toolroll 0.9.92 → 0.9.94

package/dist/store.js

@@ -9,6 +9,8 @@ import { isAcpProfile, isAcpProvider } from "./acp-agents.js";
 import { ACP_CONFORMANCE_VERSION, launchFromJson } from "./acp-attest.js";
 import { reclaimDatabase } from "./database-reclaim.js";
 import { BASELINE_SCHEMA, BASELINE_SCHEMA_VERSION } from "./store-baseline.js";
+import { codeMapRemoteChanged, codeMapShapeProblem, forgetCodeMap, V152_ADDED_COLUMNS, V152_SCHEMA } from "./code-map-store.js";
+import { readStamps, stampDigest, stampRefusal, V154_SCHEMA } from "./check-stamp.js";
 import { refArchived, taskArchived } from "./task-archive.js";
 export { refArchived, taskArchived } from "./task-archive.js";
 import { CHAT_PROVIDERS, CHAT_SCHEMA } from "./contracts/chat-tables.js";
@@ -73,8 +75,10 @@ import { ownedProcessCount, runOwnerTag } from "./exec.js";
 import { worktreeProcessOccupancy } from "./worktree.js";
 import { processMayBeAlive } from "./process-liveness.js";
 import { currentBootId, provenDeadByBootChange } from "./boot-identity.js";
+import { currentMachineId, isThisMachine, liveHostAliases, rememberHostAliases, thisMachine } from "./machine-identity.js";
 import { containerEmptiness } from "./container-state.js";
 import { hasDisguisedText, hasForbiddenControls, validateNote } from "./decision.js";
+import { ACTIVITY_ONLY_KINDS } from "./needs-you.js";
 import { parseReviewContext, reviewContextCustodyProblem } from "./review-context.js";
 import { foldReview, manualReviewOnly } from "./proof.js";
 import { hashPassword, liveReleaseOf } from "./scope.js";
@@ -92,6 +96,10 @@ import { authenticate as runnerAuthenticate } from "./runner.js";
 import { stampNewProjectLevel } from "./check-levels.js";
 import { parseCheckProgressSnapshot } from "./check-progress.js";
 import { authorityStandsSql } from "./approval-authority.js";
+import { clearRetryEpisode, settleVanished } from "./vanished-retry.js";
+import { issueImported } from "./task-source.js";
+import { BUILDER_SERVICE_SCHEMA, CHECK_ONLY_SCHEMA, FAST_PREVIEW_SCHEMA, ROUTE_CHANGE_SCHEMA, V153_ADDED_COLUMNS, VANISHED_SCHEMA } from "./plain-schema.js";
+export { V153_ADDED_COLUMNS } from "./plain-schema.js";
 import { releasePolicyDigest, serializeReleaseCheckPurpose, storedReleaseCheckPurpose, storedReleaseTerms, readReleaseTerms, readReleasePolicy } from "./contracts/release-terms.js";
 import { accountReachesSql, normalizeProjectAccess, projectAccessAllows, readProjectAccess } from "./project-access.js";
 import { LEDGER_COLUMNS, LEDGER_SCHEMA, LEDGER_TABLE, LEDGER_V99_TABLE, installLedgerTriggers } from "./action-ledger.js";
@@ -107,7 +115,7 @@ import { REQUEST_BUDGET_SCHEMA } from "./request-budget.js";
 import { REVIEW_SCHEMA, reviewSwitchWords } from "./review-switch.js";
 import { SPEND_SCHEMA, billingOf, budgetStates, canPrice, claudeMachineBilling, countsToward, filersOf, monthOf, priceWork, seenBilling as seenBillingOf, spendItems, subagentFilers, usd } from "./spend.js";
 import { DEFAULT_PERIODS, RETENTION_SCHEMA, periodWords, widenRetentionSchema } from "./retention.js";
-import { CHECKOUT_CLEANUP_SCHEMA, LANDED_CLEANUP_SCHEMA, STORAGE_SWEEP_SCHEMA, DEFAULT_CLEANUP, cleanupWords } from "./storage.js";
+import { CHECKOUT_CLEANUP_SCHEMA, LANDED_CLEANUP_SCHEMA, STORAGE_SWEEP_SCHEMA, DEFAULT_CLEANUP, DEFAULT_IDLE, V151_ADDED_COLUMNS, cleanupWords, idleWords } from "./storage.js";
 import { inReadOnlyRequest } from "./read-only-request.js";
 import { IN_RANGE, LEDGER_CHAIN_SCHEMA, safeWhole, sealLedger, verifyLedgerChain } from "./ledger-chain.js";
 import { NO_RULES, filerFor, isProtectedWork, protectedChanges, rulesWords } from "./approval-policy.js";
@@ -1114,7 +1122,21 @@ const REGISTERED_AT_FILING = "again, as it was filed";
 // v148 adds, and changes no saved row (docs/plans/results-routing.md): the results-routing tables (V148_SCHEMA, new
 // tables only) and a run's execution class, a revision's origin and a project's "Suggest cheaper models" switch
 // (V148_ADDED_COLUMNS: saved rows read NULL, NULL and 1).
-export const SCHEMA_VERSION = 148;
+// v149 adds, and changes no saved row (docs/plans/learning-loops.md): every learning-loops table (V149_SCHEMA, new
+// tables only) — each check's recorded conditions and results, mixed-outcome observations, tracked identities, lesson
+// notes and their tallies, memory use, tidy-up proposals and decision merges.
+// v150 adds, and changes no saved row: this machine's stable id on each process witness (run_process.machine_id;
+// saved witnesses read NULL and keep being matched by host name) and the hostnames each machine id was seen under
+// (machine_host_alias, a new table; machine-identity.ts). V150_SCHEMA, V150_ADDED_COLUMNS.
+// v151 adds, and changes no saved row: how long a task stays idle before its clean folder goes
+// (V151_ADDED_COLUMNS: a saved cleanup setting reads NULL, the default).
+// v152 adds, and changes no saved row (docs/plans/code-map.md): the code map's tables (V152_SCHEMA, code-map-store.ts) and
+// a project's map switch and enrollment end (V152_ADDED_COLUMNS: a saved project reads on, not enrolled).
+// v153 adds, and changes no saved row (docs/plans/plain-toolroll.md Phase 2): new tables and columns only.
+// V153_SCHEMA, V153_ADDED_COLUMNS.
+// v154 adds, and changes no saved row (docs/plans/trusted-release-reports.md, H2): each check launch's execution stamp
+// (check_stamp, a new table; check-stamp.ts). A run from before reads no stamp: how its checks ran is unknown.
+export const SCHEMA_VERSION = 154;
 /** v118: the tables merged into `credential`, in the order they move (a person's API tokens keep their ids first). */
 export const V118_MERGED_TABLES = Object.freeze({ api_token: "person", coordinator_credential: "coordinator", lead_credential: "lead" });
 /** The foreign keys that named a merged table, exactly as their DDL wrote them; each names `credential(id)` instead. */
@@ -1247,7 +1269,7 @@ const V115_DROPPED_REFERENCES = /\s+REFERENCES (?:contestant|contest|tournament_
  * unchanged), and adds the nullable column in V125_ADDED_COLUMNS, checked the same way. v126 only adds a new table
  * (task_source) and the columns in V126_ADDED_COLUMNS (null or 0), checked the same way.
  */
-export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148]);
+export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, 153, 154]);
 /** v119: the columns it adds, by table, with the value every row saved before it reads (toolroll-update's HISTORY_RULES). */
 export const V119_ADDED_COLUMNS = Object.freeze({
     task_ref: { planning_generation: { definition: "INTEGER NOT NULL DEFAULT 0", saved: "0" } },
@@ -1650,6 +1672,262 @@ export const V148_ADDED_COLUMNS = Object.freeze({
 });
 /** The v148 migration's steps after v147's, in order (OpenOptions.migrationStep may stop after each). */
 export const V148_STEPS = Object.freeze(["results-tables", "exec-class", "revision-origin", "suggest-models"]);
+/**
+ * v149 (docs/plans/learning-loops.md): every table the learning-loops arc uses, landed at once because a current store
+ * runs no DDL. Slice 1 writes check_fact, check_result and learning_watch; the rest are written from later slices.
+ * Each table has one writer module (the migration aside), which release-auto's learning scan (eval-hooks.ts
+ * learningWriteProblem) holds a release to: check_fact and check_result → check-facts.ts; local_observation → flaky.ts;
+ * ci_flaky_observation and ci_pairing_rejected → flaky-ci.ts; learning_watch → flaky.ts and lesson-notes.ts;
+ * lesson_note and lesson_note_tally → lesson-notes.ts; memory_use → memory-use.ts; memory_tidy_proposal and
+ * decision_merge → memory-tidy.ts.
+ *
+ * Nothing here is ever read for authority: a check's outcome, a verdict and an approval never change because of it.
+ *
+ * Deletion follows today's semantics (runs are never deleted by ordinary work; removing a project keeps its results).
+ * The tables are keyed by repo path with no foreign key to `project`; their run keys are plain REFERENCES with no ON
+ * DELETE action. check_fact, learning_watch, lesson_note, lesson_note_tally, memory_use, memory_tidy_proposal and
+ * decision_merge are kept and never deleted (their triggers allow only the columns their one writer sets: a watch's
+ * `until`, a tally's counters, a proposal's decision, a merge's undo). check_result, local_observation,
+ * ci_flaky_observation and ci_pairing_rejected are pruned after 180 days by the storage sweep's own step (a later
+ * slice), the only DELETE on them; their rows never change. The whole-project deletion (project-delete.ts), which
+ * lifts every guard for its one transaction, takes them with the project as it takes everything else.
+ */
+export const V149_SCHEMA = `
+CREATE TABLE IF NOT EXISTS check_fact (
+  run               INTEGER PRIMARY KEY REFERENCES run(id),
+  repo              TEXT,
+  task_ref          INTEGER NOT NULL,
+  head              TEXT,
+  tree              TEXT,
+  command_digest    TEXT,
+  access            TEXT,
+  harness_digest    TEXT,
+  lockfile          TEXT,
+  conditions_digest TEXT,
+  conditions_class  TEXT,
+  purpose           TEXT NOT NULL CHECK (purpose IN ('ordinary','release','nightly')),
+  learn_state       TEXT NOT NULL CHECK (learn_state IN ('recorded','not-recorded','not-asked')),
+  learn_why         TEXT,
+  recorded_at       TEXT NOT NULL,
+  CHECK ((learn_state = 'not-recorded') = (learn_why IS NOT NULL)),
+  CHECK ((conditions_digest IS NULL) = (conditions_class IS NULL)),
+  CHECK (conditions_digest IS NULL OR tree IS NOT NULL)
+);
+CREATE INDEX IF NOT EXISTS check_fact_by_repo ON check_fact (repo, recorded_at);
+CREATE INDEX IF NOT EXISTS check_fact_by_tree ON check_fact (tree, conditions_digest);
+CREATE TABLE IF NOT EXISTS check_result (
+  run         INTEGER NOT NULL REFERENCES check_fact(run),
+  identity    TEXT NOT NULL CHECK (length(identity) BETWEEN 1 AND 2600),
+  state       TEXT NOT NULL CHECK (state IN ('failed','passed','skipped','passed-on-retry')),
+  source      TEXT NOT NULL CHECK (source IN ('receipt','report','log','learn')),
+  recorded_at TEXT NOT NULL,
+  PRIMARY KEY (run, identity, source)
+);
+CREATE INDEX IF NOT EXISTS check_result_by_identity ON check_result (identity, run);
+CREATE TABLE IF NOT EXISTS local_observation (
+  id                INTEGER PRIMARY KEY AUTOINCREMENT,
+  repo              TEXT NOT NULL,
+  identity          TEXT NOT NULL,
+  failed_run        INTEGER NOT NULL REFERENCES run(id),
+  passed_run        INTEGER NOT NULL REFERENCES run(id),
+  tree              TEXT NOT NULL,
+  conditions_digest TEXT NOT NULL,
+  kind              TEXT NOT NULL CHECK (kind IN ('regate','same-tree','in-check-retry')),
+  observed_at       TEXT NOT NULL,
+  UNIQUE (identity, failed_run, passed_run),
+  CHECK ((kind = 'in-check-retry') = (failed_run = passed_run))
+);
+CREATE INDEX IF NOT EXISTS local_observation_by_repo ON local_observation (repo, identity, observed_at);
+CREATE TABLE IF NOT EXISTS ci_flaky_observation (
+  id                INTEGER PRIMARY KEY AUTOINCREMENT,
+  repo              TEXT NOT NULL,
+  provider          TEXT NOT NULL CHECK (provider = 'github'),
+  repository        TEXT NOT NULL,
+  workflow          TEXT NOT NULL,
+  lane_id           TEXT NOT NULL,
+  lane_name         TEXT NOT NULL,
+  workflow_run_id   INTEGER NOT NULL CHECK (workflow_run_id >= 1),
+  head_sha          TEXT NOT NULL,
+  failed_attempt    INTEGER NOT NULL CHECK (failed_attempt >= 1),
+  failed_job_id     INTEGER NOT NULL,
+  failed_conclusion TEXT NOT NULL,
+  passed_attempt    INTEGER NOT NULL,
+  passed_job_id     INTEGER NOT NULL,
+  passed_conclusion TEXT NOT NULL,
+  observed_at       TEXT NOT NULL,
+  UNIQUE (provider, repository, workflow_run_id, lane_id, failed_attempt, passed_attempt),
+  CHECK (passed_attempt > failed_attempt)
+);
+CREATE INDEX IF NOT EXISTS ci_flaky_observation_by_repo ON ci_flaky_observation (repo, lane_id, observed_at);
+CREATE TABLE IF NOT EXISTS ci_pairing_rejected (
+  provider        TEXT NOT NULL CHECK (provider = 'github'),
+  repository      TEXT NOT NULL,
+  workflow_run_id INTEGER NOT NULL CHECK (workflow_run_id >= 1),
+  attempt         INTEGER NOT NULL CHECK (attempt >= 1),
+  lane_id         TEXT,
+  why             TEXT NOT NULL,
+  at              TEXT NOT NULL,
+  PRIMARY KEY (provider, repository, workflow_run_id, attempt, why)
+);
+CREATE TABLE IF NOT EXISTS learning_watch (
+  repo       TEXT NOT NULL,
+  identity   TEXT NOT NULL CHECK (length(identity) BETWEEN 1 AND 2600),
+  reason     TEXT NOT NULL CHECK (reason IN ('note','observation')),
+  source_ref TEXT NOT NULL,
+  since      TEXT NOT NULL,
+  until      TEXT,
+  PRIMARY KEY (repo, identity, reason, source_ref),
+  CHECK (until IS NULL OR until >= since)
+);
+CREATE INDEX IF NOT EXISTS learning_watch_open ON learning_watch (repo, since) WHERE until IS NULL;
+CREATE TABLE IF NOT EXISTS lesson_note (
+  proposal                INTEGER PRIMARY KEY REFERENCES memory_proposal(id),
+  repo                    TEXT NOT NULL,
+  failed_run              INTEGER NOT NULL REFERENCES run(id),
+  passing_run             INTEGER NOT NULL REFERENCES run(id),
+  repair_chain            INTEGER REFERENCES repair_chain(id),
+  revision_origin         TEXT CHECK (revision_origin IS NULL OR revision_origin IN ('person','automatic-review','flow','lead','machine')),
+  identities_json         TEXT NOT NULL,
+  changed_paths_json      TEXT NOT NULL,
+  test_files_changed_json TEXT NOT NULL,
+  facts_digest            TEXT NOT NULL,
+  created_at              TEXT NOT NULL,
+  CHECK (failed_run <> passing_run)
+);
+CREATE INDEX IF NOT EXISTS lesson_note_by_repo ON lesson_note (repo, created_at);
+CREATE TABLE IF NOT EXISTS lesson_note_tally (
+  note                INTEGER NOT NULL REFERENCES lesson_note(proposal),
+  month               TEXT NOT NULL CHECK (month GLOB '[0-9][0-9][0-9][0-9]-[0-1][0-9]'),
+  executions          INTEGER NOT NULL DEFAULT 0 CHECK (executions >= 0),
+  failures            INTEGER NOT NULL DEFAULT 0 CHECK (failures >= 0 AND failures <= executions),
+  mixed_failures      INTEGER NOT NULL DEFAULT 0 CHECK (mixed_failures >= 0),
+  received_executions INTEGER NOT NULL DEFAULT 0 CHECK (received_executions >= 0 AND received_executions <= executions),
+  received_failures   INTEGER NOT NULL DEFAULT 0 CHECK (received_failures >= 0 AND received_failures <= received_executions AND received_failures <= failures),
+  unreported_checks   INTEGER NOT NULL DEFAULT 0 CHECK (unreported_checks >= 0),
+  sources_json        TEXT NOT NULL DEFAULT '[]',
+  partial             INTEGER NOT NULL DEFAULT 0 CHECK (partial IN (0,1)),
+  PRIMARY KEY (note, month)
+);
+CREATE TABLE IF NOT EXISTS memory_use (
+  run         INTEGER NOT NULL REFERENCES run(id),
+  repo        TEXT,
+  kind        TEXT NOT NULL CHECK (kind IN ('lesson','reference','decision')),
+  item        TEXT NOT NULL,
+  version     INTEGER,
+  phase       TEXT NOT NULL,
+  included_at TEXT,
+  PRIMARY KEY (run, kind, item)
+);
+CREATE INDEX IF NOT EXISTS memory_use_by_item ON memory_use (repo, kind, item, run);
+CREATE TABLE IF NOT EXISTS memory_tidy_proposal (
+  id            INTEGER PRIMARY KEY AUTOINCREMENT,
+  repo          TEXT NOT NULL,
+  kind          TEXT NOT NULL CHECK (kind IN ('retire','merge','contradiction','note-failing','restore','unmerge')),
+  items_json    TEXT NOT NULL,
+  after_text    TEXT,
+  rationale     TEXT NOT NULL,
+  evidence_json TEXT NOT NULL,
+  source        TEXT NOT NULL CHECK (source IN ('usage','duplicate','model','note','person')),
+  status        TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending','accepted','rejected','stale')),
+  created_at    TEXT NOT NULL,
+  decided_by    TEXT,
+  decided_proof TEXT,
+  decided_at    TEXT,
+  CHECK ((status = 'pending') = (decided_at IS NULL)),
+  CHECK (status IN ('accepted','rejected') OR (decided_by IS NULL AND decided_proof IS NULL)),
+  CHECK (status NOT IN ('accepted','rejected') OR decided_by IS NOT NULL)
+);
+CREATE INDEX IF NOT EXISTS memory_tidy_proposal_pending ON memory_tidy_proposal (repo, status, kind);
+CREATE TABLE IF NOT EXISTS decision_merge (
+  merge                INTEGER NOT NULL,
+  successor            INTEGER NOT NULL REFERENCES project_decision(id),
+  successor_revision   INTEGER NOT NULL CHECK (successor_revision >= 1),
+  predecessor          INTEGER NOT NULL REFERENCES project_decision(id),
+  predecessor_revision INTEGER NOT NULL CHECK (predecessor_revision >= 1),
+  at                   TEXT NOT NULL,
+  by                   TEXT NOT NULL,
+  undone_at            TEXT,
+  undone_by            TEXT,
+  PRIMARY KEY (merge, predecessor),
+  CHECK (successor <> predecessor),
+  CHECK ((undone_at IS NULL) = (undone_by IS NULL))
+);
+CREATE INDEX IF NOT EXISTS decision_merge_by_successor ON decision_merge (successor);
+CREATE INDEX IF NOT EXISTS decision_merge_by_predecessor ON decision_merge (predecessor);
+CREATE TRIGGER IF NOT EXISTS check_fact_no_update BEFORE UPDATE ON check_fact BEGIN SELECT RAISE(ABORT,'check facts are recorded once'); END;
+CREATE TRIGGER IF NOT EXISTS check_fact_no_delete BEFORE DELETE ON check_fact BEGIN SELECT RAISE(ABORT,'check facts are kept'); END;
+CREATE TRIGGER IF NOT EXISTS check_result_no_update BEFORE UPDATE ON check_result BEGIN SELECT RAISE(ABORT,'check results are recorded once'); END;
+CREATE TRIGGER IF NOT EXISTS local_observation_no_update BEFORE UPDATE ON local_observation BEGIN SELECT RAISE(ABORT,'observations are recorded once'); END;
+CREATE TRIGGER IF NOT EXISTS ci_flaky_observation_no_update BEFORE UPDATE ON ci_flaky_observation BEGIN SELECT RAISE(ABORT,'observations are recorded once'); END;
+CREATE TRIGGER IF NOT EXISTS ci_pairing_rejected_no_update BEFORE UPDATE ON ci_pairing_rejected BEGIN SELECT RAISE(ABORT,'rejected pairings are recorded once'); END;
+CREATE TRIGGER IF NOT EXISTS learning_watch_only_ends BEFORE UPDATE ON learning_watch
+  WHEN NEW.repo IS NOT OLD.repo OR NEW.identity IS NOT OLD.identity OR NEW.reason IS NOT OLD.reason OR NEW.source_ref IS NOT OLD.source_ref
+    OR NEW.since IS NOT OLD.since OR OLD.until IS NOT NULL OR NEW.until IS NULL
+  BEGIN SELECT RAISE(ABORT,'a tracked identity only ends, once'); END;
+CREATE TRIGGER IF NOT EXISTS learning_watch_no_delete BEFORE DELETE ON learning_watch BEGIN SELECT RAISE(ABORT,'tracked identities are kept'); END;
+CREATE TRIGGER IF NOT EXISTS lesson_note_no_update BEFORE UPDATE ON lesson_note BEGIN SELECT RAISE(ABORT,'lesson note facts are recorded once'); END;
+CREATE TRIGGER IF NOT EXISTS lesson_note_no_delete BEFORE DELETE ON lesson_note BEGIN SELECT RAISE(ABORT,'lesson notes are kept'); END;
+CREATE TRIGGER IF NOT EXISTS lesson_note_tally_only_counts BEFORE UPDATE ON lesson_note_tally
+  WHEN NEW.note IS NOT OLD.note OR NEW.month IS NOT OLD.month OR NEW.executions < OLD.executions OR NEW.failures < OLD.failures
+    OR NEW.mixed_failures < OLD.mixed_failures OR NEW.received_executions < OLD.received_executions OR NEW.received_failures < OLD.received_failures
+    OR NEW.unreported_checks < OLD.unreported_checks OR NEW.partial < OLD.partial
+  BEGIN SELECT RAISE(ABORT,'a tally only counts up'); END;
+CREATE TRIGGER IF NOT EXISTS lesson_note_tally_no_delete BEFORE DELETE ON lesson_note_tally BEGIN SELECT RAISE(ABORT,'tallies are never pruned'); END;
+CREATE TRIGGER IF NOT EXISTS memory_use_no_update BEFORE UPDATE ON memory_use BEGIN SELECT RAISE(ABORT,'memory use is recorded once'); END;
+CREATE TRIGGER IF NOT EXISTS memory_use_no_delete BEFORE DELETE ON memory_use BEGIN SELECT RAISE(ABORT,'memory use is kept'); END;
+CREATE TRIGGER IF NOT EXISTS memory_tidy_proposal_only_decides BEFORE UPDATE ON memory_tidy_proposal
+  WHEN NEW.id IS NOT OLD.id OR NEW.repo IS NOT OLD.repo OR NEW.kind IS NOT OLD.kind OR NEW.items_json IS NOT OLD.items_json
+    OR NEW.after_text IS NOT OLD.after_text OR NEW.rationale IS NOT OLD.rationale OR NEW.evidence_json IS NOT OLD.evidence_json
+    OR NEW.source IS NOT OLD.source OR NEW.created_at IS NOT OLD.created_at OR OLD.status <> 'pending'
+  BEGIN SELECT RAISE(ABORT,'a tidy-up proposal is decided once'); END;
+CREATE TRIGGER IF NOT EXISTS memory_tidy_proposal_no_delete BEFORE DELETE ON memory_tidy_proposal BEGIN SELECT RAISE(ABORT,'tidy-up proposals are kept'); END;
+CREATE TRIGGER IF NOT EXISTS decision_merge_only_undone BEFORE UPDATE ON decision_merge
+  WHEN NEW.merge IS NOT OLD.merge OR NEW.successor IS NOT OLD.successor OR NEW.successor_revision IS NOT OLD.successor_revision
+    OR NEW.predecessor IS NOT OLD.predecessor OR NEW.predecessor_revision IS NOT OLD.predecessor_revision OR NEW.at IS NOT OLD.at
+    OR NEW.by IS NOT OLD.by OR OLD.undone_at IS NOT NULL
+  BEGIN SELECT RAISE(ABORT,'a merge is undone once, never rewritten'); END;
+CREATE TRIGGER IF NOT EXISTS decision_merge_no_delete BEFORE DELETE ON decision_merge BEGIN SELECT RAISE(ABORT,'merges are kept'); END;
+`;
+/** The tables V149_SCHEMA adds, in the order a test drops them to make the v148 shape (dependents first). */
+export const V149_TABLES = Object.freeze(["check_result", "check_fact", "local_observation", "ci_flaky_observation", "ci_pairing_rejected", "learning_watch",
+    "lesson_note_tally", "lesson_note", "memory_use", "memory_tidy_proposal", "decision_merge"]);
+/** The v149 tables a whole-project deletion clears by repo (the rest hang off these or a deleted run or decision). */
+export const V149_REPO_TABLES = Object.freeze(["check_fact", "local_observation", "ci_flaky_observation", "learning_watch", "lesson_note", "memory_use", "memory_tidy_proposal"]);
+/** The v149 migration's steps after v148's, in order (OpenOptions.migrationStep may stop after each). */
+export const V149_STEPS = Object.freeze(["learning-tables"]);
+/**
+ * v150 (machine-identity.ts): which computer a process witness belongs to, by the machine's stable id rather than its
+ * network hostname (which follows the network on a Mac with no HostName set). machine_host_alias records each
+ * hostname this machine read while it knew its own id, written only by a process on that machine, beside the id it
+ * read; a witness with no id (every saved one) is this machine's when its host is one of them. Never read for any
+ * other machine's id.
+ */
+export const V150_SCHEMA = `
+CREATE TABLE IF NOT EXISTS machine_host_alias (
+  machine_id    TEXT NOT NULL CHECK (length(machine_id) = 32),
+  host          TEXT NOT NULL CHECK (host <> ''),
+  first_seen_at TEXT NOT NULL,
+  PRIMARY KEY (machine_id, host)
+);
+`;
+/** The tables V150_SCHEMA adds. */
+export const V150_TABLES = Object.freeze(["machine_host_alias"]);
+/** v150: a process witness's machine id (saved witnesses read NULL: matched by host name, as before). */
+export const V150_ADDED_COLUMNS = Object.freeze({
+    run_process: { machine_id: { definition: "TEXT CHECK (machine_id IS NULL OR length(machine_id) = 32)", saved: "NULL" } },
+});
+/** The v150 migration's steps after v149's, in order (OpenOptions.migrationStep may stop after each). */
+export const V150_STEPS = Object.freeze(["machine-aliases", "witness-machine"]);
+/** The v151 migration's steps after v150's, in order (OpenOptions.migrationStep may stop after each). */
+export const V151_STEPS = Object.freeze(["checkout-idle"]);
+/** The v152 migration's steps after v151's, in order (OpenOptions.migrationStep may stop after each). */
+export const V152_STEPS = Object.freeze(["code-map-tables", "code-map-switch", "code-map-watermark"]);
+/** v153 (plain-toolroll.md Phase 2): the tables each slice owns. */
+export const V153_SCHEMA = VANISHED_SCHEMA + CHECK_ONLY_SCHEMA + BUILDER_SERVICE_SCHEMA + FAST_PREVIEW_SCHEMA + ROUTE_CHANGE_SCHEMA;
+/** The v153 migration's steps after v152's, in order (OpenOptions.migrationStep may stop after each). */
+export const V153_STEPS = Object.freeze(["plain-tables", "plain-columns"]);
+/** The v154 migration's steps after v153's, in order (OpenOptions.migrationStep may stop after each). */
+export const V154_STEPS = Object.freeze(["check-stamps"]);
 /**
  * v135: one approval per release (docs/plans/release-once.md). `release_authority` is the single source of truth for a
  * release a person approved: one row per generation, changed only by compare-and-swap on `rev`, with a lease whose
@@ -2156,10 +2434,10 @@ function lifecycleWords(value, cap) {
 const LIFECYCLE_PHASE_WORDS = {
     "agent-running": { subject: "agent working", body: "The agent is working in its own checkout. Nothing is finished yet." },
     "validating-handoff": { subject: "checking the handoff", body: "The agent finished its turn; what it handed back is being checked." },
-    "capturing-evidence": { subject: "capturing evidence", body: "The diff, checks and proof are being captured." },
+    "capturing-evidence": { subject: "saving its files", body: "The diff, checks and report are being saved." },
     "committing": { subject: "committing", body: "The work is being committed on the task branch." },
-    "verifying-proof": { subject: "verifying the proof", body: "The proof is being checked against the approved acceptance criteria." },
-    "correcting-proof": { subject: "correcting the proof", body: "The proof did not match the sealed result; a bounded correction turn is running." },
+    "verifying-proof": { subject: "checking the report", body: "The report is being checked against the approved requirements." },
+    "correcting-proof": { subject: "correcting the report", body: "The report didn't match the saved result; one short correction turn is running." },
 };
 /** An operator's cancellation as one closed sentence: the reason, if any,
  * scrubbed like every phone string and ended with a full stop unless it
@@ -2172,10 +2450,10 @@ function cancellationWords(reason) {
 }
 /** What an independent review concluded, in the words the saved result shows. */
 const LIFECYCLE_REVIEW_WORDS = {
-    verified: { subject: "checks verified", body: "Every acceptance check was verified against the saved result." },
-    refuted: { subject: "evidence conflicts with the result", body: "The reviewer found evidence that contradicts the saved result. It is not accepted as done." },
-    attested: { subject: "agent-reported evidence only", body: "The result rests on agent-reported evidence that was not independently verified." },
-    short: { subject: "required evidence is missing", body: "Required evidence is missing from the saved result." },
+    verified: { subject: "checks verified", body: "Every requirement was checked against the saved result." },
+    refuted: { subject: "the report doesn't match the result", body: "The reviewer found something that contradicts the saved result. It is not accepted as done." },
+    attested: { subject: "only the agent's own checks", body: "The result rests on checks the agent reported, not checked independently." },
+    short: { subject: "a requirement isn't shown", body: "Something a requirement needs is missing from the saved result." },
     none: { subject: "comments only", body: "The reviewer left comments; no acceptance judgement was recorded." },
 };
 /** Why a task still waits after one hold lifts — the other owner, in words. */
@@ -4572,6 +4850,9 @@ function initializeStore(db, file, options = {}) {
     // A current file is this build's exact shape: the checks above read, the connection gets its settings, and no DDL
     // runs. Everything below runs once, on the way up from an older version (a fresh file is at v107 by now).
     if (preflight === SCHEMA_VERSION) {
+        const missing = codeMapShapeProblem(db);
+        if (missing !== null)
+            throw new Error(`${file}: refusing to open — ${missing}, though the schema says v${SCHEMA_VERSION}`);
         db.exec("PRAGMA journal_mode = WAL; PRAGMA foreign_keys = ON;");
         return new Store(db);
     }
@@ -4941,6 +5222,38 @@ CREATE INDEX IF NOT EXISTS run_checkpoint_by_task ON run_checkpoint (task_ref, i
     for (const [column, { definition }] of Object.entries(V148_ADDED_COLUMNS["project"]))
         addColumn(db, "project", column, definition);
     step("suggest-models");
+    // v149: the learning-loops tables (new tables only; docs/plans/learning-loops.md). Idempotent, as v148's steps are.
+    db.exec(V149_SCHEMA);
+    step("learning-tables");
+    // v150: this machine's stable id on each process witness and the hostnames it was seen under (V150_SCHEMA,
+    // V150_ADDED_COLUMNS: saved witnesses read NULL). Idempotent, as v149's step is.
+    db.exec(V150_SCHEMA);
+    step("machine-aliases");
+    for (const [column, { definition }] of Object.entries(V150_ADDED_COLUMNS["run_process"]))
+        addColumn(db, "run_process", column, definition);
+    step("witness-machine");
+    // v151: the idle limit beside the cleanup setting (V151_ADDED_COLUMNS: a saved row reads NULL). Idempotent, as v150's steps are.
+    for (const [column, { definition }] of Object.entries(V151_ADDED_COLUMNS["checkout_cleanup_setting"]))
+        addColumn(db, "checkout_cleanup_setting", column, definition);
+    step("checkout-idle");
+    // v152: the code map's tables, a project's switch, and the run-id watermark, set once. Idempotent, as v151's step is.
+    db.exec(V152_SCHEMA);
+    step("code-map-tables");
+    for (const [column, { definition }] of Object.entries(V152_ADDED_COLUMNS["project"]))
+        addColumn(db, "project", column, definition);
+    step("code-map-switch");
+    db.exec("INSERT OR IGNORE INTO code_map_meta (id, run_watermark) SELECT 1, COALESCE(MAX(id), 0) FROM run");
+    step("code-map-watermark");
+    // v153: Phase 2's tables (new tables only). Idempotent, as v152's steps are.
+    db.exec(V153_SCHEMA);
+    step("plain-tables");
+    for (const [table, columns] of Object.entries(V153_ADDED_COLUMNS))
+        for (const [column, { definition }] of Object.entries(columns))
+            addColumn(db, table, column, definition);
+    step("plain-columns");
+    // v154: each check launch's execution stamp (a new table). Idempotent, as v153's steps are.
+    db.exec(V154_SCHEMA);
+    step("check-stamps");
     // Keep the epoch until reclamation succeeds, including a retry after compaction already committed. A new file has
     // nothing to reclaim.
     if (!fresh)
@@ -6152,6 +6465,8 @@ export class Store {
         this.db = instrumentDatabase(trackWorkspaceWrites(db), this.telemetry);
         // And on each instance: the sealed methods as its own locked properties, so nothing shadows one later.
         lockStoreMoneyMethods(this);
+        // This machine's recorded names (v150), for the custody checks that hold no store (machine-identity.ts).
+        rememberStoredHostAliases(this.db);
     }
     /** TESTS ONLY: raw database access for migration fixtures. Production
      * code never calls this — the typed methods are the API. */
@@ -6423,7 +6738,7 @@ export class Store {
                         this.noteLifecycle({
                             taskRef: ref.id, kind: "task-queued", identity: `t${ref.id}`,
                             subject: "Back in the queue",
-                            body: prior["state"] === "running" ? "Its worker released it without finishing; another attempt can start." : "Reopened for another attempt.",
+                            body: prior["state"] === "running" ? "Its builder let it go without finishing; another attempt can start." : "Reopened for another attempt.",
                             link: chatControlHref("task", id),
                         }, now);
                     }
@@ -7741,6 +8056,11 @@ export class Store {
                 // from the live scope: a card that cut a word, or terms that changed since, seal nothing.
                 if (basis.kind !== "chat" && this.filedViaOf(taskId) === YOUIYOUX_FILED_VIA)
                     return false;
+                // THE IMPORT QUARANTINE (github-import.ts): a task filed from a GitHub issue or pull request, or a revision of
+                // one, is outside text too. Its provenance is immutable and copied through revisions, so no automatic basis
+                // ever seals it, here, whatever road it came by.
+                if (basis.kind !== "chat" && issueImported(this, taskId))
+                    return false;
                 // CHECK ACCESS (v132, check-access.ts): a scope whose checks reach beyond the fence (sign-ins, or no sandbox at
                 // all) seals only on a person's password ceremony — never a mode, a grant, a chat confirmation or a carry.
                 const profileText = this.db.prepare("SELECT profile_json FROM task_scope WHERE task_id = ?").get(taskId)?.["profile_json"];
@@ -7819,12 +8139,15 @@ export class Store {
             if (deployGate && basis?.kind === "chat" && !(basis.card === "release" && typeof basis.cardDigest === "string" && /^[0-9a-f]{64}$/.test(basis.cardDigest)))
                 return false;
             // The outside-request quarantine's chat road (above): the card showed every word of these live terms.
-            if (basis?.kind === "chat" && this.filedViaOf(taskId) === YOUIYOUX_FILED_VIA
+            if (basis?.kind === "chat" && (this.filedViaOf(taskId) === YOUIYOUX_FILED_VIA || issueImported(this, taskId))
                 && !(basis.card === "terms" && typeof basis.cardDigest === "string" && basis.cardDigest === shownTermsDigest(readScope(working))))
                 return false;
             // AUTOMATIC RELEASE SEALS (auto-approve-green.md): only on a release task (a candidate and release terms signed
             // in), only naming the evidence row the plane wrote for exactly this task, kind, digest and candidate.
             const automatic = basis?.kind === "auto-check" || basis?.kind === "auto-green";
+            // A FAST START (fast-start.ts) stays a person's: no automatic release seal ever lands on one.
+            if (automatic && this.db.prepare("SELECT 1 AS hit FROM task_ref WHERE backend = ? AND external_id = ? AND fast_start_at IS NOT NULL").get(BUILT_IN, taskId) !== undefined)
+                return false;
             if (automatic) {
                 if (terms.terms === null || typeof working["candidate"] !== "string" || working["candidate"] === "")
                     return false;
@@ -7834,6 +8157,9 @@ export class Store {
             }
             if (terms.terms !== null && basis !== undefined && basis.kind !== "chat" && !automatic)
                 return false;
+            // Nor does a fast start ever anchor a release, whoever approves it.
+            if (terms.terms !== null && this.db.prepare("SELECT 1 AS hit FROM task_ref WHERE backend = ? AND external_id = ? AND fast_start_at IS NOT NULL").get(BUILT_IN, taskId) !== undefined)
+                return false;
             if (terms.terms !== null && releaseSealProblem(this, terms.terms) !== null)
                 return false;
             const changed = this.db
@@ -7863,8 +8189,12 @@ export class Store {
                 // (setup review): the approval is what was stale, and it is new.
                 const ref = this.db.prepare("SELECT id FROM task_ref WHERE backend = ? AND external_id = ?").get(BUILT_IN, taskId);
                 if (ref !== undefined) {
-                    if (basis === undefined || basis.kind === "chat")
+                    if (basis === undefined || basis.kind === "chat") {
                         this.noteTaskAct(Number(ref["id"]), "approved", now);
+                        clearRetryEpisode(this, Number(ref["id"]));
+                        // An ordinary yes stands on its own: a fast start's window is over (its Accept backstop stays).
+                        this.db.prepare("UPDATE task_ref SET fast_start_until = NULL WHERE id = ? AND fast_start_until IS NOT NULL").run(Number(ref["id"]));
+                    }
                     this.db.prepare("DELETE FROM hold WHERE owner_kind = 'backoff' AND owner_id = ?").run(`stale:${Number(ref["id"])}`);
                     // Results routing: this yes closes the task's open exposure (as proposed, or with the model it sealed),
                     // and lifts the hold a switched-off rule put on the approval it replaces.
@@ -7873,6 +8203,11 @@ export class Store {
                     this.db
                         .prepare("UPDATE notification SET resolved_at = ? WHERE dedupe_key LIKE ? AND resolved_at IS NULL")
                         .run(now.toISOString(), `stale-approval:${Number(ref["id"])}:%`);
+                    // One-tap release approval (trusted-release-reports.md A5): the yes, by any road, retires the task's
+                    // "ready for your approval" rows, so a push not delivered yet is never sent after it.
+                    this.db
+                        .prepare("UPDATE notification SET resolved_at = ? WHERE kind = 'release-ready' AND task_ref = ? AND resolved_at IS NULL")
+                        .run(now.toISOString(), Number(ref["id"]));
                     // The approval fact (Telegram task updates): a NEW yes on these
                     // exact bytes. Re-sealing an approval that already stands on
                     // the same digest is the same state and says nothing.
@@ -7880,20 +8215,20 @@ export class Store {
                     if (alreadyOn !== working["digest"]) {
                         this.noteLifecycle({
                             taskRef: Number(ref["id"]), kind: "scope-approved", identity: `t${Number(ref["id"])}`,
-                            subject: "Scope approved",
+                            subject: "Plan approved",
                             body: basis === undefined
-                                ? `Approved by ${lifecycleWords(by, 40)}. A connected worker can take it next.`
+                                ? `Approved by ${lifecycleWords(by, 40)}. A connected builder can take it next.`
                                 : basis.kind === "chat"
-                                    ? `Approved by ${lifecycleWords(by, 40)} in chat. A connected worker can take it next.`
+                                    ? `Approved by ${lifecycleWords(by, 40)} in chat. A connected builder can take it next.`
                                     : basis.kind === "grant"
-                                        ? "Approved automatically: its flow runs on its own. A connected worker can take it next."
+                                        ? "Approved automatically: its flow runs on its own. A connected builder can take it next."
                                         : basis.kind === "schedule"
-                                            ? "Approved by its standing order. A connected worker can take it next."
+                                            ? "Approved by its standing order. A connected builder can take it next."
                                             : basis.kind === "auto-check"
                                                 ? "Checking automatically: it approves itself once CI and the release check pass."
                                                 : basis.kind === "auto-green"
                                                     ? "Approved automatically: CI and the release check passed."
-                                                    : "Approved automatically under the operating mode. A connected worker can take it next.",
+                                                    : "Approved automatically under the operating mode. A connected builder can take it next.",
                             link: chatControlHref("task", taskId),
                         }, now);
                     }
@@ -7932,7 +8267,7 @@ export class Store {
           JOIN task_ref ON task_ref.id = ? AND task_ref.backend = 'built-in' AND task_scope.task_id = task_ref.external_id
          WHERE task_scope.approved_at IS NOT NULL
            AND NOT ${authorityStandsSql("task_scope", "task_ref.repo", "?")}`)
-            .get(taskRef, now.toISOString(), now.toISOString(), now.toISOString());
+            .get(taskRef, now.toISOString(), now.toISOString(), now.toISOString(), now.toISOString());
         if (dead !== undefined)
             return false;
         // A release task (release-once.md): the whole live-release predicate, beyond what the SQL can say.
@@ -9472,10 +9807,7 @@ export class Store {
                 .get(taskRef);
             if (ref === undefined || String(ref["backend"]) !== BUILT_IN)
                 continue;
-            const { changes } = this.db
-                .prepare("UPDATE task SET state = 'queued', updated_at = ? WHERE id = ? AND state = 'running'")
-                .run(now.toISOString(), String(ref["external_id"]));
-            if (Number(changes) > 0)
+            if (settleVanished(this, taskRef, now) === "queued")
                 requeued?.push(String(ref["external_id"]));
         }
         return held.map(row => String(row["lease_id"]));
@@ -10268,7 +10600,7 @@ export class Store {
                 this.noteLifecycle({
                     taskRef: run.taskRef, run: runId, kind: "review-requested", identity: `r${runId}`,
                     subject: "Independent review requested",
-                    body: `${automatic ? "Queued automatically" : `Requested by ${lifecycleWords(by, 40)}`} for attempt #${runId}'s saved result. A connected reviewer runs it next.`,
+                    body: `${automatic ? "Queued automatically" : `Requested by ${lifecycleWords(by, 40)}`} for build #${runId}'s saved result. A connected reviewer runs it next.`,
                     link: chatResultHref(reviewedTask, runId, "checks"),
                 }, now);
             }
@@ -11572,6 +11904,10 @@ export class Store {
             for (const incident of incidents)
                 this.resolveIncidentLocked(incident, by, now);
             this.resetStrikes(taskRef);
+            clearRetryEpisode(this, taskRef);
+            // A person's Retry is a new person act: a fast start gets a new start window. A machine's never does.
+            if (!machineActing())
+                this.db.prepare("UPDATE task_ref SET fast_start_until = ? WHERE id = ? AND fast_start_until IS NOT NULL").run(new Date(now.getTime() + 30 * 60_000).toISOString(), taskRef);
             this.db
                 .prepare("UPDATE task SET state = 'queued', updated_at = ? WHERE id = ? AND state IN ('failed','queued','done')")
                 .run(stamp, taskId);
@@ -11579,10 +11915,10 @@ export class Store {
             this.resolveEpisode(`stalled:${taskRef}`, now);
             this.noteLifecycle({
                 taskRef, kind: "task-requeued", identity: `t${taskRef}`,
-                subject: "Requeued",
+                subject: "Queued again",
                 body: rejectedRun !== null
-                    ? `Its last result (attempt #${rejectedRun}) was not accepted; the next attempt continues on the same branch under the current scope.`
-                    : `${incidents.length > 0 ? "Its incident is resolved and its" : "Its"} failure streak is cleared; a worker can take it again.`,
+                    ? `Its last result (build #${rejectedRun}) was not accepted; the next attempt continues on the same branch under the current plan.`
+                    : `Its repeated failures are cleared; a builder can take it again.`,
                 link: chatControlHref("task", taskId),
             }, now);
             this.bumpWake();
@@ -13094,18 +13430,18 @@ export class Store {
         const stopped = result.outcome === "failed" && result.reason === "interrupted" && this.stopOf(id) !== null;
         if (role === "builder") {
             if (stopped) {
-                this.noteLifecycle({ taskRef, run: id, kind: "run-stopped", identity: `r${id}`, subject: `Attempt #${id} stopped`, body: "Its work is preserved. Resume this attempt from the task page when ready.", link: chatControlHref("recovery", taskId) }, now);
+                this.noteLifecycle({ taskRef, run: id, kind: "run-stopped", identity: `r${id}`, subject: `Build #${id} stopped`, body: "Its work is preserved. Resume this attempt from the task page when ready.", link: chatControlHref("recovery", taskId) }, now);
             }
             else if (result.outcome === "built") {
                 this.noteLifecycle({
                     taskRef, run: id, kind: "run-finished", identity: `r${id}`,
-                    subject: `Attempt #${id} built`,
+                    subject: `Build #${id} built`,
                     body: result.committed === false ? "It finished without a commit; the handoff explains why." : "The result is saved locally. It is not yet independently reviewed or published.",
                     link: chatResultHref(taskId, id, "changes"),
                 }, now);
             }
             else if (result.outcome === "no-change") {
-                this.noteLifecycle({ taskRef, run: id, kind: "run-finished", identity: `r${id}`, subject: `Attempt #${id} finished with no changes`, body: "Nothing needed to change; the handoff explains why.", link: chatResultHref(taskId, id) }, now);
+                this.noteLifecycle({ taskRef, run: id, kind: "run-finished", identity: `r${id}`, subject: `Build #${id} finished with no changes`, body: "Nothing needed to change; the handoff explains why.", link: chatResultHref(taskId, id) }, now);
             }
             return;
         }
@@ -13607,12 +13943,12 @@ export class Store {
         if (road.road !== "repair" && road.road !== "correction" && !(role === "planner" && parent !== null)) {
             const agent = lifecycleWords(`${provider ?? "claude"}${model === null ? "" : ` · ${model}`}`, 60);
             const words = role === "reviewer"
-                ? { subject: `Independent review started (attempt ${reviewAttempt ?? 1})`, body: `Reviewing the saved result of attempt #${run.parentRun}. Running on ${agent}.`, link: chatResultHref(taskId, run.parentRun, "checks") }
+                ? { subject: `Independent review started (attempt ${reviewAttempt ?? 1})`, body: `Reviewing the saved result of build #${run.parentRun}. Running on ${agent}.`, link: chatResultHref(taskId, run.parentRun, "checks") }
                 : role === "planner"
-                    ? { subject: `Planning started (run #${id})`, body: `Drafting the scope and plan on ${agent}.`, link: chatControlHref("planning", taskId) }
+                    ? { subject: "Planning started", body: `Drafting the plan on ${agent}.`, link: chatControlHref("planning", taskId) }
                     : role === "scout"
-                        ? { subject: `Scouting started (run #${id})`, body: `A read-only look on ${agent}; what comes back is a report.`, link: chatControlHref("task", taskId) }
-                        : { subject: road.road === "recovered" ? `Attempt #${id} resumed from its preserved draft` : `Attempt #${id} started`, body: `Building on ${agent}.`, link: chatControlHref("task", taskId) };
+                        ? { subject: "Research started", body: `A read-only look on ${agent}; what comes back is a report.`, link: chatControlHref("task", taskId) }
+                        : { subject: road.road === "recovered" ? `Build #${id} resumed from its saved draft` : `Build #${id} started`, body: `Building on ${agent}.`, link: chatControlHref("task", taskId) };
             this.noteLifecycle({ taskRef: run.taskRef, run: id, kind: "run-started", identity: `r${id}`, ...words }, run.now);
         }
         return id;
@@ -14601,7 +14937,7 @@ export class Store {
             if (taskId === null)
                 return;
             const words = LIFECYCLE_PHASE_WORDS[phase];
-            this.noteLifecycle({ taskRef, run: id, kind: "run-phase", identity: `r${id}`, subject: `Attempt #${id}: ${words.subject}`, body: words.body, link: chatControlHref("task", taskId) }, now);
+            this.noteLifecycle({ taskRef, run: id, kind: "run-phase", identity: `r${id}`, subject: `Build #${id}: ${words.subject}`, body: words.body, link: chatControlHref("task", taskId) }, now);
         });
     }
     /** The accepted head and the validated conclusion, once known. */
@@ -17825,6 +18161,7 @@ export class Store {
         this.db.prepare(`INSERT INTO action_ledger(at,actor,repo,task_id,run_id,action,outcome,source,detail)
       VALUES (?,?,?,NULL,NULL,'project remote recorded','recorded','access',?)`)
             .run(now.toISOString(), actor, repo, JSON.stringify({ previousRemote: previous, remoteUrl }));
+        codeMapRemoteChanged(this, repo);
     }
     /** The remote URL captured on admission or explicitly supplied by the owner; null when none was (or the project was removed). */
     projectRemote(path) {
@@ -17833,7 +18170,10 @@ export class Store {
     }
     /** A project removed from the lists (project-admission.ts): only its row goes; its tasks, results and settings stay. */
     forgetProject(path) {
-        this.db.prepare("DELETE FROM project WHERE path = ?").run(path);
+        this.transact(() => {
+            forgetCodeMap(this, path);
+            this.db.prepare("DELETE FROM project WHERE path = ?").run(path);
+        });
     }
     /** Most recently opened first — the opener page's order. */
     listProjects() {
@@ -18524,10 +18864,7 @@ export class Store {
                     .get(taskRef, BUILT_IN);
                 if (ref === undefined)
                     return;
-                const { changes } = this.db
-                    .prepare("UPDATE task SET state = 'queued', updated_at = ? WHERE id = ? AND state = 'running'")
-                    .run(stamp, String(ref["external_id"]));
-                if (Number(changes) > 0)
+                if (settleVanished(this, taskRef, now) === "queued")
                     requeued.push(String(ref["external_id"]));
             };
             const open = this.db
@@ -18613,16 +18950,11 @@ export class Store {
                 this.db
                     .prepare("UPDATE claim SET released_at = ?, released_by = 'recovered' WHERE lease_id = ?")
                     .run(stamp, leaseId);
-                this.db
-                    .prepare(`UPDATE task SET state = 'queued', updated_at = ?
-              WHERE state = 'running' AND id = (
-                SELECT external_id FROM task_ref WHERE id = ? AND backend = ?
-              )`)
-                    .run(stamp, taskRef, BUILT_IN);
                 this.db
                     .prepare(`UPDATE run SET outcome = 'failed', reason = 'interrupted', finished_at = ?
               WHERE lease_id = ? AND outcome IS NULL`)
                     .run(stamp, leaseId);
+                settleVanished(this, taskRef, now);
                 this.db
                     .prepare(`UPDATE worktree SET released_at = ?, verified = 0
               WHERE runner = ? AND task_ref = ? AND released_at IS NULL`)
@@ -18644,14 +18976,7 @@ export class Store {
                 this.db
                     .prepare("UPDATE run SET outcome = 'failed', reason = 'interrupted', finished_at = ? WHERE id = ?")
                     .run(stamp, Number(row["run_id"]));
-                if (this.currentLiveLease(taskRef, now) === null) {
-                    this.db
-                        .prepare(`UPDATE task SET state = 'queued', updated_at = ?
-                WHERE state = 'running' AND id = (
-                  SELECT external_id FROM task_ref WHERE id = ? AND backend = ?
-                )`)
-                        .run(stamp, taskRef, BUILT_IN);
-                }
+                settleVanished(this, taskRef, now);
                 this.db
                     .prepare("UPDATE worktree SET released_at = ?, verified = 0 WHERE runner = ? AND task_ref = ? AND released_at IS NULL")
                     .run(stamp, runner, taskRef);
@@ -18785,7 +19110,7 @@ export class Store {
             if (stoppedTask !== null) {
                 this.noteLifecycle(run.role === "reviewer"
                     ? { taskRef: run.taskRef, run: run.id, kind: "run-stopping", identity: `r${run.id}`, subject: `Stopping review #${run.id}`, body: "The review is being stopped. The saved result is unchanged.", link: chatControlHref("recovery", stoppedTask) }
-                    : { taskRef: run.taskRef, run: run.id, kind: "run-stopping", identity: `r${run.id}`, subject: `Stopping attempt #${run.id}`, body: "Its processes are being stopped and its work is preserved. The task stays paused until this attempt is resumed.", link: chatControlHref("recovery", stoppedTask) }, now);
+                    : { taskRef: run.taskRef, run: run.id, kind: "run-stopping", identity: `r${run.id}`, subject: `Stopping build #${run.id}`, body: "Its processes are being stopped and its work is kept. The task stays paused until this build is resumed.", link: chatControlHref("recovery", stoppedTask) }, now);
             }
             this.bumpWake();
             return { ok: true, stop: this.stopOf(args.runId), repeated: false };
@@ -18820,12 +19145,20 @@ export class Store {
      * what kind of answer it is (needs-you.ts reads it): `alive` while
      * something of the run may still be running, `elsewhere` when only
      * another computer can tell, `unprovable` when nothing is known to run
-     * but its exit was never recorded, `unknown` when this computer can't
-     * check at all (both are what `run settle` resolves; only the first may
-     * be called not running). `settling` already meets the automatic
-     * reconciliation proof, so no confirmation is needed. */
+     * but its exit was never recorded (Toolroll's own look, stop-proof.ts,
+     * settles it), `unknown` when this computer can't check, or that look
+     * was blocked. `settling` already meets the automatic reconciliation
+     * proof. Nobody is ever asked to confirm a build stopped. `cause` names
+     * what stop-proof.ts can prove. */
     stopQuiescenceFact(runId) {
-        const fact = (run, kind, problem) => ({ run, kind, problem });
+        const fact = (run, kind, problem, cause) => cause === undefined ? { run, kind, problem } : { run, kind, problem, cause };
+        // What Toolroll can prove on its own (stop-proof.ts): until its own check of this computer's processes has run, the
+        // answer is `unprovable` (it settles by itself); once that check could not look, or found a process it didn't start
+        // in the build's folder, it is `unknown`, and the plain reason says why. Nobody is asked to vouch either way.
+        const provable = (run, problem, cause) => {
+            const verdict = stopProofVerdictOf(this, run);
+            return verdict === null ? fact(run, "unprovable", problem, cause) : fact(run, "unknown", `run #${run} ${verdict}`, cause);
+        };
         const ids = this.ownedRunsOf(runId);
         if (ids.length === 0)
             return fact(runId, "open", `run #${runId} does not exist`);
@@ -18836,24 +19169,27 @@ export class Store {
             if (ownedProcessCount(runOwnerTag(this, id)) > 0)
                 return fact(id, "alive", `run #${id} still has an owned subprocess`);
             const witnesses = this.db.prepare("SELECT * FROM run_process WHERE run = ? ORDER BY id").all(id);
+            const here = storeMachine(this.db);
             let incompleteSpawn = false;
             if (run.providerStartedAt !== null && witnesses.length === 0 && !this.processesSummarized(id)) {
-                return fact(id, "unprovable", `run #${id} may have spawned before its process witness was recorded; exit is unproven`);
+                return provable(id, `run #${id} may have spawned before its process witness was recorded; exit is unproven`, "no-witness");
             }
             for (const witness of witnesses) {
                 // A recorded group exit proves the whole group ended, not just its
                 // leader. Re-probing its number could mistake reuse for the old group.
                 if (witness["exited_at"] !== null)
                     continue;
-                const host = String(witness["host"]);
                 const bootId = witness["boot_id"] === null || witness["boot_id"] === undefined ? null : String(witness["boot_id"]);
-                // A VERIFIED boot change on this host (v53): nothing of the old
+                // This machine by its stable id, or by one of its own names for a witness from before v150 (machine-identity.ts):
+                // a hostname that moved with the network never makes this machine's own witness another computer's.
+                const local = witnessIsLocal(witness, here);
+                // A VERIFIED boot change on this machine (v53): nothing of the old
                 // boot survives — an incomplete spawn, a reused pid and a native
                 // object alike are gone. Every other case keeps the conservative
                 // road below.
-                if (provenDeadByBootChange({ host, bootId }))
+                if (local && provenDeadByBootChange({ host: String(witness["host"]), bootId }, { host: String(witness["host"]), bootId: currentBootId() }))
                     continue;
-                if (host !== hostname())
+                if (!local)
                     return fact(id, "elsewhere", `run #${id}'s process belongs to another host; exit is unproven here`);
                 const backend = witness["containment"] === null || witness["containment"] === undefined ? null : String(witness["containment"]);
                 const container = witness["container"] === null || witness["container"] === undefined ? null : String(witness["container"]);
@@ -18887,24 +19223,32 @@ export class Store {
                         return fact(id, "alive", `run #${id}'s workspace is still held by process ${occupied.by}`);
                 }
                 catch {
-                    // An unreadable workspace note is no proof either way; an approver's recorded word settles it.
-                    if (!this.workspaceConfirmedByApprover(id))
-                        return fact(id, "unknown", `run #${id}'s workspace occupancy could not be established`);
+                    // An unreadable workspace note is no proof either way; Toolroll's own look at this computer's processes settles
+                    // it (stop-proof.ts), as an approver's recorded word did before.
+                    if (!this.workspaceConfirmedByApprover(id)) {
+                        const verdict = stopProofVerdictOf(this, id);
+                        return fact(id, "unknown", verdict === null ? `run #${id}'s workspace occupancy could not be established` : `run #${id} ${verdict}`, "workspace-unreadable");
+                    }
                 }
             }
-            if (incompleteSpawn)
-                return fact(id, this.settleableUnspawnedWitnesses(run, witnesses).length > 0 ? "settling" : "unprovable", `run #${id} has an incomplete spawn witness; exit is unproven`);
+            if (incompleteSpawn) {
+                if (this.settleableUnspawnedWitnesses(run, witnesses).length > 0)
+                    return fact(id, "settling", `run #${id} has an incomplete spawn witness; exit is unproven`);
+                return provable(id, `run #${id} has an incomplete spawn witness; exit is unproven`, "incomplete-spawn");
+            }
         }
         return null;
     }
-    /** `run settle` recorded an approver's word that a run whose workspace
-     * note couldn't be read has stopped. */
+    /** A run whose workspace note couldn't be read was proven free: by Toolroll's own look (stop-proof.ts), or, in
+     * ledgers from before it, by an approver's recorded word (still read, never written now). */
     workspaceConfirmedByApprover(runId) {
-        return this.db.prepare("SELECT 1 FROM action_ledger WHERE run_id = ? AND action = 'workspace settled by approver' LIMIT 1").get(runId) !== undefined;
+        // An older approver's word still counts (ledger entries before stop-proof.ts); Toolroll's own proof counts the same.
+        return this.db.prepare("SELECT 1 FROM action_ledger WHERE run_id = ? AND action IN ('workspace settled by approver', ?) LIMIT 1").get(runId, STOP_PROOF_WORKSPACE_FREE) !== undefined;
     }
     reserveRunProcess(runId, now, group = true) {
-        return Number(this.db.prepare("INSERT INTO run_process (run,host,process_group,observed_at,boot_id) VALUES (?,?,?,?,?)")
-            .run(runId, hostname(), group ? 1 : 0, now.toISOString(), currentBootId()).lastInsertRowid);
+        recordMachineHostAliases(this.db, now);
+        return Number(this.db.prepare("INSERT INTO run_process (run,host,process_group,observed_at,boot_id,machine_id) VALUES (?,?,?,?,?,?)")
+            .run(runId, hostname(), group ? 1 : 0, now.toISOString(), currentBootId(), currentMachineId()).lastInsertRowid);
     }
     /** The run's process witnesses not yet proved exited — after first saving whatever exit evidence is available. */
     openRunProcessCount(runId, now) {
@@ -18924,12 +19268,13 @@ export class Store {
         // check uses: ESRCH, or a process now holding the pid that was born after
         // the run ended. An open run has no finish time, so only ESRCH counts.
         const finishedAt = this.getRun(runId)?.finishedAt ?? null;
+        const here = storeMachine(this.db);
         let recorded = 0;
         for (const row of rows) {
             const host = String(row["host"]), bootId = row["boot_id"] == null ? null : String(row["boot_id"]);
-            if (host !== hostname() || typeof row["observed_at"] !== "string" || !Number.isFinite(Date.parse(row["observed_at"])) || Date.parse(row["observed_at"]) > now.getTime())
+            if (!witnessIsLocal(row, here) || typeof row["observed_at"] !== "string" || !Number.isFinite(Date.parse(row["observed_at"])) || Date.parse(row["observed_at"]) > now.getTime())
                 continue;
-            let gone = provenDeadByBootChange({ host, bootId });
+            let gone = provenDeadByBootChange({ host, bootId }, { host, bootId: currentBootId() });
             if (!gone) {
                 const backend = row["containment"] == null ? null : String(row["containment"]);
                 const container = row["container"] == null ? null : String(row["container"]);
@@ -18940,11 +19285,12 @@ export class Store {
                     gone = row["pid"] != null && !processMayBeAlive(Number(row["pid"]), row["process_group"] === 1, finishedAt === null ? undefined : { observedAt: row["observed_at"], finishedAt });
                 }
             }
+            const sameMachine = witnessesCarryMachine(this.db);
             if (gone)
                 recorded += Number(this.db.prepare(`UPDATE run_process SET exited_at = ?
-        WHERE id = ? AND run = ? AND exited_at IS NULL AND pid IS ? AND host = ? AND process_group = ?
+        WHERE id = ? AND run = ? AND exited_at IS NULL AND pid IS ? AND host = ?${sameMachine ? " AND machine_id IS ?" : ""} AND process_group = ?
           AND observed_at = ? AND boot_id IS ? AND containment IS ? AND container IS ? AND container_identity IS ?`)
-                    .run(now.toISOString(), row["id"], runId, row["pid"], row["host"], row["process_group"], row["observed_at"], row["boot_id"], row["containment"], row["container"], row["container_identity"]).changes);
+                    .run(now.toISOString(), row["id"], runId, row["pid"], row["host"], ...(sameMachine ? [row["machine_id"] ?? null] : []), row["process_group"], row["observed_at"], row["boot_id"], row["containment"], row["container"], row["container_identity"]).changes);
         }
         return recorded;
     }
@@ -18954,12 +19300,13 @@ export class Store {
      * yet stays open and is passed over, never holding newer runs behind it:
      * every finished run is visited, a batch at a time. Never signals. */
     recordFinishedRunExits(now, batch = 200) {
+        const local = localWitnessSql(this.db, "p");
         const page = this.db.prepare(`SELECT DISTINCT p.run FROM run_process p JOIN run r ON r.id = p.run
-      WHERE p.exited_at IS NULL AND p.host = ? AND p.run > ? AND r.outcome IS NOT NULL AND r.finished_at IS NOT NULL
+      WHERE p.exited_at IS NULL AND ${local.sql} AND p.run > ? AND r.outcome IS NOT NULL AND r.finished_at IS NOT NULL
       ORDER BY p.run LIMIT ?`);
         let recorded = 0;
         for (let after = 0;;) {
-            const runs = page.all(hostname(), after, batch).map(row => Number(row["run"]));
+            const runs = page.all(...local.params, after, batch).map(row => Number(row["run"]));
             for (const run of runs)
                 recorded += this.recordRunProcessExits(run, now);
             if (runs.length < batch)
@@ -18989,12 +19336,13 @@ export class Store {
      * here, every other witness of the run has exited and none of the run's
      * process groups is alive, it settles as never started, with a ledger
      * entry. A sole pid-less witness has no group to prove gone and stays for
-     * `run settle`. Native witnesses keep their OS-only road. */
+     * Toolroll's own look (stop-proof.ts). Native witnesses keep their OS-only road. */
     settleUnspawnedWitnesses(now, onlyRun) {
+        const local = localWitnessSql(this.db, "p");
         const candidates = this.db.prepare(`SELECT DISTINCT p.run FROM run_process p JOIN run r ON r.id = p.run
       WHERE p.exited_at IS NULL AND p.pid IS NULL AND p.containment IS NULL AND p.container IS NULL
-        AND p.host = ? AND r.outcome IS NOT NULL AND r.finished_at IS NOT NULL
-        AND (? IS NULL OR p.run = ?) ORDER BY p.run`).all(hostname(), onlyRun ?? null, onlyRun ?? null);
+        AND ${local.sql} AND r.outcome IS NOT NULL AND r.finished_at IS NOT NULL
+        AND (? IS NULL OR p.run = ?) ORDER BY p.run`).all(...local.params, onlyRun ?? null, onlyRun ?? null);
         let settled = 0;
         for (const candidate of candidates) {
             const runId = Number(candidate["run"]);
@@ -19029,93 +19377,16 @@ export class Store {
     settleableUnspawnedWitnesses(run, rows) {
         if (run.outcome === null || run.finishedAt === null || ownedProcessCount(runOwnerTag(this, run.id)) > 0)
             return [];
-        const pidless = rows.filter(row => row["exited_at"] === null && row["pid"] === null && row["containment"] === null && row["container"] === null && row["host"] === hostname());
+        const here = storeMachine(this.db);
+        const pidless = rows.filter(row => row["exited_at"] === null && row["pid"] === null && row["containment"] === null && row["container"] === null && witnessIsLocal(row, here));
         const others = rows.filter(row => !pidless.includes(row));
         if (pidless.length === 0 || others.length === 0 || others.some(row => row["exited_at"] === null))
             return [];
-        const known = others.filter(row => row["pid"] !== null && row["host"] === hostname());
+        const known = others.filter(row => row["pid"] !== null && witnessIsLocal(row, here));
         if (known.length === 0 || known.some(row => processMayBeAlive(Number(row["pid"]), row["process_group"] === 1, { observedAt: row["observed_at"], finishedAt: run.finishedAt, exitedAt: row["exited_at"] })))
             return [];
         return pidless;
     }
-    /** `run settle` (an approver's last resort): every witness of a finished
-     * run that cannot be proven either way is recorded settled under the
-     * approver's reason, in the ledger. Refuses while anything of the run is
-     * alive or could be checked only from another host. Never signals. */
-    settleRunWitnessesByApprover(args, now) {
-        return this.transact(() => {
-            const run = this.getRun(args.runId);
-            if (run === null)
-                return { ok: false, reason: "unknown-run", detail: `no run #${args.runId}` };
-            if (run.outcome === null)
-                return { ok: false, reason: "still-running", detail: `run #${args.runId} is still open` };
-            const alive = (detail) => ({ ok: false, reason: "alive", detail });
-            if (ownedProcessCount(runOwnerTag(this, args.runId)) > 0)
-                return alive(`run #${args.runId} still has an owned subprocess`);
-            const rows = this.db.prepare("SELECT * FROM run_process WHERE run = ? ORDER BY id").all(args.runId);
-            const open = rows.filter(row => row["exited_at"] === null);
-            for (const row of rows) {
-                if (row["pid"] === null)
-                    continue;
-                if (row["host"] !== hostname()) {
-                    if (row["exited_at"] === null)
-                        return alive(`run #${args.runId}'s process ${String(row["pid"])} belongs to ${String(row["host"])}; settle it there`);
-                    continue;
-                }
-                if (processMayBeAlive(Number(row["pid"]), row["process_group"] === 1, { observedAt: row["observed_at"], finishedAt: run.finishedAt, exitedAt: row["exited_at"] }))
-                    return alive(`run #${args.runId}'s process ${String(row["pid"])} is still running`);
-            }
-            for (const row of open) {
-                if (row["pid"] === null && row["host"] !== hostname())
-                    return alive(`run #${args.runId} has a witness from ${String(row["host"])}; settle it there`);
-                if (row["containment"] != null && row["container"] != null && row["container_empty_at"] == null &&
-                    containerEmptiness(String(row["containment"]), String(row["container"]), process.platform, row["container_identity"] == null ? null : String(row["container_identity"])) === "populated") {
-                    return alive(`run #${args.runId}'s ${String(row["containment"])} object ${String(row["container"])} still has members`);
-                }
-            }
-            // A workspace still held by a live process refuses; one whose note can't
-            // be read is settled by the approver's word, in the ledger.
-            let workspace = false;
-            if (run.worktree !== null) {
-                try {
-                    const occupied = worktreeProcessOccupancy(run.worktree);
-                    if (occupied.held)
-                        return alive(`run #${args.runId}'s workspace is still held by process ${occupied.by}`);
-                }
-                catch {
-                    workspace = !this.workspaceConfirmedByApprover(args.runId);
-                }
-            }
-            const ref = this.refById(run.taskRef);
-            if (workspace) {
-                this.recordAction({ at: now.toISOString(), actor: args.by, repo: ref?.repo ?? null, taskId: ref?.externalId ?? null, runId: args.runId,
-                    action: "workspace settled by approver", outcome: run.worktree ?? "", source: "request", detail: args.why });
-            }
-            // A run that may have spawned before any witness was written has none
-            // to settle: the approver's word is recorded as one ended witness.
-            if (rows.length === 0 && run.providerStartedAt !== null && !this.processesSummarized(args.runId)) {
-                const id = Number(this.db.prepare("INSERT INTO run_process (run,host,process_group,observed_at,boot_id,exited_at) VALUES (?,?,0,?,?,?)")
-                    .run(args.runId, hostname(), now.toISOString(), currentBootId(), now.toISOString()).lastInsertRowid);
-                this.recordAction({ at: now.toISOString(), actor: args.by, repo: ref?.repo ?? null, taskId: ref?.externalId ?? null, runId: args.runId,
-                    action: "process witness settled by approver", outcome: `witness ${id}`, source: "request", detail: args.why });
-                this.settleQuiescentStops(now);
-                return { ok: true, witnesses: [id], repeated: false };
-            }
-            if (open.length === 0) {
-                if (workspace)
-                    this.settleQuiescentStops(now);
-                return { ok: true, witnesses: [], repeated: !workspace };
-            }
-            const ids = open.map(row => Number(row["id"]));
-            for (const id of ids)
-                this.db.prepare("UPDATE run_process SET exited_at = ? WHERE id = ? AND run = ? AND exited_at IS NULL").run(now.toISOString(), id, args.runId);
-            this.recordAction({ at: now.toISOString(), actor: args.by, repo: ref?.repo ?? null, taskId: ref?.externalId ?? null, runId: args.runId,
-                action: "process witness settled by approver", outcome: `witness ${ids.join(", ")}`, source: "request", detail: args.why });
-            compactSettledRunProcesses(this.db, now, args.runId);
-            this.settleQuiescentStops(now);
-            return { ok: true, witnesses: ids, repeated: false };
-        });
-    }
     recordRunProcess(runId, pid, now, group = true, witness) {
         if (!Number.isSafeInteger(pid) || pid <= 0)
             throw new Error("a process witness needs a valid spawned PID");
@@ -19126,8 +19397,9 @@ export class Store {
                 throw new Error("spawn witness custody changed");
             return;
         }
-        this.db.prepare("INSERT INTO run_process (run,pid,host,process_group,observed_at,boot_id) VALUES (?,?,?,?,?,?)")
-            .run(runId, pid, hostname(), group ? 1 : 0, now.toISOString(), currentBootId());
+        recordMachineHostAliases(this.db, now);
+        this.db.prepare("INSERT INTO run_process (run,pid,host,process_group,observed_at,boot_id,machine_id) VALUES (?,?,?,?,?,?,?)")
+            .run(runId, pid, hostname(), group ? 1 : 0, now.toISOString(), currentBootId(), currentMachineId());
     }
     /** The native OS object a witnessed spawn ran inside (v53) — recorded
      * with the spawn, before the target can execute. */
@@ -19147,11 +19419,12 @@ export class Store {
      * must independently prove gone; this never grants authority to signal. */
     runCustodyProvenGone(runId) {
         const rows = this.db.prepare("SELECT * FROM run_process WHERE run = ?").all(runId);
+        const here = storeMachine(this.db);
         // A summarized run's witnesses all exited, each on recorded proof.
         return (rows.length > 0 || this.processesSummarized(runId)) && rows.every(row => {
-            if (String(row["host"]) !== hostname())
+            if (!witnessIsLocal(row, here))
                 return false;
-            if (provenDeadByBootChange({ host: String(row["host"]), bootId: row["boot_id"] == null ? null : String(row["boot_id"]) }))
+            if (provenDeadByBootChange({ host: String(row["host"]), bootId: row["boot_id"] == null ? null : String(row["boot_id"]) }, { host: String(row["host"]), bootId: currentBootId() }))
                 return true;
             if (row["containment"] == null || row["container"] == null)
                 return false;
@@ -19227,7 +19500,7 @@ export class Store {
             this.addRunNote(args.runId, args.by, "Resumed. The next pass takes a fresh claim, re-proves the signed scope, and inherits this attempt's preserved draft with fresh proof.", now);
             const resumedTask = this.externalIdFor(args.taskRef);
             if (resumedTask !== null) {
-                this.noteLifecycle({ taskRef: args.taskRef, run: args.runId, kind: "run-resumed", identity: `r${args.runId}`, subject: `Attempt #${args.runId} resumed`, body: "The next pass takes a fresh claim and continues from the preserved work.", link: chatControlHref("task", resumedTask) }, now);
+                this.noteLifecycle({ taskRef: args.taskRef, run: args.runId, kind: "run-resumed", identity: `r${args.runId}`, subject: `Build #${args.runId} resumed`, body: "The next attempt continues from the saved work.", link: chatControlHref("task", resumedTask) }, now);
             }
             this.bumpWake();
             return { ok: true, stop: this.stopOf(args.runId) };
@@ -19987,12 +20260,14 @@ export class Store {
             .prepare(`INSERT OR IGNORE INTO push_delivery (notification, subscription, created_at)
          SELECT notification.id, push_subscription.id, ?
            FROM notification, push_subscription
-          WHERE (notification.push_class IS NOT NULL OR notification.kind = 'check-progress')
+          WHERE notification.push_class IS NOT NULL
+            -- A fact that needs nothing from a person (checks in progress) stays in the activity log: no phone ping.
+            AND notification.kind NOT IN (SELECT value FROM json_each(?))
             AND notification.resolved_at IS NULL
             AND (notification.recipient IS NULL OR notification.recipient = push_subscription.approver)
             AND push_subscription.retired_at IS NULL
             AND notification.id > push_subscription.starts_after_notification`)
-            .run(now.toISOString());
+            .run(now.toISOString(), JSON.stringify([...ACTIVITY_ONLY_KINDS]));
         // Pings follow responsibility: a pair this person must not be alerted about retires before it is ever sent.
         if (Number(changes) > 0) {
             const fresh = this.db.prepare(`SELECT p.id AS pair, s.approver AS approver, n.* FROM push_delivery p
@@ -20319,7 +20594,8 @@ export class Store {
             return null;
         }
     }
-    /** The level a run's checks ran at: missing or unreadable reads as sandboxed. */
+    /** The level a later check of this run may run at, at most: missing or unreadable reads as sandboxed, the narrowest.
+     * Never an account of how its checks DID run: that is runCheckStamp (check-stamp.ts). */
     runCheckAccess(runId) {
         return checkAccessOf(this.db.prepare("SELECT sandbox_access FROM run WHERE id = ?").get(runId)?.["sandbox_access"]);
     }
@@ -21602,6 +21878,11 @@ export function carryReleaseApproval(store, w, now, recheck) {
         const problem = recheck();
         if (problem !== null)
             return { ok: false, why: problem };
+        // How the release's check ran, read again with the write: a launch since the preflight counts (H2).
+        const ran = taskCheckStamp(store, a.repo, a.tipTask);
+        const unshown = ran === null ? null : stampRefusal(ran.reading, checkAccessOf(a.accessDigest));
+        if (unshown !== null)
+            return { ok: false, why: `This release's approval can't carry: ${unshown}.` };
         if (store.getTask(w.taskId) !== null)
             return { ok: false, why: `A task ${w.taskId} already exists.` };
         const anchorRow = store.handle.prepare("SELECT * FROM task_scope WHERE task_id = ?").get(a.anchorTask);
@@ -21637,7 +21918,7 @@ export function carryReleaseApproval(store, w, now, recheck) {
         store.recordAction({ at: now.toISOString(), actor: "toolroll", repo: a.repo, taskId: w.taskId, runId: null, action: "release carried", outcome: "carried", source: "work",
             detail: `release ${a.id} · carry ${carryId} · ${a.tipSha} → ${w.to} · ${w.files} files · ${w.changedLines} lines · request ${w.requestId}` });
         // One quiet task notification, no push.
-        store.enqueueNotification({ dedupeKey: `release-carried:${a.id}:${carryId}`, kind: "release-carried", subject: `Carried to ${w.to.slice(0, 7)}`,
+        store.enqueueNotification({ dedupeKey: `release-carried:${a.id}:${carryId}`, kind: "release-carried", subject: `Release now includes ${w.to.slice(0, 7)}`,
             body: `Release ${a.version} now ships ${w.to.slice(0, 7)} (${w.files} file${w.files === 1 ? "" : "s"}, ${w.changedLines} line${w.changedLines === 1 ? "" : "s"}) under ${anchor.approvedBy ?? "the"} release approval.`,
             link: chatControlHref("task", w.taskId), source: { taskRef: ref.id } }, now);
         return { ok: true, taskId: w.taskId, carry: releaseCarryTo(store, a.id, w.to) };
@@ -22458,7 +22739,8 @@ export function recordReleaseStep(store, entry) {
         .run(entry.taskId, entry.tag, entry.version, entry.pr, entry.step, entry.state, at, ended ? at : null, detail, at);
 }
 /** A release's steps, for the release task: the newest tag recorded for it, its steps in the order they ran, and the
- * step it stopped at when the last thing recorded was a failure. Null: no step recorded. */
+ * step it stopped at when the last thing recorded was a failure and no build of the task has started since. Null: no
+ * step recorded. */
 export function releaseProgressFor(store, taskId) {
     const newest = store.handle.prepare("SELECT tag FROM release_step WHERE task_id = ? ORDER BY updated_at DESC, rowid DESC LIMIT 1").get(taskId);
     if (newest === undefined)
@@ -22468,9 +22750,13 @@ export function releaseProgressFor(store, taskId) {
     const steps = rows.map(row => ({ step: String(row["step"]), state: String(row["state"]), startedAt: String(row["started_at"]),
         endedAt: row["ended_at"] === null ? null : String(row["ended_at"]), detail: row["detail"] === null ? null : String(row["detail"]) }));
     const last = [...rows].sort((a, b) => String(a["updated_at"]).localeCompare(String(b["updated_at"]))).at(-1);
-    const stopped = String(last["state"]) === "failed" ? { step: String(last["step"]), message: last["detail"] === null ? "" : String(last["detail"]), at: String(last["updated_at"]) } : null;
+    const failed = String(last["state"]) === "failed";
+    const live = !failed ? undefined : store.handle.prepare(`SELECT id, started_at FROM run WHERE task_ref IN (SELECT value FROM json_each(?)) AND role = 'builder'
+      AND finished_at IS NULL AND outcome IS NULL AND started_at > ? ORDER BY id DESC LIMIT 1`).get(JSON.stringify(taskFamilyRefs(store, taskId).map(one => one.id)), String(last["updated_at"]));
+    const building = live === undefined ? null : { run: Number(live["id"]), startedAt: String(live["started_at"]) };
+    const stopped = failed && building === null ? { step: String(last["step"]), message: last["detail"] === null ? "" : String(last["detail"]), at: String(last["updated_at"]) } : null;
     const pr = last["pr"] === null ? null : Number(last["pr"]);
-    return { tag, version: String(last["version"]), pr, startedAt: steps[0].startedAt, updatedAt: String(last["updated_at"]), steps, stopped };
+    return { tag, version: String(last["version"]), pr, startedAt: steps[0].startedAt, updatedAt: String(last["updated_at"]), steps, stopped, building };
 }
 /** The release task whose steps were recorded most recently (v146), or null when none was. */
 export function latestReleaseStepTask(store) {
@@ -22661,3 +22947,166 @@ export function forgetProjectModels(store, repo, now) {
         return rows + forgetProjectRoutes(store, repo);
     });
 }
+// ---- Toolroll's own stop proof (stop-proof.ts) ------------------------------------------------------------------
+/** The ledger words of Toolroll's own stop proof. Nobody is asked to vouch that a build stopped: Toolroll looks at
+ * this computer's processes itself, and a person's older recorded word (`run settle` before this) is still read. */
+export const STOP_PROOF_SETTLED = "run stop proven automatically";
+export const STOP_PROOF_BLOCKED = "automatic stop check blocked";
+export const STOP_PROOF_WORKSPACE_FREE = "workspace proven free automatically";
+/** Why Toolroll's own stop check is blocked for a run, in words that follow "run #N " (the stop fact's problem), or
+ * null when its newest word is not a block (never checked, or proven since). */
+export function stopProofVerdictOf(store, runId) {
+    const row = store.handle.prepare("SELECT action, outcome FROM action_ledger WHERE run_id = ? AND action IN (?, ?) ORDER BY id DESC LIMIT 1")
+        .get(runId, STOP_PROOF_BLOCKED, STOP_PROOF_SETTLED);
+    return row === undefined || row["action"] !== STOP_PROOF_BLOCKED ? null : String(row["outcome"]);
+}
+/** Record that Toolroll's own stop check could not prove a run stopped (`words` follow "run #N "; `detail` is the
+ * evidence). The same block twice in a row is recorded once. True when recorded. */
+export function recordStopProofBlocked(store, runId, words, detail, now) {
+    return store.transact(() => {
+        if (stopProofVerdictOf(store, runId) === words)
+            return false;
+        const run = store.getRun(runId);
+        const ref = run === null ? null : store.refById(run.taskRef);
+        store.recordAction({ at: now.toISOString(), actor: "system", repo: ref?.repo ?? null, taskId: ref?.externalId ?? null, runId,
+            action: STOP_PROOF_BLOCKED, outcome: words, source: "work", detail });
+        return true;
+    });
+}
+/**
+ * Settle a finished run's unproven stop on Toolroll's own observation of this computer (stop-proof.ts): the caller
+ * looked at every process here and found none of the run's. Applies only while the run's stop is still unproven for
+ * exactly `cause` (re-read in this transaction): a pid-less spawn witness is recorded ended, a run with no witness gets
+ * one ended witness, an unreadable workspace note is recorded proven free. The evidence goes in the ledger. Never
+ * signals. True when this call settled it.
+ */
+export function settleRunStopByObservation(store, args, now) {
+    return store.transact(() => {
+        const fact = store.stopQuiescenceFact(args.runId);
+        if (fact === null || fact.run !== args.runId || fact.cause !== args.cause || (fact.kind !== "unprovable" && fact.kind !== "unknown"))
+            return false;
+        const run = store.getRun(args.runId);
+        if (run === null || run.outcome === null || run.finishedAt === null)
+            return false;
+        const db = store.handle;
+        const ref = store.refById(run.taskRef);
+        const at = now.toISOString();
+        let what;
+        if (args.cause === "incomplete-spawn") {
+            const local = localWitnessSql(db);
+            const changed = db.prepare(`UPDATE run_process SET exited_at = ? WHERE run = ? AND exited_at IS NULL AND pid IS NULL
+        AND containment IS NULL AND container IS NULL AND ${local.sql}`).run(at, args.runId, ...local.params).changes;
+            if (Number(changed) === 0)
+                return false;
+            what = `${Number(changed)} process witness${Number(changed) === 1 ? "" : "es"} with no process ID recorded ended`;
+        }
+        else if (args.cause === "no-witness") {
+            recordMachineHostAliases(db, now);
+            db.prepare("INSERT INTO run_process (run,host,process_group,observed_at,boot_id,exited_at,machine_id) VALUES (?,?,0,?,?,?,?)")
+                .run(args.runId, hostname(), at, currentBootId(), at, currentMachineId());
+            what = "its missing process witness recorded ended";
+        }
+        else {
+            store.recordAction({ at, actor: "system", repo: ref?.repo ?? null, taskId: ref?.externalId ?? null, runId: args.runId,
+                action: STOP_PROOF_WORKSPACE_FREE, outcome: run.worktree ?? "", source: "work", detail: args.evidence });
+            what = "its folder recorded free";
+        }
+        store.recordAction({ at, actor: "system", repo: ref?.repo ?? null, taskId: ref?.externalId ?? null, runId: args.runId,
+            action: STOP_PROOF_SETTLED, outcome: what, source: "work", detail: args.evidence });
+        compactSettledRunProcesses(db, now, args.runId);
+        store.settleQuiescentStops(now);
+        return true;
+    });
+}
+/**
+ * This machine as the store knows it (v150, machine-identity.ts): its stable id and every name it is known by, the
+ * hostnames recorded beside its own id included. Read fresh each time, so a name recorded by another process on this
+ * machine counts at once.
+ */
+export function storeMachine(db) {
+    const id = currentMachineId();
+    let recorded = [];
+    if (id !== null) {
+        try {
+            recorded = db.prepare("SELECT host FROM machine_host_alias WHERE machine_id = ?").all(id).map(row => String(row["host"]));
+        }
+        catch {
+            recorded = [];
+        }
+        rememberHostAliases(id, recorded);
+    }
+    return thisMachine(recorded);
+}
+/** Load this machine's recorded names for the checks that hold no store; a store that can't read them loads none. */
+export function rememberStoredHostAliases(db) {
+    try {
+        storeMachine(db);
+    }
+    catch { /* none recorded, or no table to read: only the live names count */ }
+}
+/** Record the names this machine is known by right now beside its own id, read here at this moment (never a name a
+ * witness, a note or another computer supplied). Nothing when this machine's id is unknown. */
+export function recordMachineHostAliases(db, now) {
+    const id = currentMachineId();
+    if (id === null)
+        return;
+    const names = liveHostAliases();
+    const insert = db.prepare("INSERT OR IGNORE INTO machine_host_alias (machine_id, host, first_seen_at) VALUES (?, ?, ?)");
+    for (const host of names)
+        insert.run(id, host, now.toISOString());
+    rememberHostAliases(id, names);
+}
+/** Whether a run_process row is this machine's (machine-identity.ts isThisMachine). */
+export function witnessIsLocal(row, here) {
+    return isThisMachine({ host: String(row["host"]), machineId: row["machine_id"] == null ? null : String(row["machine_id"]) }, here);
+}
+/** The same rule as witnessIsLocal, as SQL over run_process (optionally aliased): its id is ours, or it has none and
+ * its host is one of our names. With our id unknown, `machine_id = NULL` matches nothing: an id-bearing witness is
+ * never taken for ours. */
+export function localWitnessSql(db, alias) {
+    const p = alias === undefined ? "" : `${alias}.`, here = storeMachine(db);
+    if (!witnessesCarryMachine(db))
+        return { sql: `${p}host IN (SELECT value FROM json_each(?))`, params: [JSON.stringify(here.hosts)] };
+    return { sql: `(${p}machine_id = ? OR (${p}machine_id IS NULL AND ${p}host IN (SELECT value FROM json_each(?))))`, params: [here.id, JSON.stringify(here.hosts)] };
+}
+/** Whether this database has v150's run_process.machine_id. An update settles leftover records on the database it is
+ * about to back up, still at the older schema (toolroll-update.ts drain), so no query it reaches may assume the column:
+ * there every witness has no id, and the host-name rule above is the whole rule. */
+export function witnessesCarryMachine(db) {
+    return db.prepare("SELECT 1 FROM pragma_table_info('run_process') WHERE name = 'machine_id'").get() !== undefined;
+}
+// ---- Idle cleanup (checkout-cleanup.ts) ----------------------------------------------------------------------------
+/** Settings → Storage: how long a task stays idle before its clean folder goes (the default until someone chooses). */
+export function checkoutIdle(store) {
+    const row = store.handle.prepare("SELECT idle FROM checkout_cleanup_setting WHERE id = 1").get();
+    return row === undefined || row["idle"] === null ? DEFAULT_IDLE : String(row["idle"]);
+}
+/** Choose how long a task stays idle before its clean folder goes; the ledger keeps before → after. */
+export function setCheckoutIdle(store, idle, by, now) {
+    return store.transact(() => {
+        const before = checkoutIdle(store);
+        store.handle.prepare("INSERT INTO checkout_cleanup_setting (id, cleanup, idle, updated_by, updated_at) VALUES (1, ?, ?, ?, ?) ON CONFLICT(id) DO UPDATE SET idle = excluded.idle, updated_by = excluded.updated_by, updated_at = excluded.updated_at")
+            .run(store.checkoutCleanup(), idle, by, now.toISOString());
+        if (before !== idle)
+            store.recordAction({ at: now.toISOString(), actor: by, repo: null, taskId: null, runId: null, action: "idle cleanup changed", outcome: "changed", source: "policy", detail: `${idleWords(before)} → ${idleWords(idle)}` });
+        return checkoutIdle(store);
+    });
+}
+/** A check launch's execution stamp (check-stamp.ts), written by the code that launched it. One row per distinct launch. */
+export function recordCheckStamp(store, runId, stamp, now) {
+    store.handle.prepare("INSERT OR IGNORE INTO check_stamp (run_id, digest, stamp, at) VALUES (?, ?, ?, ?)").run(runId, stampDigest(stamp), JSON.stringify(stamp), now.toISOString());
+}
+/** How a run's checks actually ran, by every launch it stamped: `unknown` when none is there or one can't be read. */
+export function runCheckStamp(store, runId) {
+    return readStamps(store.handle.prepare("SELECT stamp FROM check_stamp WHERE run_id = ? ORDER BY id").all(runId).map(row => row["stamp"]));
+}
+/** The newest run of a task whose checks ran (it saved a check log), and how they ran; null when none has. */
+export function taskCheckStamp(store, repo, taskId) {
+    const runs = store.handle.prepare(`SELECT r.id FROM run r JOIN task_ref t ON t.id = r.task_ref WHERE t.repo = ? AND t.external_id = ? ORDER BY r.id DESC`).all(repo, taskId);
+    for (const row of runs) {
+        const runId = Number(row["id"]);
+        if (store.artifactsFor(runId).some(one => one.kind === "check-log"))
+            return { runId, reading: runCheckStamp(store, runId) };
+    }
+    return null;
+}