toolroll 0.9.92 → 0.9.93

package/dist/store.js

@@ -1114,7 +1114,10 @@ const REGISTERED_AT_FILING = "again, as it was filed";
 // v148 adds, and changes no saved row (docs/plans/results-routing.md): the results-routing tables (V148_SCHEMA, new
 // tables only) and a run's execution class, a revision's origin and a project's "Suggest cheaper models" switch
 // (V148_ADDED_COLUMNS: saved rows read NULL, NULL and 1).
-export const SCHEMA_VERSION = 148;
+// v149 adds, and changes no saved row (docs/plans/learning-loops.md): every learning-loops table (V149_SCHEMA, new
+// tables only) — each check's recorded conditions and results, mixed-outcome observations, tracked identities, lesson
+// notes and their tallies, memory use, tidy-up proposals and decision merges.
+export const SCHEMA_VERSION = 149;
 /** v118: the tables merged into `credential`, in the order they move (a person's API tokens keep their ids first). */
 export const V118_MERGED_TABLES = Object.freeze({ api_token: "person", coordinator_credential: "coordinator", lead_credential: "lead" });
 /** The foreign keys that named a merged table, exactly as their DDL wrote them; each names `credential(id)` instead. */
@@ -1247,7 +1250,7 @@ const V115_DROPPED_REFERENCES = /\s+REFERENCES (?:contestant|contest|tournament_
  * unchanged), and adds the nullable column in V125_ADDED_COLUMNS, checked the same way. v126 only adds a new table
  * (task_source) and the columns in V126_ADDED_COLUMNS (null or 0), checked the same way.
  */
-export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148]);
+export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149]);
 /** v119: the columns it adds, by table, with the value every row saved before it reads (toolroll-update's HISTORY_RULES). */
 export const V119_ADDED_COLUMNS = Object.freeze({
     task_ref: { planning_generation: { definition: "INTEGER NOT NULL DEFAULT 0", saved: "0" } },
@@ -1650,6 +1653,229 @@ export const V148_ADDED_COLUMNS = Object.freeze({
 });
 /** The v148 migration's steps after v147's, in order (OpenOptions.migrationStep may stop after each). */
 export const V148_STEPS = Object.freeze(["results-tables", "exec-class", "revision-origin", "suggest-models"]);
+/**
+ * v149 (docs/plans/learning-loops.md): every table the learning-loops arc uses, landed at once because a current store
+ * runs no DDL. Slice 1 writes check_fact, check_result and learning_watch; the rest are written from later slices.
+ * Each table has one writer module (the migration aside), which release-auto's learning scan (eval-hooks.ts
+ * learningWriteProblem) holds a release to: check_fact and check_result → check-facts.ts; local_observation → flaky.ts;
+ * ci_flaky_observation and ci_pairing_rejected → flaky-ci.ts; learning_watch → flaky.ts and lesson-notes.ts;
+ * lesson_note and lesson_note_tally → lesson-notes.ts; memory_use → memory-use.ts; memory_tidy_proposal and
+ * decision_merge → memory-tidy.ts.
+ *
+ * Nothing here is ever read for authority: a check's outcome, a verdict and an approval never change because of it.
+ *
+ * Deletion follows today's semantics (runs are never deleted by ordinary work; removing a project keeps its results).
+ * The tables are keyed by repo path with no foreign key to `project`; their run keys are plain REFERENCES with no ON
+ * DELETE action. check_fact, learning_watch, lesson_note, lesson_note_tally, memory_use, memory_tidy_proposal and
+ * decision_merge are kept and never deleted (their triggers allow only the columns their one writer sets: a watch's
+ * `until`, a tally's counters, a proposal's decision, a merge's undo). check_result, local_observation,
+ * ci_flaky_observation and ci_pairing_rejected are pruned after 180 days by the storage sweep's own step (a later
+ * slice), the only DELETE on them; their rows never change. The whole-project deletion (project-delete.ts), which
+ * lifts every guard for its one transaction, takes them with the project as it takes everything else.
+ */
+export const V149_SCHEMA = `
+CREATE TABLE IF NOT EXISTS check_fact (
+  run               INTEGER PRIMARY KEY REFERENCES run(id),
+  repo              TEXT,
+  task_ref          INTEGER NOT NULL,
+  head              TEXT,
+  tree              TEXT,
+  command_digest    TEXT,
+  access            TEXT,
+  harness_digest    TEXT,
+  lockfile          TEXT,
+  conditions_digest TEXT,
+  conditions_class  TEXT,
+  purpose           TEXT NOT NULL CHECK (purpose IN ('ordinary','release','nightly')),
+  learn_state       TEXT NOT NULL CHECK (learn_state IN ('recorded','not-recorded','not-asked')),
+  learn_why         TEXT,
+  recorded_at       TEXT NOT NULL,
+  CHECK ((learn_state = 'not-recorded') = (learn_why IS NOT NULL)),
+  CHECK ((conditions_digest IS NULL) = (conditions_class IS NULL)),
+  CHECK (conditions_digest IS NULL OR tree IS NOT NULL)
+);
+CREATE INDEX IF NOT EXISTS check_fact_by_repo ON check_fact (repo, recorded_at);
+CREATE INDEX IF NOT EXISTS check_fact_by_tree ON check_fact (tree, conditions_digest);
+CREATE TABLE IF NOT EXISTS check_result (
+  run         INTEGER NOT NULL REFERENCES check_fact(run),
+  identity    TEXT NOT NULL CHECK (length(identity) BETWEEN 1 AND 2600),
+  state       TEXT NOT NULL CHECK (state IN ('failed','passed','skipped','passed-on-retry')),
+  source      TEXT NOT NULL CHECK (source IN ('receipt','report','log','learn')),
+  recorded_at TEXT NOT NULL,
+  PRIMARY KEY (run, identity, source)
+);
+CREATE INDEX IF NOT EXISTS check_result_by_identity ON check_result (identity, run);
+CREATE TABLE IF NOT EXISTS local_observation (
+  id                INTEGER PRIMARY KEY AUTOINCREMENT,
+  repo              TEXT NOT NULL,
+  identity          TEXT NOT NULL,
+  failed_run        INTEGER NOT NULL REFERENCES run(id),
+  passed_run        INTEGER NOT NULL REFERENCES run(id),
+  tree              TEXT NOT NULL,
+  conditions_digest TEXT NOT NULL,
+  kind              TEXT NOT NULL CHECK (kind IN ('regate','same-tree','in-check-retry')),
+  observed_at       TEXT NOT NULL,
+  UNIQUE (identity, failed_run, passed_run),
+  CHECK ((kind = 'in-check-retry') = (failed_run = passed_run))
+);
+CREATE INDEX IF NOT EXISTS local_observation_by_repo ON local_observation (repo, identity, observed_at);
+CREATE TABLE IF NOT EXISTS ci_flaky_observation (
+  id                INTEGER PRIMARY KEY AUTOINCREMENT,
+  repo              TEXT NOT NULL,
+  provider          TEXT NOT NULL CHECK (provider = 'github'),
+  repository        TEXT NOT NULL,
+  workflow          TEXT NOT NULL,
+  lane_id           TEXT NOT NULL,
+  lane_name         TEXT NOT NULL,
+  workflow_run_id   INTEGER NOT NULL CHECK (workflow_run_id >= 1),
+  head_sha          TEXT NOT NULL,
+  failed_attempt    INTEGER NOT NULL CHECK (failed_attempt >= 1),
+  failed_job_id     INTEGER NOT NULL,
+  failed_conclusion TEXT NOT NULL,
+  passed_attempt    INTEGER NOT NULL,
+  passed_job_id     INTEGER NOT NULL,
+  passed_conclusion TEXT NOT NULL,
+  observed_at       TEXT NOT NULL,
+  UNIQUE (provider, repository, workflow_run_id, lane_id, failed_attempt, passed_attempt),
+  CHECK (passed_attempt > failed_attempt)
+);
+CREATE INDEX IF NOT EXISTS ci_flaky_observation_by_repo ON ci_flaky_observation (repo, lane_id, observed_at);
+CREATE TABLE IF NOT EXISTS ci_pairing_rejected (
+  provider        TEXT NOT NULL CHECK (provider = 'github'),
+  repository      TEXT NOT NULL,
+  workflow_run_id INTEGER NOT NULL CHECK (workflow_run_id >= 1),
+  attempt         INTEGER NOT NULL CHECK (attempt >= 1),
+  lane_id         TEXT,
+  why             TEXT NOT NULL,
+  at              TEXT NOT NULL,
+  PRIMARY KEY (provider, repository, workflow_run_id, attempt, why)
+);
+CREATE TABLE IF NOT EXISTS learning_watch (
+  repo       TEXT NOT NULL,
+  identity   TEXT NOT NULL CHECK (length(identity) BETWEEN 1 AND 2600),
+  reason     TEXT NOT NULL CHECK (reason IN ('note','observation')),
+  source_ref TEXT NOT NULL,
+  since      TEXT NOT NULL,
+  until      TEXT,
+  PRIMARY KEY (repo, identity, reason, source_ref),
+  CHECK (until IS NULL OR until >= since)
+);
+CREATE INDEX IF NOT EXISTS learning_watch_open ON learning_watch (repo, since) WHERE until IS NULL;
+CREATE TABLE IF NOT EXISTS lesson_note (
+  proposal                INTEGER PRIMARY KEY REFERENCES memory_proposal(id),
+  repo                    TEXT NOT NULL,
+  failed_run              INTEGER NOT NULL REFERENCES run(id),
+  passing_run             INTEGER NOT NULL REFERENCES run(id),
+  repair_chain            INTEGER REFERENCES repair_chain(id),
+  revision_origin         TEXT CHECK (revision_origin IS NULL OR revision_origin IN ('person','automatic-review','flow','lead','machine')),
+  identities_json         TEXT NOT NULL,
+  changed_paths_json      TEXT NOT NULL,
+  test_files_changed_json TEXT NOT NULL,
+  facts_digest            TEXT NOT NULL,
+  created_at              TEXT NOT NULL,
+  CHECK (failed_run <> passing_run)
+);
+CREATE INDEX IF NOT EXISTS lesson_note_by_repo ON lesson_note (repo, created_at);
+CREATE TABLE IF NOT EXISTS lesson_note_tally (
+  note                INTEGER NOT NULL REFERENCES lesson_note(proposal),
+  month               TEXT NOT NULL CHECK (month GLOB '[0-9][0-9][0-9][0-9]-[0-1][0-9]'),
+  executions          INTEGER NOT NULL DEFAULT 0 CHECK (executions >= 0),
+  failures            INTEGER NOT NULL DEFAULT 0 CHECK (failures >= 0 AND failures <= executions),
+  mixed_failures      INTEGER NOT NULL DEFAULT 0 CHECK (mixed_failures >= 0),
+  received_executions INTEGER NOT NULL DEFAULT 0 CHECK (received_executions >= 0 AND received_executions <= executions),
+  received_failures   INTEGER NOT NULL DEFAULT 0 CHECK (received_failures >= 0 AND received_failures <= received_executions AND received_failures <= failures),
+  unreported_checks   INTEGER NOT NULL DEFAULT 0 CHECK (unreported_checks >= 0),
+  sources_json        TEXT NOT NULL DEFAULT '[]',
+  partial             INTEGER NOT NULL DEFAULT 0 CHECK (partial IN (0,1)),
+  PRIMARY KEY (note, month)
+);
+CREATE TABLE IF NOT EXISTS memory_use (
+  run         INTEGER NOT NULL REFERENCES run(id),
+  repo        TEXT,
+  kind        TEXT NOT NULL CHECK (kind IN ('lesson','reference','decision')),
+  item        TEXT NOT NULL,
+  version     INTEGER,
+  phase       TEXT NOT NULL,
+  included_at TEXT,
+  PRIMARY KEY (run, kind, item)
+);
+CREATE INDEX IF NOT EXISTS memory_use_by_item ON memory_use (repo, kind, item, run);
+CREATE TABLE IF NOT EXISTS memory_tidy_proposal (
+  id            INTEGER PRIMARY KEY AUTOINCREMENT,
+  repo          TEXT NOT NULL,
+  kind          TEXT NOT NULL CHECK (kind IN ('retire','merge','contradiction','note-failing','restore','unmerge')),
+  items_json    TEXT NOT NULL,
+  after_text    TEXT,
+  rationale     TEXT NOT NULL,
+  evidence_json TEXT NOT NULL,
+  source        TEXT NOT NULL CHECK (source IN ('usage','duplicate','model','note','person')),
+  status        TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending','accepted','rejected','stale')),
+  created_at    TEXT NOT NULL,
+  decided_by    TEXT,
+  decided_proof TEXT,
+  decided_at    TEXT,
+  CHECK ((status = 'pending') = (decided_at IS NULL)),
+  CHECK (status IN ('accepted','rejected') OR (decided_by IS NULL AND decided_proof IS NULL)),
+  CHECK (status NOT IN ('accepted','rejected') OR decided_by IS NOT NULL)
+);
+CREATE INDEX IF NOT EXISTS memory_tidy_proposal_pending ON memory_tidy_proposal (repo, status, kind);
+CREATE TABLE IF NOT EXISTS decision_merge (
+  merge                INTEGER NOT NULL,
+  successor            INTEGER NOT NULL REFERENCES project_decision(id),
+  successor_revision   INTEGER NOT NULL CHECK (successor_revision >= 1),
+  predecessor          INTEGER NOT NULL REFERENCES project_decision(id),
+  predecessor_revision INTEGER NOT NULL CHECK (predecessor_revision >= 1),
+  at                   TEXT NOT NULL,
+  by                   TEXT NOT NULL,
+  undone_at            TEXT,
+  undone_by            TEXT,
+  PRIMARY KEY (merge, predecessor),
+  CHECK (successor <> predecessor),
+  CHECK ((undone_at IS NULL) = (undone_by IS NULL))
+);
+CREATE INDEX IF NOT EXISTS decision_merge_by_successor ON decision_merge (successor);
+CREATE INDEX IF NOT EXISTS decision_merge_by_predecessor ON decision_merge (predecessor);
+CREATE TRIGGER IF NOT EXISTS check_fact_no_update BEFORE UPDATE ON check_fact BEGIN SELECT RAISE(ABORT,'check facts are recorded once'); END;
+CREATE TRIGGER IF NOT EXISTS check_fact_no_delete BEFORE DELETE ON check_fact BEGIN SELECT RAISE(ABORT,'check facts are kept'); END;
+CREATE TRIGGER IF NOT EXISTS check_result_no_update BEFORE UPDATE ON check_result BEGIN SELECT RAISE(ABORT,'check results are recorded once'); END;
+CREATE TRIGGER IF NOT EXISTS local_observation_no_update BEFORE UPDATE ON local_observation BEGIN SELECT RAISE(ABORT,'observations are recorded once'); END;
+CREATE TRIGGER IF NOT EXISTS ci_flaky_observation_no_update BEFORE UPDATE ON ci_flaky_observation BEGIN SELECT RAISE(ABORT,'observations are recorded once'); END;
+CREATE TRIGGER IF NOT EXISTS ci_pairing_rejected_no_update BEFORE UPDATE ON ci_pairing_rejected BEGIN SELECT RAISE(ABORT,'rejected pairings are recorded once'); END;
+CREATE TRIGGER IF NOT EXISTS learning_watch_only_ends BEFORE UPDATE ON learning_watch
+  WHEN NEW.repo IS NOT OLD.repo OR NEW.identity IS NOT OLD.identity OR NEW.reason IS NOT OLD.reason OR NEW.source_ref IS NOT OLD.source_ref
+    OR NEW.since IS NOT OLD.since OR OLD.until IS NOT NULL OR NEW.until IS NULL
+  BEGIN SELECT RAISE(ABORT,'a tracked identity only ends, once'); END;
+CREATE TRIGGER IF NOT EXISTS learning_watch_no_delete BEFORE DELETE ON learning_watch BEGIN SELECT RAISE(ABORT,'tracked identities are kept'); END;
+CREATE TRIGGER IF NOT EXISTS lesson_note_no_update BEFORE UPDATE ON lesson_note BEGIN SELECT RAISE(ABORT,'lesson note facts are recorded once'); END;
+CREATE TRIGGER IF NOT EXISTS lesson_note_no_delete BEFORE DELETE ON lesson_note BEGIN SELECT RAISE(ABORT,'lesson notes are kept'); END;
+CREATE TRIGGER IF NOT EXISTS lesson_note_tally_only_counts BEFORE UPDATE ON lesson_note_tally
+  WHEN NEW.note IS NOT OLD.note OR NEW.month IS NOT OLD.month OR NEW.executions < OLD.executions OR NEW.failures < OLD.failures
+    OR NEW.mixed_failures < OLD.mixed_failures OR NEW.received_executions < OLD.received_executions OR NEW.received_failures < OLD.received_failures
+    OR NEW.unreported_checks < OLD.unreported_checks OR NEW.partial < OLD.partial
+  BEGIN SELECT RAISE(ABORT,'a tally only counts up'); END;
+CREATE TRIGGER IF NOT EXISTS lesson_note_tally_no_delete BEFORE DELETE ON lesson_note_tally BEGIN SELECT RAISE(ABORT,'tallies are never pruned'); END;
+CREATE TRIGGER IF NOT EXISTS memory_use_no_update BEFORE UPDATE ON memory_use BEGIN SELECT RAISE(ABORT,'memory use is recorded once'); END;
+CREATE TRIGGER IF NOT EXISTS memory_use_no_delete BEFORE DELETE ON memory_use BEGIN SELECT RAISE(ABORT,'memory use is kept'); END;
+CREATE TRIGGER IF NOT EXISTS memory_tidy_proposal_only_decides BEFORE UPDATE ON memory_tidy_proposal
+  WHEN NEW.id IS NOT OLD.id OR NEW.repo IS NOT OLD.repo OR NEW.kind IS NOT OLD.kind OR NEW.items_json IS NOT OLD.items_json
+    OR NEW.after_text IS NOT OLD.after_text OR NEW.rationale IS NOT OLD.rationale OR NEW.evidence_json IS NOT OLD.evidence_json
+    OR NEW.source IS NOT OLD.source OR NEW.created_at IS NOT OLD.created_at OR OLD.status <> 'pending'
+  BEGIN SELECT RAISE(ABORT,'a tidy-up proposal is decided once'); END;
+CREATE TRIGGER IF NOT EXISTS memory_tidy_proposal_no_delete BEFORE DELETE ON memory_tidy_proposal BEGIN SELECT RAISE(ABORT,'tidy-up proposals are kept'); END;
+CREATE TRIGGER IF NOT EXISTS decision_merge_only_undone BEFORE UPDATE ON decision_merge
+  WHEN NEW.merge IS NOT OLD.merge OR NEW.successor IS NOT OLD.successor OR NEW.successor_revision IS NOT OLD.successor_revision
+    OR NEW.predecessor IS NOT OLD.predecessor OR NEW.predecessor_revision IS NOT OLD.predecessor_revision OR NEW.at IS NOT OLD.at
+    OR NEW.by IS NOT OLD.by OR OLD.undone_at IS NOT NULL
+  BEGIN SELECT RAISE(ABORT,'a merge is undone once, never rewritten'); END;
+CREATE TRIGGER IF NOT EXISTS decision_merge_no_delete BEFORE DELETE ON decision_merge BEGIN SELECT RAISE(ABORT,'merges are kept'); END;
+`;
+/** The tables V149_SCHEMA adds, in the order a test drops them to make the v148 shape (dependents first). */
+export const V149_TABLES = Object.freeze(["check_result", "check_fact", "local_observation", "ci_flaky_observation", "ci_pairing_rejected", "learning_watch",
+    "lesson_note_tally", "lesson_note", "memory_use", "memory_tidy_proposal", "decision_merge"]);
+/** The v149 tables a whole-project deletion clears by repo (the rest hang off these or a deleted run or decision). */
+export const V149_REPO_TABLES = Object.freeze(["check_fact", "local_observation", "ci_flaky_observation", "learning_watch", "lesson_note", "memory_use", "memory_tidy_proposal"]);
+/** The v149 migration's steps after v148's, in order (OpenOptions.migrationStep may stop after each). */
+export const V149_STEPS = Object.freeze(["learning-tables"]);
 /**
  * v135: one approval per release (docs/plans/release-once.md). `release_authority` is the single source of truth for a
  * release a person approved: one row per generation, changed only by compare-and-swap on `rev`, with a lease whose
@@ -4941,6 +5167,9 @@ CREATE INDEX IF NOT EXISTS run_checkpoint_by_task ON run_checkpoint (task_ref, i
     for (const [column, { definition }] of Object.entries(V148_ADDED_COLUMNS["project"]))
         addColumn(db, "project", column, definition);
     step("suggest-models");
+    // v149: the learning-loops tables (new tables only; docs/plans/learning-loops.md). Idempotent, as v148's steps are.
+    db.exec(V149_SCHEMA);
+    step("learning-tables");
     // Keep the epoch until reclamation succeeds, including a retry after compaction already committed. A new file has
     // nothing to reclaim.
     if (!fresh)
@@ -7873,6 +8102,11 @@ export class Store {
                     this.db
                         .prepare("UPDATE notification SET resolved_at = ? WHERE dedupe_key LIKE ? AND resolved_at IS NULL")
                         .run(now.toISOString(), `stale-approval:${Number(ref["id"])}:%`);
+                    // One-tap release approval (trusted-release-reports.md A5): the yes, by any road, retires the task's
+                    // "ready for your approval" rows, so a push not delivered yet is never sent after it.
+                    this.db
+                        .prepare("UPDATE notification SET resolved_at = ? WHERE kind = 'release-ready' AND task_ref = ? AND resolved_at IS NULL")
+                        .run(now.toISOString(), Number(ref["id"]));
                     // The approval fact (Telegram task updates): a NEW yes on these
                     // exact bytes. Re-sealing an approval that already stands on
                     // the same digest is the same state and says nothing.
@@ -18820,12 +19054,20 @@ export class Store {
      * what kind of answer it is (needs-you.ts reads it): `alive` while
      * something of the run may still be running, `elsewhere` when only
      * another computer can tell, `unprovable` when nothing is known to run
-     * but its exit was never recorded, `unknown` when this computer can't
-     * check at all (both are what `run settle` resolves; only the first may
-     * be called not running). `settling` already meets the automatic
-     * reconciliation proof, so no confirmation is needed. */
+     * but its exit was never recorded (Toolroll's own look, stop-proof.ts,
+     * settles it), `unknown` when this computer can't check, or that look
+     * was blocked. `settling` already meets the automatic reconciliation
+     * proof. Nobody is ever asked to confirm a build stopped. `cause` names
+     * what stop-proof.ts can prove. */
     stopQuiescenceFact(runId) {
-        const fact = (run, kind, problem) => ({ run, kind, problem });
+        const fact = (run, kind, problem, cause) => cause === undefined ? { run, kind, problem } : { run, kind, problem, cause };
+        // What Toolroll can prove on its own (stop-proof.ts): until its own check of this computer's processes has run, the
+        // answer is `unprovable` (it settles by itself); once that check could not look, or found a process it didn't start
+        // in the build's folder, it is `unknown`, and the plain reason says why. Nobody is asked to vouch either way.
+        const provable = (run, problem, cause) => {
+            const verdict = stopProofVerdictOf(this, run);
+            return verdict === null ? fact(run, "unprovable", problem, cause) : fact(run, "unknown", `run #${run} ${verdict}`, cause);
+        };
         const ids = this.ownedRunsOf(runId);
         if (ids.length === 0)
             return fact(runId, "open", `run #${runId} does not exist`);
@@ -18838,7 +19080,7 @@ export class Store {
             const witnesses = this.db.prepare("SELECT * FROM run_process WHERE run = ? ORDER BY id").all(id);
             let incompleteSpawn = false;
             if (run.providerStartedAt !== null && witnesses.length === 0 && !this.processesSummarized(id)) {
-                return fact(id, "unprovable", `run #${id} may have spawned before its process witness was recorded; exit is unproven`);
+                return provable(id, `run #${id} may have spawned before its process witness was recorded; exit is unproven`, "no-witness");
             }
             for (const witness of witnesses) {
                 // A recorded group exit proves the whole group ended, not just its
@@ -18887,20 +19129,27 @@ export class Store {
                         return fact(id, "alive", `run #${id}'s workspace is still held by process ${occupied.by}`);
                 }
                 catch {
-                    // An unreadable workspace note is no proof either way; an approver's recorded word settles it.
-                    if (!this.workspaceConfirmedByApprover(id))
-                        return fact(id, "unknown", `run #${id}'s workspace occupancy could not be established`);
+                    // An unreadable workspace note is no proof either way; Toolroll's own look at this computer's processes settles
+                    // it (stop-proof.ts), as an approver's recorded word did before.
+                    if (!this.workspaceConfirmedByApprover(id)) {
+                        const verdict = stopProofVerdictOf(this, id);
+                        return fact(id, "unknown", verdict === null ? `run #${id}'s workspace occupancy could not be established` : `run #${id} ${verdict}`, "workspace-unreadable");
+                    }
                 }
             }
-            if (incompleteSpawn)
-                return fact(id, this.settleableUnspawnedWitnesses(run, witnesses).length > 0 ? "settling" : "unprovable", `run #${id} has an incomplete spawn witness; exit is unproven`);
+            if (incompleteSpawn) {
+                if (this.settleableUnspawnedWitnesses(run, witnesses).length > 0)
+                    return fact(id, "settling", `run #${id} has an incomplete spawn witness; exit is unproven`);
+                return provable(id, `run #${id} has an incomplete spawn witness; exit is unproven`, "incomplete-spawn");
+            }
         }
         return null;
     }
-    /** `run settle` recorded an approver's word that a run whose workspace
-     * note couldn't be read has stopped. */
+    /** A run whose workspace note couldn't be read was proven free: by Toolroll's own look (stop-proof.ts), or, in
+     * ledgers from before it, by an approver's recorded word (still read, never written now). */
     workspaceConfirmedByApprover(runId) {
-        return this.db.prepare("SELECT 1 FROM action_ledger WHERE run_id = ? AND action = 'workspace settled by approver' LIMIT 1").get(runId) !== undefined;
+        // An older approver's word still counts (ledger entries before stop-proof.ts); Toolroll's own proof counts the same.
+        return this.db.prepare("SELECT 1 FROM action_ledger WHERE run_id = ? AND action IN ('workspace settled by approver', ?) LIMIT 1").get(runId, STOP_PROOF_WORKSPACE_FREE) !== undefined;
     }
     reserveRunProcess(runId, now, group = true) {
         return Number(this.db.prepare("INSERT INTO run_process (run,host,process_group,observed_at,boot_id) VALUES (?,?,?,?,?)")
@@ -18989,7 +19238,7 @@ export class Store {
      * here, every other witness of the run has exited and none of the run's
      * process groups is alive, it settles as never started, with a ledger
      * entry. A sole pid-less witness has no group to prove gone and stays for
-     * `run settle`. Native witnesses keep their OS-only road. */
+     * Toolroll's own look (stop-proof.ts). Native witnesses keep their OS-only road. */
     settleUnspawnedWitnesses(now, onlyRun) {
         const candidates = this.db.prepare(`SELECT DISTINCT p.run FROM run_process p JOIN run r ON r.id = p.run
       WHERE p.exited_at IS NULL AND p.pid IS NULL AND p.containment IS NULL AND p.container IS NULL
@@ -19038,84 +19287,6 @@ export class Store {
             return [];
         return pidless;
     }
-    /** `run settle` (an approver's last resort): every witness of a finished
-     * run that cannot be proven either way is recorded settled under the
-     * approver's reason, in the ledger. Refuses while anything of the run is
-     * alive or could be checked only from another host. Never signals. */
-    settleRunWitnessesByApprover(args, now) {
-        return this.transact(() => {
-            const run = this.getRun(args.runId);
-            if (run === null)
-                return { ok: false, reason: "unknown-run", detail: `no run #${args.runId}` };
-            if (run.outcome === null)
-                return { ok: false, reason: "still-running", detail: `run #${args.runId} is still open` };
-            const alive = (detail) => ({ ok: false, reason: "alive", detail });
-            if (ownedProcessCount(runOwnerTag(this, args.runId)) > 0)
-                return alive(`run #${args.runId} still has an owned subprocess`);
-            const rows = this.db.prepare("SELECT * FROM run_process WHERE run = ? ORDER BY id").all(args.runId);
-            const open = rows.filter(row => row["exited_at"] === null);
-            for (const row of rows) {
-                if (row["pid"] === null)
-                    continue;
-                if (row["host"] !== hostname()) {
-                    if (row["exited_at"] === null)
-                        return alive(`run #${args.runId}'s process ${String(row["pid"])} belongs to ${String(row["host"])}; settle it there`);
-                    continue;
-                }
-                if (processMayBeAlive(Number(row["pid"]), row["process_group"] === 1, { observedAt: row["observed_at"], finishedAt: run.finishedAt, exitedAt: row["exited_at"] }))
-                    return alive(`run #${args.runId}'s process ${String(row["pid"])} is still running`);
-            }
-            for (const row of open) {
-                if (row["pid"] === null && row["host"] !== hostname())
-                    return alive(`run #${args.runId} has a witness from ${String(row["host"])}; settle it there`);
-                if (row["containment"] != null && row["container"] != null && row["container_empty_at"] == null &&
-                    containerEmptiness(String(row["containment"]), String(row["container"]), process.platform, row["container_identity"] == null ? null : String(row["container_identity"])) === "populated") {
-                    return alive(`run #${args.runId}'s ${String(row["containment"])} object ${String(row["container"])} still has members`);
-                }
-            }
-            // A workspace still held by a live process refuses; one whose note can't
-            // be read is settled by the approver's word, in the ledger.
-            let workspace = false;
-            if (run.worktree !== null) {
-                try {
-                    const occupied = worktreeProcessOccupancy(run.worktree);
-                    if (occupied.held)
-                        return alive(`run #${args.runId}'s workspace is still held by process ${occupied.by}`);
-                }
-                catch {
-                    workspace = !this.workspaceConfirmedByApprover(args.runId);
-                }
-            }
-            const ref = this.refById(run.taskRef);
-            if (workspace) {
-                this.recordAction({ at: now.toISOString(), actor: args.by, repo: ref?.repo ?? null, taskId: ref?.externalId ?? null, runId: args.runId,
-                    action: "workspace settled by approver", outcome: run.worktree ?? "", source: "request", detail: args.why });
-            }
-            // A run that may have spawned before any witness was written has none
-            // to settle: the approver's word is recorded as one ended witness.
-            if (rows.length === 0 && run.providerStartedAt !== null && !this.processesSummarized(args.runId)) {
-                const id = Number(this.db.prepare("INSERT INTO run_process (run,host,process_group,observed_at,boot_id,exited_at) VALUES (?,?,0,?,?,?)")
-                    .run(args.runId, hostname(), now.toISOString(), currentBootId(), now.toISOString()).lastInsertRowid);
-                this.recordAction({ at: now.toISOString(), actor: args.by, repo: ref?.repo ?? null, taskId: ref?.externalId ?? null, runId: args.runId,
-                    action: "process witness settled by approver", outcome: `witness ${id}`, source: "request", detail: args.why });
-                this.settleQuiescentStops(now);
-                return { ok: true, witnesses: [id], repeated: false };
-            }
-            if (open.length === 0) {
-                if (workspace)
-                    this.settleQuiescentStops(now);
-                return { ok: true, witnesses: [], repeated: !workspace };
-            }
-            const ids = open.map(row => Number(row["id"]));
-            for (const id of ids)
-                this.db.prepare("UPDATE run_process SET exited_at = ? WHERE id = ? AND run = ? AND exited_at IS NULL").run(now.toISOString(), id, args.runId);
-            this.recordAction({ at: now.toISOString(), actor: args.by, repo: ref?.repo ?? null, taskId: ref?.externalId ?? null, runId: args.runId,
-                action: "process witness settled by approver", outcome: `witness ${ids.join(", ")}`, source: "request", detail: args.why });
-            compactSettledRunProcesses(this.db, now, args.runId);
-            this.settleQuiescentStops(now);
-            return { ok: true, witnesses: ids, repeated: false };
-        });
-    }
     recordRunProcess(runId, pid, now, group = true, witness) {
         if (!Number.isSafeInteger(pid) || pid <= 0)
             throw new Error("a process witness needs a valid spawned PID");
@@ -22661,3 +22832,72 @@ export function forgetProjectModels(store, repo, now) {
         return rows + forgetProjectRoutes(store, repo);
     });
 }
+// ---- Toolroll's own stop proof (stop-proof.ts) ------------------------------------------------------------------
+/** The ledger words of Toolroll's own stop proof. Nobody is asked to vouch that a build stopped: Toolroll looks at
+ * this computer's processes itself, and a person's older recorded word (`run settle` before this) is still read. */
+export const STOP_PROOF_SETTLED = "run stop proven automatically";
+export const STOP_PROOF_BLOCKED = "automatic stop check blocked";
+export const STOP_PROOF_WORKSPACE_FREE = "workspace proven free automatically";
+/** Why Toolroll's own stop check is blocked for a run, in words that follow "run #N " (the stop fact's problem), or
+ * null when its newest word is not a block (never checked, or proven since). */
+export function stopProofVerdictOf(store, runId) {
+    const row = store.handle.prepare("SELECT action, outcome FROM action_ledger WHERE run_id = ? AND action IN (?, ?) ORDER BY id DESC LIMIT 1")
+        .get(runId, STOP_PROOF_BLOCKED, STOP_PROOF_SETTLED);
+    return row === undefined || row["action"] !== STOP_PROOF_BLOCKED ? null : String(row["outcome"]);
+}
+/** Record that Toolroll's own stop check could not prove a run stopped (`words` follow "run #N "; `detail` is the
+ * evidence). The same block twice in a row is recorded once. True when recorded. */
+export function recordStopProofBlocked(store, runId, words, detail, now) {
+    return store.transact(() => {
+        if (stopProofVerdictOf(store, runId) === words)
+            return false;
+        const run = store.getRun(runId);
+        const ref = run === null ? null : store.refById(run.taskRef);
+        store.recordAction({ at: now.toISOString(), actor: "system", repo: ref?.repo ?? null, taskId: ref?.externalId ?? null, runId,
+            action: STOP_PROOF_BLOCKED, outcome: words, source: "work", detail });
+        return true;
+    });
+}
+/**
+ * Settle a finished run's unproven stop on Toolroll's own observation of this computer (stop-proof.ts): the caller
+ * looked at every process here and found none of the run's. Applies only while the run's stop is still unproven for
+ * exactly `cause` (re-read in this transaction): a pid-less spawn witness is recorded ended, a run with no witness gets
+ * one ended witness, an unreadable workspace note is recorded proven free. The evidence goes in the ledger. Never
+ * signals. True when this call settled it.
+ */
+export function settleRunStopByObservation(store, args, now) {
+    return store.transact(() => {
+        const fact = store.stopQuiescenceFact(args.runId);
+        if (fact === null || fact.run !== args.runId || fact.cause !== args.cause || (fact.kind !== "unprovable" && fact.kind !== "unknown"))
+            return false;
+        const run = store.getRun(args.runId);
+        if (run === null || run.outcome === null || run.finishedAt === null)
+            return false;
+        const db = store.handle;
+        const ref = store.refById(run.taskRef);
+        const at = now.toISOString();
+        let what;
+        if (args.cause === "incomplete-spawn") {
+            const changed = db.prepare(`UPDATE run_process SET exited_at = ? WHERE run = ? AND exited_at IS NULL AND pid IS NULL
+        AND containment IS NULL AND container IS NULL AND host = ?`).run(at, args.runId, hostname()).changes;
+            if (Number(changed) === 0)
+                return false;
+            what = `${Number(changed)} process witness${Number(changed) === 1 ? "" : "es"} with no process ID recorded ended`;
+        }
+        else if (args.cause === "no-witness") {
+            db.prepare("INSERT INTO run_process (run,host,process_group,observed_at,boot_id,exited_at) VALUES (?,?,0,?,?,?)")
+                .run(args.runId, hostname(), at, currentBootId(), at);
+            what = "its missing process witness recorded ended";
+        }
+        else {
+            store.recordAction({ at, actor: "system", repo: ref?.repo ?? null, taskId: ref?.externalId ?? null, runId: args.runId,
+                action: STOP_PROOF_WORKSPACE_FREE, outcome: run.worktree ?? "", source: "work", detail: args.evidence });
+            what = "its folder recorded free";
+        }
+        store.recordAction({ at, actor: "system", repo: ref?.repo ?? null, taskId: ref?.externalId ?? null, runId: args.runId,
+            action: STOP_PROOF_SETTLED, outcome: what, source: "work", detail: args.evidence });
+        compactSettledRunProcesses(db, now, args.runId);
+        store.settleQuiescentStops(now);
+        return true;
+    });
+}

package/dist/surface.js

@@ -315,7 +315,7 @@ const GUIDE_ROWS = [
             { name: "days", takesValue: true, meaning: "also finished tasks untouched this many days (1–365, default 14)" },
             { name: "except", takesValue: true, meaning: "comma-separated tasks from the list to leave out" }],
         notableReasons: ["usage", "not-an-approver", "empty"] },
-    operator("run settle", "last resort for a finished run whose process witness can't be proven either way: records your --why in the ledger; refuses while any of the run's processes is alive"),
+    operator("run settle", "have Toolroll check again whether a finished run stopped: it looks at this computer's processes itself, stops only leftovers proven the run's, and settles the run when none is left (nobody vouches; --why is ignored)"),
     operator("task resume", "resume the exact stopped attempt (--run <id>): refuses until it is quiescent, lifts only that stop's hold, approves nothing — the next pass re-proves the scope and inherits the draft with fresh proof"),
     // ---- leases (runner surface) ----
     { invocation: "claim", synopsis: "take one ready, approved task; answers with a lease", audience: "agent", agentMayInvoke: true, mutation: "keyed",

package/dist/task-outcome-cli.js

@@ -10,6 +10,7 @@ import { requestResultChanges } from './result-actions.js';
 import { commentSourceKey, revisionSourceOf } from './result-review.js';
 import { envelopeJson } from './envelope.js';
 import { completeAndOpenPullRequest, mergeAsPerson, MERGE_NEEDS_PERSON, newestPullRequestOf, publishingOf, pullRequestViewOf } from './pull-request-flow.js';
+import { proveRunStopped } from './stop-proof.js';
 export async function runTaskOutcomeCommand(action, positional, flags, context) {
     const command = `task ${action}`;
     const emit = (result, lines) => {
@@ -36,6 +37,10 @@ export async function runTaskOutcomeCommand(action, positional, flags, context)
     if (credential.token === null && operator === null)
         return fail('unauthenticated', 'Sign in with up, or supply --as and --token. Agents can use --token-file or --token-env with a scoped credential.');
     const { store, now, evidenceRoot } = context;
+    // A result whose build Toolroll hasn't yet proven stopped: it looks now (stop-proof.ts), so completing never waits
+    // on a person to confirm it, only on Toolroll's own check (a refusal says "stopping" until it lands).
+    if (action === 'complete')
+        await proveTaskBuildsStopped(store, task, () => now);
     return store.transact(() => {
         const coordinator = credential.token === null ? null : authenticateCoordinator(store, credential.token);
         if (coordinator !== null && !coordinator.ok)
@@ -172,3 +177,17 @@ export function pullRequestLines(view) {
         return [];
     return [`  pull request: ${view.prUrl ?? 'opening'} · ${view.label}`, `    ${view.detail}`, ...(view.mergeCommit === null ? [] : [`    merge commit: ${view.mergeCommit}`])];
 }
+/** Toolroll's own stop proof for every finished build of a task's family whose stop it can prove here. Best effort: a
+ * failure leaves the completion's own refusal to say what is still unproven. */
+async function proveTaskBuildsStopped(store, task, clock) {
+    try {
+        const family = store.taskFamilyOf(task, null, true);
+        const refs = family === null ? [store.lookupRef(task)?.id].filter((one) => one !== undefined) : family.versions.map(version => version.refId);
+        for (const ref of refs)
+            for (const run of store.runsFor(ref)) {
+                if (run.outcome !== null && store.stopQuiescenceFact(run.id)?.cause !== undefined)
+                    await proveRunStopped(store, run.id, clock);
+            }
+    }
+    catch { /* the completion below refuses with what is still unproven */ }
+}

package/dist/toolroll-update-ui.js

@@ -24,7 +24,7 @@ export function updateStepsHtml(j, running, options = {}) {
     const items = UPDATE_STEPS.map((step, i) => {
         const state = j.phase === "complete" || i < last ? "done" : i > last ? "waiting" : failed ? "failed" : finished ? "waiting" : "now";
         // Only where it adds something: which work it waits for, or what went wrong.
-        const detail = state === "now" && step === "draining" && j.waiting ? html `${j.waiting.on}.${j.waiting.action ? html ` If nothing of it is running, run <code class="k-mono">${j.waiting.action}</code>.` : ""}`
+        const detail = state === "now" && step === "draining" && j.waiting ? html `${j.waiting.on}.${j.waiting.action ? html ` To have Toolroll check again, run <code class="k-mono">${j.waiting.action}</code>.` : ""}`
             : (state === "now" && step === "draining") || (state === "failed" && j.phase === "rolling-back") ? html `${j.detail}` : "";
         return settingsRecord({ title: STEP_WORDS[step], sub: detail, when: STEP_CHIP[state], attrs: { "data-step": step, "data-state": state } });
     });
@@ -43,7 +43,7 @@ function outcomeHtml(j) {
     // Stopped on a finished run it can't show has ended: what is in the way and the one command, nothing more.
     if (j.phase === "refused" && j.waiting) {
         return settingsSection({ id: "update-outcome", title: `Update to ${j.to.version} stopped: run #${j.waiting.run} is in the way`,
-            body: html `<div data-update-outcome="stopped">${infoLine(`${j.waiting.on}. New work resumed.`)}${j.waiting.action ? note(html `If nothing of it is running, run <code class="k-mono">${j.waiting.action}</code>, then update again.`) : note("Update again once it has stopped.")}</div>` });
+            body: html `<div data-update-outcome="stopped">${infoLine(`${j.waiting.on}. New work resumed.`)}${j.waiting.action ? note(html `To have Toolroll check again, run <code class="k-mono">${j.waiting.action}</code>, then update again.`) : note("Update again once it has stopped.")}</div>` });
     }
     const title = j.phase === "refused" ? `Didn't update to ${j.to.version}` : j.phase === "restored" ? `Update to ${j.to.version} didn't finish` : "The update needs attention";
     return settingsSection({ id: "update-outcome", title, state: html ` ${chip("Failed", "failed")}`,

package/dist/toolroll-update.js

@@ -414,6 +414,7 @@ const HISTORY_RULES = {
     // v147: an account's password flag reads set (1), a browser session reads full with no local binding or key, and the
     // console record reads no key epoch.
     // v148: a run's execution class and a revision's origin read none (NULL), and a project's suggestion switch reads on.
+    // v149 adds tables only (the learning-loops records): no saved row changes, so no rule is needed for it.
     ...Object.fromEntries(Object.entries(addedColumns(V119_ADDED_COLUMNS, V120_ADDED_COLUMNS, V121_ADDED_COLUMNS, V122_ADDED_COLUMNS, V123_ADDED_COLUMNS, V125_ADDED_COLUMNS, V126_ADDED_COLUMNS, V128_ADDED_COLUMNS, V129_ADDED_COLUMNS, V134_ADDED_COLUMNS, V135_ADDED_COLUMNS, V138_ADDED_COLUMNS, V143_ADDED_COLUMNS, V147_ADDED_COLUMNS, V148_ADDED_COLUMNS))
         .map(([table, rule]) => [table, { ...EARLIER_RULES[table], ...rule }])),
 };