toolroll 0.9.93 → 0.9.95

package/dist/phase-routing.js

@@ -745,7 +745,7 @@ export function projectRoute(route, readiness) {
             ...leg,
             reasons: leg.reasons.map(reason => reason.replace("builder and reviewer", "builder")),
             readiness: state,
-            readinessReason: seen === null ? "no runner has reported this provider yet" : seen.reason,
+            readinessReason: seen === null ? "no builder has reported this provider yet" : seen.reason,
             readinessRunner: seen === null ? null : seen.runner,
             observedAt: seen === null ? null : seen.observedAt,
             words: "",
@@ -775,7 +775,7 @@ export function projectRoute(route, readiness) {
 export function routeWords(projection, indent = "  ") {
     const pad = `${indent}             `;
     return [
-        `${indent}route        ${projection.riskTitle.toLowerCase()} · ${projection.postureWords} · ${projection.digest}`,
+        `${indent}route        ${projection.riskTitle.toLowerCase()} · ${projection.postureWords}`,
         ...(projection.sizeWords === null ? [] : [`${indent}size         ${projection.sizeWords} — ${projection.sizeReason}`]),
         `${pad}${projection.summary}`,
         ...projection.legs.flatMap(leg => [`${pad}${leg.words}`, ...leg.reasons.map(reason => `${pad}    ${reason}`)]),

package/dist/plain-schema.d.ts

@@ -0,0 +1,23 @@
+/** v153 (docs/plans/plain-toolroll.md Phase 2): the tables the authority slices own, new tables only. Kept apart so
+ * store.ts loads them without loading the roads that use them. */
+/** A vanished build's one charge per run, and the episode its automatic retries stay inside (vanished-retry.ts). */
+export declare const VANISHED_SCHEMA = "\nCREATE TABLE IF NOT EXISTS vanished_charge (\n  run        INTEGER PRIMARY KEY REFERENCES run(id),\n  task_ref   INTEGER NOT NULL REFERENCES task_ref(id),\n  charged_at TEXT NOT NULL,\n  settled_at TEXT\n);\nCREATE INDEX IF NOT EXISTS vanished_charge_open ON vanished_charge (task_ref) WHERE settled_at IS NULL;\nCREATE TABLE IF NOT EXISTS retry_episode (\n  task_ref          INTEGER PRIMARY KEY REFERENCES task_ref(id),\n  retries           INTEGER NOT NULL DEFAULT 0 CHECK (retries >= 0),\n  reserved_microusd INTEGER NOT NULL DEFAULT 0 CHECK (reserved_microusd >= 0),\n  stopped           TEXT CHECK (stopped IS NULL OR stopped IN ('no-budget', 'attempts', 'spend')),\n  stopped_run       INTEGER,\n  started_at        TEXT NOT NULL,\n  updated_at        TEXT NOT NULL\n);\n";
+/** A check-only authorization (check-only.ts): one automatic run of the approved check on one exact commit. The unique
+ * key is the cap: one per (commit, command digest), however many workers race. Written only from the approval that
+ * built that commit; it seals nothing and starts no agent. */
+export declare const CHECK_ONLY_SCHEMA = "\nCREATE TABLE IF NOT EXISTS check_authorization (\n  id             INTEGER PRIMARY KEY AUTOINCREMENT,\n  task_ref       INTEGER NOT NULL REFERENCES task_ref(id),\n  run            INTEGER NOT NULL REFERENCES run(id),\n  candidate      TEXT NOT NULL CHECK (length(candidate) = 40),\n  command_digest TEXT NOT NULL,\n  level          TEXT NOT NULL CHECK (level IN ('quick', 'full')),\n  check_access   TEXT NOT NULL,\n  scope_digest   TEXT NOT NULL,\n  written_at     TEXT NOT NULL,\n  expires_at     TEXT NOT NULL,\n  used_at        TEXT,\n  used_request   INTEGER,\n  closed_at      TEXT,\n  UNIQUE (task_ref, candidate, command_digest)\n);\nCREATE INDEX IF NOT EXISTS check_authorization_open ON check_authorization (expires_at) WHERE used_at IS NULL AND closed_at IS NULL;\n";
+/** Whether this computer's own builder is meant to be running, and with what (builder-restart.ts): set by `background
+ * on` and `up`, cleared by `background off` and `stop`. `builder_restart` is every automatic restart Toolroll tried. */
+export declare const BUILDER_SERVICE_SCHEMA = "\nCREATE TABLE IF NOT EXISTS builder_service (\n  id             INTEGER PRIMARY KEY CHECK (id = 1),\n  desired        TEXT NOT NULL CHECK (desired IN ('running', 'stopped')),\n  build          TEXT NOT NULL,\n  schema_version INTEGER NOT NULL,\n  set_by         TEXT NOT NULL,\n  set_at         TEXT NOT NULL\n);\nCREATE TABLE IF NOT EXISTS builder_restart (\n  id INTEGER PRIMARY KEY AUTOINCREMENT,\n  at TEXT NOT NULL\n);\n";
+/** A fast start's form as it was rendered (fast-start.ts): what the person typed and what the classifier said, kept here
+ * so Build files exactly that, whatever a form posts. Used once. */
+export declare const FAST_PREVIEW_SCHEMA = "\nCREATE TABLE IF NOT EXISTS fast_preview (\n  id          TEXT PRIMARY KEY,\n  actor       TEXT NOT NULL,\n  via         TEXT NOT NULL,\n  task_id     TEXT NOT NULL,\n  repo        TEXT NOT NULL,\n  title       TEXT NOT NULL,\n  permission  TEXT,\n  sizing_json TEXT NOT NULL,\n  digest      TEXT NOT NULL,\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT\n);\n";
+/** The one new route Toolroll proposed for a task whose sealed one no longer matches (route-change.ts): the line a person
+ * reads, bound to the exact route digest it describes. */
+export declare const ROUTE_CHANGE_SCHEMA = "\nCREATE TABLE IF NOT EXISTS route_change (\n  task_ref        INTEGER PRIMARY KEY REFERENCES task_ref(id),\n  scope_digest    TEXT NOT NULL,\n  to_route_digest TEXT NOT NULL,\n  words           TEXT NOT NULL,\n  created_at      TEXT NOT NULL\n);\n";
+/** v153's columns: a fast start's marker and start window on the task (both NULL on saved rows) and the project setting
+ * Small tasks start right away (NULL: the default). */
+export declare const V153_ADDED_COLUMNS: Readonly<Record<string, Readonly<Record<string, {
+    definition: string;
+    saved: string;
+}>>>>;

package/dist/plain-schema.js

@@ -0,0 +1,94 @@
+/** v153 (docs/plans/plain-toolroll.md Phase 2): the tables the authority slices own, new tables only. Kept apart so
+ * store.ts loads them without loading the roads that use them. */
+/** A vanished build's one charge per run, and the episode its automatic retries stay inside (vanished-retry.ts). */
+export const VANISHED_SCHEMA = `
+CREATE TABLE IF NOT EXISTS vanished_charge (
+  run        INTEGER PRIMARY KEY REFERENCES run(id),
+  task_ref   INTEGER NOT NULL REFERENCES task_ref(id),
+  charged_at TEXT NOT NULL,
+  settled_at TEXT
+);
+CREATE INDEX IF NOT EXISTS vanished_charge_open ON vanished_charge (task_ref) WHERE settled_at IS NULL;
+CREATE TABLE IF NOT EXISTS retry_episode (
+  task_ref          INTEGER PRIMARY KEY REFERENCES task_ref(id),
+  retries           INTEGER NOT NULL DEFAULT 0 CHECK (retries >= 0),
+  reserved_microusd INTEGER NOT NULL DEFAULT 0 CHECK (reserved_microusd >= 0),
+  stopped           TEXT CHECK (stopped IS NULL OR stopped IN ('no-budget', 'attempts', 'spend')),
+  stopped_run       INTEGER,
+  started_at        TEXT NOT NULL,
+  updated_at        TEXT NOT NULL
+);
+`;
+/** A check-only authorization (check-only.ts): one automatic run of the approved check on one exact commit. The unique
+ * key is the cap: one per (commit, command digest), however many workers race. Written only from the approval that
+ * built that commit; it seals nothing and starts no agent. */
+export const CHECK_ONLY_SCHEMA = `
+CREATE TABLE IF NOT EXISTS check_authorization (
+  id             INTEGER PRIMARY KEY AUTOINCREMENT,
+  task_ref       INTEGER NOT NULL REFERENCES task_ref(id),
+  run            INTEGER NOT NULL REFERENCES run(id),
+  candidate      TEXT NOT NULL CHECK (length(candidate) = 40),
+  command_digest TEXT NOT NULL,
+  level          TEXT NOT NULL CHECK (level IN ('quick', 'full')),
+  check_access   TEXT NOT NULL,
+  scope_digest   TEXT NOT NULL,
+  written_at     TEXT NOT NULL,
+  expires_at     TEXT NOT NULL,
+  used_at        TEXT,
+  used_request   INTEGER,
+  closed_at      TEXT,
+  UNIQUE (task_ref, candidate, command_digest)
+);
+CREATE INDEX IF NOT EXISTS check_authorization_open ON check_authorization (expires_at) WHERE used_at IS NULL AND closed_at IS NULL;
+`;
+/** Whether this computer's own builder is meant to be running, and with what (builder-restart.ts): set by `background
+ * on` and `up`, cleared by `background off` and `stop`. `builder_restart` is every automatic restart Toolroll tried. */
+export const BUILDER_SERVICE_SCHEMA = `
+CREATE TABLE IF NOT EXISTS builder_service (
+  id             INTEGER PRIMARY KEY CHECK (id = 1),
+  desired        TEXT NOT NULL CHECK (desired IN ('running', 'stopped')),
+  build          TEXT NOT NULL,
+  schema_version INTEGER NOT NULL,
+  set_by         TEXT NOT NULL,
+  set_at         TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS builder_restart (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL
+);
+`;
+/** A fast start's form as it was rendered (fast-start.ts): what the person typed and what the classifier said, kept here
+ * so Build files exactly that, whatever a form posts. Used once. */
+export const FAST_PREVIEW_SCHEMA = `
+CREATE TABLE IF NOT EXISTS fast_preview (
+  id          TEXT PRIMARY KEY,
+  actor       TEXT NOT NULL,
+  via         TEXT NOT NULL,
+  task_id     TEXT NOT NULL,
+  repo        TEXT NOT NULL,
+  title       TEXT NOT NULL,
+  permission  TEXT,
+  sizing_json TEXT NOT NULL,
+  digest      TEXT NOT NULL,
+  created_at  TEXT NOT NULL,
+  expires_at  TEXT NOT NULL,
+  consumed_at TEXT
+);
+`;
+/** The one new route Toolroll proposed for a task whose sealed one no longer matches (route-change.ts): the line a person
+ * reads, bound to the exact route digest it describes. */
+export const ROUTE_CHANGE_SCHEMA = `
+CREATE TABLE IF NOT EXISTS route_change (
+  task_ref        INTEGER PRIMARY KEY REFERENCES task_ref(id),
+  scope_digest    TEXT NOT NULL,
+  to_route_digest TEXT NOT NULL,
+  words           TEXT NOT NULL,
+  created_at      TEXT NOT NULL
+);
+`;
+/** v153's columns: a fast start's marker and start window on the task (both NULL on saved rows) and the project setting
+ * Small tasks start right away (NULL: the default). */
+export const V153_ADDED_COLUMNS = Object.freeze({
+    task_ref: { fast_start_at: { definition: "TEXT", saved: "NULL" }, fast_start_until: { definition: "TEXT", saved: "NULL" } },
+    project: { fast_start: { definition: "INTEGER CHECK (fast_start IS NULL OR fast_start IN (0, 1))", saved: "NULL" } },
+});

package/dist/plain-words.d.ts

@@ -0,0 +1,20 @@
+/** One vocabulary for the words Toolroll writes (docs/plans/plain-toolroll.md, "The words"): each row is a word or
+ * phrase product copy never says, and what it says instead. Matching is by whole word and ignores case.
+ *
+ * Product copy is the text Toolroll writes. Preserved content (goals, requirements, notes, agent reports, issue text,
+ * commit messages and the exact terms a consent shows) is never rewritten to satisfy this table. Code, the database,
+ * `--json`, the agent contract and the audit page's hash detail keep their own words. */
+export type PlainWord = {
+    never: string;
+    pattern: RegExp;
+    say: string;
+};
+export declare const PLAIN_WORDS: readonly PlainWord[];
+/** The words, for messages and tests. */
+export declare const BANNED_WORDS: readonly string[];
+/** Every banned word in `text`, as the table names it. */
+export declare function bannedWordsIn(text: string): string[];
+/** Whether `text` says any word product copy never says. */
+export declare const hasInternalWords: (text: string) => boolean;
+/** A plan's version as Details shows it: a short handle, never the whole digest. */
+export declare const planVersionWords: (digest: string) => string;

package/dist/plain-words.js

@@ -0,0 +1,66 @@
+/** One vocabulary for the words Toolroll writes (docs/plans/plain-toolroll.md, "The words"): each row is a word or
+ * phrase product copy never says, and what it says instead. Matching is by whole word and ignores case.
+ *
+ * Product copy is the text Toolroll writes. Preserved content (goals, requirements, notes, agent reports, issue text,
+ * commit messages and the exact terms a consent shows) is never rewritten to satisfy this table. Code, the database,
+ * `--json`, the agent contract and the audit page's hash detail keep their own words. */
+const row = (never, pattern, say) => ({ never, pattern: new RegExp(`(?<![\\w-])(?:${pattern})(?![\\w-])`, "i"), say });
+export const PLAIN_WORDS = [
+    row("scope", "scopes?|scoped", "plan"),
+    row("contract", "contracts?", "plan"),
+    // "Sign in", "signed in" and "signed out" are a person signing in, not an approval.
+    row("signs", "signs|signed(?!\\s+(?:in|out|into)\\b)", "Approved by …"),
+    row("sealed", "seal|seals|sealed|sealing", "approved"),
+    row("binds", "binds?", "approved"),
+    row("digest", "digests?", "(the plan version, in Details)"),
+    row("worker", "workers?", "builder"),
+    row("runner", "runners?", "builder"),
+    row("daemon", "daemons?", "builder"),
+    row("background service", "background service", "builder"),
+    row("operator", "operators?|instance operator", "approver, or owner"),
+    row("coordinator", "coordinators?", "your lead"),
+    row("mate", "mate", "your lead"),
+    row("scout", "scouts?|scouting|scouted", "research"),
+    row("criterion", "criterion|criteria", "requirement"),
+    row("evidence", "evidence", "requirement, or the saved files"),
+    row("proof", "proofs?", "requirement"),
+    row("verdict", "verdicts?", "requirement"),
+    row("caveat", "caveats?", "requirement"),
+    row("mark complete", "mark(?:ed|s|ing)?\\s+(?:it\\s+|this\\s+|that\\s+|them\\s+|the\\s+result\\s+)?complete", "Accept"),
+    row("Accept and finish", "accept\\s+and\\s+finish", "Accept"),
+    row("Revise", "revise", "Send back, or Request changes"),
+    row("re-file", "re-?file[ds]?|re-?filing", "Send back, or Request changes"),
+    row("Draft a repair task", "draft\\s+a\\s+repair\\s+task", "Send back"),
+    row("put away", "put(?:s|ting)?\\s+(?:it\\s+|them\\s+|tasks\\s+|old\\s+tasks\\s+)?away", "Archive"),
+    row("tidy", "tidy|tidied|tidying", "Archive"),
+    row("run #N", "(?:run|attempt|result)\\s+#?\\d+", "build #N"),
+    row("reconcile", "reconcile[ds]?|reconciling|reconciliation", "Waiting: Toolroll is …"),
+    row("requeue", "requeue[ds]?|requeuing", "Waiting: Toolroll is …"),
+    row("claim", "claim|claimed", "Waiting: Toolroll is …"),
+    row("lease", "leases?|leased", "Waiting: Toolroll is …"),
+    row("custody", "custody", "Waiting: Toolroll is …"),
+    row("incident", "incidents?", "Waiting: Toolroll is …"),
+    row("plane", "plane", "Toolroll"),
+    row("fence", "fences?|fenced", "Waiting: Toolroll is …"),
+    row("attested", "attest|attested|attestation", "Waiting: Toolroll is …"),
+    row("receipt", "receipts?", "Waiting: Toolroll is …"),
+    row("regate", "regate[ds]?", "Run checks"),
+    row("carried", "carried|carry|carries", "Waiting: Toolroll is …"),
+    row("incarnation", "incarnations?", "Waiting: Toolroll is …"),
+    row("admission", "admission", "Waiting: Toolroll is …"),
+    row("quiescence", "quiescen(?:ce|t)", "Waiting: Toolroll is …"),
+    row("witness", "witness(?:es|ed)?", "Waiting: Toolroll is …"),
+    row("unproven", "unproven", "Waiting: Toolroll is …"),
+    // A plan version or digest written out: twelve or more hex characters. A short commit (seven) is fine.
+    row("version hex", "(?=[0-9a-f]*\\d)(?=[0-9a-f]*[a-f])[0-9a-f]{12,64}", "(the plan version, in Details)"),
+];
+/** The words, for messages and tests. */
+export const BANNED_WORDS = PLAIN_WORDS.map(one => one.never);
+/** Every banned word in `text`, as the table names it. */
+export function bannedWordsIn(text) {
+    return PLAIN_WORDS.filter(one => one.pattern.test(text)).map(one => one.never);
+}
+/** Whether `text` says any word product copy never says. */
+export const hasInternalWords = (text) => PLAIN_WORDS.some(one => one.pattern.test(text));
+/** A plan's version as Details shows it: a short handle, never the whole digest. */
+export const planVersionWords = (digest) => `Plan version ${digest.slice(0, 8)}`;

package/dist/plan-login.d.ts

@@ -0,0 +1,14 @@
+import type { Billing } from "./spend.js";
+/** How Codex says it's signed in (`codex login status`): a ChatGPT sign-in is its plan; a key or Bedrock is a key;
+ * null when it says neither (not signed in, or it didn't answer). */
+export declare function codexLoginBilling(binary: string, omitEnv: readonly string[], env?: Record<string, string | undefined>): Promise<Billing | null>;
+/** Providers whose CLI can say, live and machine-readably, that the credential a run will use is a plan. */
+export declare const PLAN_LOGIN_PROVABLE: ReadonlySet<string>;
+/**
+ * How Claude says it is signed in (`claude auth status --json`), read with the run's own environment so it reads the
+ * credential the child will use. Strict: a plan only for a first-party claude.ai login with a named subscription; any
+ * other shape, a key, a cloud provider or no answer is not a plan.
+ */
+export declare function claudeLoginBilling(binary: string, omitEnv: readonly string[], env: Record<string, string | undefined>): Promise<Billing | null>;
+/** The live plan proof for a provider, or null where none exists (the caller refuses). */
+export declare function livePlanLogin(provider: string, binary: string, omitEnv: readonly string[], env: Record<string, string | undefined>): Promise<Billing | null>;

package/dist/plan-login.js

@@ -0,0 +1,58 @@
+/**
+ * How a CLI says it is signed in, read live, right before a run: the gateway's billing evidence, and the proof a
+ * plan-pinned fallback agent needs before it runs (fallback.ts). Only providers listed in PLAN_LOGIN_PROVABLE can be a
+ * plan fallback: for any other there is no live proof, so filing and the chain setting refuse it.
+ */
+import { run as runCommand } from "./exec.js";
+/** How Codex says it's signed in (`codex login status`): a ChatGPT sign-in is its plan; a key or Bedrock is a key;
+ * null when it says neither (not signed in, or it didn't answer). */
+export async function codexLoginBilling(binary, omitEnv, env) {
+    try {
+        const status = await runCommand(binary, ["login", "status"], { timeoutMs: 15_000, omitEnv, processGroup: true,
+            ...(env === undefined ? {} : { env: Object.fromEntries(Object.entries(env).filter((one) => one[1] !== undefined)) }) });
+        const said = `${status.stdout}\n${status.stderr}`;
+        // Strict: the status line itself, at the start of a line. A line naming both is never read as a plan.
+        if (/^Logged in using ChatGPT\s*$/m.test(said) && !/api key|bedrock/i.test(said))
+            return "subscription";
+        // Anything naming a key or Bedrock is read as a key (never a plan): that only ever narrows.
+        return /api key|bedrock/i.test(said) ? "api-key" : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Providers whose CLI can say, live and machine-readably, that the credential a run will use is a plan. */
+export const PLAN_LOGIN_PROVABLE = new Set(["claude", "codex"]);
+/**
+ * How Claude says it is signed in (`claude auth status --json`), read with the run's own environment so it reads the
+ * credential the child will use. Strict: a plan only for a first-party claude.ai login with a named subscription; any
+ * other shape, a key, a cloud provider or no answer is not a plan.
+ */
+export async function claudeLoginBilling(binary, omitEnv, env) {
+    try {
+        const status = await runCommand(binary, ["auth", "status", "--json"], { timeoutMs: 15_000, omitEnv, processGroup: true,
+            env: Object.fromEntries(Object.entries(env).filter((one) => one[1] !== undefined)) });
+        if (status.code !== 0)
+            return null;
+        const read = JSON.parse(status.stdout);
+        if (read === null || typeof read !== "object" || Array.isArray(read))
+            return null;
+        const said = read;
+        if (said["loggedIn"] !== true)
+            return null;
+        if (said["authMethod"] === "claude.ai" && said["apiProvider"] === "firstParty" && typeof said["subscriptionType"] === "string" && /^[a-z0-9_-]{1,32}$/.test(said["subscriptionType"]))
+            return "subscription";
+        return "api-key";
+    }
+    catch {
+        return null;
+    }
+}
+/** The live plan proof for a provider, or null where none exists (the caller refuses). */
+export async function livePlanLogin(provider, binary, omitEnv, env) {
+    if (provider === "codex")
+        return codexLoginBilling(binary, omitEnv, env);
+    if (provider === "claude")
+        return claudeLoginBilling(binary, omitEnv, env);
+    return null;
+}

package/dist/planner.d.ts

@@ -2,7 +2,7 @@ import type { ProviderId } from "./contracts/provider.js";
 import type { Store } from "./store.js";
 import { type ParsedDecision, type Problem } from "./decision.js";
 import { type ParsedPlan, type PlanProblem } from "./plan.js";
-import type { Runner } from "./builder.js";
+import { type Runner } from "./builder.js";
 import { type PlannerSource } from "./planner-source.js";
 export type PlanRequest = {
     /** v105: what's left of a monthly budget this API-key work counts toward (the CLI's own cap), when one does. */

package/dist/planner.js

@@ -1,6 +1,7 @@
 import { ACP_AGENTS, isAcpProvider } from "./acp-agents.js";
 import { skillsContext } from "./project-skills.js";
 import { learningContext } from "./project-learning.js";
+import { deliverCodeMap } from "./code-map-admission.js";
 import { knowledgeContext } from "./project-knowledge.js";
 /**
  * The planner: an agent that reads the repository and negotiates a plan —
@@ -31,6 +32,7 @@ import { TEXT_LIMITS } from "./text-limits.js";
 import { invokeAgent } from "./invoke.js";
 import { TOKEN_ENVS as TELEGRAM_TOKEN_ENVS } from "./telegram.js";
 import { evidenceRoot, mailboxName, planFileName, quarantineMailboxes, readMailbox, storeEvidence, writeEvidenceFile, } from "./evidence.js";
+import { gitFailureWords } from "./builder.js";
 import { MARKER as LEASE_MARKER } from "./worktree.js";
 import { liveLogContext } from "./live-detail.js";
 import { openLiveLog } from "./live.js";
@@ -536,7 +538,7 @@ export async function plan(store, request) {
     }
     const revision = await git(GIT, ["--no-optional-locks", "rev-parse", "HEAD"], { cwd: worktree });
     if (revision.code !== 0) {
-        return { ok: false, kind: "failure", reason: "git", message: `could not read the base revision in ${worktree}` };
+        return { ok: false, kind: "failure", reason: "git", message: `could not read the base revision in ${worktree} (${gitFailureWords(revision)})` };
     }
     const baseRevision = revision.stdout.trim();
     store.stampRun(request.runId, { baseRevision });
@@ -712,7 +714,7 @@ export async function plan(store, request) {
     try {
         const invoked = await invokeAgent(store, request.runId, { provider, model }, {
             phase: "plan",
-            brief: projectSkillContext + knowledgeContext(store, request.runId, join(root, '..', 'repository-context')) + learningContext(store, root, request.runId, "plan", clock()) + plannerBrief(request.taskTitle, mailbox, planFile, request.answers ?? [], request.source, structured),
+            brief: projectSkillContext + knowledgeContext(store, request.runId, join(root, '..', 'repository-context'), undefined, clock()) + deliverCodeMap(store, request.runId, clock()) + learningContext(store, root, request.runId, "plan", clock()) + plannerBrief(request.taskTitle, mailbox, planFile, request.answers ?? [], request.source, structured),
             maxTurns,
             // Claude's built-in `plan` permission mode diverts writes into its
             // own ~/.claude/plans file and refuses the nonce-bound handoff file.

package/dist/process-liveness.d.ts

@@ -3,6 +3,8 @@ type HistoricalWitness = {
     finishedAt: unknown;
     exitedAt?: unknown;
 };
+/** How long a run must have been over before a number its group once held can be read as someone else's. */
+export declare const REUSED_GROUP_AFTER_MS: number;
 /** Read-only checks of retained process witnesses. Saved PIDs authorize no
  * signal. ESRCH or proven macOS PID reuse establishes absence; everything
  * unknown stays occupied. This concerns the historical identity, not whether

package/dist/process-liveness.js

@@ -6,6 +6,17 @@ function timestamp(value) {
     const ms = Date.parse(value);
     return Number.isFinite(ms) && new Date(ms).toISOString() === value ? ms : null;
 }
+/** A whole `ps` lstart (locale C, UTC) as the earliest moment that process can have started, or null. The displayed
+ * second is a lower bound, not a rounded millisecond identity. Never lets Date.parse guess a locale, a timezone or an
+ * invalid calendar date. */
+function birthOf(lstart) {
+    const match = /^(Sun|Mon|Tue|Wed|Thu|Fri|Sat) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) (\d{1,2}) (\d{2}:\d{2}:\d{2}) (\d{4})$/.exec(lstart.trim().replace(/ +/g, " "));
+    if (match === null)
+        return null;
+    const utc = `${match[1]}, ${match[3].padStart(2, "0")} ${match[2]} ${match[5]} ${match[4]} GMT`;
+    const start = Date.parse(utc);
+    return !Number.isFinite(start) || new Date(start).toUTCString() !== utc || start > Date.now() ? null : start;
+}
 function newerMacProcess(pid, witness) {
     if (process.platform !== "darwin" || witness === undefined)
         return false;
@@ -13,26 +24,58 @@ function newerMacProcess(pid, witness) {
     if (observed === null || finished === null)
         return false;
     try {
-        // lstart has whole-second precision. Fix locale AND timezone; never let
-        // Date.parse guess either, or normalize an invalid calendar date.
-        const raw = execFileSync("/bin/ps", ["-p", String(pid), "-o", "lstart="], {
+        const start = birthOf(execFileSync("/bin/ps", ["-p", String(pid), "-o", "lstart="], {
             encoding: "utf8", env: { ...process.env, LC_ALL: "C", TZ: "UTC" },
             stdio: ["ignore", "pipe", "ignore"], maxBuffer: 1024,
             // Bound only this owned diagnostic child, never an agent or task.
             // A stalled/oversized lookup throws and leaves the witness occupied.
             timeout: 1_000, killSignal: "SIGKILL",
-        }).trim().replace(/ +/g, " ");
-        const match = /^(Sun|Mon|Tue|Wed|Thu|Fri|Sat) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) (\d{1,2}) (\d{2}:\d{2}:\d{2}) (\d{4})$/.exec(raw);
-        if (match === null)
-            return false;
-        const utc = `${match[1]}, ${match[3].padStart(2, "0")} ${match[2]} ${match[5]} ${match[4]} GMT`;
-        const start = Date.parse(utc);
-        if (!Number.isFinite(start) || new Date(start).toUTCString() !== utc || start > Date.now())
-            return false;
-        // The displayed second is a lower bound, not a rounded millisecond
-        // identity. Same-second observations are ambiguous. Reservations can
-        // precede spawn, so also require birth AFTER the owning run ended.
-        return start > Math.max(observed, finished);
+        }));
+        // Same-second observations are ambiguous. Reservations can precede
+        // spawn, so also require birth AFTER the owning run ended.
+        return start !== null && start > Math.max(observed, finished);
+    }
+    catch {
+        return false;
+    }
+}
+/** How long a run must have been over before a number its group once held can be read as someone else's. */
+export const REUSED_GROUP_AFTER_MS = 10 * 60_000;
+/**
+ * Whether a group whose exit is recorded is now a different group under the same number (macOS; run 3313's pid-less
+ * witness waited on three numbers MTLCompilerService and dataaccessd had taken). A recorded group exit was proved when
+ * it was written (no member left, a newer process holding the number, or a reboot), so the proof here only has to
+ * show that whoever holds the number came later: the run is over and old, and every process now in the group was
+ * born after that exit, or after the run ended if the exit was recorded later than that. A member older than that,
+ * an empty or unreadable table, or any line that can't be read leaves the group occupied. Nothing is signalled.
+ */
+function groupTakenSinceExit(pgid, witness) {
+    if (process.platform !== "darwin" || witness === undefined)
+        return false;
+    const observed = timestamp(witness.observedAt), finished = timestamp(witness.finishedAt), exited = timestamp(witness.exitedAt);
+    if (observed === null || finished === null || exited === null || Date.now() - finished < REUSED_GROUP_AFTER_MS)
+        return false;
+    const since = Math.max(observed, Math.min(exited, finished));
+    try {
+        const table = execFileSync("/bin/ps", ["-axo", "pid=,pgid=,lstart="], {
+            encoding: "utf8", env: { ...process.env, LC_ALL: "C", TZ: "UTC" },
+            stdio: ["ignore", "pipe", "ignore"], maxBuffer: 16 * 1024 * 1024, timeout: 5_000, killSignal: "SIGKILL",
+        });
+        let members = 0;
+        for (const line of table.split("\n")) {
+            if (line.trim() === "")
+                continue;
+            const row = /^\s*\d+\s+(\d+)(?:\s+(.*))?$/.exec(line);
+            if (row === null)
+                return false;
+            if (Number(row[1]) !== pgid)
+                continue;
+            const start = birthOf(row[2] ?? "");
+            if (start === null || start <= since)
+                return false;
+            members += 1;
+        }
+        return members > 0;
     }
     catch {
         return false;
@@ -65,10 +108,11 @@ export function processMayBeAlive(pid, group, witness) {
         // Darwin's forkproc excludes existing PIDs, PGIDs and session IDs under
         // proc_list_lock. A proven newer PID EQUAL to the saved PGID therefore
         // implies the old group ended before allocation, even if a new group now
-        // uses that number. A new member or an absent leader proves nothing.
+        // uses that number. A new member or an absent leader proves nothing,
+        // unless the group's exit is already on record (groupTakenSinceExit).
         // See docs/assessments/UPDATE_PID_REUSE_2026-09-15.md, recovery attempt 2.
         if (!absent)
-            return !newerMacProcess(pid, witness);
+            return !newerMacProcess(pid, witness) && !groupTakenSinceExit(pid, witness);
     }
     try {
         process.kill(pid, 0);

package/dist/project-delete-ui.d.ts

@@ -1,3 +1,10 @@
+/**
+ * Settings → Project: what Toolroll holds for a project, and deleting
+ * it. An instance operator deletes in two steps: type the project's name,
+ * then read exactly what goes and confirm with their password (or a fresh
+ * sign-in with the identity provider). The repository itself stays.
+ */
+import { type FallbackSetting } from "./fallback.js";
 import type { ProjectSandbox } from "./project-sandbox.js";
 import type { ProjectNetwork } from "./egress.js";
 import type { WritesMode } from "./writes-mode.js";
@@ -8,6 +15,13 @@ import { type ProjectHoldings } from "./project-delete.js";
 export declare const PROJECT_DELETE_CSS: string;
 export type ProjectSettingsView = {
     remoteUrl?: string | null;
+    /** The code map's switch and, while it runs, the holdout's end date. */
+    codeMap?: {
+        on: boolean;
+        enrollUntil: string | null;
+        canEndHoldout: boolean;
+        href: string;
+    };
     repo: string;
     name: string;
     holdings: ProjectHoldings;
@@ -42,6 +56,11 @@ export type ProjectSettingsView = {
         setting: ProjectNetwork;
         canChange: boolean;
     };
+    /** Who takes over when an agent runs out of its plan (fallback.ts), and whether this person may change it. */
+    fallback?: {
+        setting: FallbackSetting | null;
+        canChange: boolean;
+    };
     /** Where its builds may write (writes-mode.ts), and whether this person may change it. */
     writes?: {
         setting: WritesMode;
@@ -69,8 +88,6 @@ export type ProjectSettingsView = {
         signInsUnavailable?: string | null;
     };
 };
-/** The project's page: its name and path, what Toolroll holds for it, its build settings, and (for an instance operator)
- * Remove and Delete. */
 export declare function projectSettingsHtml(view: ProjectSettingsView, said: {
     said?: string | null;
     problem?: string | null;

package/dist/project-delete-ui.js

@@ -4,6 +4,7 @@
  * then read exactly what goes and confirm with their password (or a fresh
  * sign-in with the identity provider). The repository itself stays.
  */
+import { entryMovesOnWords, entryWords } from "./fallback.js";
 import { sandboxRuntimeWords } from "./sandbox-runtime.js";
 import { CHECK_ACCESS_WARNINGS, signInHostsMissing } from "./check-access.js";
 import { html, joinHtml, postForm } from "./html.js";
@@ -132,6 +133,22 @@ function networkHtml(view) {
                     note("Tasks scoped from now on use this; tasks already approved keep the network they were approved with."),
                 ]) }))]) });
 }
+function fallbackHtml(view) {
+    const fallback = view.fallback;
+    if (fallback === undefined)
+        return "";
+    const { setting } = fallback;
+    const lead = setting === null ? html `When an agent runs out of its plan, the task stops.` : html `When an agent runs out of its plan, the work moves to the next agent here.`;
+    const lines = setting === null ? "" : joinHtml(setting.entries.map(one => note(`${entryWords(one)}. ${entryMovesOnWords(one)}.`)));
+    return settingsSection({ id: "fallback", title: "Fallback agents", state: setting === null ? "" : ` · ${setting.entries.length}`, lead,
+        body: joinHtml([lines, !fallback.canChange ? APPROVER_CHANGES : disclose("Change", kitSectionForm({ proof: "project-fallback", action: "/settings/project/fallback", id: "fallback-form", gate: true, hidden: { repo: view.repo },
+                body: joinHtml([
+                    formRow("Agents, in order", "One per line: provider:model:plan or provider:model:api-key. Empty turns this off.", textarea({ id: "fallback-agents", name: "agents", value: setting === null ? "" : setting.entries.map(one => `${one.provider}:${one.model}:${one.authMode === "subscription" ? "plan" : "api-key"}`).join("\n"), rows: 3,
+                        attrs: { autocomplete: "off", autocapitalize: "off", spellcheck: "false", placeholder: "codex:gpt-5.6:plan", "aria-label": "Fallback agents, in order" } }), "top"),
+                    formRow("Paid fallback", "An agent on an API key spends money. It runs only while this is on.", switchInput({ id: "fallback-paid", name: "paid", label: "Allowed", on: setting?.paidGrant != null, attrs: { value: "on", "aria-label": "Allow paid fallback agents to spend" } }), "inline"),
+                    note("Tasks scoped from now on use this; tasks already approved keep the chain they were approved with."),
+                ]) }))]) });
+}
 /** Live view: hidden by default; showing commands takes the password, hiding them is one step. */
 function liveViewHtml(view) {
     const live = view.liveView;
@@ -186,6 +203,17 @@ function buildsHtml(view) {
 }
 /** The project's page: its name and path, what Toolroll holds for it, its build settings, and (for an instance operator)
  * Remove and Delete. */
+function codeMapHtml(view) {
+    const map = view.codeMap;
+    if (map === undefined)
+        return html ``;
+    return settingsSection({ id: "code-map", title: "Code map", right: postForm("/settings/project/code-map", btn(map.on ? "Turn off" : "Turn on", { sm: true, type: "submit" }), { hidden: { repo: view.repo, on: map.on ? "0" : "1" } }),
+        lead: map.on ? "Toolroll makes a map of main and gives it to builds." : "Off. No new maps are made, and builds get none.",
+        body: joinHtml([
+            html `<p><a class="k-link" href="${map.href}">Open code map</a></p>`,
+            ...(map.enrollUntil === null ? [] : [formRow("Holdout", `About half of new builds run without the map until ${map.enrollUntil.slice(0, 10)}, to measure whether it helps.`, map.canEndHoldout ? postForm("/settings/project/code-map/holdout", btn("End holdout", { sm: true, type: "submit" }), { hidden: { repo: view.repo } }) : html ``, "inline")]),
+        ]) });
+}
 export function projectSettingsHtml(view, said) {
     const answer = said.problem ? notice(said.problem) : said.said ? infoLine(said.said) : "";
     const project = settingsSection({ id: "project", title: view.name, lead: mono(view.repo),
@@ -194,7 +222,7 @@ export function projectSettingsHtml(view, said) {
             formRow("Recorded remote", view.remoteUrl ? null : "None. Landed work waits for your review.", view.remoteUrl ? mono(view.remoteUrl) : html ``, view.remoteUrl ? "wide" : "inline"),
             disclose("Change remote", joinHtml([note("An owner or instance operator can run:"), codeLine("toolroll repos add <project> --remote <url>")])),
         ]) });
-    const settings = joinHtml([buildsHtml(view), accessHtml(view), networkHtml(view), writesHtml(view), sandboxHtml(view), checkAccessHtml(view), liveViewHtml(view)]);
+    const settings = joinHtml([buildsHtml(view), accessHtml(view), networkHtml(view), fallbackHtml(view), writesHtml(view), sandboxHtml(view), checkAccessHtml(view), liveViewHtml(view), codeMapHtml(view)]);
     if (!view.canDelete)
         return joinHtml([answer, project, settings, note("An instance operator can remove or delete a project.")]);
     const deleteBody = view.running.length > 0

package/dist/project-delete.js

@@ -50,6 +50,8 @@ const SETTINGS = [
     ["intake_grant", "repo"], ["capability", "repo"], ["project_tool", "repo"],
     ["learning_policy", "repo"], ["operating_mode", "repo"], ["project_knowledge", "repo"], ["live_detail_setting", "repo"],
     ["project_decision", "repo"], ["flow_script", "repo"], ["workflow_recipe", "repo"], ["team_lead_project", "project"],
+    // Its fallback agents and, on the same row, its paid fallback grant (fallback.ts).
+    ["fallback_setting", "repo"],
 ];
 /** The project's Models rows, counted with its settings and deleted by forgetProjectModels only. */
 export const MODEL_SETTINGS = Object.freeze([["phase_config", "scope"], ["phase_tier_config", "scope"], ["phase_tier_alternate", "scope"]]);
@@ -264,8 +266,14 @@ function deleteRows(store, repo, d, now) {
     del("diff_comment", `${IN("run")} OR ${IN("reviewer_run")} OR ${IN("artifact")}`, R, R, A);
     del("review_request", `${IN("run")} OR ${IN("reviewer_run")}`, R, R);
     del("repair_chain", IN("source_run"), R);
+    // What happens to a result after its agent finishes (fleet-schema.ts): a project's own rows, answers first.
+    del("finding_answer", "finding IN (SELECT id FROM finding WHERE repo = ?)", repo);
+    for (const table of ["finding", "check_repair", "evidence_pair", "failing_first", "provider_capture"])
+        del(table, "repo = ?", repo);
     for (const table of ["incident", "proof_acceptance", "proof_verdict", "run_process", "run_route", "run_spend", "run_tool", "run_note", "run_stop", "run_checkpoint", "execution_slot"])
         del(table, IN("run"), R);
+    del("code_map_delivery", IN("run"), R);
+    del("code_map_snapshot", IN("run"), R);
     del("knowledge_snapshot", `repo = ? OR ${IN("run")}`, repo, R);
     del("learning_snapshot", `repo = ? OR ${IN("run")}`, repo, R);
     del("learning_capture", `repo = ? OR ${IN("source")} OR ${IN("reviewer")}`, repo, R, R);
@@ -290,9 +298,10 @@ function deleteRows(store, repo, d, now) {
     for (const [table, column] of [["scope_approval_vote", "task_id"], ["scope_author", "task_id"], ["plan_authorization", "task_id"], ["tool_seal", "task"], ["mcp_idempotency", "task_id"], ["coordinator_event", "task_id"], ["workflow_preview", "task_id"], ["task_source", "task_id"]])
         del(table, IN(column), K);
     del("workflow_preview", "repo = ?", repo);
+    del("fast_preview", "repo = ?", repo);
     del("coding_handoff_scope", `id IN (SELECT id FROM coding_handoff WHERE json_extract(payload, '$.repo') = ?)`, repo);
     del("coding_handoff", "json_extract(payload, '$.repo') = ?", repo);
-    for (const table of ["task_act", "task_replacement", "task_archive"])
+    for (const table of ["task_act", "task_replacement", "task_archive", "vanished_charge", "retry_episode", "check_authorization", "route_change"])
         del(table, IN("task_ref"), T);
     del("task_ref", IN("id"), T);
     del("task_scope", IN("task_id"), K);
@@ -322,6 +331,10 @@ function deleteRows(store, repo, d, now) {
     // the rows they hang off (the deleted runs, notes and decisions), below.
     for (const table of V149_REPO_TABLES)
         del(table, "repo = ?", repo);
+    // Its code map: the pointer before the versions it names.
+    del("code_map_current", "repo = ?", repo);
+    for (const table of ["code_map_version", "code_map_refresh", "code_map_family"])
+        del(table, "repo = ?", repo);
     del("memory_sighting", "gap IN (SELECT id FROM memory_gap WHERE repo = ?) OR session IN (SELECT id FROM memory_session WHERE repo = ?)", repo, repo);
     for (const [table, column] of SETTINGS)
         del(table, `${column} = ?`, repo);