toolroll 0.9.92 → 0.9.94

package/dist/browser-crew.js

@@ -15,8 +15,8 @@ export function browserWorkActionHref(item) {
         return '/settings/agents#providers';
     if (action.code === 'answer-agent' && runId !== null)
         return `/agents?run=${runId}`;
-    if (action.code === 'confirm-stopped')
-        return `/t/${encodeURIComponent(item.rootId)}#confirm-stopped`;
+    if (action.code === 'recheck-stopped')
+        return `/t/${encodeURIComponent(item.rootId)}#recheck-stopped`;
     if (action.code === 'open-result' && runId !== null)
         return chatResultHref(taskId, runId);
     if (action.code === 'open-pr' && /^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/pull\/\d+$/.test(item.publicationUrl ?? ''))

package/dist/browser-shell.d.ts

@@ -6,4 +6,4 @@ export declare function serveBrowserAsset(request: IncomingMessage, response: Se
 /** Retain the complete native document as the no-JavaScript/unloaded-bundle
  * fallback. React replaces its root only once the local module has loaded.
  * The data script is escaped for HTML parsing, not merely valid JSON. */
-export declare function browserWorkspaceDocument(document: Html, workspace: BrowserWorkspace, nonce: string, functionalScript: string): Html;
+export declare function browserWorkspaceDocument(document: Html, workspace: BrowserWorkspace, nonce: string, functionalScript: string, beside?: Html): Html;

package/dist/browser-shell.js

@@ -51,7 +51,7 @@ export function serveBrowserAsset(request, response, path) {
 /** Retain the complete native document as the no-JavaScript/unloaded-bundle
  * fallback. React replaces its root only once the local module has loaded.
  * The data script is escaped for HTML parsing, not merely valid JSON. */
-export function browserWorkspaceDocument(document, workspace, nonce, functionalScript) {
+export function browserWorkspaceDocument(document, workspace, nonce, functionalScript, beside = html ``) {
     const initialize = `window.addEventListener('standing-orders:workspace-rendered',function initializeWorkspace(){window.removeEventListener('standing-orders:workspace-rendered',initializeWorkspace);${functionalScript}});`;
     // A cross-page fade the browser gives up on rejects its promises; settle them from the head, before the
     // first frame (the app's own listener arrives too late when a page is revealed before the bundle runs).
@@ -61,5 +61,5 @@ export function browserWorkspaceDocument(document, workspace, nonce, functionalS
     // A page showing a password keeps to its one script (the sensitivity contract), so it goes without.
     html `<link rel="stylesheet" href="/assets/workspace.css">${workspace.sensitive ? "" : scriptElement(settleFades, { nonce })}</head>`);
     out = replaceMarkup(out, /<body>/, () => html `<body><div id="standing-orders-workspace">`);
-    return replaceMarkup(out, /<\/body>/, () => html `</div>${jsonScript(workspace, { id: "standing-orders-workspace-data", nonce })}${scriptElement(initialize, { nonce })}<script type="module" src="/assets/workspace.js" nonce="${nonce}"></script></body>`);
+    return replaceMarkup(out, /<\/body>/, () => html `</div>${beside}${jsonScript(workspace, { id: "standing-orders-workspace-data", nonce })}${scriptElement(initialize, { nonce })}<script type="module" src="/assets/workspace.js" nonce="${nonce}"></script></body>`);
 }

package/dist/browser-workspace.d.ts

@@ -259,7 +259,7 @@ export type BrowserTaskRow = {
     /** Put away, or Restore in Archived (task-tidy.md): a POST to the task's own route; null for a viewer or live work. */
     tidy?: {
         action: string;
-        label: 'Put away' | 'Restore';
+        label: 'Archive' | 'Restore';
         returnTo: string;
     } | null;
 };
@@ -381,11 +381,10 @@ export type BrowserTaskView = {
     statusHtml: string;
     /** The approval ceremony or its updated terms, exactly as signed. */
     approval: string;
-    /** Confirm it stopped, behind the password, when the status asks for it. */
-    confirmStopped?: {
+    /** Check again (a build Toolroll could not prove stopped from this computer), when the status asks for it. */
+    recheckStopped?: {
         action: string;
         run: number;
-        checked?: boolean;
     } | null;
     /** Build again, in place, when the status asks for it (a result built to an earlier plan). */
     rebuild?: {
@@ -529,6 +528,8 @@ export type BrowserTaskView = {
         summary: string;
         observedAt: string;
     } | null;
+    /** "Can I merge?" (merge-checklist.ts; `toolroll task ready` is its twin): each row and its blocker's form. Null: no result yet. */
+    mergeReady?: MergeReadyView | null;
     /** A release's own steps (release status's twin). Null: this task is no release, or nothing recorded. */
     release?: {
         tag: string;
@@ -543,6 +544,13 @@ export type BrowserTaskView = {
             at: string;
         } | null;
         startedAt: string;
+        /** The step it is on now, and where that is in its steps. */
+        at?: {
+            step: string;
+            name: string;
+            index: number;
+            of: number;
+        } | null;
     } | null;
     /** How the plan was approved: by whom and how, or the rule that approved it automatically. */
     approved?: {
@@ -555,6 +563,11 @@ export type BrowserTaskView = {
     } | null;
     /** ⋯ More actions: the task's secondary acts, the same order on the task and agent pages, destructive last. */
     more?: BrowserTaskMore[];
+    /** The task's full audit record (its link in the header); it moved out of More (docs/plans/plain-toolroll.md P1.3). */
+    audit?: {
+        label: string;
+        href: string;
+    } | null;
 };
 export type BrowserTaskTab = "activity" | "result" | "plan" | "attempts";
 /** One ⋯ item: a plain link, a copy of this page's address, a one-click POST (never a ceremony), or a go-to that switches
@@ -703,7 +716,7 @@ export type BrowserResultDecision = {
         why: string | null;
     };
 };
-/** A Needs you action: a link, (Confirm it stopped) a form behind the password, (Build again) one
+/** A Needs you action: a link, (Check again, Build again) one
  * button, or (on the result itself) Accept, which records the person's acceptance; `note` asks why
  * when the evidence disagrees. */
 export type BrowserNeedAction = {
@@ -713,7 +726,6 @@ export type BrowserNeedAction = {
         action: string;
         run: number;
         returnTo: string;
-        checked?: boolean;
     } | null;
     accept?: {
         action: string;
@@ -1661,7 +1673,7 @@ export type BrowserHomeView = {
         href: string;
     }[];
     groups: {
-        key: 'decide' | 'review' | 'unblock' | 'running';
+        key: 'decide' | 'review' | 'unblock' | 'running' | 'waiting';
         label: string;
         rows: BrowserHomeRow[];
     }[];
@@ -1855,3 +1867,32 @@ export declare function browserProjectsOf(projects: readonly {
     path: string;
 }[]): BrowserProject[];
 export declare function browserNavigationOf(path: string, project?: string | null, needsYou?: number, tasksProject?: string | null, needsYouLabel?: string): BrowserNavigationItem[];
+/** One "Can I merge?" act, as the task page's form for it (server/merge-ready-view.ts builds it). */
+export type MergeReadyAct = {
+    kind: "run-checks";
+    action: string;
+    level: "quick" | "full";
+    returnTo: string;
+} | {
+    kind: "retry";
+} | {
+    kind: "fix";
+    action: string;
+    note: string;
+    batch: string;
+    source: string;
+    request: string;
+    returnTo: string;
+};
+/** The task page's "Can I merge?" panel. */
+export type MergeReadyView = {
+    answer: "yes" | "no" | "not-yet" | "merged";
+    sentence: string;
+    rows: {
+        key: string;
+        label: string;
+        mark: "yes" | "no" | "waiting" | "unknown" | "skip";
+        say: string;
+        act: MergeReadyAct | null;
+    }[];
+};

package/dist/browser-workspace.js

@@ -90,7 +90,7 @@ export function browserProjectsOf(projects) {
         if (seen.has(project.path))
             return [];
         seen.add(project.path);
-        return [{ name: project.name, path: project.path, href: `/work?project=${encodeURIComponent(project.path)}`,
+        return [{ name: project.name, path: project.path, href: `/tasks?project=${encodeURIComponent(project.path)}`,
                 knowledgeHref: `/settings/knowledge?repo=${encodeURIComponent(project.path)}` }];
     });
 }
@@ -102,8 +102,8 @@ export function browserNavigationOf(path, project = null, needsYou = 0, tasksPro
     return [
         { label: 'Home', href: '/', active: pathname === '/' || pathname === '/chat' || under('/d', '/activity', '/morning'),
             ...(needsYou > 0 ? { count: needsYou, ...(needsYouLabel === undefined ? {} : { countLabel: needsYouLabel }) } : {}) },
-        { label: 'Tasks', href: `/work${tasksProject === null ? '' : `?project=${encodeURIComponent(tasksProject)}`}`,
-            active: under('/work', '/tasks', '/t', '/r', '/done', '/board', '/queue', '/inbox', '/review') },
+        { label: 'Tasks', href: `/tasks${tasksProject === null ? '' : `?project=${encodeURIComponent(tasksProject)}`}`,
+            active: under('/tasks', '/t', '/r', '/review') },
         { label: 'Flows', href: '/flows', active: under('/flows', '/recipes', '/kits', '/routines') },
         { label: 'Agents', href: '/agents', active: under('/agents', '/peek', '/term', '/fleet', '/system', '/runs') },
         { label: 'Projects', href: '/projects', active: under('/projects') },

package/dist/builder-restart.d.ts

@@ -0,0 +1,21 @@
+import { type Store } from "./store.js";
+/** At most this many automatic restarts in this window (tried, whatever came of them). */
+export declare const RESTART_LIMIT = 3;
+export declare const RESTART_WINDOW_MS: number;
+export type BuilderWish = {
+    desired: "running" | "stopped";
+    build: string;
+    schema: number;
+    setBy: string;
+    setAt: string;
+};
+export declare function builderWish(store: Store): BuilderWish | null;
+export declare function databaseFormat(store: Store): number | null;
+/** Record what a person asked for. A `stopped` keeps the last known build. */
+export declare function recordBuilderWish(store: Store, desired: "running" | "stopped", by: string, build: string, now: Date): void;
+/** An update, a deploy's drain or a stop in progress: this is someone else's restart to make. */
+export declare function restartPaused(store: Store, now: Date): boolean;
+export type RestartAdmission = "admitted" | "not-wanted" | "paused" | "attempts";
+/** The wish, the pause and the count, read again and the attempt written in one transaction: two callers can't both
+ * take the last attempt, and a crash after this still counted. */
+export declare function admitBuilderRestart(store: Store, now: Date): RestartAdmission;

package/dist/builder-restart.js

@@ -0,0 +1,50 @@
+/**
+ * Restarting this computer's own builder (docs/plans/plain-toolroll.md P2.3): the record of what a person wants, and the
+ * one transaction that admits an automatic restart. The supervisor work is laptop-background.ts restartOwnBuilder.
+ *
+ * `background on` and `up` record that the builder should run, with the build and database format they ran; `background
+ * off` and `stop` record that it should not, before they stop it. Nothing else writes that wish, and only a recorded
+ * wish to run is ever acted on.
+ */
+import { updateAdmissionPaused } from "./desktop-update-gate.js";
+import { drainOf } from "./runner.js";
+import { readSchemaVersion } from "./store.js";
+/** At most this many automatic restarts in this window (tried, whatever came of them). */
+export const RESTART_LIMIT = 3;
+export const RESTART_WINDOW_MS = 30 * 60_000;
+export function builderWish(store) {
+    const row = store.handle.prepare("SELECT desired, build, schema_version, set_by, set_at FROM builder_service WHERE id = 1").get();
+    return row === undefined ? null : { desired: row["desired"] === "running" ? "running" : "stopped", build: String(row["build"]), schema: Number(row["schema_version"]), setBy: String(row["set_by"]), setAt: String(row["set_at"]) };
+}
+export function databaseFormat(store) {
+    const read = readSchemaVersion(store.handle);
+    return read.ok ? read.version : null;
+}
+/** Record what a person asked for. A `stopped` keeps the last known build. */
+export function recordBuilderWish(store, desired, by, build, now) {
+    store.handle.prepare(`INSERT INTO builder_service (id, desired, build, schema_version, set_by, set_at) VALUES (1, ?, ?, ?, ?, ?)
+    ON CONFLICT (id) DO UPDATE SET desired = excluded.desired, build = excluded.build, schema_version = excluded.schema_version, set_by = excluded.set_by, set_at = excluded.set_at`)
+        .run(desired, build, databaseFormat(store) ?? 0, by, now.toISOString());
+}
+/** An update, a deploy's drain or a stop in progress: this is someone else's restart to make. */
+export function restartPaused(store, now) {
+    if (updateAdmissionPaused(store.raw()))
+        return true;
+    return store.listRunners().some(runner => drainOf(store, runner, now) !== null);
+}
+/** The wish, the pause and the count, read again and the attempt written in one transaction: two callers can't both
+ * take the last attempt, and a crash after this still counted. */
+export function admitBuilderRestart(store, now) {
+    return store.transact(() => {
+        if (builderWish(store)?.desired !== "running")
+            return "not-wanted";
+        if (restartPaused(store, now))
+            return "paused";
+        const since = new Date(now.getTime() - RESTART_WINDOW_MS).toISOString();
+        const tried = Number(store.handle.prepare("SELECT COUNT(*) AS n FROM builder_restart WHERE at > ?").get(since)?.["n"] ?? 0);
+        if (tried >= RESTART_LIMIT)
+            return "attempts";
+        store.handle.prepare("INSERT INTO builder_restart (at) VALUES (?)").run(now.toISOString());
+        return "admitted";
+    });
+}

package/dist/builder.d.ts

@@ -3,6 +3,7 @@ import { type CheckAccess } from "./check-access.js";
 import type { WritesMode } from "./writes-mode.js";
 import type { LaunchNetwork } from "./invoke.js";
 import type { ProviderId } from "./contracts/provider.js";
+import { type MachineSample } from "./check-load.js";
 import { type PreparedEvidence } from "./prepared-evidence.js";
 import { type ExecResult, type RunOptions } from "./exec.js";
 import type { Decision, Store } from "./store.js";
@@ -121,6 +122,9 @@ export type BuildRequest = {
     /** Runs the repository's approved verification command (Priority 2), after
      * commit. Tests inject; production uses exec. */
     verify?: Runner;
+    /** Reads the machine's cores and load for a release check's limit and load record (check-load.ts). Tests inject;
+     * production reads the operating system. */
+    machine?: () => MachineSample;
     /**
      * The stop fence (audit IV-1, completed): re-proved AFTER the agent and
      * BEFORE the commit. A stop that lands while the agent runs preserves

package/dist/builder.js

@@ -1,15 +1,17 @@
 import { legacyNetwork, repositoryEcosystems } from "./egress.js";
 import { CHECK_ACCESS_DEFAULT, checkAccessHere, checkNetworkOf, localModeCap } from "./check-access.js";
 import { localModeOn } from "./local-owner.js";
-import { checkoutGit } from "./teardown-git.js";
+import { checkoutGit, refusal as gitRefusal } from "./teardown-git.js";
 import { isAcpProvider } from "./acp-agents.js";
 import { OBSERVATION_MAILBOX, observationBrief, parseObservationCases, collectObservations } from "./observations.js";
 import { checkCommandFor, effectiveCheckLevel, recordRunCheckLevel } from "./check-levels.js";
+import { captureCheckConditions, learnRequestFor, recordCheckFacts } from "./check-facts.js";
 import { queueBatchCheck } from "./batch-checks.js";
 import { batchesFullCheck } from "./batch-policy.js";
 import { skillsContext } from "./project-skills.js";
 import { failedVerificationEvidence, sealVerificationReceipt, verificationEvidence, reuseObservationVerification } from "./verification-evidence.js";
-import { CHECK_INVENTORY_CAPTURE, CHECK_REPORT_CAPTURE, CheckBaselineUnverifiable, prepareCheckAttempt, reportFromOutput, sealCheckOutcome } from "./check-report.js";
+import { CHECK_INVENTORY_CAPTURE, CHECK_REPORT_CAPTURE, CheckBaselineUnverifiable, prepareCheckAttempt, reportFromOutput, sealCheckOutcome, sealJson } from "./check-report.js";
+import { CHECK_LOAD_CAPTURE, CheckLoadWatch } from "./check-load.js";
 import { retriedInside } from "./check-failure.js";
 import { planTargetedRecheck, settleCoverage } from "./release-recheck.js";
 import { effectiveCheckFacts } from "./verification-evidence.js";
@@ -79,6 +81,7 @@ import { LIVE_TICK_MS, tickLiveSteer } from "./steer-live.js";
 import { withRunActivity } from "./task-activity.js";
 import { CheckProgressTracker, coalescedProgressWriter } from "./check-progress.js";
 import { captureParkEvidence, captureTerminalDiff, captureBaseTree, evidenceRoot, handoffName, isImagePath, WORKTREE_EVIDENCE_DIR, storeHandoffArtifact, looksLikeProtocolFile, mailboxName, progressFileName, steerFolderName, statusFileName, proofFileName, rubricFileName, proposalFileName, quarantineMailboxes, readMailbox, readVerifiedArtifact, scanForSecrets, redactSecretLines, storeEvidence, validateScreenshotBytes, imageDimensions, SCREENSHOT_BYTE_CAP, boundStreamHeadTail } from "./evidence.js";
+import { deliverCodeMap } from "./code-map-admission.js";
 import { attemptKeyOf, closeRunQuestions, noteOpenTool, recordAgentTurn } from "./agent-board.js";
 import { openStatusFile, pulseAgentBoard, removeStatusFile, statusBrief } from "./agent-pulse.js";
 import { withAgentTurns } from "./agent-turns.js";
@@ -706,8 +709,11 @@ export async function build(store, request) {
             return { ok: false, reason: "no-op", message: refusal };
         // Check the exact candidate before setup or the full gate spends anything.
         const listed = await git(GIT, [...preparedEvidenceGit(), "ls-tree", "-z", preparedCandidate, "--", PREPARED_EVIDENCE_FILE], { cwd: worktree, maxBuffer: 2048 });
-        if (listed.code !== 0)
-            return { ok: false, reason: "no-op", message: "The committed screenshot inventory could not be inspected. Restore the saved candidate before review." };
+        if (listed.code !== 0) {
+            // Say why (runs 3316–3324 said only this sentence while the real cause was a refused config read).
+            const why = gitRefusal(listed) ?? listed.stderr.split("\n").map(line => line.trim()).find(line => line !== "") ?? `git exited ${listed.code}`;
+            return { ok: false, reason: "no-op", message: `The committed screenshot inventory could not be inspected (${redactSecretText(why).slice(0, 400)}). Restore the saved candidate before review.` };
+        }
         const required = scope?.acceptance.some(criterion => criterion.evidence.includes("screenshot")) ?? false;
         try {
             if (required || listed.stdout.length > 0)
@@ -1312,7 +1318,7 @@ export async function build(store, request) {
     const retryBase = pinnedBase !== null && pinnedBase !== baseRevision ? pinnedBase : null;
     const contextBase = codingHandoff !== null ? baseRevision : undefined;
     const lessonContext = learningContext(store, root, request.runId, "build", clock(), contextBase);
-    const briefText = projectSkillContext + knowledgeContext(store, request.runId, join(root, '..', 'repository-context'), contextBase) + lessonContext + brief(scope, branch, mailbox, done, proof, answers, planDocument, revisionBrief, previousHandoff, steering, retryBase, request.recoveredDraftRun ?? null, request.recoveredDraftKind ?? "partial", 
+    const briefText = projectSkillContext + knowledgeContext(store, request.runId, join(root, '..', 'repository-context'), contextBase, clock()) + deliverCodeMap(store, request.runId, clock()) + lessonContext + brief(scope, branch, mailbox, done, proof, answers, planDocument, revisionBrief, previousHandoff, steering, retryBase, request.recoveredDraftRun ?? null, request.recoveredDraftKind ?? "partial", 
     // The adaptive-execution-plan protocol is offered ONLY when there is a
     // real plan with real milestones to checkpoint against: no plan means
     // no revision to name, no ids to report, and nothing to propose a
@@ -2322,11 +2328,16 @@ async function settleProof(captured, statArtifactId, sealedHead) {
     const gateCommand = batched ? null : configured;
     let verifyCommand;
     let checkAttempt = null;
+    // A release check's limit and the machine's load while it runs, measured by the plane itself (check-load.ts).
+    let loadWatch = null;
     let releaseFacts = null;
     const verification = { last: null };
+    // What the check ran under, captured as its command starts (check-facts.ts): advisory, recorded at disposition.
+    const checkConditions = { last: null };
     const checkLog = [];
     const checkOutcomes = [];
     const checkSuites = [];
+    let settledReport = null;
     const noteCheckSuite = (name, result) => {
         checkSuites.push({
             name,
@@ -2380,9 +2391,13 @@ async function settleProof(captured, statArtifactId, sealedHead) {
             // A release's check (signed terms or an open authority): CI never stands in for its unit suite.
             // A release's check: signed terms, a release check purpose (pipeline-speed.md, P0) or an open authority.
             const release = decision.authority !== null || releaseCheckScope(store.getScope(request.taskId));
+            // A busy machine cuts the check's budget; the plane gives it time in proportion, bounded (check-load.ts).
+            loadWatch = new CheckLoadWatch(configured.timeoutMs, request.machine === undefined ? {} : { sample: request.machine });
             try {
-                checkAttempt = prepareCheckAttempt(store, root, { runId, repo, head: sealedHead, command: configured, access, authority: decision.authority,
-                    ...(decision.mode === "targeted" ? { plan: decision.plan, snapshot: decision.snapshot } : {}), watch: decision.watch, release }, now());
+                checkAttempt = prepareCheckAttempt(store, root, { runId, repo, head: sealedHead, command: configured, access, authority: decision.authority, limitMs: loadWatch?.limitMs,
+                    ...(decision.mode === "targeted" ? { plan: decision.plan, snapshot: decision.snapshot } : {}), watch: decision.watch, release,
+                    // Advisory only (docs/plans/learning-loops.md): the project's tracked identities, a separate handshake field.
+                    learn: learnRequestFor(store, repo, now(), runId).learn }, now());
             }
             catch (error) {
                 // A recorded last release that can't be verified (eval-harness review 2, finding 4): nothing runs.
@@ -2392,6 +2407,12 @@ async function settleProof(captured, statArtifactId, sealedHead) {
                 baselineUnverifiable = error.message;
                 recordCheckNote(error.message);
             }
+            if (checkAttempt === null && loadWatch !== null) {
+                loadWatch.finish();
+                loadWatch = null;
+            }
+            if (loadWatch !== null && loadWatch.limitMs !== configured.timeoutMs)
+                store.addRunNote(runId, "Toolroll", `The release check's time limit: ${loadWatch.why}.`, now());
             if (checkAttempt !== null && decision.mode === "targeted")
                 store.addRunNote(runId, "Toolroll", `Re-running only what failed at run #${decision.plan.base}: ${decision.plan.units.length} unit files, ${decision.plan.groups.reduce((n, one) => n + one.groups.length, 0)} journey groups, ${decision.plan.versions.length} upgrade versions${decision.plan.parts.length > 0 ? `, and in full: ${decision.plan.parts.join(", ")}` : ""}.`, now());
         }
@@ -2404,26 +2425,32 @@ async function settleProof(captured, statArtifactId, sealedHead) {
         const checkProgress = new CheckProgressTracker(snapshot => progressWrites.push(snapshot));
         const runVerification = async (label, missing = null) => {
             const streamed = { stdout: false, stderr: false };
+            // The conditions it starts under (verified tree, command, access, inherited environment): advisory, never authority.
+            if (missing === null)
+                checkConditions.last = captureCheckConditions({ repo, head: sealedHead, command: configured, access: checkLaunchOf(store, runId, captured.effective.profile).access, envNames: SETUP_ENV_ALLOWLIST });
             // The check runs under the stop watch (v52), owned by this run.
             const result = missing !== null
                 ? { code: 127, stdout: "", stderr: `Toolroll did not start the check: ${missing} wasn't found.`, timedOut: false, notFound: false }
-                : await underStopWatch(store, runId, () => runWithIsolatedDatabase(witnessedRunner(store, runId, now, commandRunner(store, runId, captured.effective.profile, verifyRunner)), verifyShell.file, verifyShell.args, {
-                    cwd: worktree,
-                    timeoutMs: configured.timeoutMs,
-                    processGroup: true,
-                    owner: runOwnerTag(store, runId),
-                    beforeSpawn: () => !stopRequestedFor(store, runId, request.shouldStop),
-                    onSpawn: pid => {
-                        request.onProviderSpawn?.(pid);
-                        if (stopRequestedFor(store, runId, request.shouldStop))
-                            throw new Error("the attempt was stopped before spawn custody completed");
-                    },
-                    envAllowlist: SETUP_ENV_ALLOWLIST,
-                    omitEnv: SETUP_ENV_DENYLIST,
-                    ...(checkAttempt === null ? {} : { stdin: checkAttempt.stdin }),
-                    onStdout: chunk => { streamed.stdout = true; checkProgress.feed(chunk, "stdout"); },
-                    onStderr: chunk => { streamed.stderr = true; checkProgress.feed(chunk, "stderr"); },
-                }));
+                : await underStopWatch(store, runId, () => {
+                    loadWatch?.attemptStarted();
+                    return runWithIsolatedDatabase(witnessedRunner(store, runId, now, commandRunner(store, runId, captured.effective.profile, verifyRunner)), verifyShell.file, verifyShell.args, {
+                        cwd: worktree,
+                        timeoutMs: loadWatch?.limitMs ?? configured.timeoutMs,
+                        processGroup: true,
+                        owner: runOwnerTag(store, runId),
+                        beforeSpawn: () => !stopRequestedFor(store, runId, request.shouldStop),
+                        onSpawn: pid => {
+                            request.onProviderSpawn?.(pid);
+                            if (stopRequestedFor(store, runId, request.shouldStop))
+                                throw new Error("the attempt was stopped before spawn custody completed");
+                        },
+                        envAllowlist: SETUP_ENV_ALLOWLIST,
+                        omitEnv: SETUP_ENV_DENYLIST,
+                        ...(checkAttempt === null ? {} : { stdin: checkAttempt.stdin }),
+                        onStdout: chunk => { streamed.stdout = true; checkProgress.feed(chunk, "stdout"); },
+                        onStderr: chunk => { streamed.stderr = true; checkProgress.feed(chunk, "stderr"); },
+                    }).finally(() => loadWatch?.attemptEnded());
+                });
             if (missing !== null)
                 unstartedChecks.set(result, missing);
             if (!streamed.stdout)
@@ -2618,13 +2645,24 @@ async function settleProof(captured, statArtifactId, sealedHead) {
             checkProgress.finish();
         }
         catch { /* display only */ }
+        // The plane's own load record (check-load.ts), sealed beside the receipt: the one thing that can call a timeout on a
+        // busy machine the machine's own fault. A record that can't be sealed excuses nothing; the check's outcome is unchanged.
+        if (loadWatch !== null) {
+            const record = loadWatch.finish();
+            try {
+                sealJson(store, root, runId, "check-load.json", record, CHECK_LOAD_CAPTURE, now());
+            }
+            catch (error) {
+                store.addRunNote(runId, "Toolroll", `This check's load record wasn't kept (${redactSecretText(error instanceof Error ? error.message : String(error))}), so a timeout in it can't be called the machine's own.`, now());
+            }
+        }
         if (!progressWrites.flush())
             progressWrites.flush();
         // The check's own report (the last line carrying the nonce), sealed beside what was sealed before it ran.
         const last = verification.last;
         let sealedReport = null;
         if (checkAttempt !== null && last !== null && !last.notFound) {
-            sealedReport = sealCheckOutcome(store, root, checkAttempt, { stdout: last.stdout, exitCode: last.timedOut ? null : last.code }, now());
+            sealedReport = settledReport = sealCheckOutcome(store, root, checkAttempt, { stdout: last.stdout, exitCode: last.timedOut ? null : last.code }, now());
             // Where the check's time went (latency-timeline.ts): each part's start and end, display only.
             keepCheckTimeline(store, { runId, taskId: request.taskId, report: sealedReport, stdout: last.stdout, now: now() });
         }
@@ -2683,6 +2721,16 @@ async function settleProof(captured, statArtifactId, sealedHead) {
         exitCode: checkExitCode,
         suites,
     }, now());
+    // What the check ran under and reported, every failure in it, each tagged by source (check-facts.ts): advisory, never
+    // read for this outcome, a verdict or an approval.
+    // A failure to record them is said on the run and never reaches the check's outcome.
+    try {
+        recordCheckFacts(store, root, { runId, taskRef: captured.taskRef, repo, conditions: checkConditions.last, receipt: { status: checkStatus }, report: settledReport,
+            attempt: checkAttempt === null ? null : { nonce: checkAttempt.nonce, learn: checkAttempt.learn }, stdout: verification.last?.stdout ?? null, now: now() });
+    }
+    catch (error) {
+        store.addRunNote(runId, "Toolroll", `This check's facts for the flaky-test list weren't recorded (${redactSecretText(error instanceof Error ? error.message : String(error))}); its result is unchanged.`, now());
+    }
     // 4. The sealed diff-stat was restated above, before the correction; it
     // is re-read now, after the gate, and the cached facts are adjudicated
     // only when the artifact still states exactly them. The gate receipt

package/dist/chat-acceptance.js

@@ -14,7 +14,7 @@ export function acceptanceStatus(proof, accepted, check) {
     if (proof?.verdict === "verified" && check !== "passed") {
         return check === undefined ? "Open the result to see its checks" : check === "failed" ? "Checks failed" : check === "running" ? "Checks running" : "The check result couldn't be read";
     }
-    return proof === null ? "No checks recorded" : ({ verified: "Checks passed", attested: "Checks reported by the agent", short: "Some required material is missing", refuted: "Saved result conflicts with the approved scope" }[proof.verdict] ?? "Some required material is missing");
+    return proof === null ? "No checks recorded" : ({ verified: "Checks passed", attested: "Checks reported by the agent", short: "Some required material is missing", refuted: "Saved result doesn't match the approved plan" }[proof.verdict] ?? "Some required material is missing");
 }
 export function readAcceptanceEvidence(store, who, root, task, runId, offset = 0) {
     const ref = store.lookupRef(task);

package/dist/chat-actions.d.ts

@@ -239,6 +239,16 @@ export declare const CHAT_ACTIONS: {
         readonly protected: false;
         readonly password: false;
     };
+    readonly code_map_switch: {
+        readonly label: "Change code map";
+        readonly protected: false;
+        readonly password: false;
+    };
+    readonly code_map_holdout_end: {
+        readonly label: "End holdout";
+        readonly protected: false;
+        readonly password: false;
+    };
     readonly lead_about_you: {
         readonly label: "Remember";
         readonly protected: false;
@@ -250,7 +260,7 @@ export declare const CHAT_ACTIONS: {
         readonly password: true;
     };
     readonly result_accept: {
-        readonly label: "Accept and finish";
+        readonly label: "Accept";
         readonly protected: true;
         readonly password: false;
     };
@@ -287,7 +297,7 @@ export declare function sharedActionReviewPath(id: number): string;
 export declare function mintSharedActionReview(store: Store, who: VerifiedApprover, id: number, root: string, now: Date): {
     payload: {
         version: 1;
-        operation: "decision_record" | "decision_retire" | "flow_browser" | "flow_browser_off" | "flow_card_add" | "flow_card_approve" | "flow_card_assign" | "flow_card_cancel" | "flow_card_choose" | "flow_card_comment" | "flow_card_move" | "flow_card_send_back" | "flow_card_watch" | "flow_create" | "flow_edit" | "flow_script_save" | "flow_starter" | "flow_trigger_add" | "flow_trigger_pause" | "flow_trigger_remove" | "flow_trigger_resume" | "kit_setup" | "knowledge_instructions" | "knowledge_remove" | "knowledge_restore" | "knowledge_save" | "lead_about_you" | "result_accept" | "scope_approve" | "skill_disable" | "skill_enable" | "skill_import" | "skill_restore" | "skill_test" | "subagent_answer" | "subagent_ask" | "subagent_create" | "subagent_memory" | "subagent_note" | "subagent_routine" | "subagent_soul" | "subagent_state" | "subagent_tools" | "subagent_undo" | "suggestion_not_now" | "sweep_cancel_rest" | "sweep_file" | "task_cancel" | "task_resume" | "tool_add" | "tool_remove" | "trial_stop";
+        operation: "code_map_holdout_end" | "code_map_switch" | "decision_record" | "decision_retire" | "flow_browser" | "flow_browser_off" | "flow_card_add" | "flow_card_approve" | "flow_card_assign" | "flow_card_cancel" | "flow_card_choose" | "flow_card_comment" | "flow_card_move" | "flow_card_send_back" | "flow_card_watch" | "flow_create" | "flow_edit" | "flow_script_save" | "flow_starter" | "flow_trigger_add" | "flow_trigger_pause" | "flow_trigger_remove" | "flow_trigger_resume" | "kit_setup" | "knowledge_instructions" | "knowledge_remove" | "knowledge_restore" | "knowledge_save" | "lead_about_you" | "result_accept" | "scope_approve" | "skill_disable" | "skill_enable" | "skill_import" | "skill_restore" | "skill_test" | "subagent_answer" | "subagent_ask" | "subagent_create" | "subagent_memory" | "subagent_note" | "subagent_routine" | "subagent_soul" | "subagent_state" | "subagent_tools" | "subagent_undo" | "suggestion_not_now" | "sweep_cancel_rest" | "sweep_file" | "task_cancel" | "task_resume" | "tool_add" | "tool_remove" | "trial_stop";
         request: {
             [x: string]: unknown;
         };

package/dist/chat-actions.js

@@ -1,5 +1,7 @@
 /** Shared, exact-state actions. Models may prepare; only the existing human
  * confirmation door executes. Protected actions use a one-use review receipt. */
+import { endHoldout, setCodeMapSwitch } from "./code-map-acts.js";
+import { codeMapOn } from "./code-map-store.js";
 import { dismissSuggestion, ruleById, stopTrial, suggestionsFor, suggestionWords, taskEvidenceWords, trialWords } from "./route-rules.js";
 import { CHAT_ACTION_LOCAL_ACTS, currentLocalOwner } from "./local-owner.js";
 import { fileTaskProposal } from "./proposal.js";
@@ -133,10 +135,13 @@ export const CHAT_ACTIONS = {
     suggestion_not_now: { label: "Not now", protected: false, password: false },
     // Stopping a trial only lowers: new tasks build on the configured model; approved ones keep theirs.
     trial_stop: { label: "Stop trial", protected: false, password: false },
+    // The code map's switch and holdout (docs/plans/code-map.md §5): a person's yes on the card, re-proved in the write.
+    code_map_switch: { label: "Change code map", protected: false, password: false },
+    code_map_holdout_end: { label: "End holdout", protected: false, password: false },
     // What the owner's own lead knows about them: theirs alone, in no project (lead-about.ts).
     lead_about_you: { label: "Remember", protected: false, password: false },
     scope_approve: { label: "Approve work", protected: true, password: true },
-    result_accept: { label: "Accept and finish", protected: true, password: false },
+    result_accept: { label: "Accept", protected: true, password: false },
     task_cancel: { label: "Cancel task", protected: true, password: false },
     task_resume: { label: "Resume task", protected: true, password: true },
 };
@@ -284,7 +289,7 @@ export function prepareSharedAction(store, who, operation, input, root, now = ne
         const stamp = hash({ operation, request, repo: "", state, terms, actor: who.name, generation: who.generation, ceiling: who.ceilingDigest });
         return { version: SHARED_ACTION_VERSION, operation, request, repo: "", title, terms, stamp, state };
     }
-    const task = operation.startsWith("skill_") || operation.startsWith("knowledge_") || operation.startsWith("decision_") || operation.startsWith("tool_") || operation.startsWith("flow_") || operation.startsWith("subagent_") || operation.startsWith("kit_") || operation.startsWith("sweep_") || operation.startsWith("suggestion_") || operation.startsWith("trial_")
+    const task = operation.startsWith("code_map_") || operation.startsWith("skill_") || operation.startsWith("knowledge_") || operation.startsWith("decision_") || operation.startsWith("tool_") || operation.startsWith("flow_") || operation.startsWith("subagent_") || operation.startsWith("kit_") || operation.startsWith("sweep_") || operation.startsWith("suggestion_") || operation.startsWith("trial_")
         ? null
         : text(input, "task", 64);
     const flowTarget = operation.startsWith("flow_") && operation !== "flow_create" && operation !== "flow_script_save" && operation !== "flow_starter" ? flowTargetOf(store, input) : null;
@@ -891,6 +896,17 @@ export function prepareSharedAction(store, who, operation, input, root, now = ne
         title = "Stop trying a cheaper model";
         terms.push(trialWords(store, trial), "New tasks build on the configured model again. Tasks a person already approved on the trial keep that model.");
     }
+    else if (operation === "code_map_switch") {
+        const on = input["on"] === true;
+        state = { on: codeMapOn(store, repo) };
+        title = on ? "Turn the code map on" : "Turn the code map off";
+        terms.push(on ? "Toolroll keeps a map of main for this project, and builds get it." : "No new maps are made, and builds get none. The last map stays saved.");
+    }
+    else if (operation === "code_map_holdout_end") {
+        state = { holdout: true };
+        title = "End the code map holdout";
+        terms.push("No new builds are enrolled. Builds already enrolled keep their arm, so the results stay comparable.");
+    }
     else if (operation.startsWith("decision_")) {
         // The staleness fence: the newest decision id and the active count, so a
         // card drafted before a subagent recorded or retired one is refused.
@@ -1282,6 +1298,13 @@ export function executeSharedAction(store, who, id, payload, now, options) {
                     throw Error(done.problem);
                 return { ok: true, taskId: null, said: "Trial stopped. New tasks build on the configured model.", href: `/settings/models?scope=${encodeURIComponent(repo)}#models-suggested` };
             }
+            else if (payload.operation === "code_map_switch" || payload.operation === "code_map_holdout_end") {
+                const door = currentLocalOwner() !== null ? { kind: "local-owner", actor } : { kind: "person", person: { actor: who.name, generation: who.generation, method: "session" } };
+                const done = payload.operation === "code_map_switch" ? setCodeMapSwitch(store, door, repo, req["on"] === true, now) : endHoldout(store, door, repo, now);
+                if (!done.ok)
+                    throw Error(done.problem);
+                return { ok: true, taskId: null, said: payload.operation === "code_map_switch" ? `The code map is ${req["on"] === true ? "on" : "off"}.` : "The holdout has ended.", href: `/settings/project?repo=${encodeURIComponent(repo)}#code-map` };
+            }
             else if (payload.operation === "suggestion_not_now") {
                 // The rule door (route-store.ts proveRuleDoor) re-proves who says it: this computer's local owner only inside
                 // its `dismiss-suggestion` act, or the confirming person.

package/dist/chat-channel.js

@@ -529,6 +529,16 @@ export const CHAT_ACTION_PARITY = {
         how: "Reads bounded source excerpts or advisory import impact in an accessible enrolled project through the shared engine, with source-search fallback when its index is unavailable.",
         gap: "Index refresh uses the local CLI. Dedicated Telegram and Slack journeys for this tool and live channel rendering remain unverified.",
     },
+    get_code_map: {
+        support: "direct",
+        how: "Reads the project's generated code map through the shared reader, one labelled answer at most 6 KB, paging one pinned version.",
+        gap: null,
+    },
+    refresh_code_map: {
+        support: "direct",
+        how: "Queues a check of the project's main, as Check now does on the page.",
+        gap: null,
+    },
     get_action_status: {
         support: "direct",
         how: "Reads the exact saved shared action and its outcome, including completion through secure review.",
@@ -569,6 +579,7 @@ export const CHAT_ACTION_PARITY = {
         how: "Read during a turn.",
         gap: null,
     },
+    get_flaky_tests: { support: "direct", how: "Read during a turn: a project's tests with mixed outcomes, each with the task that would fix it. Fixing one is an ordinary task card.", gap: null },
     get_models: { support: "direct", how: "Read during a turn: default agents with the exact model each runs, CLI versions and new models. Changes use the labelled Settings → Models page.", gap: null },
     get_diff: { support: "direct", how: "Read during a turn: the exact result's changed files, then one file's diff, so a requested change names the right file and line.", gap: null },
     get_check_log: { support: "direct", how: "Read during a turn: the end of the exact result's check log, a page of it, or the lines matching a search.", gap: null },

package/dist/chat-decide.d.ts

@@ -51,13 +51,18 @@ export type DecideButton = {
 };
 /** The words, said once. */
 export declare const DECIDE_LABELS: {
-    readonly accept: "Accept and finish";
-    readonly changes: "Request changes";
+    readonly accept: "Accept";
+    readonly changes: "Send back";
     readonly retry: "Retry";
     readonly approve: "Approve & start";
     readonly "not-now": "Not now";
     readonly merge: "Merge";
     readonly look: "Look first";
+    /** A result's one link (docs/plans/plain-toolroll.md P1.5). */
+    readonly open: "Open result";
+    /** A plan card's one button: it shows the full terms, and the Approve sits under them. Never an approval itself. */
+    readonly review: "Review plan";
+    readonly details: "Details";
     readonly edit: "Edit";
     readonly yes: "Yes";
     readonly cancel: "Cancel";