toolroll 0.9.92 → 0.9.94

package/CHANGELOG.md

@@ -1,5 +1,92 @@
 # Changelog
 
+## Unreleased
+
+## 0.9.94 — 2026-11-07
+
+- **Small tasks start in one step.** For small work you start yourself, New
+  task shows the exact terms and **Build** is your approval. If the change
+  grows past small, Toolroll stops and asks you to approve it to keep it.
+  In the terminal: `toolroll task new "<what should change>" --repo <project>`.
+- **Start a task from a GitHub issue or pull request.** Paste the link in New
+  task, or use `toolroll task new --from <url>`. Toolroll quotes the text as
+  written outside Toolroll, and you read it before filing it.
+- **Needs you now holds only what needs you.** Things that are simply waiting
+  say what they wait for, and the task page, chat, the terminal and pings all
+  say the same sentence. Pings are one line with one button ("#41 is ready to
+  review").
+- **Fewer pages and fewer words.** Home has Needs you, Running and Waiting;
+  Tasks is the one list. Old links still land in the right place. A result has
+  Accept, Send back and Retry; a plan has Approve, Request changes and Reject.
+  One set of keyboard shortcuts works in the console and the terminal.
+- **"Can I merge?"** One checklist on each task: plan, build, checks,
+  requirements, pull request, review comments and release check.
+- **A code map for each project.** `/projects/<name>/map` and `toolroll map`
+  show the areas, files and exports of your main branch, generated by Toolroll
+  itself with no agent or model. Builds and the lead can read it, and the page
+  reports how builds with the map compare to builds without it. Turn it off
+  per project in its settings.
+- **Flaky tests**: each project lists tests with mixed outcomes under recorded
+  conditions, from local checks and GitHub CI re-runs, with history and one
+  action, "Make a task to fix it". `toolroll flaky list|show`. Read only:
+  nothing is rerun and no check changes.
+- **Lesson notes**: when a revision passes a test that failed, Toolroll
+  proposes a note with what was recorded. You put it in your own words and
+  accept it as a decision, then see how often that test fails afterwards.
+- **Last included in a run** on lessons, references and decisions, and
+  decisions now reach runs in projects with no other knowledge.
+- **Clean up** in Settings → Knowledge proposes retiring, merging or settling
+  memory entries. Nothing changes until you accept, and restore and undo merge
+  are there when you change your mind. `toolroll memory tidy|restore|unmerge`.
+- **Toolroll cleans up task folders nobody is using.** A task idle for 14
+  days now loses its working folder even if its result is still waiting for
+  review or the task never finished, as long as nothing would be lost: no
+  uncommitted changes, every commit on its branch, nothing running in it.
+  Reviewing, Accept, Send back, Run checks, Retry and Resume all keep working;
+  the next run makes the folder again from its branch. Choose 7, 14 or 30
+  days or never in Settings → Storage, or with
+  `toolroll storage cleanup idle <days>`. `toolroll storage` shows what the
+  next sweep would free.
+- **Folders with uncommitted changes are listed, never removed.** Settings →
+  Storage and `toolroll storage` now show them so you can decide. Storage
+  calls these "task folders" now.
+- **Builds that vanish recover on their own, within limits.** A lost build
+  counts once and retries up to three times. Past that, or with no budget left,
+  the task stops and says why.
+- **A missing check verdict gets one automatic recheck** of that exact commit,
+  with no agent, instead of waiting for you.
+- **The builder comes back after a crash.** Toolroll restarts it only if you
+  left it on and it can prove the old process is gone. If you turned it off, it
+  stays off.
+- **A changed route is one Approve.** When a task's model route changed since
+  you approved, you see one line saying what changed and approve once.
+- **One release command.** `toolroll release <branch>` works out the next step,
+  picks up what a stopped deploy left, and updates a branch that is behind main.
+- **Toolroll knows which computer it is on, even if the network renames it.**
+  A release no longer waits forever on "the computer that ran build #N".
+- **Checks say how they ran.** Each check launch records its sandbox, and the
+  result page and release card show it. A check with no record reads unknown and
+  is never carried forward as sandboxed.
+
+## 0.9.93 — 2026-11-06
+
+- **Approve a release with one tap.** When a release is ready for your yes,
+  your phone gets one notification ("A release is ready for your approval")
+  that opens a single screen: what changed since the last release, the
+  GitHub checks, the full terms, and one **Approve release** button. Approve
+  and walk away: it deploys only after everything passes, and you hear back
+  only if something fails. In the terminal, `toolroll release approve` finds
+  the release itself — no task names or codes to copy.
+- **No more "Confirm it stopped".** When a finished build's process record
+  is incomplete, Toolroll now checks the computer itself, stops anything left
+  over that it can prove is that build's, and carries on. The task says
+  "Making sure build #N stopped. This clears on its own." Releases wait
+  through it instead of stopping.
+- **Checks record what they saw.** Each finished check now keeps an advisory
+  record of the exact code, conditions and failures, groundwork for a list
+  of flaky tests and for lessons from fixed failures. It never changes a
+  check's result.
+
 ## 0.9.92 — 2026-11-05
 
 - **Toolroll learns which cheaper models do the job.** Every task now gets a

package/dist/activity-line.d.ts

@@ -3,9 +3,10 @@
  * 40 s ago". Pure and shared: the server sends the facts, and each page words
  * them against its own clock, so the age keeps counting between reads.
  *
- * After five minutes with no word the line turns amber and says so; a worker
- * whose heartbeat stopped says that instead, because a quiet agent and a
- * machine that went away need different help.
+ * After five minutes with no word the line says when it last heard, in the
+ * same quiet secondary text (a quiet agent isn't something a person must do;
+ * amber is for what needs you). A worker whose heartbeat stopped says that
+ * instead, and that one is marked: the builder going away needs a person.
  */
 /** The facts behind the line: our own words for the last thing done (never a tool's arguments), when, and whether
  * the worker running it still answers. */
@@ -19,8 +20,10 @@ export declare const QUIET_AFTER_MS: number;
 export declare const ACTIVITY_WORDS: Readonly<Record<string, string>>;
 /** "just now", "40 s ago", "3 min ago", "2 h ago". */
 export declare function agoWords(ms: number): string;
-/** The line itself, and whether it is quiet (amber): silent five minutes or more, or the worker is offline. */
+/** The line itself. `quiet` (marked): the worker is offline, which needs a person. `stale`: silent five minutes or
+ * more, said in the same neutral words as any other update. */
 export declare function activityLine(activity: RunActivity, now: number): {
     text: string;
     quiet: boolean;
+    stale: boolean;
 };

package/dist/activity-line.js

@@ -3,9 +3,10 @@
  * 40 s ago". Pure and shared: the server sends the facts, and each page words
  * them against its own clock, so the age keeps counting between reads.
  *
- * After five minutes with no word the line turns amber and says so; a worker
- * whose heartbeat stopped says that instead, because a quiet agent and a
- * machine that went away need different help.
+ * After five minutes with no word the line says when it last heard, in the
+ * same quiet secondary text (a quiet agent isn't something a person must do;
+ * amber is for what needs you). A worker whose heartbeat stopped says that
+ * instead, and that one is marked: the builder going away needs a person.
  */
 export const QUIET_AFTER_MS = 5 * 60_000;
 /** The words for each fixed activity kind (live.ts's vocabulary) and for a progress checkpoint. */
@@ -35,13 +36,14 @@ export function agoWords(ms) {
         return `${minutes} min ago`;
     return `${Math.floor(minutes / 60)} h ago`;
 }
-/** The line itself, and whether it is quiet (amber): silent five minutes or more, or the worker is offline. */
+/** The line itself. `quiet` (marked): the worker is offline, which needs a person. `stale`: silent five minutes or
+ * more, said in the same neutral words as any other update. */
 export function activityLine(activity, now) {
     const at = Date.parse(activity.at);
     const since = Number.isNaN(at) ? 0 : Math.max(0, now - at);
     if (activity.worker === "offline")
-        return { text: `Worker offline · last word ${agoWords(since)}`, quiet: true };
+        return { text: `Worker offline · last word ${agoWords(since)}`, quiet: true, stale: false };
     if (since >= QUIET_AFTER_MS)
-        return { text: `No word for ${Math.floor(since / 60_000)} min`, quiet: true };
-    return { text: `${activity.what} · ${agoWords(since)}`, quiet: false };
+        return { text: `Last update ${agoWords(since)}`, quiet: false, stale: true };
+    return { text: `${activity.what} · ${agoWords(since)}`, quiet: false, stale: false };
 }

package/dist/agent-fence.d.ts

@@ -90,6 +90,8 @@ export type FenceGrants = {
     pool?: CheckoutPool;
     network?: NetworkFence;
     writes?: WriteAllowlist;
+    /** Which `readable` entries are one exact file: read with no listing of its folder, so a sibling stays denied. */
+    exactFiles?: string[];
     /** Policy v1: the home configuration names denied by name, present or not (TaskBoundary.homeNames). */
     homeNames?: string[];
     /** macOS: the project's sealed mach services beyond the runtime's baseline (its `allowMachLookup`). */
@@ -359,6 +361,8 @@ export type FenceKind = "build" | "command" | "check" | "flow" | "tool-server";
  * with no checkout), so no caller forgets one; every path comes from Toolroll's own records, never from the checkout.
  */
 export type FenceContext = {
+    /** One exact file read back inside the fence (a build's code map), or null. */
+    exactFile?: string | null;
     databaseFile: string | null;
     worktree: string | null;
     boundary: TaskBoundary | null;

package/dist/agent-fence.js

@@ -1006,7 +1006,7 @@ export function srtTermsOf(fence, grants = NO_GRANTS) {
     const denyRead = new Set(fence.map(real));
     // A readable grant's own folder is read too: bundlers (esbuild) find node_modules by listing it. The runtime can't
     // grant a listing without the folder's files, so the shared copy's folder is read whole (its ready note among them).
-    const allowRead = new Set(grants.readable.flatMap(path => [real(path), real(dirname(path))]));
+    const allowRead = new Set(grants.readable.flatMap(path => grants.exactFiles?.includes(path) === true ? [real(path)] : [real(path), real(dirname(path))]));
     const denyWrite = new Set([...fence, ...grants.readOnly].map(real));
     for (const path of grants.writeDenies ?? [])
         denyWrite.add(path);
@@ -1180,9 +1180,12 @@ export function fenceFor(kind, ctx) {
     // launches: rewriting the code that fences a build would switch the fence off.
     const made = { ...found, readOnly: [...new Set([...found.readOnly, ...toolrollInstall(ctx.worktree, ctx.home ?? homedir(), ctx.binding?.main ?? null)])].sort() };
     const written = ctx.writes ?? null;
+    const exact = ctx.exactFile ?? null;
     const grants = {
         ...made,
         ...(written === null ? {} : { writes: written.writes, readOnly: [...new Set([...made.readOnly, ...written.readOnly])].sort() }),
+        // One exact file, granted as the shared dependencies are, and never written (Claude's Edit rules read `readOnly`).
+        ...(exact === null ? {} : { readable: [...made.readable, exact], exactFiles: [exact], readOnly: [...new Set([...made.readOnly, ...(written?.readOnly ?? []), exact])].sort() }),
         ...(ctx.network === undefined ? {} : { network: ctx.network }),
         ...(ctx.machLookup === undefined || ctx.machLookup.length === 0 ? {} : { machLookup: [...ctx.machLookup] }),
         // A project's checks may drive a browser (Playwright's Chromium), and so may a flow's script zone whose browser use

package/dist/approval-authority.d.ts

@@ -1,7 +1,13 @@
 /** SQL over a `task_scope` alias and a repo expression: whether that row's approval authority stands at `now` (an SQL
- * expression, used exactly three times: the mode and grant clauses, and the release's expiry). It never asks whether the row is approved.
+ * expression, used exactly four times: the mode and grant clauses, the release's expiry and a fast start's window). It never asks whether the row is approved.
  * COALESCE: a NULL basis would make the OR chain NULL, and NOT NULL reads as "not dead"; NULL stands on nothing. */
 export declare function authorityStandsSql(scope: string, repo: string, now: string): string;
+/**
+ * SQL, conjunctive with every alternative above (plain-toolroll.md P2.4): narrow only. A fast start's seal dispatches only
+ * inside its start window, and only as what it claims to be: a person's own ceremony yes to these exact bytes, proved at
+ * the seal's instant. Losing the marker leaves an ordinary person approval; nothing here grants anything.
+ */
+export declare function fastStartStandsSql(scope: string, now: string): string;
 /**
  * SQL, conjunctive with every alternative above (results routing slice 3): a task whose sealed route tries a cheaper
  * model (its build leg's selection is a trial) stands only on a PERSON's own yes to these exact bytes — the ceremony

package/dist/approval-authority.js

@@ -18,7 +18,7 @@ import { autoSealSql } from "./release-authority.js";
 /** The proofs a person gives (src/person-proof.ts), as an SQL list. */
 const PERSON_PROOFS = "('password-now', 'sso-now', 'fresh-password', 'fresh-sso', 'session', 'cli-login', 'chat', 'passkey', 'local-owner')";
 /** SQL over a `task_scope` alias and a repo expression: whether that row's approval authority stands at `now` (an SQL
- * expression, used exactly three times: the mode and grant clauses, and the release's expiry). It never asks whether the row is approved.
+ * expression, used exactly four times: the mode and grant clauses, the release's expiry and a fast start's window). It never asks whether the row is approved.
  * COALESCE: a NULL basis would make the OR chain NULL, and NOT NULL reads as "not dead"; NULL stands on nothing. */
 export function authorityStandsSql(scope, repo, now) {
     return `COALESCE((((COALESCE(${scope}.approval_basis, '') IN ('password', 'chat') AND NOT ${machineSealSql(scope)}
@@ -31,9 +31,18 @@ export function authorityStandsSql(scope, repo, now) {
     OR (${scope}.approval_basis = 'grant' AND ${grantStandsSql(`${scope}.mode_digest`, now, repo)})
     OR (${scope}.approval_basis = 'schedule' AND ${approverStandsSql(scope, repo)})
     OR (${scope}.approval_basis IN ('auto-check', 'auto-green') AND ${autoSealSql(scope, repo)} AND ${approverStandsSql(scope, repo)}))
-    AND ${releaseStandsSql(scope, now)} AND ${localSealStandsSql(scope, repo)}
+    AND ${releaseStandsSql(scope, now)} AND ${localSealStandsSql(scope, repo)} AND ${fastStartStandsSql(scope, now)}
     AND (instr(COALESCE(${scope}.approved_route_json, ''), '"trial"') = 0 OR ${trialSealStandsSql(scope)})), 0)`;
 }
+/**
+ * SQL, conjunctive with every alternative above (plain-toolroll.md P2.4): narrow only. A fast start's seal dispatches only
+ * inside its start window, and only as what it claims to be: a person's own ceremony yes to these exact bytes, proved at
+ * the seal's instant. Losing the marker leaves an ordinary person approval; nothing here grants anything.
+ */
+export function fastStartStandsSql(scope, now) {
+    return `NOT EXISTS (SELECT 1 FROM task_ref fsr WHERE fsr.backend = 'built-in' AND fsr.external_id = ${scope}.task_id AND fsr.fast_start_until IS NOT NULL
+      AND (fsr.fast_start_until <= ${now} OR COALESCE(${scope}.approval_basis, '') <> 'password' OR ${machineSealSql(scope)} OR NOT ${personSealSql(scope)}))`;
+}
 /**
  * SQL, conjunctive with every alternative above (results routing slice 3): a task whose sealed route tries a cheaper
  * model (its build leg's selection is a trial) stands only on a PERSON's own yes to these exact bytes — the ceremony

package/dist/approval-password.d.ts

@@ -0,0 +1,31 @@
+import type { Scope } from "./scope.js";
+import type { Store } from "./store.js";
+export type ApprovalPasswordField = {
+    field: "none";
+    why: "passwordless" | "local-owner";
+} | {
+    field: "remembered";
+    since: string;
+} | {
+    field: "required";
+} | {
+    field: "local-refused";
+    message: string;
+    href: string;
+    action: string;
+};
+export type ApprovalPasswordFacts = {
+    /** The approver. */
+    name: string;
+    taskId: string;
+    scope: Scope;
+    /** Passwordless is on for this browser session (html.ts passwordlessRendering). */
+    passwordless: boolean;
+    /** The request is this laptop's local owner (easy-start C5). */
+    localOwner: boolean;
+    /** When a password was last typed on this session, if it may still stand (scope.ts freshnessFor), else null. */
+    freshAt: number | null;
+    /** Where a refused local owner goes back to. */
+    returnTo: string;
+};
+export declare function approvalPasswordField(store: Store, facts: ApprovalPasswordFacts): ApprovalPasswordField;

package/dist/approval-password.js

@@ -0,0 +1,26 @@
+/** When an approval form asks for a password (docs/plans/plain-toolroll.md P1.3): one function every approve form reads,
+ * so the task page, the focused chat and the shared-action review never disagree. It only decides what a form shows;
+ * approve() proves the person, the freshness, the local owner and the digest again inside its own transaction, with
+ * the same two rules this reads (freshlyApprovable, localApprovalEligible).
+ *
+ * - `none`: Passwordless is on for this session, or this computer's local owner may approve this exact work.
+ * - `remembered`: a password typed on this session in the last fifteen minutes may stand for these terms; the field
+ *   shows, and may be left empty.
+ * - `required`: a password typed now: protected or escalated work, terms an agent wrote, or nothing remembered.
+ * - `local-refused`: a local owner who can't approve this here, with where to go instead. */
+import { freshlyApprovable, localApprovalEligible } from "./scope.js";
+import { localOwnerRefusal } from "./local-owner.js";
+export function approvalPasswordField(store, facts) {
+    if (facts.localOwner) {
+        if (localApprovalEligible(store, facts.name, facts.taskId).ok)
+            return { field: "none", why: "local-owner" };
+        return { field: "local-refused", ...localOwnerRefusal(store.accountOf(facts.name)?.passwordSet === true, facts.returnTo) };
+    }
+    if (facts.passwordless)
+        return { field: "none", why: "passwordless" };
+    if (facts.freshAt === null)
+        return { field: "required" };
+    const gate = store.approvalGate(facts.taskId, facts.name, "person");
+    return freshlyApprovable(store, facts.taskId, facts.scope, gate.verdict === "seal" && !gate.protectedWork)
+        ? { field: "remembered", since: new Date(facts.freshAt).toISOString() } : { field: "required" };
+}

package/dist/assignment-status.d.ts

@@ -23,7 +23,7 @@ export declare function assignmentStatusBrief(assignment: AssignmentSnapshot): {
     } | null;
     runId: number | null;
     primaryAction: {
-        code: "answer-agent" | "confirm-stopped" | "inspect-decisions" | "inspect-run" | "inspect-stop" | "inspect-task" | "open-pr" | "reconcile-run" | "sign-in" | import("./dispatch.js").DispatchAction;
+        code: "answer-agent" | "inspect-decisions" | "inspect-run" | "inspect-stop" | "inspect-task" | "open-pr" | "recheck-stopped" | "reconcile-run" | "sign-in" | import("./dispatch.js").DispatchAction;
         label: string;
         target: import("./work-summary.js").WorkTarget;
     } | null;

package/dist/assignment-ui.js

@@ -31,8 +31,8 @@ export function assignmentActionHref(assignment) {
     if (action.code === 'sign-in')
         return '/settings/agents#providers';
     // The confirmation sits on the task page, behind the password.
-    if (action.code === 'confirm-stopped')
-        return `/t/${encodeURIComponent(assignment.rootId)}#confirm-stopped`;
+    if (action.code === 'recheck-stopped')
+        return `/t/${encodeURIComponent(assignment.rootId)}#recheck-stopped`;
     if (action.code === 'open-pr' && /^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/pull\/\d+$/.test(assignment.publication?.prUrl ?? ''))
         return assignment.publication.prUrl;
     if (runId !== null && (action.code === 'open-result' || action.code === 'open-pr' || action.code === 'retry-review')) {
@@ -63,7 +63,7 @@ export function assignmentAttemptsOf(assignment) {
 export function assignmentAttemptsHtml(assignment) {
     if (assignment.attempts.length === 0)
         return html ``;
-    return html `<details class="assignment-attempts"><summary>Attempts <span class="meta">${assignment.attempts.length}</span></summary><ol>${assignmentAttemptsOf(assignment).map(attempt => html `<li data-attempt-task="${attempt.taskId}" data-history-version="${attempt.taskId}"><a href="${attempt.href}">${attempt.label}</a>${attempt.runId === null ? '' : html ` <a href="/r/${attempt.runId}">Run #${attempt.runId}</a>`}${attempt.detail === null ? '' : html `<p class="meta">${attempt.detail}</p>`}</li>`)}</ol>${assignment.owner === null ? '' : html `<p class="meta">Lead: ${assignment.owner.label}${assignment.owner.active ? '' : ' · access ended'}</p>`}<p class="work-meta work-id">Task <span class="mono">${assignment.rootId}</span></p></details>`;
+    return html `<details class="assignment-attempts"><summary>Attempts <span class="meta">${assignment.attempts.length}</span></summary><ol>${assignmentAttemptsOf(assignment).map(attempt => html `<li data-attempt-task="${attempt.taskId}" data-history-version="${attempt.taskId}"><a href="${attempt.href}">${attempt.label}</a>${attempt.runId === null ? '' : html ` <a href="/r/${attempt.runId}">Build #${attempt.runId}</a>`}${attempt.detail === null ? '' : html `<p class="meta">${attempt.detail}</p>`}</li>`)}</ol>${assignment.owner === null ? '' : html `<p class="meta">Lead: ${assignment.owner.label}${assignment.owner.active ? '' : ' · access ended'}</p>`}<p class="work-meta work-id">Task <span class="mono">${assignment.rootId}</span></p></details>`;
 }
 /** Only recognized storage limits and explicitly identified older records are
  * secondary. Unknown findings and damaged current material stay in view. */

package/dist/assignment.js

@@ -1,6 +1,7 @@
 /** One assignment follows the existing task family. It owns no execution,
  * approval or proof state. Lead ownership and exact receipt acknowledgments
  * are append-only actions; handoffs use the existing durable outbox. */
+import { fastCompletionProblem } from "./fast-start.js";
 import { createHash } from "node:crypto";
 import { currentActor, withActor } from "./actor.js";
 import { replacedWords } from "./task-status.js";
@@ -252,13 +253,14 @@ export function assignmentOf(store, taskId, now, access, root, memo) {
             : { code: "inspect-task", label: `Open ${successor}`, target: { taskId: successor, runId: null, decisionId: null }, access: "read", retry: "read-again" };
     }
     else if (!live && processFact !== null && result !== null) {
-        // Toolroll can't confirm the build stopped. A person confirms it when
-        // nothing of it may still run; otherwise the work waits, needing no one.
+        // Toolroll hasn't yet proven the build stopped. It proves that itself
+        // (stop-proof.ts), so the work waits, needing no one; only when this
+        // computer can't look is it held, offering Check again — never a vouch.
         const process = processNeedOf(processFact);
         if ("need" in process) {
             state = "needs-decision";
             detail = NEEDS[process.need].sentence({ build: process.build });
-            primaryAction = { code: "confirm-stopped", label: NEEDS[process.need].action.label, target: { taskId: current.id, runId: process.build, decisionId: null },
+            primaryAction = { code: "recheck-stopped", label: NEEDS[process.need].action.label, target: { taskId: current.id, runId: process.build, decisionId: null },
                 access: access.principal === "operator" ? "operator-control" : "operator-handoff", retry: "refresh-before-acting" };
             need = { key: process.need, build: process.build };
         }
@@ -480,6 +482,11 @@ function acknowledgeCurrent(store, current, receiptDigest, actor, now, root, acc
     // The nightly check of main is a check only (release-once.md, part 3): nobody completes it.
     if (store.handle.prepare("SELECT 1 AS hit FROM nightly_check WHERE task = ?").get(current.receipt.taskId) !== undefined)
         return { ok: false, reason: "check-only", message: "The nightly check of main is only a check; it isn't completed." };
+    // Toolroll is still proving its build stopped (stop-proof.ts): a wait that clears on its own, said as one, so a
+    // release waits for it instead of stopping.
+    if (current.state !== "ready-to-check" && current.state !== "complete" && current.need != null && "wait" in current.need && STOP_WAITS.has(current.need.wait)) {
+        return { ok: false, reason: "stopping", message: `Toolroll is still making sure ${current.need.build === null ? "the build" : `build #${current.need.build}`} stopped. This clears on its own.` };
+    }
     if (current.state !== "ready-to-check" && current.state !== "complete")
         return { ok: false, reason: "not-ready", message: "This assignment still has unresolved execution, scope or decisions." };
     // A release task completes only while its release approval stands for it (release-once.md, liveReleaseOf).
@@ -490,6 +497,10 @@ function acknowledgeCurrent(store, current, receiptDigest, actor, now, root, acc
     // token, a remote API run) that may complete ordinary work but is never the second person on protected work.
     const person = actor.startsWith("operator:") && !machineActing() ? actor.slice("operator:".length) : null;
     const marked = actor.startsWith("operator:") ? (person === null ? COMPLETION_BY_MACHINE : COMPLETION_BY_PERSON) : null;
+    // A fast start's Accept backstop (fast-start.ts): a person only, and only a change that stayed small.
+    const grown = fastCompletionProblem(store, receipt.taskId, receipt.runId, person);
+    if (grown !== null)
+        return { ok: false, reason: "not-ready", message: grown };
     if (current.state !== "complete") {
         // The one readiness guard: a failed or missing required check, an unresolved requirement or HIGH finding refuses.
         const blockers = current.readiness?.blockers ?? [];
@@ -674,3 +685,5 @@ export function assignmentUpdates(store, now, access, query, root) {
     });
     return { events, nextCursor: page.length === 0 ? after : Number(page.at(-1)["id"]), hasMore: rows.length > limit };
 }
+/** The waits of a build Toolroll is still proving stopped by itself (needs-you.ts processNeedOf). */
+const STOP_WAITS = new Set(["build-finishing", "build-checking", "build-stopping"]);

package/dist/boot-identity.d.ts

@@ -48,10 +48,11 @@ export declare function injectBootIdentity(identity: BootIdentity | null): void;
 export type BootWitness = {
     host: string;
     bootId: string | null;
+    machineId?: string | null;
 };
 /**
  * THE ONE RULE (plan §login/reboot recovery): a witnessed process is
- * proven dead by boot change only when the witness names THIS host, the
+ * proven dead by boot change only when the witness names THIS machine (isThisMachine), the
  * witness carries a well-formed boot id, this host's current boot id is
  * well-formed and known, and the two differ. Same boot, a legacy witness
  * without an id, a foreign host, an unknown or malformed current id — each

package/dist/boot-identity.js

@@ -21,7 +21,7 @@
  */
 import { execFileSync } from "node:child_process";
 import { readFileSync } from "node:fs";
-import { hostname } from "node:os";
+import { isThisMachine } from "./machine-identity.js";
 /** RFC 4122 shape, any case; the kernel tokens are exactly this. */
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 /** Normalize a candidate token: exactly one UUID, lower-cased; anything else is malformed. */
@@ -79,15 +79,17 @@ export function injectBootIdentity(identity) {
 }
 /**
  * THE ONE RULE (plan §login/reboot recovery): a witnessed process is
- * proven dead by boot change only when the witness names THIS host, the
+ * proven dead by boot change only when the witness names THIS machine (isThisMachine), the
  * witness carries a well-formed boot id, this host's current boot id is
  * well-formed and known, and the two differ. Same boot, a legacy witness
  * without an id, a foreign host, an unknown or malformed current id — each
  * answers false, and the caller keeps its PID probe or its refusal.
  */
 export function provenDeadByBootChange(witness, current = { bootId: currentBootId() }) {
-    const host = current.host ?? hostname();
-    if (witness.host !== host)
+    // A caller naming the host compares exactly (restart certification, tests); otherwise THIS machine is decided by
+    // its stable id, or for a witness without one by this machine's own names (machine-identity.ts), never by the
+    // network hostname alone: a boot id from another machine always differs from ours.
+    if (current.host !== undefined ? witness.host !== current.host : !isThisMachine(witness))
         return false;
     if (witness.bootId === null || current.bootId === null)
         return false;

package/dist/bounded-spawn.d.ts

@@ -0,0 +1,57 @@
+export type BoundedStart = {
+    pid: number;
+    pgid: number;
+    startedAt: string | null;
+};
+export type BoundedOptions = {
+    cwd: string;
+    /** The child's whole environment. */
+    env: Record<string, string>;
+    label: string;
+    stdin?: Buffer;
+    timeoutMs: number;
+    /** Past this the tree is killed (`killed: "output"`). */
+    maxStdout: number;
+    /** Kept to this many bytes; more is dropped. */
+    maxStderr: number;
+    memoryBytes?: number;
+    diskBytes?: number;
+    /** The largest file any process may write (RLIMIT_FSIZE). */
+    fileBytes?: number;
+    /** The folder whose total `diskBytes` bounds. */
+    folder?: string;
+    onStart?: (started: BoundedStart) => void;
+    sampleMs?: number;
+};
+export type BoundedResult = {
+    code: number | null;
+    signal: NodeJS.Signals | null;
+    stdout: Buffer;
+    stderr: string;
+    killed: "time" | "memory" | "disk" | "output" | null;
+    enforced: "system" | "checked";
+    peakBytes: number;
+};
+export type BoundedRunner = (file: string, args: readonly string[], options: BoundedOptions) => Promise<BoundedResult>;
+/** Tests: forget the probed machine. */
+export declare function resetBoundedContainmentForTests(): void;
+/** A process's own start time, as `ps` reports it: what tells a live process from a reused pid. */
+export declare function processStartedAt(pid: number): string | null;
+/** The folder's total size, without following a link. */
+export declare function folderBytes(folder: string): number;
+export declare const boundedRun: BoundedRunner;
+export type SpawnRecord = {
+    pid: number | null;
+    pgid: number | null;
+    startedAt: string | null;
+    folder: string | null;
+};
+/**
+ * What a crashed build left: its group is killed only if the leader is still the process recorded (the pid and its start
+ * time, so a reused pid isn't killed), and its folder goes if it sits under `root`. On Linux the cgroup janitor has
+ * done this already.
+ */
+export declare function cleanupLeftover(record: SpawnRecord, root: string): {
+    killed: boolean;
+    removed: boolean;
+};