toolroll 0.9.91 → 0.9.93

package/dist/store.js

@@ -35,6 +35,7 @@ import { actorLabel, currentActor } from "./actor.js";
 import { scanForSecrets } from "./evidence.js";
 import { LIVE_ACTIVITY_KINDS } from "./live.js";
 import { hashSecret, mintLeadToken, parseCredential, secretMatches, tokenPurpose, tokenRotationProblem } from "./api-tokens.js";
+import { admitTrialRun, bumpModelsGeneration, forgetProjectRoutes, liveEarnedRules, liveTrialFor, noteExposureCancelled, noteExposureFiled, noteExposureSealed, releaseTrialPlaces, reserveTrialPlace, ruleHoldOf, settleTrialPlaces, trialSealProblem, writeRunCohort } from "./route-store.js";
 /**
  * The database: a small task store, and the operational overlay beside it.
  *
@@ -1110,7 +1111,13 @@ const REGISTERED_AT_FILING = "again, as it was filed";
 // read 1), a browser session's authority (web_session.authority; saved rows read 'full'), its local generation, key
 // epoch and key hash (saved rows read NULL: no local binding, and a stale key), and the running console's key epoch
 // (console_instance.key_epoch; NULL). V147_ADDED_COLUMNS.
-export const SCHEMA_VERSION = 147;
+// v148 adds, and changes no saved row (docs/plans/results-routing.md): the results-routing tables (V148_SCHEMA, new
+// tables only) and a run's execution class, a revision's origin and a project's "Suggest cheaper models" switch
+// (V148_ADDED_COLUMNS: saved rows read NULL, NULL and 1).
+// v149 adds, and changes no saved row (docs/plans/learning-loops.md): every learning-loops table (V149_SCHEMA, new
+// tables only) — each check's recorded conditions and results, mixed-outcome observations, tracked identities, lesson
+// notes and their tallies, memory use, tidy-up proposals and decision merges.
+export const SCHEMA_VERSION = 149;
 /** v118: the tables merged into `credential`, in the order they move (a person's API tokens keep their ids first). */
 export const V118_MERGED_TABLES = Object.freeze({ api_token: "person", coordinator_credential: "coordinator", lead_credential: "lead" });
 /** The foreign keys that named a merged table, exactly as their DDL wrote them; each names `credential(id)` instead. */
@@ -1243,7 +1250,7 @@ const V115_DROPPED_REFERENCES = /\s+REFERENCES (?:contestant|contest|tournament_
  * unchanged), and adds the nullable column in V125_ADDED_COLUMNS, checked the same way. v126 only adds a new table
  * (task_source) and the columns in V126_ADDED_COLUMNS (null or 0), checked the same way.
  */
-export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147]);
+export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149]);
 /** v119: the columns it adds, by table, with the value every row saved before it reads (toolroll-update's HISTORY_RULES). */
 export const V119_ADDED_COLUMNS = Object.freeze({
     task_ref: { planning_generation: { definition: "INTEGER NOT NULL DEFAULT 0", saved: "0" } },
@@ -1498,6 +1505,377 @@ export const V147_ADDED_COLUMNS = Object.freeze({
 });
 /** The v147 migration's steps after the epoch, in order: a test seam (OpenOptions.migrationStep) may stop after each. */
 export const V147_STEPS = Object.freeze(["epoch", "local-mode", "password-set", "web-session", "console-instance"]);
+/**
+ * v148 (docs/plans/results-routing.md): every table the results-routing arc uses, landed at once because a current
+ * store runs no DDL. Slice 1 writes run_cohort, route_record and models_generation; route_rule, route_exposure* and
+ * route_trial_reservation are written from later slices. src/route-store.ts is the only writer of all of them (the
+ * migration aside), which release-auto.ts's routing scan (route-hooks.ts) holds a release to.
+ *
+ * - run_cohort: one row per code-writing run (builder, repair), written in the run's admission transaction beside its
+ *   route stamp and never updated: the sealed facts its eligibility was decided from. cohort_size NULL = not eligible,
+ *   with the reason in `ineligible`.
+ * - route_record: a task family's result record (keyed by its root task_ref), recomputed by the reconcile pass.
+ *   `settled` = its verdict (state, reason, result, acceptance, decision time) is final; its spending and counts keep
+ *   accumulating through later revision and repair runs until `closed` (the family is quiet, or 90 days after its
+ *   first run: route-results.ts ACCUMULATE_FOR_MS).
+ * - route_rule: an earned rule or a trial, with its sealed grant, price snapshot and the configuration generations it
+ *   depends on; one live winner per project and size (route_rule_one_winner).
+ * - route_exposure / route_exposure_event: one exposure per task and rule, its events append-only.
+ * - route_trial_reservation: a trial's place, reserved, then consumed (once, at admission) or released.
+ * - models_generation: a counter per (scope, phase), moved by every Models row writer in the same transaction.
+ */
+export const V148_SCHEMA = `
+CREATE TABLE IF NOT EXISTS run_cohort (
+  run              INTEGER PRIMARY KEY REFERENCES run(id) ON DELETE CASCADE,
+  task_ref         INTEGER NOT NULL REFERENCES task_ref(id) ON DELETE CASCADE,
+  root_ref         INTEGER NOT NULL REFERENCES task_ref(id) ON DELETE CASCADE,
+  repo             TEXT,
+  role             TEXT NOT NULL CHECK (role IN ('builder','repair')),
+  size             TEXT CHECK (size IS NULL OR size IN ('small','medium','large')),
+  risky            INTEGER CHECK (risky IS NULL OR risky IN (0,1)),
+  quality_mode     TEXT NOT NULL CHECK (quality_mode IN ('default','strict')),
+  evidence_demands INTEGER NOT NULL CHECK (evidence_demands IN (0,1)),
+  publication      TEXT NOT NULL CHECK (publication IN ('none','notify','automerge')),
+  release          INTEGER NOT NULL CHECK (release IN (0,1)),
+  protected        INTEGER NOT NULL CHECK (protected IN (0,1)),
+  selection_json   TEXT NOT NULL,
+  route_digest     TEXT NOT NULL,
+  provider         TEXT NOT NULL,
+  model            TEXT,
+  cohort_size      TEXT CHECK (cohort_size IS NULL OR cohort_size IN ('small','medium')),
+  ineligible       TEXT,
+  started_at       TEXT NOT NULL,
+  CHECK ((cohort_size IS NULL) = (ineligible IS NOT NULL))
+);
+CREATE INDEX IF NOT EXISTS run_cohort_by_task ON run_cohort (task_ref);
+CREATE INDEX IF NOT EXISTS run_cohort_by_root ON run_cohort (repo, root_ref);
+CREATE TABLE IF NOT EXISTS route_record (
+  task_ref            INTEGER PRIMARY KEY REFERENCES task_ref(id) ON DELETE CASCADE,
+  repo                TEXT,
+  cohort_size         TEXT CHECK (cohort_size IS NULL OR cohort_size IN ('small','medium')),
+  provider            TEXT,
+  model               TEXT,
+  state               TEXT NOT NULL CHECK (state IN ('pending','provisional','mature','rejected','not-counted')),
+  reason              TEXT,
+  result_run          INTEGER REFERENCES run(id) ON DELETE SET NULL,
+  first_started_at    TEXT,
+  accepted_at         TEXT,
+  decided_at          TEXT,
+  model_failures      INTEGER NOT NULL DEFAULT 0 CHECK (model_failures >= 0),
+  infra_failures      INTEGER NOT NULL DEFAULT 0 CHECK (infra_failures >= 0),
+  api_microusd        INTEGER NOT NULL DEFAULT 0 CHECK (api_microusd >= 0),
+  subscription_runs   INTEGER NOT NULL DEFAULT 0 CHECK (subscription_runs >= 0),
+  subscription_tokens INTEGER NOT NULL DEFAULT 0 CHECK (subscription_tokens >= 0),
+  unknown_runs        INTEGER NOT NULL DEFAULT 0 CHECK (unknown_runs >= 0),
+  remediation_runs    INTEGER NOT NULL DEFAULT 0 CHECK (remediation_runs >= 0),
+  person_revisions    INTEGER NOT NULL DEFAULT 0 CHECK (person_revisions >= 0),
+  first_check_passed  INTEGER CHECK (first_check_passed IS NULL OR first_check_passed IN (0,1)),
+  agent_turns         INTEGER NOT NULL DEFAULT 0 CHECK (agent_turns >= 0),
+  turns_unknown_runs  INTEGER NOT NULL DEFAULT 0 CHECK (turns_unknown_runs >= 0),
+  provenance_json     TEXT NOT NULL DEFAULT '[]',
+  settled             INTEGER NOT NULL DEFAULT 0 CHECK (settled IN (0,1)),
+  closed              INTEGER NOT NULL DEFAULT 0 CHECK (closed IN (0,1)),
+  evaluated_at        TEXT NOT NULL,
+  CHECK ((state IN ('rejected','not-counted')) = (reason IS NOT NULL)),
+  CHECK (closed = 0 OR settled = 1)
+);
+CREATE INDEX IF NOT EXISTS route_record_by_cohort ON route_record (repo, cohort_size, state, first_started_at);
+CREATE INDEX IF NOT EXISTS route_record_open ON route_record (evaluated_at) WHERE closed = 0;
+CREATE TABLE IF NOT EXISTS route_rule (
+  id                  INTEGER PRIMARY KEY AUTOINCREMENT,
+  repo                TEXT NOT NULL,
+  cohort_size         TEXT NOT NULL CHECK (cohort_size IN ('small','medium')),
+  kind                TEXT NOT NULL CHECK (kind IN ('rule','trial')),
+  provider            TEXT NOT NULL,
+  model               TEXT NOT NULL,
+  configured_provider TEXT NOT NULL,
+  configured_model    TEXT,
+  state               TEXT NOT NULL CHECK (state IN ('active','trialling','paused','switched-off','turned-off','expired','dropped','finished')),
+  generation          INTEGER NOT NULL DEFAULT 1 CHECK (generation >= 1),
+  grant_json          TEXT NOT NULL,
+  prices_json         TEXT NOT NULL,
+  depends_json        TEXT NOT NULL,
+  trial_limit         INTEGER CHECK (trial_limit IS NULL OR trial_limit >= 1),
+  accepted_by         TEXT NOT NULL,
+  accepted_at         TEXT NOT NULL,
+  ended_at            TEXT,
+  ended_by            TEXT,
+  end_reason          TEXT,
+  CHECK ((kind = 'trial') = (trial_limit IS NOT NULL))
+);
+CREATE UNIQUE INDEX IF NOT EXISTS route_rule_one_winner ON route_rule (repo, cohort_size) WHERE state IN ('active','trialling','paused');
+CREATE TABLE IF NOT EXISTS route_exposure (
+  id         INTEGER PRIMARY KEY AUTOINCREMENT,
+  task_ref   INTEGER NOT NULL REFERENCES task_ref(id) ON DELETE CASCADE,
+  rule       INTEGER NOT NULL REFERENCES route_rule(id) ON DELETE CASCADE,
+  created_at TEXT NOT NULL,
+  closed_at  TEXT,
+  UNIQUE (task_ref, rule)
+);
+CREATE TABLE IF NOT EXISTS route_exposure_event (
+  id       INTEGER PRIMARY KEY AUTOINCREMENT,
+  exposure INTEGER NOT NULL REFERENCES route_exposure(id) ON DELETE CASCADE,
+  kind     TEXT NOT NULL CHECK (kind IN ('proposed','refiled','approved-as-proposed','approved-with-other','cancelled')),
+  model    TEXT,
+  at       TEXT NOT NULL,
+  CHECK ((kind = 'approved-with-other') = (model IS NOT NULL))
+);
+CREATE INDEX IF NOT EXISTS route_exposure_event_by_exposure ON route_exposure_event (exposure, id);
+CREATE TABLE IF NOT EXISTS route_trial_reservation (
+  id           INTEGER PRIMARY KEY AUTOINCREMENT,
+  rule         INTEGER NOT NULL REFERENCES route_rule(id) ON DELETE CASCADE,
+  task_ref     INTEGER NOT NULL REFERENCES task_ref(id) ON DELETE CASCADE,
+  scope_digest TEXT NOT NULL,
+  state        TEXT NOT NULL CHECK (state IN ('reserved','consumed','released')),
+  consumed_run INTEGER REFERENCES run(id) ON DELETE SET NULL,
+  created_at   TEXT NOT NULL,
+  updated_at   TEXT NOT NULL,
+  UNIQUE (rule, task_ref),
+  CHECK (state = 'consumed' OR consumed_run IS NULL)
+);
+CREATE TABLE IF NOT EXISTS models_generation (
+  scope      TEXT NOT NULL,
+  phase      TEXT NOT NULL,
+  generation INTEGER NOT NULL CHECK (generation >= 1),
+  changed_at TEXT NOT NULL,
+  PRIMARY KEY (scope, phase)
+);
+`;
+/** The tables V148_SCHEMA adds, in the order a test drops them to make the v147 shape. */
+export const V148_TABLES = Object.freeze(["route_trial_reservation", "route_exposure_event", "route_exposure", "route_rule", "route_record", "run_cohort", "models_generation"]);
+/** v148: a run's execution class (saved runs read NULL: none kept, which the records count as the model's), a
+ * revision's origin (saved revisions read NULL: not recorded, never a person), and a project's "Suggest cheaper models"
+ * switch (saved projects read 1: on). */
+export const V148_ADDED_COLUMNS = Object.freeze({
+    run: { exec_class: { definition: "TEXT CHECK (exec_class IS NULL OR exec_class IN ('model','infrastructure'))", saved: "NULL" } },
+    task_ref: { revision_origin: { definition: "TEXT CHECK (revision_origin IS NULL OR revision_origin IN ('person','automatic-review','flow','lead','machine'))", saved: "NULL" } },
+    project: { suggest_models: { definition: "INTEGER NOT NULL DEFAULT 1 CHECK (suggest_models IN (0,1))", saved: "1" } },
+});
+/** The v148 migration's steps after v147's, in order (OpenOptions.migrationStep may stop after each). */
+export const V148_STEPS = Object.freeze(["results-tables", "exec-class", "revision-origin", "suggest-models"]);
+/**
+ * v149 (docs/plans/learning-loops.md): every table the learning-loops arc uses, landed at once because a current store
+ * runs no DDL. Slice 1 writes check_fact, check_result and learning_watch; the rest are written from later slices.
+ * Each table has one writer module (the migration aside), which release-auto's learning scan (eval-hooks.ts
+ * learningWriteProblem) holds a release to: check_fact and check_result → check-facts.ts; local_observation → flaky.ts;
+ * ci_flaky_observation and ci_pairing_rejected → flaky-ci.ts; learning_watch → flaky.ts and lesson-notes.ts;
+ * lesson_note and lesson_note_tally → lesson-notes.ts; memory_use → memory-use.ts; memory_tidy_proposal and
+ * decision_merge → memory-tidy.ts.
+ *
+ * Nothing here is ever read for authority: a check's outcome, a verdict and an approval never change because of it.
+ *
+ * Deletion follows today's semantics (runs are never deleted by ordinary work; removing a project keeps its results).
+ * The tables are keyed by repo path with no foreign key to `project`; their run keys are plain REFERENCES with no ON
+ * DELETE action. check_fact, learning_watch, lesson_note, lesson_note_tally, memory_use, memory_tidy_proposal and
+ * decision_merge are kept and never deleted (their triggers allow only the columns their one writer sets: a watch's
+ * `until`, a tally's counters, a proposal's decision, a merge's undo). check_result, local_observation,
+ * ci_flaky_observation and ci_pairing_rejected are pruned after 180 days by the storage sweep's own step (a later
+ * slice), the only DELETE on them; their rows never change. The whole-project deletion (project-delete.ts), which
+ * lifts every guard for its one transaction, takes them with the project as it takes everything else.
+ */
+export const V149_SCHEMA = `
+CREATE TABLE IF NOT EXISTS check_fact (
+  run               INTEGER PRIMARY KEY REFERENCES run(id),
+  repo              TEXT,
+  task_ref          INTEGER NOT NULL,
+  head              TEXT,
+  tree              TEXT,
+  command_digest    TEXT,
+  access            TEXT,
+  harness_digest    TEXT,
+  lockfile          TEXT,
+  conditions_digest TEXT,
+  conditions_class  TEXT,
+  purpose           TEXT NOT NULL CHECK (purpose IN ('ordinary','release','nightly')),
+  learn_state       TEXT NOT NULL CHECK (learn_state IN ('recorded','not-recorded','not-asked')),
+  learn_why         TEXT,
+  recorded_at       TEXT NOT NULL,
+  CHECK ((learn_state = 'not-recorded') = (learn_why IS NOT NULL)),
+  CHECK ((conditions_digest IS NULL) = (conditions_class IS NULL)),
+  CHECK (conditions_digest IS NULL OR tree IS NOT NULL)
+);
+CREATE INDEX IF NOT EXISTS check_fact_by_repo ON check_fact (repo, recorded_at);
+CREATE INDEX IF NOT EXISTS check_fact_by_tree ON check_fact (tree, conditions_digest);
+CREATE TABLE IF NOT EXISTS check_result (
+  run         INTEGER NOT NULL REFERENCES check_fact(run),
+  identity    TEXT NOT NULL CHECK (length(identity) BETWEEN 1 AND 2600),
+  state       TEXT NOT NULL CHECK (state IN ('failed','passed','skipped','passed-on-retry')),
+  source      TEXT NOT NULL CHECK (source IN ('receipt','report','log','learn')),
+  recorded_at TEXT NOT NULL,
+  PRIMARY KEY (run, identity, source)
+);
+CREATE INDEX IF NOT EXISTS check_result_by_identity ON check_result (identity, run);
+CREATE TABLE IF NOT EXISTS local_observation (
+  id                INTEGER PRIMARY KEY AUTOINCREMENT,
+  repo              TEXT NOT NULL,
+  identity          TEXT NOT NULL,
+  failed_run        INTEGER NOT NULL REFERENCES run(id),
+  passed_run        INTEGER NOT NULL REFERENCES run(id),
+  tree              TEXT NOT NULL,
+  conditions_digest TEXT NOT NULL,
+  kind              TEXT NOT NULL CHECK (kind IN ('regate','same-tree','in-check-retry')),
+  observed_at       TEXT NOT NULL,
+  UNIQUE (identity, failed_run, passed_run),
+  CHECK ((kind = 'in-check-retry') = (failed_run = passed_run))
+);
+CREATE INDEX IF NOT EXISTS local_observation_by_repo ON local_observation (repo, identity, observed_at);
+CREATE TABLE IF NOT EXISTS ci_flaky_observation (
+  id                INTEGER PRIMARY KEY AUTOINCREMENT,
+  repo              TEXT NOT NULL,
+  provider          TEXT NOT NULL CHECK (provider = 'github'),
+  repository        TEXT NOT NULL,
+  workflow          TEXT NOT NULL,
+  lane_id           TEXT NOT NULL,
+  lane_name         TEXT NOT NULL,
+  workflow_run_id   INTEGER NOT NULL CHECK (workflow_run_id >= 1),
+  head_sha          TEXT NOT NULL,
+  failed_attempt    INTEGER NOT NULL CHECK (failed_attempt >= 1),
+  failed_job_id     INTEGER NOT NULL,
+  failed_conclusion TEXT NOT NULL,
+  passed_attempt    INTEGER NOT NULL,
+  passed_job_id     INTEGER NOT NULL,
+  passed_conclusion TEXT NOT NULL,
+  observed_at       TEXT NOT NULL,
+  UNIQUE (provider, repository, workflow_run_id, lane_id, failed_attempt, passed_attempt),
+  CHECK (passed_attempt > failed_attempt)
+);
+CREATE INDEX IF NOT EXISTS ci_flaky_observation_by_repo ON ci_flaky_observation (repo, lane_id, observed_at);
+CREATE TABLE IF NOT EXISTS ci_pairing_rejected (
+  provider        TEXT NOT NULL CHECK (provider = 'github'),
+  repository      TEXT NOT NULL,
+  workflow_run_id INTEGER NOT NULL CHECK (workflow_run_id >= 1),
+  attempt         INTEGER NOT NULL CHECK (attempt >= 1),
+  lane_id         TEXT,
+  why             TEXT NOT NULL,
+  at              TEXT NOT NULL,
+  PRIMARY KEY (provider, repository, workflow_run_id, attempt, why)
+);
+CREATE TABLE IF NOT EXISTS learning_watch (
+  repo       TEXT NOT NULL,
+  identity   TEXT NOT NULL CHECK (length(identity) BETWEEN 1 AND 2600),
+  reason     TEXT NOT NULL CHECK (reason IN ('note','observation')),
+  source_ref TEXT NOT NULL,
+  since      TEXT NOT NULL,
+  until      TEXT,
+  PRIMARY KEY (repo, identity, reason, source_ref),
+  CHECK (until IS NULL OR until >= since)
+);
+CREATE INDEX IF NOT EXISTS learning_watch_open ON learning_watch (repo, since) WHERE until IS NULL;
+CREATE TABLE IF NOT EXISTS lesson_note (
+  proposal                INTEGER PRIMARY KEY REFERENCES memory_proposal(id),
+  repo                    TEXT NOT NULL,
+  failed_run              INTEGER NOT NULL REFERENCES run(id),
+  passing_run             INTEGER NOT NULL REFERENCES run(id),
+  repair_chain            INTEGER REFERENCES repair_chain(id),
+  revision_origin         TEXT CHECK (revision_origin IS NULL OR revision_origin IN ('person','automatic-review','flow','lead','machine')),
+  identities_json         TEXT NOT NULL,
+  changed_paths_json      TEXT NOT NULL,
+  test_files_changed_json TEXT NOT NULL,
+  facts_digest            TEXT NOT NULL,
+  created_at              TEXT NOT NULL,
+  CHECK (failed_run <> passing_run)
+);
+CREATE INDEX IF NOT EXISTS lesson_note_by_repo ON lesson_note (repo, created_at);
+CREATE TABLE IF NOT EXISTS lesson_note_tally (
+  note                INTEGER NOT NULL REFERENCES lesson_note(proposal),
+  month               TEXT NOT NULL CHECK (month GLOB '[0-9][0-9][0-9][0-9]-[0-1][0-9]'),
+  executions          INTEGER NOT NULL DEFAULT 0 CHECK (executions >= 0),
+  failures            INTEGER NOT NULL DEFAULT 0 CHECK (failures >= 0 AND failures <= executions),
+  mixed_failures      INTEGER NOT NULL DEFAULT 0 CHECK (mixed_failures >= 0),
+  received_executions INTEGER NOT NULL DEFAULT 0 CHECK (received_executions >= 0 AND received_executions <= executions),
+  received_failures   INTEGER NOT NULL DEFAULT 0 CHECK (received_failures >= 0 AND received_failures <= received_executions AND received_failures <= failures),
+  unreported_checks   INTEGER NOT NULL DEFAULT 0 CHECK (unreported_checks >= 0),
+  sources_json        TEXT NOT NULL DEFAULT '[]',
+  partial             INTEGER NOT NULL DEFAULT 0 CHECK (partial IN (0,1)),
+  PRIMARY KEY (note, month)
+);
+CREATE TABLE IF NOT EXISTS memory_use (
+  run         INTEGER NOT NULL REFERENCES run(id),
+  repo        TEXT,
+  kind        TEXT NOT NULL CHECK (kind IN ('lesson','reference','decision')),
+  item        TEXT NOT NULL,
+  version     INTEGER,
+  phase       TEXT NOT NULL,
+  included_at TEXT,
+  PRIMARY KEY (run, kind, item)
+);
+CREATE INDEX IF NOT EXISTS memory_use_by_item ON memory_use (repo, kind, item, run);
+CREATE TABLE IF NOT EXISTS memory_tidy_proposal (
+  id            INTEGER PRIMARY KEY AUTOINCREMENT,
+  repo          TEXT NOT NULL,
+  kind          TEXT NOT NULL CHECK (kind IN ('retire','merge','contradiction','note-failing','restore','unmerge')),
+  items_json    TEXT NOT NULL,
+  after_text    TEXT,
+  rationale     TEXT NOT NULL,
+  evidence_json TEXT NOT NULL,
+  source        TEXT NOT NULL CHECK (source IN ('usage','duplicate','model','note','person')),
+  status        TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending','accepted','rejected','stale')),
+  created_at    TEXT NOT NULL,
+  decided_by    TEXT,
+  decided_proof TEXT,
+  decided_at    TEXT,
+  CHECK ((status = 'pending') = (decided_at IS NULL)),
+  CHECK (status IN ('accepted','rejected') OR (decided_by IS NULL AND decided_proof IS NULL)),
+  CHECK (status NOT IN ('accepted','rejected') OR decided_by IS NOT NULL)
+);
+CREATE INDEX IF NOT EXISTS memory_tidy_proposal_pending ON memory_tidy_proposal (repo, status, kind);
+CREATE TABLE IF NOT EXISTS decision_merge (
+  merge                INTEGER NOT NULL,
+  successor            INTEGER NOT NULL REFERENCES project_decision(id),
+  successor_revision   INTEGER NOT NULL CHECK (successor_revision >= 1),
+  predecessor          INTEGER NOT NULL REFERENCES project_decision(id),
+  predecessor_revision INTEGER NOT NULL CHECK (predecessor_revision >= 1),
+  at                   TEXT NOT NULL,
+  by                   TEXT NOT NULL,
+  undone_at            TEXT,
+  undone_by            TEXT,
+  PRIMARY KEY (merge, predecessor),
+  CHECK (successor <> predecessor),
+  CHECK ((undone_at IS NULL) = (undone_by IS NULL))
+);
+CREATE INDEX IF NOT EXISTS decision_merge_by_successor ON decision_merge (successor);
+CREATE INDEX IF NOT EXISTS decision_merge_by_predecessor ON decision_merge (predecessor);
+CREATE TRIGGER IF NOT EXISTS check_fact_no_update BEFORE UPDATE ON check_fact BEGIN SELECT RAISE(ABORT,'check facts are recorded once'); END;
+CREATE TRIGGER IF NOT EXISTS check_fact_no_delete BEFORE DELETE ON check_fact BEGIN SELECT RAISE(ABORT,'check facts are kept'); END;
+CREATE TRIGGER IF NOT EXISTS check_result_no_update BEFORE UPDATE ON check_result BEGIN SELECT RAISE(ABORT,'check results are recorded once'); END;
+CREATE TRIGGER IF NOT EXISTS local_observation_no_update BEFORE UPDATE ON local_observation BEGIN SELECT RAISE(ABORT,'observations are recorded once'); END;
+CREATE TRIGGER IF NOT EXISTS ci_flaky_observation_no_update BEFORE UPDATE ON ci_flaky_observation BEGIN SELECT RAISE(ABORT,'observations are recorded once'); END;
+CREATE TRIGGER IF NOT EXISTS ci_pairing_rejected_no_update BEFORE UPDATE ON ci_pairing_rejected BEGIN SELECT RAISE(ABORT,'rejected pairings are recorded once'); END;
+CREATE TRIGGER IF NOT EXISTS learning_watch_only_ends BEFORE UPDATE ON learning_watch
+  WHEN NEW.repo IS NOT OLD.repo OR NEW.identity IS NOT OLD.identity OR NEW.reason IS NOT OLD.reason OR NEW.source_ref IS NOT OLD.source_ref
+    OR NEW.since IS NOT OLD.since OR OLD.until IS NOT NULL OR NEW.until IS NULL
+  BEGIN SELECT RAISE(ABORT,'a tracked identity only ends, once'); END;
+CREATE TRIGGER IF NOT EXISTS learning_watch_no_delete BEFORE DELETE ON learning_watch BEGIN SELECT RAISE(ABORT,'tracked identities are kept'); END;
+CREATE TRIGGER IF NOT EXISTS lesson_note_no_update BEFORE UPDATE ON lesson_note BEGIN SELECT RAISE(ABORT,'lesson note facts are recorded once'); END;
+CREATE TRIGGER IF NOT EXISTS lesson_note_no_delete BEFORE DELETE ON lesson_note BEGIN SELECT RAISE(ABORT,'lesson notes are kept'); END;
+CREATE TRIGGER IF NOT EXISTS lesson_note_tally_only_counts BEFORE UPDATE ON lesson_note_tally
+  WHEN NEW.note IS NOT OLD.note OR NEW.month IS NOT OLD.month OR NEW.executions < OLD.executions OR NEW.failures < OLD.failures
+    OR NEW.mixed_failures < OLD.mixed_failures OR NEW.received_executions < OLD.received_executions OR NEW.received_failures < OLD.received_failures
+    OR NEW.unreported_checks < OLD.unreported_checks OR NEW.partial < OLD.partial
+  BEGIN SELECT RAISE(ABORT,'a tally only counts up'); END;
+CREATE TRIGGER IF NOT EXISTS lesson_note_tally_no_delete BEFORE DELETE ON lesson_note_tally BEGIN SELECT RAISE(ABORT,'tallies are never pruned'); END;
+CREATE TRIGGER IF NOT EXISTS memory_use_no_update BEFORE UPDATE ON memory_use BEGIN SELECT RAISE(ABORT,'memory use is recorded once'); END;
+CREATE TRIGGER IF NOT EXISTS memory_use_no_delete BEFORE DELETE ON memory_use BEGIN SELECT RAISE(ABORT,'memory use is kept'); END;
+CREATE TRIGGER IF NOT EXISTS memory_tidy_proposal_only_decides BEFORE UPDATE ON memory_tidy_proposal
+  WHEN NEW.id IS NOT OLD.id OR NEW.repo IS NOT OLD.repo OR NEW.kind IS NOT OLD.kind OR NEW.items_json IS NOT OLD.items_json
+    OR NEW.after_text IS NOT OLD.after_text OR NEW.rationale IS NOT OLD.rationale OR NEW.evidence_json IS NOT OLD.evidence_json
+    OR NEW.source IS NOT OLD.source OR NEW.created_at IS NOT OLD.created_at OR OLD.status <> 'pending'
+  BEGIN SELECT RAISE(ABORT,'a tidy-up proposal is decided once'); END;
+CREATE TRIGGER IF NOT EXISTS memory_tidy_proposal_no_delete BEFORE DELETE ON memory_tidy_proposal BEGIN SELECT RAISE(ABORT,'tidy-up proposals are kept'); END;
+CREATE TRIGGER IF NOT EXISTS decision_merge_only_undone BEFORE UPDATE ON decision_merge
+  WHEN NEW.merge IS NOT OLD.merge OR NEW.successor IS NOT OLD.successor OR NEW.successor_revision IS NOT OLD.successor_revision
+    OR NEW.predecessor IS NOT OLD.predecessor OR NEW.predecessor_revision IS NOT OLD.predecessor_revision OR NEW.at IS NOT OLD.at
+    OR NEW.by IS NOT OLD.by OR OLD.undone_at IS NOT NULL
+  BEGIN SELECT RAISE(ABORT,'a merge is undone once, never rewritten'); END;
+CREATE TRIGGER IF NOT EXISTS decision_merge_no_delete BEFORE DELETE ON decision_merge BEGIN SELECT RAISE(ABORT,'merges are kept'); END;
+`;
+/** The tables V149_SCHEMA adds, in the order a test drops them to make the v148 shape (dependents first). */
+export const V149_TABLES = Object.freeze(["check_result", "check_fact", "local_observation", "ci_flaky_observation", "ci_pairing_rejected", "learning_watch",
+    "lesson_note_tally", "lesson_note", "memory_use", "memory_tidy_proposal", "decision_merge"]);
+/** The v149 tables a whole-project deletion clears by repo (the rest hang off these or a deleted run or decision). */
+export const V149_REPO_TABLES = Object.freeze(["check_fact", "local_observation", "ci_flaky_observation", "learning_watch", "lesson_note", "memory_use", "memory_tidy_proposal"]);
+/** The v149 migration's steps after v148's, in order (OpenOptions.migrationStep may stop after each). */
+export const V149_STEPS = Object.freeze(["learning-tables"]);
 /**
  * v135: one approval per release (docs/plans/release-once.md). `release_authority` is the single source of truth for a
  * release a person approved: one row per generation, changed only by compare-and-swap on `rev`, with a lease whose
@@ -4776,6 +5154,22 @@ CREATE INDEX IF NOT EXISTS run_checkpoint_by_task ON run_checkpoint (task_ref, i
     for (const [column, { definition }] of Object.entries(V147_ADDED_COLUMNS["console_instance"]))
         addColumn(db, "console_instance", column, definition);
     step("console-instance");
+    // v148: the results-routing tables (new tables only) and the execution class, revision origin and suggestion switch
+    // (V148_ADDED_COLUMNS: saved rows read their declared values). Each step is idempotent, as v147's are.
+    db.exec(V148_SCHEMA);
+    step("results-tables");
+    for (const [column, { definition }] of Object.entries(V148_ADDED_COLUMNS["run"]))
+        addColumn(db, "run", column, definition);
+    step("exec-class");
+    for (const [column, { definition }] of Object.entries(V148_ADDED_COLUMNS["task_ref"]))
+        addColumn(db, "task_ref", column, definition);
+    step("revision-origin");
+    for (const [column, { definition }] of Object.entries(V148_ADDED_COLUMNS["project"]))
+        addColumn(db, "project", column, definition);
+    step("suggest-models");
+    // v149: the learning-loops tables (new tables only; docs/plans/learning-loops.md). Idempotent, as v148's steps are.
+    db.exec(V149_SCHEMA);
+    step("learning-tables");
     // Keep the epoch until reclamation succeeds, including a retry after compaction already committed. A new file has
     // nothing to reclaim.
     if (!fresh)
@@ -6166,6 +6560,12 @@ export class Store {
         }
         if (ref !== undefined && prior?.["state"] !== "cancelled")
             this.noteTaskAct(Number(ref["id"]), "cancelled", now);
+        // Results routing: a cancel closes the task's open exposure to an earned rule.
+        if (ref !== undefined)
+            noteExposureCancelled(this, Number(ref["id"]), now);
+        // …and gives up any trial place it holds unconsumed (a consumed place is never released).
+        if (ref !== undefined)
+            releaseTrialPlaces(this, Number(ref["id"]), now);
         // A cancelled task's pending steering settles superseded in the SAME
         // transaction, whichever road cancelled it — a note silently waiting
         // for a build that can no longer happen is wrong on every road, not
@@ -7293,6 +7693,9 @@ export class Store {
                     const problems = routeProblems(route);
                     if (problems.length > 0)
                         unresolvedReason = problems.join("; ");
+                    // A trial's place is one task's (results routing slice 3): a frozen route never carries one to another.
+                    else if (legOf(route, "build").selection?.kind === "trial")
+                        unresolvedReason = "a frozen agent route can't try a cheaper model — a trial place belongs to the task it was reserved for";
                 }
             }
             else if (!candidatesResolved.ok) {
@@ -7308,7 +7711,16 @@ export class Store {
                 unresolvedReason = planPin.problem;
             }
             else {
-                route = recommendRoute({
+                // Results routing (route v3): the project's live earned rules and trial, and the two eligibility facts the
+                // route doesn't carry. A release or candidate is read conservatively: terms this filing may still drop count.
+                const earnedBase = ref === null || ref.backend !== BUILT_IN || ref.repo === null ? null : {
+                    rules: liveEarnedRules(this, ref.repo),
+                    release: (scope.candidate ?? null) !== null || options.releaseTerms != null || options.releaseCheck != null
+                        || prior?.["release_terms_json"] != null || prior?.["release_check_json"] != null || releaseTaskRef(this, ref.id) || nightlyTaskRef(this, ref.id),
+                    protected: isProtectedWork(this.approvalRules(ref.repo), scope.touches),
+                };
+                const trial = earnedBase === null || ref === null ? null : liveTrialFor(this, ref.repo, ref.sizing?.size);
+                const routeWith = (reservation) => recommendRoute({
                     qualityMode,
                     evidence: [...new Set(scope.acceptance.flatMap(one => one.evidence))],
                     publication: this.publicationAuthorityOf(ref?.repo ?? null, new Date(scope.proposedAt)),
@@ -7319,7 +7731,19 @@ export class Store {
                     // with the route like every other input.
                     size: ref?.sizing ?? null,
                     headroom: this.planHeadroom(new Date(scope.proposedAt)),
+                    earned: earnedBase === null ? null : { ...earnedBase, ...(trial === null ? {} : { trial: { ...trial, reservation } }) },
                 });
+                // A TRIAL'S PLACE (results routing slice 3): asked first whether this filing would take the trial at all (a
+                // pure probe, nothing written), then its place reserved here, in this write transaction, and the route made
+                // with that place (or with none left: the configured builder runs it). A pin, an override or an ineligible
+                // task never takes a place.
+                route = routeWith(trial === null ? null : Number.MAX_SAFE_INTEGER);
+                if (trial !== null && ref !== null && legOf(route, "build").selection?.kind === "trial") {
+                    route = routeWith(reserveTrialPlace(this, trial.id, ref.id, new Date(scope.proposedAt)));
+                }
+                else if (trial !== null) {
+                    route = routeWith(null);
+                }
                 const problems = routeProblems(route);
                 if (problems.length > 0)
                     unresolvedReason = problems.join("; ");
@@ -7463,6 +7887,16 @@ export class Store {
             // or a remote API run keeps any mark already there and never erases a
             // quarantine by refiling, and the lead's own text is marked `lead`.
             this.db.prepare("UPDATE task_scope SET proposed_via = ? WHERE task_id = ?").run(provenanceAfter(prior?.["proposed_via"], options.proposedVia ?? null), scope.taskId);
+            // Results routing (exposure, route-store.ts): a build leg under an earned rule opens the task's one exposure to
+            // it; a re-filing adds an event to an open one, never a row.
+            if (ref !== null && route !== null)
+                noteExposureFiled(this, ref.id, legOf(route, "build").selection, new Date(scope.proposedAt));
+            // Results routing (trials, route-store.ts): the place this route seals is bound to the digest it was filed under
+            // (repeated saves reuse it); any other place this task held unconsumed is released.
+            if (ref !== null) {
+                const selection = route === null ? undefined : legOf(route, "build").selection;
+                settleTrialPlaces(this, ref.id, options.route !== undefined ? undefined : selection, boundDigest, new Date(scope.proposedAt));
+            }
             return null;
         }));
     }
@@ -7584,6 +8018,17 @@ export class Store {
                 return false;
             if (routeProblems(authority.route).length > 0)
                 return false;
+            // RESULTS ROUTING (route v3): a build leg selected by an earned rule that switched itself off since it was
+            // filed seals nothing — re-filing routes it on the configured builder (route-rules.ts holds what was approved).
+            const sealedSelection = legOf(authority.route, "build").selection;
+            if (sealedSelection?.kind === "rule" && this.db.prepare("SELECT state FROM route_rule WHERE id = ?").get(sealedSelection.rule)?.["state"] === "switched-off")
+                return false;
+            // A TRIAL (results routing slice 3): only a person's own yes seals it — the ceremony or their paired-chat tap,
+            // never a mode, a grant, a schedule, an automatic seal, a carry or the lead — and only while its place stands.
+            const trialRef = this.db.prepare("SELECT id FROM task_ref WHERE backend = ? AND external_id = ?").get(BUILT_IN, taskId);
+            if (trialSealProblem(this, { taskRef: trialRef === undefined ? null : Number(trialRef["id"]), selection: sealedSelection, digest: String(working["digest"] ?? ""),
+                basis: basis === undefined ? null : basis.kind, by, machine: machineActing() }) !== null)
+                return false;
             // RELEASE TERMS (release-once.md): only a person's own yes (the ceremony or a paired-chat tap) seals them, and
             // that yes opens the release's authority record in this same transaction — or the seal doesn't stand.
             const terms = storedReleaseTerms(working["release_terms_json"]);
@@ -7650,9 +8095,18 @@ export class Store {
                     if (basis === undefined || basis.kind === "chat")
                         this.noteTaskAct(Number(ref["id"]), "approved", now);
                     this.db.prepare("DELETE FROM hold WHERE owner_kind = 'backoff' AND owner_id = ?").run(`stale:${Number(ref["id"])}`);
+                    // Results routing: this yes closes the task's open exposure (as proposed, or with the model it sealed),
+                    // and lifts the hold a switched-off rule put on the approval it replaces.
+                    noteExposureSealed(this, Number(ref["id"]), { selection: sealedSelection, model: legOf(authority.route, "build").model }, now);
+                    this.db.prepare("DELETE FROM hold WHERE owner_kind = 'backoff' AND owner_id = ?").run(`rule-off:${Number(ref["id"])}`);
                     this.db
                         .prepare("UPDATE notification SET resolved_at = ? WHERE dedupe_key LIKE ? AND resolved_at IS NULL")
                         .run(now.toISOString(), `stale-approval:${Number(ref["id"])}:%`);
+                    // One-tap release approval (trusted-release-reports.md A5): the yes, by any road, retires the task's
+                    // "ready for your approval" rows, so a push not delivered yet is never sent after it.
+                    this.db
+                        .prepare("UPDATE notification SET resolved_at = ? WHERE kind = 'release-ready' AND task_ref = ? AND resolved_at IS NULL")
+                        .run(now.toISOString(), Number(ref["id"]));
                     // The approval fact (Telegram task updates): a NEW yes on these
                     // exact bytes. Re-sealing an approval that already stands on
                     // the same digest is the same state and says nothing.
@@ -11778,22 +12232,32 @@ export class Store {
     }
     /** Write one complete pair. Audited: who changed spend routing, and when. */
     setPhaseConfig(scope, phase, provider, model, by, now) {
-        const was = this.phaseConfig(scope, phase);
-        const words = (agent) => agent === null ? "not set" : `${agent.provider} · ${agent.model ?? "its default model"}`;
-        this.recordPolicy(by, scope === "installation" ? null : scope, `agent for ${phase} changed`, words(was), words({ provider, model }), now);
-        this.db
-            .prepare(`INSERT INTO phase_config (scope, phase, provider, model, updated_at, updated_by)
-         VALUES (?, ?, ?, ?, ?, ?)
-         ON CONFLICT (scope, phase) DO UPDATE SET
-           provider = excluded.provider, model = excluded.model,
-           updated_at = excluded.updated_at, updated_by = excluded.updated_by`)
-            .run(scope, phase, provider, model, now.toISOString(), by);
+        // Results routing (v148): a changed row moves its (scope, phase) generation in the same transaction, which pauses
+        // any rule that depended on it (route-store.ts bumpModelsGeneration).
+        this.transact(() => {
+            const was = this.phaseConfig(scope, phase);
+            const words = (agent) => agent === null ? "not set" : `${agent.provider} · ${agent.model ?? "its default model"}`;
+            this.recordPolicy(by, scope === "installation" ? null : scope, `agent for ${phase} changed`, words(was), words({ provider, model }), now);
+            this.db
+                .prepare(`INSERT INTO phase_config (scope, phase, provider, model, updated_at, updated_by)
+           VALUES (?, ?, ?, ?, ?, ?)
+           ON CONFLICT (scope, phase) DO UPDATE SET
+             provider = excluded.provider, model = excluded.model,
+             updated_at = excluded.updated_at, updated_by = excluded.updated_by`)
+                .run(scope, phase, provider, model, now.toISOString(), by);
+            if (was === null || was.provider !== provider || was.model !== model)
+                bumpModelsGeneration(this, scope, phase, now);
+        });
     }
     clearPhaseConfig(scope, phase) {
-        const { changes } = this.db
-            .prepare("DELETE FROM phase_config WHERE scope = ? AND phase = ?")
-            .run(scope, phase);
-        return Number(changes) > 0;
+        return this.transact(() => {
+            const { changes } = this.db
+                .prepare("DELETE FROM phase_config WHERE scope = ? AND phase = ?")
+                .run(scope, phase);
+            if (Number(changes) > 0)
+                bumpModelsGeneration(this, scope, phase, new Date());
+            return Number(changes) > 0;
+        });
     }
     // ---- phase routing (v47) -----------------------------------------------
     /** The operator's named STRONG candidate for a phase at a scope, or null.
@@ -11827,16 +12291,25 @@ export class Store {
         // A small change makes no plan and repairs resume the builder: only the build phase has a light agent.
         if (tier === "light" && phase !== "build")
             throw new Error(`a light agent is for the build phase only, not ${phase}`);
-        this.db
-            .prepare(`INSERT INTO phase_tier_config (scope, phase, tier, provider, model, updated_at, updated_by)
-         VALUES (?, ?, ?, ?, ?, ?, ?)
-         ON CONFLICT (scope, phase, tier) DO UPDATE SET provider = excluded.provider, model = excluded.model,
-                                                        updated_at = excluded.updated_at, updated_by = excluded.updated_by`)
-            .run(scope, phase, tier, provider, model, now.toISOString(), by);
+        this.transact(() => {
+            const was = this.phaseTierConfig(scope, phase, tier);
+            this.db
+                .prepare(`INSERT INTO phase_tier_config (scope, phase, tier, provider, model, updated_at, updated_by)
+           VALUES (?, ?, ?, ?, ?, ?, ?)
+           ON CONFLICT (scope, phase, tier) DO UPDATE SET provider = excluded.provider, model = excluded.model,
+                                                          updated_at = excluded.updated_at, updated_by = excluded.updated_by`)
+                .run(scope, phase, tier, provider, model, now.toISOString(), by);
+            if (was === null || was.provider !== provider || was.model !== model)
+                bumpModelsGeneration(this, scope, phase, now);
+        });
     }
     clearPhaseTierConfig(scope, phase, tier) {
-        const { changes } = this.db.prepare("DELETE FROM phase_tier_config WHERE scope = ? AND phase = ? AND tier = ?").run(scope, phase, tier);
-        return Number(changes) > 0;
+        return this.transact(() => {
+            const { changes } = this.db.prepare("DELETE FROM phase_tier_config WHERE scope = ? AND phase = ? AND tier = ?").run(scope, phase, tier);
+            if (Number(changes) > 0)
+                bumpModelsGeneration(this, scope, phase, new Date());
+            return Number(changes) > 0;
+        });
     }
     /** A tier's candidates on other providers at a scope, in provider order (sized routing). */
     phaseTierAlternates(scope, phase, tier) {
@@ -11863,19 +12336,28 @@ export class Store {
     setPhaseTierAlternate(scope, phase, tier, provider, model, by, now) {
         if (tier === "light" && phase !== "build")
             throw new Error(`a light agent is for the build phase only, not ${phase}`);
-        this.db
-            .prepare(`INSERT INTO phase_tier_alternate (scope, phase, tier, provider, model, updated_at, updated_by)
-         VALUES (?, ?, ?, ?, ?, ?, ?)
-         ON CONFLICT (scope, phase, tier, provider) DO UPDATE SET model = excluded.model,
-                                                                  updated_at = excluded.updated_at, updated_by = excluded.updated_by`)
-            .run(scope, phase, tier, provider, model, now.toISOString(), by);
+        this.transact(() => {
+            const was = this.phaseTierAlternates(scope, phase, tier).find(one => one.provider === provider) ?? null;
+            this.db
+                .prepare(`INSERT INTO phase_tier_alternate (scope, phase, tier, provider, model, updated_at, updated_by)
+           VALUES (?, ?, ?, ?, ?, ?, ?)
+           ON CONFLICT (scope, phase, tier, provider) DO UPDATE SET model = excluded.model,
+                                                                    updated_at = excluded.updated_at, updated_by = excluded.updated_by`)
+                .run(scope, phase, tier, provider, model, now.toISOString(), by);
+            if (was === null || was.model !== model)
+                bumpModelsGeneration(this, scope, phase, now);
+        });
     }
     /** Remove one provider's candidate from a tier, or every one when no provider is named; how many went. */
     clearPhaseTierAlternates(scope, phase, tier, provider) {
-        const { changes } = provider === null
-            ? this.db.prepare("DELETE FROM phase_tier_alternate WHERE scope = ? AND phase = ? AND tier = ?").run(scope, phase, tier)
-            : this.db.prepare("DELETE FROM phase_tier_alternate WHERE scope = ? AND phase = ? AND tier = ? AND provider = ?").run(scope, phase, tier, provider);
-        return Number(changes);
+        return this.transact(() => {
+            const { changes } = provider === null
+                ? this.db.prepare("DELETE FROM phase_tier_alternate WHERE scope = ? AND phase = ? AND tier = ?").run(scope, phase, tier)
+                : this.db.prepare("DELETE FROM phase_tier_alternate WHERE scope = ? AND phase = ? AND tier = ? AND provider = ?").run(scope, phase, tier, provider);
+            if (Number(changes) > 0)
+                bumpModelsGeneration(this, scope, phase, new Date());
+            return Number(changes);
+        });
     }
     /** Each provider's plan headroom right now, from the latest readings of
      * its usage windows — the routing policy's headroom input at filing. */
@@ -13288,6 +13770,14 @@ export class Store {
         const problem = this.routeAdmissionProblem({ taskRef: run.taskRef, role, provider: provider ?? "claude", model }, run.route, run.now);
         if (problem !== null)
             refuse(problem);
+        // RESULTS ROUTING (route v3): a task approved under an earned rule that then switched itself off on its sealed
+        // trigger is held — its first build never starts on that model (no strike: nothing ran). A rule a person turned
+        // off, or one that expired, keeps the sealed model; a started task's later attempts finish under it.
+        if (role === "builder") {
+            const held = ruleHoldOf(this, taskId);
+            if (held !== null)
+                refuse(`rule-switched-off: results for ${held.model} dropped after this was approved — approve it again or re-file it`);
+        }
         const stamp = run.route;
         const qualityMode = role === "reviewer" && parent !== null
             ? parent.qualityMode ?? "default"
@@ -13319,6 +13809,16 @@ export class Store {
         // The provenance row lands in the same transaction as the run row —
         // proved above, written here; a run and its route are one fact.
         this.writeRunRoute(id, stamp, run.now);
+        // Results routing (v148): a code-writing run's cohort snapshot, beside its route in this same transaction and
+        // never updated (route-store.ts writeRunCohort; a snapshot it can't compute is recorded as not eligible).
+        if (role === "builder" || role === "repair") {
+            writeRunCohort(this, { run: id, taskRef: run.taskRef, role, routeDigest: stamp.routeDigest, provider: provider ?? "claude", model, qualityMode, startedAt: run.now.toISOString() });
+            // A TRIAL (results routing slice 3): a person's own approval, and its place consumed exactly once against the
+            // sealed digest (a retry or repair of the same task consumes nothing more). Refused → the row rolls back.
+            const trialProblem = admitTrialRun(this, { taskId, taskRef: run.taskRef, role, run: id, now: run.now });
+            if (trialProblem !== null)
+                refuse(trialProblem);
+        }
         if (role === "reviewer" && parent?.role === "reviewer" && parent.watchIncarnation != null) {
             this.db.prepare("UPDATE run SET watch_incarnation = ? WHERE id = ?").run(parent.watchIncarnation, id);
         }
@@ -18554,12 +19054,20 @@ export class Store {
      * what kind of answer it is (needs-you.ts reads it): `alive` while
      * something of the run may still be running, `elsewhere` when only
      * another computer can tell, `unprovable` when nothing is known to run
-     * but its exit was never recorded, `unknown` when this computer can't
-     * check at all (both are what `run settle` resolves; only the first may
-     * be called not running). `settling` already meets the automatic
-     * reconciliation proof, so no confirmation is needed. */
+     * but its exit was never recorded (Toolroll's own look, stop-proof.ts,
+     * settles it), `unknown` when this computer can't check, or that look
+     * was blocked. `settling` already meets the automatic reconciliation
+     * proof. Nobody is ever asked to confirm a build stopped. `cause` names
+     * what stop-proof.ts can prove. */
     stopQuiescenceFact(runId) {
-        const fact = (run, kind, problem) => ({ run, kind, problem });
+        const fact = (run, kind, problem, cause) => cause === undefined ? { run, kind, problem } : { run, kind, problem, cause };
+        // What Toolroll can prove on its own (stop-proof.ts): until its own check of this computer's processes has run, the
+        // answer is `unprovable` (it settles by itself); once that check could not look, or found a process it didn't start
+        // in the build's folder, it is `unknown`, and the plain reason says why. Nobody is asked to vouch either way.
+        const provable = (run, problem, cause) => {
+            const verdict = stopProofVerdictOf(this, run);
+            return verdict === null ? fact(run, "unprovable", problem, cause) : fact(run, "unknown", `run #${run} ${verdict}`, cause);
+        };
         const ids = this.ownedRunsOf(runId);
         if (ids.length === 0)
             return fact(runId, "open", `run #${runId} does not exist`);
@@ -18572,7 +19080,7 @@ export class Store {
             const witnesses = this.db.prepare("SELECT * FROM run_process WHERE run = ? ORDER BY id").all(id);
             let incompleteSpawn = false;
             if (run.providerStartedAt !== null && witnesses.length === 0 && !this.processesSummarized(id)) {
-                return fact(id, "unprovable", `run #${id} may have spawned before its process witness was recorded; exit is unproven`);
+                return provable(id, `run #${id} may have spawned before its process witness was recorded; exit is unproven`, "no-witness");
             }
             for (const witness of witnesses) {
                 // A recorded group exit proves the whole group ended, not just its
@@ -18621,20 +19129,27 @@ export class Store {
                         return fact(id, "alive", `run #${id}'s workspace is still held by process ${occupied.by}`);
                 }
                 catch {
-                    // An unreadable workspace note is no proof either way; an approver's recorded word settles it.
-                    if (!this.workspaceConfirmedByApprover(id))
-                        return fact(id, "unknown", `run #${id}'s workspace occupancy could not be established`);
+                    // An unreadable workspace note is no proof either way; Toolroll's own look at this computer's processes settles
+                    // it (stop-proof.ts), as an approver's recorded word did before.
+                    if (!this.workspaceConfirmedByApprover(id)) {
+                        const verdict = stopProofVerdictOf(this, id);
+                        return fact(id, "unknown", verdict === null ? `run #${id}'s workspace occupancy could not be established` : `run #${id} ${verdict}`, "workspace-unreadable");
+                    }
                 }
             }
-            if (incompleteSpawn)
-                return fact(id, this.settleableUnspawnedWitnesses(run, witnesses).length > 0 ? "settling" : "unprovable", `run #${id} has an incomplete spawn witness; exit is unproven`);
+            if (incompleteSpawn) {
+                if (this.settleableUnspawnedWitnesses(run, witnesses).length > 0)
+                    return fact(id, "settling", `run #${id} has an incomplete spawn witness; exit is unproven`);
+                return provable(id, `run #${id} has an incomplete spawn witness; exit is unproven`, "incomplete-spawn");
+            }
         }
         return null;
     }
-    /** `run settle` recorded an approver's word that a run whose workspace
-     * note couldn't be read has stopped. */
+    /** A run whose workspace note couldn't be read was proven free: by Toolroll's own look (stop-proof.ts), or, in
+     * ledgers from before it, by an approver's recorded word (still read, never written now). */
     workspaceConfirmedByApprover(runId) {
-        return this.db.prepare("SELECT 1 FROM action_ledger WHERE run_id = ? AND action = 'workspace settled by approver' LIMIT 1").get(runId) !== undefined;
+        // An older approver's word still counts (ledger entries before stop-proof.ts); Toolroll's own proof counts the same.
+        return this.db.prepare("SELECT 1 FROM action_ledger WHERE run_id = ? AND action IN ('workspace settled by approver', ?) LIMIT 1").get(runId, STOP_PROOF_WORKSPACE_FREE) !== undefined;
     }
     reserveRunProcess(runId, now, group = true) {
         return Number(this.db.prepare("INSERT INTO run_process (run,host,process_group,observed_at,boot_id) VALUES (?,?,?,?,?)")
@@ -18723,7 +19238,7 @@ export class Store {
      * here, every other witness of the run has exited and none of the run's
      * process groups is alive, it settles as never started, with a ledger
      * entry. A sole pid-less witness has no group to prove gone and stays for
-     * `run settle`. Native witnesses keep their OS-only road. */
+     * Toolroll's own look (stop-proof.ts). Native witnesses keep their OS-only road. */
     settleUnspawnedWitnesses(now, onlyRun) {
         const candidates = this.db.prepare(`SELECT DISTINCT p.run FROM run_process p JOIN run r ON r.id = p.run
       WHERE p.exited_at IS NULL AND p.pid IS NULL AND p.containment IS NULL AND p.container IS NULL
@@ -18772,84 +19287,6 @@ export class Store {
             return [];
         return pidless;
     }
-    /** `run settle` (an approver's last resort): every witness of a finished
-     * run that cannot be proven either way is recorded settled under the
-     * approver's reason, in the ledger. Refuses while anything of the run is
-     * alive or could be checked only from another host. Never signals. */
-    settleRunWitnessesByApprover(args, now) {
-        return this.transact(() => {
-            const run = this.getRun(args.runId);
-            if (run === null)
-                return { ok: false, reason: "unknown-run", detail: `no run #${args.runId}` };
-            if (run.outcome === null)
-                return { ok: false, reason: "still-running", detail: `run #${args.runId} is still open` };
-            const alive = (detail) => ({ ok: false, reason: "alive", detail });
-            if (ownedProcessCount(runOwnerTag(this, args.runId)) > 0)
-                return alive(`run #${args.runId} still has an owned subprocess`);
-            const rows = this.db.prepare("SELECT * FROM run_process WHERE run = ? ORDER BY id").all(args.runId);
-            const open = rows.filter(row => row["exited_at"] === null);
-            for (const row of rows) {
-                if (row["pid"] === null)
-                    continue;
-                if (row["host"] !== hostname()) {
-                    if (row["exited_at"] === null)
-                        return alive(`run #${args.runId}'s process ${String(row["pid"])} belongs to ${String(row["host"])}; settle it there`);
-                    continue;
-                }
-                if (processMayBeAlive(Number(row["pid"]), row["process_group"] === 1, { observedAt: row["observed_at"], finishedAt: run.finishedAt, exitedAt: row["exited_at"] }))
-                    return alive(`run #${args.runId}'s process ${String(row["pid"])} is still running`);
-            }
-            for (const row of open) {
-                if (row["pid"] === null && row["host"] !== hostname())
-                    return alive(`run #${args.runId} has a witness from ${String(row["host"])}; settle it there`);
-                if (row["containment"] != null && row["container"] != null && row["container_empty_at"] == null &&
-                    containerEmptiness(String(row["containment"]), String(row["container"]), process.platform, row["container_identity"] == null ? null : String(row["container_identity"])) === "populated") {
-                    return alive(`run #${args.runId}'s ${String(row["containment"])} object ${String(row["container"])} still has members`);
-                }
-            }
-            // A workspace still held by a live process refuses; one whose note can't
-            // be read is settled by the approver's word, in the ledger.
-            let workspace = false;
-            if (run.worktree !== null) {
-                try {
-                    const occupied = worktreeProcessOccupancy(run.worktree);
-                    if (occupied.held)
-                        return alive(`run #${args.runId}'s workspace is still held by process ${occupied.by}`);
-                }
-                catch {
-                    workspace = !this.workspaceConfirmedByApprover(args.runId);
-                }
-            }
-            const ref = this.refById(run.taskRef);
-            if (workspace) {
-                this.recordAction({ at: now.toISOString(), actor: args.by, repo: ref?.repo ?? null, taskId: ref?.externalId ?? null, runId: args.runId,
-                    action: "workspace settled by approver", outcome: run.worktree ?? "", source: "request", detail: args.why });
-            }
-            // A run that may have spawned before any witness was written has none
-            // to settle: the approver's word is recorded as one ended witness.
-            if (rows.length === 0 && run.providerStartedAt !== null && !this.processesSummarized(args.runId)) {
-                const id = Number(this.db.prepare("INSERT INTO run_process (run,host,process_group,observed_at,boot_id,exited_at) VALUES (?,?,0,?,?,?)")
-                    .run(args.runId, hostname(), now.toISOString(), currentBootId(), now.toISOString()).lastInsertRowid);
-                this.recordAction({ at: now.toISOString(), actor: args.by, repo: ref?.repo ?? null, taskId: ref?.externalId ?? null, runId: args.runId,
-                    action: "process witness settled by approver", outcome: `witness ${id}`, source: "request", detail: args.why });
-                this.settleQuiescentStops(now);
-                return { ok: true, witnesses: [id], repeated: false };
-            }
-            if (open.length === 0) {
-                if (workspace)
-                    this.settleQuiescentStops(now);
-                return { ok: true, witnesses: [], repeated: !workspace };
-            }
-            const ids = open.map(row => Number(row["id"]));
-            for (const id of ids)
-                this.db.prepare("UPDATE run_process SET exited_at = ? WHERE id = ? AND run = ? AND exited_at IS NULL").run(now.toISOString(), id, args.runId);
-            this.recordAction({ at: now.toISOString(), actor: args.by, repo: ref?.repo ?? null, taskId: ref?.externalId ?? null, runId: args.runId,
-                action: "process witness settled by approver", outcome: `witness ${ids.join(", ")}`, source: "request", detail: args.why });
-            compactSettledRunProcesses(this.db, now, args.runId);
-            this.settleQuiescentStops(now);
-            return { ok: true, witnesses: ids, repeated: false };
-        });
-    }
     recordRunProcess(runId, pid, now, group = true, witness) {
         if (!Number.isSafeInteger(pid) || pid <= 0)
             throw new Error("a process witness needs a valid spawned PID");
@@ -22376,3 +22813,91 @@ export function laptopPortOf(store) {
 export function recordLaptopPort(store, port, now) {
     store.recordInstallationFact(LAPTOP_PORT_FACT, String(port), now);
 }
+// ---- v148: results routing (docs/plans/results-routing.md) ------------------------------------------------------
+/** The Models rows of a project being deleted (project-delete.ts), through the same counter as every other Models
+ * writer: each phase whose rows go moves its generation (pausing what depended on it), then the project's
+ * results-routing rows go (route-store.ts forgetProjectRoutes). One of the routing scan's named phase_* writers
+ * (route-hooks.ts). How many rows went. */
+export function forgetProjectModels(store, repo, now) {
+    return store.transact(() => {
+        const db = store.handle;
+        let rows = 0;
+        const phases = new Set(db.prepare(`SELECT phase FROM phase_config WHERE scope = ? UNION SELECT phase FROM phase_tier_config WHERE scope = ?
+      UNION SELECT phase FROM phase_tier_alternate WHERE scope = ?`).all(repo, repo, repo).map(row => String(row["phase"])));
+        rows += Number(db.prepare("DELETE FROM phase_config WHERE scope = ?").run(repo).changes);
+        rows += Number(db.prepare("DELETE FROM phase_tier_config WHERE scope = ?").run(repo).changes);
+        rows += Number(db.prepare("DELETE FROM phase_tier_alternate WHERE scope = ?").run(repo).changes);
+        for (const phase of [...phases].sort())
+            bumpModelsGeneration(store, repo, phase, now);
+        return rows + forgetProjectRoutes(store, repo);
+    });
+}
+// ---- Toolroll's own stop proof (stop-proof.ts) ------------------------------------------------------------------
+/** The ledger words of Toolroll's own stop proof. Nobody is asked to vouch that a build stopped: Toolroll looks at
+ * this computer's processes itself, and a person's older recorded word (`run settle` before this) is still read. */
+export const STOP_PROOF_SETTLED = "run stop proven automatically";
+export const STOP_PROOF_BLOCKED = "automatic stop check blocked";
+export const STOP_PROOF_WORKSPACE_FREE = "workspace proven free automatically";
+/** Why Toolroll's own stop check is blocked for a run, in words that follow "run #N " (the stop fact's problem), or
+ * null when its newest word is not a block (never checked, or proven since). */
+export function stopProofVerdictOf(store, runId) {
+    const row = store.handle.prepare("SELECT action, outcome FROM action_ledger WHERE run_id = ? AND action IN (?, ?) ORDER BY id DESC LIMIT 1")
+        .get(runId, STOP_PROOF_BLOCKED, STOP_PROOF_SETTLED);
+    return row === undefined || row["action"] !== STOP_PROOF_BLOCKED ? null : String(row["outcome"]);
+}
+/** Record that Toolroll's own stop check could not prove a run stopped (`words` follow "run #N "; `detail` is the
+ * evidence). The same block twice in a row is recorded once. True when recorded. */
+export function recordStopProofBlocked(store, runId, words, detail, now) {
+    return store.transact(() => {
+        if (stopProofVerdictOf(store, runId) === words)
+            return false;
+        const run = store.getRun(runId);
+        const ref = run === null ? null : store.refById(run.taskRef);
+        store.recordAction({ at: now.toISOString(), actor: "system", repo: ref?.repo ?? null, taskId: ref?.externalId ?? null, runId,
+            action: STOP_PROOF_BLOCKED, outcome: words, source: "work", detail });
+        return true;
+    });
+}
+/**
+ * Settle a finished run's unproven stop on Toolroll's own observation of this computer (stop-proof.ts): the caller
+ * looked at every process here and found none of the run's. Applies only while the run's stop is still unproven for
+ * exactly `cause` (re-read in this transaction): a pid-less spawn witness is recorded ended, a run with no witness gets
+ * one ended witness, an unreadable workspace note is recorded proven free. The evidence goes in the ledger. Never
+ * signals. True when this call settled it.
+ */
+export function settleRunStopByObservation(store, args, now) {
+    return store.transact(() => {
+        const fact = store.stopQuiescenceFact(args.runId);
+        if (fact === null || fact.run !== args.runId || fact.cause !== args.cause || (fact.kind !== "unprovable" && fact.kind !== "unknown"))
+            return false;
+        const run = store.getRun(args.runId);
+        if (run === null || run.outcome === null || run.finishedAt === null)
+            return false;
+        const db = store.handle;
+        const ref = store.refById(run.taskRef);
+        const at = now.toISOString();
+        let what;
+        if (args.cause === "incomplete-spawn") {
+            const changed = db.prepare(`UPDATE run_process SET exited_at = ? WHERE run = ? AND exited_at IS NULL AND pid IS NULL
+        AND containment IS NULL AND container IS NULL AND host = ?`).run(at, args.runId, hostname()).changes;
+            if (Number(changed) === 0)
+                return false;
+            what = `${Number(changed)} process witness${Number(changed) === 1 ? "" : "es"} with no process ID recorded ended`;
+        }
+        else if (args.cause === "no-witness") {
+            db.prepare("INSERT INTO run_process (run,host,process_group,observed_at,boot_id,exited_at) VALUES (?,?,0,?,?,?)")
+                .run(args.runId, hostname(), at, currentBootId(), at);
+            what = "its missing process witness recorded ended";
+        }
+        else {
+            store.recordAction({ at, actor: "system", repo: ref?.repo ?? null, taskId: ref?.externalId ?? null, runId: args.runId,
+                action: STOP_PROOF_WORKSPACE_FREE, outcome: run.worktree ?? "", source: "work", detail: args.evidence });
+            what = "its folder recorded free";
+        }
+        store.recordAction({ at, actor: "system", repo: ref?.repo ?? null, taskId: ref?.externalId ?? null, runId: args.runId,
+            action: STOP_PROOF_SETTLED, outcome: what, source: "work", detail: args.evidence });
+        compactSettledRunProcesses(db, now, args.runId);
+        store.settleQuiescentStops(now);
+        return true;
+    });
+}