rows"`);
+}
 /** Checks the amount next to its field before any password is asked or the form leaves the page; the server checks
  * it again. Remove skips it. */
 export function spendScript() {

package/dist/stop-proof.d.ts

@@ -0,0 +1,67 @@
+import { type StopOptions } from "./run-closeout.js";
+import { type Store } from "./store.js";
+/** How long after a run finished its processes have to go on their own before Toolroll looks. */
+export declare const STOP_PROOF_GRACE_MS = 60000;
+export type StopProofOutcome = 
+/** Proven stopped and settled, in the ledger with its evidence. */
+"settled"
+/** Not yet: inside the grace period, a live child is still tracked here, or a leftover was just stopped. */
+ | "waiting"
+/** This computer can't prove it (can't look, another computer's process, or something it didn't start is in the
+ * folder). Recorded once, in plain words. */
+ | "blocked"
+/** Nothing for this proof to do: already stopped, still open, alive on its own record, or a native sandbox. */
+ | "skipped";
+export type StopProofResult = {
+    run: number;
+    outcome: StopProofOutcome;
+    words: string;
+    stopped?: number;
+};
+export type StopProofOptions = StopOptions & {
+    /** How long after the run finished before Toolroll looks (STOP_PROOF_GRACE_MS). `graceMs` is the SIGTERM grace. */
+    afterFinishMs?: number;
+    /** Which processes have their working directory inside each path; must throw when it can't tell. */
+    cwds?: (paths: readonly string[]) => Map<string, number[]>;
+    /** Every process's command line, by pid; must throw when it can't tell. */
+    commandLines?: () => Map<number, string>;
+    /** The live service's own pid (its ancestors are never targets). */
+    self?: number;
+    /** The worktree note check (worktree.ts); throws when the note can't be read. */
+    occupancy?: (path: string) => {
+        held: true;
+        by: number;
+    } | {
+        held: false;
+    };
+    /** Called after processes were stopped: a cached look must be read again. */
+    refresh?: () => void;
+};
+/** One pass's shared look at this computer: the process table, folders and command lines are read once for every
+ * run the pass checks, and again after anything was stopped. */
+export declare function sharedLook(options?: StopProofOptions): StopProofOptions;
+/** Which processes work inside each path, from the OS: /proc on Linux, lsof on macOS. Unlike a best-effort listing,
+ * it throws when the listing can't be read: no answer is never "nobody". */
+export declare function processesInStrict(paths: readonly string[], listing?: readonly {
+    pid: number;
+    cwd: string;
+}[]): Map<string, number[]>;
+/** Every process's working directory, from the OS; throws when the listing can't be read. */
+export declare function processFolders(): {
+    pid: number;
+    cwd: string;
+}[];
+/** Every process's command line, by pid. Read to match a folder's path in memory only; never stored or shown. */
+export declare function processCommandLines(): Map<number, string>;
+/** Whether a command line names `path` or something inside it (a whole path, never a longer folder's prefix). */
+export declare function namesPath(line: string, path: string): boolean;
+/**
+ * Prove one finished run stopped, on this computer, without asking anyone (see the file's comment). Walks the run's
+ * owned runs one unproven stop at a time. Never signals a process that isn't proven the run's.
+ */
+export declare function proveRunStopped(store: Store, runId: number, clock: () => Date, options?: StopProofOptions): Promise<StopProofResult>;
+/** The worker's pass (operate.ts reconcile): every finished run of this computer whose stop is unproven where
+ * Toolroll's own look can prove it. A batch a pass, oldest first; a blocked run never holds newer ones back. */
+export declare function proveFinishedRunsStopped(store: Store, clock: () => Date, options?: StopProofOptions & {
+    batch?: number;
+}): Promise<StopProofResult[]>;