toolroll 0.9.93 → 0.9.94

package/dist/chat-decide.js

@@ -13,6 +13,7 @@
  * The same in every chat app: Telegram's bridge and the shared engine Slack, Discord and Teams run on (chat-delivery.ts)
  * offer, mint and answer these through the same tokens (the `channel` column). Every act runs through the door the
  * console uses. */
+import { routeChangeOf } from "./route-change.js";
 import { NIGHTLY_CHECK_ONLY, RELEASE_MERGES_ONLY, nightlyTaskRef, releaseTaskRef } from "./store.js";
 import { isAcpProfile } from "./acp-agents.js";
 import { DECIDE_ACTS, readDecideActionRow } from "./contracts/chat-callback-rows.js";
@@ -41,13 +42,18 @@ import { PLATFORM_LIMITS } from "./text-limits.js";
 export { permissionPlainWords };
 /** The words, said once. */
 export const DECIDE_LABELS = {
-    accept: "Accept and finish",
-    changes: "Request changes",
+    accept: "Accept",
+    changes: "Send back",
     retry: "Retry",
     approve: "Approve & start",
     "not-now": "Not now",
     merge: "Merge",
     look: "Look first",
+    /** A result's one link (docs/plans/plain-toolroll.md P1.5). */
+    open: "Open result",
+    /** A plan card's one button: it shows the full terms, and the Approve sits under them. Never an approval itself. */
+    review: "Review plan",
+    details: "Details",
     edit: "Edit",
     yes: "Yes",
     cancel: "Cancel",
@@ -390,9 +396,11 @@ export function planCardText(store, taskId, scope, root, channel) {
     const goal = scope.goal.split("\n").filter(one => one.trim() !== "").slice(0, 2).map(one => phoneText(one, 160));
     const allowing = [permissionPlainWords(scope.profile), scope.budgetMicrousd === null ? "no attempt limit" : `up to ${money(scope.budgetMicrousd)} per attempt`]
         .filter((one) => one !== null);
+    const changed = routeChangeOf(store, taskId);
     if (channel === "telegram") {
         return [
             `Plan ready: ${title(store, taskId)}`,
+            ...(changed === null ? [] : [changed]),
             `Starting allows: ${allowing.join(" · ")}`,
             "",
             ...goal,
@@ -405,6 +413,7 @@ export function planCardText(store, taskId, scope, root, channel) {
     }
     return [
         `Plan ready: ${title(store, taskId)}`,
+        ...(changed === null ? [] : [changed]),
         "",
         ...goal,
         "",
@@ -433,7 +442,7 @@ export function decideOffer(store, target, who, now, channel, root) {
             const fresh = resultFresh(store, target.taskId, target.run, who, now, root);
             if (!fresh.ok)
                 return null;
-            const look = { label: DECIDE_LABELS.look, path: chatResultHref(target.taskId, target.run, "changes") };
+            const look = { label: DECIDE_LABELS.open, path: chatResultHref(target.taskId, target.run, "changes") };
             // A result accepted only with a reason ("Accept anyway") keeps its link: the reason is typed on the result.
             if (fresh.exception)
                 return null;
@@ -473,15 +482,17 @@ export function decideOffer(store, target, who, now, channel, root) {
                     rows: [[{ act: "approve", run: null, digest: releaseDigest(card), label: "Continue" }], [{ label: DECIDE_LABELS.edit, path: chatControlHref("approval", target.taskId) }, { act: "not-now", run: null, digest: releaseDigest(card) }]],
                     ...(channel === "telegram" ? { file: { name: card.fileName, text: card.full } } : {}) };
             }
-            return { text: planCardText(store, target.taskId, plan.scope, root, channel),
-                rows: [[{ act: "approve", run: null, digest: plan.digest }], [{ label: DECIDE_LABELS.edit, path: chatControlHref("approval", target.taskId) }, { act: "not-now", run: null, digest: plan.digest }]] };
+            // One line, one button and Details (docs/plans/plain-toolroll.md P1.5): Review plan shows the full terms in the
+            // card, and only there does Approve appear, bound to the same digest.
+            return { text: planLineOf(store, target.taskId, ref.id),
+                rows: [[{ act: "approve", run: null, digest: plan.digest, label: DECIDE_LABELS.review }], [{ label: DECIDE_LABELS.details, path: chatControlHref("approval", target.taskId) }]] };
         }
         case "requests": return requestsOffer(store, target.taskId, who, now, channel, root);
         case "merge": {
             const merge = mergeInChat(store, target.taskId, target.run, who.name, now, channel);
             if (!merge.ok)
                 return null;
-            return { text: null, rows: [[{ act: "merge", run: target.run, digest: merge.head }], [{ label: DECIDE_LABELS.look, path: chatResultHref(target.taskId, target.run, "changes") }]] };
+            return { text: null, rows: [[{ act: "merge", run: target.run, digest: merge.head }], [{ label: DECIDE_LABELS.open, path: chatResultHref(target.taskId, target.run, "changes") }]] };
         }
     }
 }
@@ -623,7 +634,7 @@ seat, root) {
     return { ok: true, card, modeDigest: plan.modeDigest, source: plan.source, scope: plan.scope };
 }
 const QUESTIONS = {
-    accept: name => `Accept and finish "${name}"?`,
+    accept: name => `Accept "${name}"?`,
     retry: name => `Retry "${name}"? It queues another attempt.`,
     approve: name => `Approve and start "${name}"?`,
     merge: name => `Merge "${name}"?`,
@@ -712,7 +723,7 @@ function staleWhy(store, row, who, now, channel, root) {
 /** The links a card keeps once its acts are spent or stale: where to look, never a token. */
 export function linksFor(target) {
     switch (target.kind) {
-        case "result": return [[{ label: DECIDE_LABELS.look, link: { label: DECIDE_LABELS.look, path: chatResultHref(target.taskId, target.run, "changes") } }]];
+        case "result": return [[{ label: DECIDE_LABELS.open, link: { label: DECIDE_LABELS.open, path: chatResultHref(target.taskId, target.run, "changes") } }]];
         case "merge": return [[{ label: "Open task", link: { label: "Open task", path: chatControlHref("task", target.taskId) } }]];
         case "plan": return [[{ label: "Review & start", link: { label: "Review & start", path: chatControlHref("approval", target.taskId) } }]];
         case "failed": return [[{ label: "Open task", link: { label: "Open task", path: chatControlHref("task", target.taskId) } }]];
@@ -740,7 +751,7 @@ export function planWhereNow(store, taskId, who, now, root) {
     }
     return { said: `"${name}" is under way.`, rows: [] };
 }
-const QUESTION_STARTS = ["Accept and finish \"", "Retry \"", "Approve and start \"", "Merge \"", "Approve release "];
+const QUESTION_STARTS = ["Accept \"", "Accept and finish \"", "Retry \"", "Approve and start \"", "Merge \"", "Approve release "];
 /** The card's words without a question this module appended. */
 function cardBody(shown) {
     const at = shown.lastIndexOf("\n\n");
@@ -847,6 +858,19 @@ export function applyDecideTap(store, seat, input) {
             return { ack: "Confirm below.", edit: { text: `${body}\n\n${asked}`,
                     rows: [[{ label: DECIDE_LABELS.yes, token: yes }, { label: DECIDE_LABELS.cancel, token: cancel }]], tokens: [yes, cancel] } };
         }
+        // A plan card's Review plan: the full terms in the card, and under them the Approve (the yes, bound to the same
+        // digest the card was minted with, checked again at the tap). Approve is reachable only from here.
+        if (row.act === "approve") {
+            const plan = planInChat(store, row.taskId, who.name, now, seat.channel, input.root);
+            if (!plan.ok)
+                return stale(plan.why);
+            spend();
+            const spec = { act: "approve", run: null, digest: row.digest };
+            const yes = mint(store, seat, input.message, spec, row.taskId, "yes", now);
+            const later = mint(store, seat, input.message, { act: "not-now", run: null, digest: row.digest }, row.taskId, "offer", now);
+            return { ack: "Read the plan, then approve.", edit: { text: `${planCardText(store, row.taskId, plan.scope, input.root, seat.channel)}\n\n${QUESTIONS.approve(name)} This approves exactly this plan.`,
+                    rows: [[{ label: DECIDE_LABELS.approve, token: yes }], [{ label: DECIDE_LABELS.edit, link: { label: DECIDE_LABELS.edit, path: chatControlHref("approval", row.taskId) } }, { label: DECIDE_LABELS["not-now"], token: later }]], tokens: [yes, later] } };
+        }
         // The first tap asks; only the yes acts, bound to exactly what this button was.
         spend();
         const spec = { act: row.act, run: row.run, digest: row.digest };
@@ -1007,3 +1031,7 @@ export function decideTargetOf(row) {
         return { kind: "failed", taskId: row.taskId };
     return null;
 }
+/** A plan card's one line: the task's number, "plan ready", and its title (docs/plans/plain-toolroll.md P1.5). */
+function planLineOf(store, taskId, number) {
+    return `#${number}: plan ready · ${title(store, taskId)}`;
+}

package/dist/chat-quiet.js

@@ -102,7 +102,7 @@ export function quietCardView(store, taskRefs, now, root, viewer) {
     const heading = `${lines.length} tasks`;
     const projects = [...new Set(lines.map(one => projectLabel(one.project)))];
     const text = [heading, ...lines.map(one => `${one.icon} ${phoneText(one.title, 60)} · ${one.status}`), "", projects.join(", ")].join("\n");
-    return { text, entities: [{ type: "bold", offset: 0, length: heading.length }], link: { label: "Open tasks", path: "/work" } };
+    return { text, entities: [{ type: "bold", offset: 0, length: heading.length }], link: { label: "Open tasks", path: "/tasks" } };
 }
 /** Facts that carry their own controls or must stand alone (a security alert, a decision, a flow card, a
  * screenshot, an acceptance packet, a youiyoux pass's card) are never folded into a batch. */
@@ -177,7 +177,7 @@ export function finishedView(store, batch, now, root, viewer) {
         return null;
     const text = batchLine(lines.map(one => one.fact));
     if (lines.length > 1)
-        return { text, entities: [], link: { label: "Open", path: "/work" } };
+        return { text, entities: [], link: { label: "Open", path: "/tasks" } };
     const target = lines[0].target ?? null;
     return { text, entities: [], link: lines[0].link, ...(lines[0].also.length === 0 ? {} : { also: lines[0].also }), ...(target === null ? {} : { target }) };
 }
@@ -244,7 +244,7 @@ export function enqueueEveningDigests(store, now, root) {
             if (body === null)
                 return;
             if (store.enqueueNotification({ dedupeKey: `digest:evening:${person.account}:${day}`, kind: "evening-digest", subject: "Evening digest", body,
-                link: "/work", source: { installation: true }, recipient: person.account }, now))
+                link: "/tasks", source: { installation: true }, recipient: person.account }, now))
                 queued++;
         });
     }

package/dist/chat-voice.d.ts

@@ -39,7 +39,7 @@ export type FinishedFact = {
 /** The two buttons under a result ready for a person: the real next step, then a look first. */
 export declare const READY_ACTIONS: {
     readonly merge: "Merge";
-    readonly complete: "Accept and finish";
+    readonly complete: "Accept";
     readonly look: "Look first";
 };
 /** Whether this line asks for the result's next step, so it carries [Merge] or [Accept and finish] and [Look first]. */

package/dist/chat-voice.js

@@ -48,7 +48,7 @@ export function inSentence(summary) {
     return /^\p{Lu}\p{Ll}/u.test(summary) ? summary[0].toLowerCase() + summary.slice(1) : summary;
 }
 /** The two buttons under a result ready for a person: the real next step, then a look first. */
-export const READY_ACTIONS = { merge: "Merge", complete: "Accept and finish", look: "Look first" };
+export const READY_ACTIONS = { merge: "Merge", complete: "Accept", look: "Look first" };
 /** Whether this line asks for the result's next step, so it carries [Merge] or [Accept and finish] and [Look first]. */
 export function asksToFinish(fact) {
     return fact.update == null && fact.headline === "Ready for review" && !fact.report;
@@ -67,7 +67,7 @@ export function finishedLine(fact) {
             if (fact.report)
                 return fact.lead === true ? `I wrote up ${lower}. The report is ready to read.` : `${name}: the report is ready to read.`;
             if (fact.checks === "passed")
-                return `${ready}. Your tests passed. ${fact.pullRequest === true ? "Merge it?" : "Accept and finish it?"}`;
+                return `${ready}. Your tests passed. ${fact.pullRequest === true ? "Merge it?" : "Accept it?"}`;
             if (fact.checks === "off")
                 return `${ready}. Its checks run at release, so look it over first.`;
             return `${ready}, but no tests ran. Look it over first.`;

package/dist/check-facts.d.ts

@@ -87,6 +87,8 @@ export type CheckFactsInput = {
  * nothing reads these for a verdict, a rerun or an approval.
  */
 export declare function recordCheckFacts(store: Store, root: string, input: CheckFactsInput): void;
+/** The storage sweep's own step: results older than the retention window go; their fact rows stay. */
+export declare function pruneCheckResults(store: Store, now: Date): number;
 /** A check's recorded facts, or null. */
 export type CheckFact = {
     run: number;
@@ -117,7 +119,7 @@ export declare function checkResultsOf(store: Store, runId: number): {
  * accepted note's until it ends, an observation's for 90 days — exact cases only, the most recently tracked first, at
  * most 200. Those left out are counted (`leftOut`): a coverage gap, said, never hidden.
  */
-export declare function learnRequestFor(store: Store, repo: string, now: Date): {
+export declare function learnRequestFor(store: Store, repo: string, now: Date, runId?: number): {
     learn: string[];
     leftOut: number;
 };

package/dist/check-facts.js

@@ -25,6 +25,8 @@ import { createHash } from "node:crypto";
 import { failingTestsOf } from "./gate-failure.js";
 import { checkContextOf, projectGitDir, treeFactsOf } from "./check-report.js";
 import { readVerifiedArtifact } from "./evidence.js";
+import { recordObservations } from "./flaky.js";
+import { considerLessonNote, markTalliesPartial, revisedFailures, tallyCheck } from "./lesson-notes.js";
 import { CHECK_REPORT_PREFIX, isExactCase, learnLineSchema, learnRequest, LEARN_MAX_BYTES, LEARN_PREFIX } from "./contracts/release-check.js";
 import { nightlyTaskRef, releaseTaskRef } from "./store.js";
 /** The sources a result can come from, and the states it can have. */
@@ -36,6 +38,8 @@ export const UNEXPLAINED = "unexplained";
 export const MAX_RESULTS_PER_CHECK = 20_000;
 /** How old a tracked observation may be and still be asked about (docs/plans/learning-loops.md, 90-day window). */
 export const OBSERVATION_WATCH_MS = 90 * 24 * 60 * 60 * 1000;
+/** How long per-identity results are kept (docs/plans/learning-loops.md, "Per table"). */
+const RESULT_RETAIN_MS = 180 * 24 * 60 * 60 * 1000;
 const sha256 = (value) => createHash("sha256").update(value).digest("hex");
 /**
  * The conditions a check's command starts under: its commit's verified tree facts, the approved command's digest, its
@@ -225,16 +229,47 @@ export function recordCheckFacts(store, root, input) {
             kept.set(key, row);
     }
     const at = input.now.toISOString();
-    store.transact(() => {
-        const inserted = store.handle.prepare(`INSERT INTO check_fact (run, repo, task_ref, head, tree, command_digest, access, harness_digest, lockfile, conditions_digest,
+    let recorded = false;
+    try {
+        store.transact(() => {
+            const inserted = store.handle.prepare(`INSERT INTO check_fact (run, repo, task_ref, head, tree, command_digest, access, harness_digest, lockfile, conditions_digest,
         conditions_class, purpose, learn_state, learn_why, recorded_at) SELECT id, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ? FROM run WHERE id = ?
       ON CONFLICT (run) DO NOTHING`).run(input.repo, input.taskRef, conditions?.head ?? null, comparable ? conditions.tree : null, conditions?.commandDigest ?? null, conditions?.access ?? null, comparable ? conditions.harnessDigest : null, comparable ? conditions.lockfile : null, comparable ? conditions.conditionsDigest : null, comparable ? conditions.conditionsClass : null, checkPurposeOf(store, input.taskRef), learnState, learnState === "not-recorded" ? learnWhy ?? "not recorded" : null, at, input.runId);
-        if (Number(inserted.changes) !== 1)
-            return;
-        const insert = store.handle.prepare("INSERT INTO check_result (run, identity, state, source, recorded_at) VALUES (?, ?, ?, ?, ?)");
-        for (const row of [...kept.values()].slice(0, MAX_RESULTS_PER_CHECK))
-            insert.run(input.runId, row.identity, row.state, row.source, at);
-    });
+            if (Number(inserted.changes) !== 1)
+                return;
+            const insert = store.handle.prepare("INSERT INTO check_result (run, identity, state, source, recorded_at) VALUES (?, ?, ?, ?, ?)");
+            for (const row of [...kept.values()].slice(0, MAX_RESULTS_PER_CHECK))
+                insert.run(input.runId, row.identity, row.state, row.source, at);
+            // In the same transaction: what this check adds to the flaky-test list and to accepted notes' tallies, advisory like
+            // everything here.
+            const observations = recordObservations(store, input.runId, input.now);
+            if (input.repo !== null)
+                tallyCheck(store, input.runId, input.repo, observations, input.now);
+            recorded = true;
+        });
+    }
+    catch (error) {
+        // Not every check was counted this month: its tallies say so.
+        if (input.repo !== null) {
+            try {
+                markTalliesPartial(store, input.repo, input.now);
+            }
+            catch { /* the note reads as it was */ }
+        }
+        throw error;
+    }
+    // A person's lesson note, when this check is what passed a revision. Advisory: nothing here reaches the check.
+    if (recorded) {
+        try {
+            considerLessonNote(store, root, input.runId, input.now);
+        }
+        catch { /* no note */ }
+    }
+}
+/** The storage sweep's own step: results older than the retention window go; their fact rows stay. */
+export function pruneCheckResults(store, now) {
+    const cut = new Date(now.getTime() - RESULT_RETAIN_MS).toISOString();
+    return Number(store.handle.prepare("DELETE FROM check_result WHERE recorded_at < ?").run(cut).changes);
 }
 export function checkFactOf(store, runId) {
     const row = store.handle.prepare("SELECT * FROM check_fact WHERE run = ?").get(runId);
@@ -255,7 +290,7 @@ export function checkResultsOf(store, runId) {
  * accepted note's until it ends, an observation's for 90 days — exact cases only, the most recently tracked first, at
  * most 200. Those left out are counted (`leftOut`): a coverage gap, said, never hidden.
  */
-export function learnRequestFor(store, repo, now) {
+export function learnRequestFor(store, repo, now, runId) {
     const since = new Date(now.getTime() - OBSERVATION_WATCH_MS).toISOString();
     let tracked;
     // Advisory: a read that fails asks about nothing, and the check runs as it would have.
@@ -267,6 +302,17 @@ export function learnRequestFor(store, repo, now) {
     catch {
         return { learn: [], leftOut: 0 };
     }
-    const learn = learnRequest(tracked);
-    return { learn, leftOut: tracked.length - learn.length };
+    // First, the failed cases of the check this run revises (lesson-notes.ts rule 4).
+    let revised = [];
+    if (runId !== undefined) {
+        try {
+            revised = revisedFailures(store, runId);
+        }
+        catch {
+            revised = [];
+        }
+    }
+    const all = [...new Set([...revised, ...tracked])];
+    const learn = learnRequest(all);
+    return { learn, leftOut: all.length - learn.length };
 }

package/dist/check-failure.d.ts

@@ -1,4 +1,5 @@
 import { type CheckReport } from "./contracts/release-check.js";
+import { type CheckLoadRecord } from "./check-load.js";
 import { INFRA_RERUNS_PER_CANDIDATE, INFRA_RERUNS_PER_INCIDENT, type FailureClassName } from "./release.js";
 import type { Store } from "./store.js";
 export type FailureClass = FailureClassName;
@@ -20,12 +21,16 @@ export type CheckFacts = {
         failure?: string;
     };
     coverage?: string | undefined;
+    /** The approved limit of the command the receipt names (receipt.command.timeoutMs): a load record must be for it. */
+    grantMs?: number | undefined;
 };
 /**
- * One failed check, classified. `facts` come from the plane's sealed receipt; `report` (the check's own report, sealed
- * when valid) only ever picks among the classes that block. Null when the check passed.
+ * One failed check, classified. `facts` come from the plane's sealed receipt and `load` from the plane's own sealed load
+ * record (check-load.ts); `report` (the check's own report, sealed when valid) only ever picks among the classes that
+ * block — a timeout is excused only when the report names nothing else that failed, and only by the plane's own facts:
+ * its load readings cut the budget, and the check ran into its limit by the plane's own clock. Null when it passed.
  */
-export declare function classifyCheckFailure(facts: CheckFacts, report: CheckReport | null): ClassifiedFailure | null;
+export declare function classifyCheckFailure(facts: CheckFacts, report: CheckReport | null, load?: CheckLoadRecord | null): ClassifiedFailure | null;
 /** What passed only on a retry inside a passing check (a real-model journey group, a unit file): counted and reported,
  * never silently part of a pass. Null when there is no valid report to read it from: unknown, never "no retries". */
 export declare function retriedInside(report: CheckReport | null): string[] | null;
@@ -45,6 +50,20 @@ export declare const SETUP_REPLAY_RETRY = "the whole check, rerun after the appr
  * missing program; a receipt that doesn't classify it (an older one) says so, never that it was a launch failure.
  */
 export declare function setupReplayWords(first: unknown): string;
+/**
+ * An attempt interrupted before its candidate was even loaded (run 3326: the worker stopped under it — "The attempt was
+ * stopped before the prepared candidate was loaded."): it ran no check, so it is no check failure of the commit. Only
+ * the plane's own records say so, all of them at once: the run ended failed/interrupted, recorded no commit, and has no
+ * check attempt (sealed before any check command runs), no recorded check and no check log or receipt. Any attempt that
+ * got as far as its check keeps every rule below.
+ */
+export declare function ranNoCheck(store: Store, row: {
+    id: number;
+    outcome: unknown;
+    reason: unknown;
+    head: unknown;
+    checkRow: unknown;
+}): boolean;
 /**
  * Whether a passing check of a release task stands, given every earlier attempt on the same candidate and signed scope:
  * each earlier failure must be confirmed infrastructure the release itself reran (at most two), and nothing in the

package/dist/check-failure.js

@@ -5,7 +5,8 @@
  *   deterministic    typecheck, build, a failing test, a scripted journey, an upgrade, a required test gone:
  *                    nothing tolerated, never rerun to pass; the branch is fixed and the new commit released.
  *   infrastructure   independently confirmed by the plane itself: the check never started, this worker lost the
- *                    build, Toolroll's own shutdown stopped it — or, on GitHub, a job that failed before any of the
+ *                    build, Toolroll's own shutdown stopped it, it ran out of time on a machine the plane measured
+ *                    busy enough to cut its budget to half or less (check-load.ts) — or, on GitHub, a job that failed before any of the
  *                    workflow's own steps ran. At most one rerun per incident and two per candidate, under the same
  *                    approval; a pass after them counts.
  *   unknown          exit 1 with no failing test named, an unexplained timeout or signal, no result at all: an error
@@ -20,10 +21,12 @@
  */
 import { CHECK_REPORT_CAPTURE, readSealedJson } from "./check-report.js";
 import { readCheckReport } from "./contracts/release-check.js";
+import { busyMachineTimeout, CHECK_LOAD_CAPTURE, readCheckLoad } from "./check-load.js";
 import { regateTask } from "./dispose.js";
 import { INFRA_RERUNS_PER_CANDIDATE, INFRA_RERUNS_PER_INCIDENT } from "./release.js";
 import { releaseCheckScope } from "./scope.js";
-import { verificationEvidence } from "./verification-evidence.js";
+import { isVerificationReceipt, verificationEvidence } from "./verification-evidence.js";
+import { checkAttemptOf } from "./store.js";
 /** The plane's limits for confirmed infrastructure failures (one rerun per incident, two per candidate). */
 export { INFRA_RERUNS_PER_CANDIDATE, INFRA_RERUNS_PER_INCIDENT };
 /** The ledger action that records each rerun the release asked for, and why. */
@@ -35,11 +38,15 @@ const PLANE_INFRA = {
     "custody-lost": "this worker lost the build before the check could finish",
     "stopped-by-toolroll": "Toolroll's own shutdown stopped the check before it finished",
 };
+/** How a timeout on a busy machine reads (its rerun is the release terms' "Toolroll's own machine fails"). */
+const busyWords = (why) => `${why}: Toolroll's own machine, so this commit's check runs again`;
 /**
- * One failed check, classified. `facts` come from the plane's sealed receipt; `report` (the check's own report, sealed
- * when valid) only ever picks among the classes that block. Null when the check passed.
+ * One failed check, classified. `facts` come from the plane's sealed receipt and `load` from the plane's own sealed load
+ * record (check-load.ts); `report` (the check's own report, sealed when valid) only ever picks among the classes that
+ * block — a timeout is excused only when the report names nothing else that failed, and only by the plane's own facts:
+ * its load readings cut the budget, and the check ran into its limit by the plane's own clock. Null when it passed.
  */
-export function classifyCheckFailure(facts, report) {
+export function classifyCheckFailure(facts, report, load = null) {
     const result = facts.result;
     const passedCoverage = facts.coverage === undefined || facts.coverage === "full" || facts.coverage === "composed";
     if (result.configured && result.ran === true && result.exitCode === 0 && passedCoverage)
@@ -51,8 +58,12 @@ export function classifyCheckFailure(facts, report) {
         const infra = PLANE_INFRA[failure];
         if (infra !== undefined)
             return { class: "infrastructure", why: infra };
-        if (failure === "timed-out" || failure === "retry-timed-out")
-            return { class: "unknown", why: "the check timed out, and nothing says why" };
+        if (failure === "timed-out" || failure === "retry-timed-out") {
+            // The plane stopped it at its limit. With the plane's own record of a cut budget, the machine's fault; otherwise
+            // (a normal budget, or no record) a timeout nothing explains, as ever.
+            const busy = facts.grantMs === undefined ? null : busyMachineTimeout(load, facts.grantMs, true);
+            return busy !== null ? { class: "infrastructure", why: busyWords(busy) } : { class: "unknown", why: "the check timed out, and nothing says why" };
+        }
         if (failure === "baseline-unverifiable")
             return { class: "unknown", why: "the last release Toolroll recorded couldn't be verified, so what the check owed is unknown and it wasn't run" };
         if (failure === "no-result")
@@ -65,10 +76,14 @@ export function classifyCheckFailure(facts, report) {
     if (report === null)
         return { class: "unknown", why: `the check exited ${result.exitCode ?? "nonzero"} and gave no report naming what failed` };
     const deterministic = [], agent = [], unexplained = [];
+    // Whether everything unexplained is a part that ran out of time (never a signal, never an error no test owned).
+    let onlyTimeouts = true;
     for (const part of report.parts) {
         if (!part.selected || !part.ran || part.code === null)
             continue;
         if (part.timedOut || part.signal != null) {
+            if (!part.timedOut || part.signal != null)
+                onlyTimeouts = false;
             unexplained.push(`${part.part} ${part.timedOut ? "timed out" : `was ended by ${part.signal}`}`);
             continue;
         }
@@ -78,8 +93,10 @@ export function classifyCheckFailure(facts, report) {
     for (const file of report.units?.files ?? [])
         if (file.state === "failed")
             deterministic.push(`${file.file} failed`);
-    if ((report.units?.runErrors ?? 0) > 0 && !(report.units?.files ?? []).some(file => file.state === "failed"))
+    if ((report.units?.runErrors ?? 0) > 0 && !(report.units?.files ?? []).some(file => file.state === "failed")) {
+        onlyTimeouts = false;
         unexplained.push(`${report.units.runErrors} unit errors no test owned`);
+    }
     for (const run of report.journeys)
         for (const group of run.groups) {
             if (group.state !== "failed")
@@ -94,8 +111,14 @@ export function classifyCheckFailure(facts, report) {
         return { class: "deterministic", why: list(deterministic) };
     if (agent.length > 0)
         return { class: "agent-behaviour", why: list(agent) };
-    if (unexplained.length > 0)
+    if (unexplained.length > 0) {
+        // Only parts that ran out of time, and the plane's own record says the machine cut the budget and the check ran
+        // into its limit: the machine's fault. The report can only withhold this (by naming anything else), never grant it.
+        const busy = onlyTimeouts && facts.grantMs !== undefined ? busyMachineTimeout(load, facts.grantMs, false) : null;
+        if (busy !== null)
+            return { class: "infrastructure", why: busyWords(`${list(unexplained)}; ${busy}`) };
         return { class: "unknown", why: list(unexplained) };
+    }
     return { class: "unknown", why: `the check exited ${result.exitCode ?? "nonzero"} with no failing test identified` };
 }
 /** What passed only on a retry inside a passing check (a real-model journey group, a unit file): counted and reported,
@@ -127,7 +150,10 @@ export function classifyRunCheck(store, root, runId) {
         return { class: "unknown", why: "the check's receipt names no result" };
     const sealed = readSealedJson(store, root, runId, CHECK_REPORT_CAPTURE);
     const parsed = sealed === null ? null : readCheckReport(sealed.value);
-    return classifyCheckFailure({ result: receipt.result, coverage: receipt.coverage }, parsed?.ok === true ? parsed.value : null);
+    // The plane's own load record (check-load.ts): absent on older runs, and then nothing is excused.
+    const loadSealed = readSealedJson(store, root, runId, CHECK_LOAD_CAPTURE);
+    const grantMs = typeof receipt.command?.timeoutMs === "number" ? receipt.command.timeoutMs : undefined;
+    return classifyCheckFailure({ result: receipt.result, coverage: receipt.coverage, grantMs }, parsed?.ok === true ? parsed.value : null, loadSealed === null ? null : readCheckLoad(loadSealed.value));
 }
 /**
  * What passed only on a retry inside a run's check (eval-harness review 1, finding 3): the summary sealed into its
@@ -174,12 +200,27 @@ export function setupReplayWords(first) {
     }
     return `${SETUP_REPLAY_RETRY} (its first attempt's failure isn't classified)`;
 }
-/** The task's finished builder runs under `digest`, oldest first, each with whether its check passed. */
+/**
+ * An attempt interrupted before its candidate was even loaded (run 3326: the worker stopped under it — "The attempt was
+ * stopped before the prepared candidate was loaded."): it ran no check, so it is no check failure of the commit. Only
+ * the plane's own records say so, all of them at once: the run ended failed/interrupted, recorded no commit, and has no
+ * check attempt (sealed before any check command runs), no recorded check and no check log or receipt. Any attempt that
+ * got as far as its check keeps every rule below.
+ */
+export function ranNoCheck(store, row) {
+    if (row.outcome !== "failed" || row.reason !== "interrupted" || row.head !== null || row.checkRow !== null)
+        return false;
+    if (checkAttemptOf(store, row.id) !== null)
+        return false;
+    return !store.artifactsFor(row.id).some(artifact => artifact.kind === "check-log" || isVerificationReceipt(artifact));
+}
+/** The task's finished builder runs under `digest`, oldest first, each with whether its check passed or never ran. */
 function builderRuns(store, taskRef, digest) {
-    return store.handle.prepare(`SELECT r.id, r.outcome, r.scope_digest, r.finished_at, c.status FROM run r LEFT JOIN run_check c ON c.run = r.id
+    return store.handle.prepare(`SELECT r.id, r.outcome, r.reason, r.head_revision, r.scope_digest, r.finished_at, c.status, c.run AS check_row FROM run r LEFT JOIN run_check c ON c.run = r.id
       WHERE r.task_ref = ? AND r.role = 'builder' AND r.finished_at IS NOT NULL AND r.scope_digest = ? ORDER BY r.id`).all(taskRef, digest)
         .map(row => ({ id: Number(row["id"]), outcome: row["outcome"] === null ? null : String(row["outcome"]), scopeDigest: String(row["scope_digest"]), finishedAt: String(row["finished_at"]),
-        passed: (row["outcome"] === "built" || row["outcome"] === "no-change") && row["status"] === "passed" }));
+        passed: (row["outcome"] === "built" || row["outcome"] === "no-change") && row["status"] === "passed",
+        noCheck: ranNoCheck(store, { id: Number(row["id"]), outcome: row["outcome"], reason: row["reason"], head: row["head_revision"] ?? null, checkRow: row["check_row"] ?? null }) }));
 }
 /** The reruns the release asked for on this task (each source run once): run id → its class. */
 function reruns(store, taskId) {
@@ -208,6 +249,9 @@ export function releaseCheckStanding(store, root, input) {
     for (const one of builderRuns(store, ref.id, digest)) {
         if (one.id >= input.run || one.passed)
             continue;
+        // Interrupted before its candidate was loaded: no check ran, so there is no check failure to stand against a pass.
+        if (one.noCheck)
+            continue;
         const classified = one.outcome === "built" || one.outcome === "no-change" ? classifyRunCheck(store, root, one.id) : { class: "unknown", why: `its build ended ${one.outcome ?? "without an outcome"}` };
         if (classified === null)
             continue;

package/dist/check-levels-ui.d.ts

@@ -24,6 +24,10 @@ export type CheckSettingsView = {
     batch?: {
         on: boolean;
     };
+    /** Small tasks start right away (fast-start.ts). */
+    fast?: {
+        on: boolean;
+    };
     said: string | null;
     problem: string | null;
 };

package/dist/check-levels-ui.js

@@ -48,7 +48,16 @@ export function checkSettingsHtml(view) {
         body: view.full === null
             ? joinHtml([note("Approve one from the command line:"), codeLine(`toolroll verify set --repo … --command "…"`)])
             : command(view.full) });
-    return joinHtml([head, level, batchHtml(view), reviewHtml(view), quick, full]);
+    return joinHtml([head, level, fastHtml(view), batchHtml(view), reviewHtml(view), quick, full]);
+    /** Small tasks: one state, one sentence, and its one change behind a disclosure (the password). */
+    function fastHtml(view) {
+        if (view.fast === undefined)
+            return "";
+        const act = view.fast.on ? "Turn off" : "Turn on";
+        return settingsSection({ id: "small-tasks", title: "Small tasks start right away", state: html `<span data-small-tasks="${view.fast.on ? "on" : "off"}"> · ${view.fast.on ? "On" : "Off"}</span>`,
+            lead: "New task shows the exact terms and Build approves them, with no plan step. It takes a person, and only small, ordinary changes.",
+            body: view.canChange ? disclose(act, form("small-tasks-form", "small-tasks", html ``, { label: act, variant: "outline" }, { on: view.fast.on ? "0" : "1" })) : "" });
+    }
     /** Batch checks: one state and one sentence; turning it on restates exactly what happens before the password. */
     function batchHtml(view) {
         const batch = view.batch;

package/dist/check-load.d.ts

@@ -0,0 +1,85 @@
+import { z } from "zod";
+export declare const CHECK_LOAD_CAPTURE = "release check load v1";
+/** One reading of the machine: its cores and one-minute load (NaN where it isn't measured: Windows reports 0). */
+export type MachineSample = {
+    cores: number;
+    load: number;
+};
+export declare const machineSample: (platform?: NodeJS.Platform, read?: () => number[], cores?: () => number) => MachineSample;
+/** The check's budget on a quiet machine: three quarters of the cores, at least 2 (release-check.mjs checkBudget). */
+export declare const normalFree: (cores: number) => number;
+/** The check's budget under `load` (release-check.mjs checkBudget's `free`). Unmeasured load budgets from the cores. */
+export declare const freeAt: (cores: number, load: number) => number;
+/** Cut: the budget is at most half its normal size. Unmeasured load is never cut. */
+export declare const budgetCut: (cores: number, load: number) => boolean;
+/** A release check's limit never goes past this, however busy the machine. */
+export declare const CHECK_LIMIT_CEILING_MS: number;
+/** …nor past this many times the approved limit. */
+export declare const CHECK_LIMIT_MAX_FACTOR = 2;
+/**
+ * The limit a release check runs under: the approved one, unless the machine's load at its start cuts the check's
+ * budget to half or less — then the approved limit times normal/granted, at most twice it and never past the ceiling
+ * (an approved limit already at or past the ceiling is never extended). `why` says which, in words.
+ */
+export declare function checkLimitFor(grantMs: number, sample: MachineSample): {
+    limitMs: number;
+    why: string;
+};
+/** When a check ends itself before its limit (release-check.mjs checkDeadline, from its start): src/check-load.test.ts
+ * holds the two equal. A check that ran at least this long ran into its own limit. */
+export declare const selfStopAfter: (limitMs: number) => number;
+/** The samples read for the budget the check started with: the check waits up to ten minutes for the load to drop
+ * (release-check.mjs), so the least load in its first eleven — before its own load counts — is what it budgeted from at
+ * best. The least, so a check that found a quieter moment is never called cut. */
+export declare const CUT_WINDOW_MS: number;
+declare const recordSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    cores: z.ZodInt;
+    grantMs: z.ZodInt;
+    limitMs: z.ZodInt;
+    why: z.ZodString;
+    startedAt: z.ZodString;
+    elapsedMs: z.ZodNullable<z.ZodInt>;
+    samples: z.ZodArray<z.ZodObject<{
+        atMs: z.ZodInt;
+        load: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type CheckLoadRecord = z.infer<typeof recordSchema>;
+/** A sealed record read back, or null when it isn't one (an older run has none: then nothing is excused). */
+export declare function readCheckLoad(value: unknown): CheckLoadRecord | null;
+/**
+ * Why a release check that ran out of time did so because the machine was busy — or null. Every fact is the plane's:
+ * its load readings in the first eleven minutes (the least of them) cut the check's budget to half or less, and the
+ * check's last attempt ran into its own limit (at least `selfStopAfter(limitMs)`), or the plane stopped it at the limit
+ * (`stoppedAtLimit`). A check with its normal budget that times out is never excused here: a real hang stays a failure.
+ */
+export declare function busyMachineTimeout(record: CheckLoadRecord | null, grantMs: number, stoppedAtLimit: boolean): string | null;
+/**
+ * Watches one release check: the limit at its start, the load every 15 s while it runs, and how long its last attempt
+ * took. Advisory to the check itself (the limit is a plane value the check is told), and the only source of the record.
+ */
+export declare class CheckLoadWatch {
+    private readonly grantMs;
+    private readonly options;
+    private readonly started;
+    private readonly samples;
+    private readonly timer;
+    private readonly cores;
+    private attemptStart;
+    private elapsed;
+    readonly limitMs: number;
+    readonly why: string;
+    constructor(grantMs: number, options?: {
+        sample?: () => MachineSample;
+        clock?: () => number;
+        everyMs?: number;
+    });
+    private push;
+    /** Around each attempt of the command: the last one's time is the record's. */
+    attemptStarted(): void;
+    attemptEnded(): void;
+    /** Stops the readings and gives the record to seal. */
+    finish(): CheckLoadRecord;
+}
+export {};