toolroll 0.9.95 → 0.9.97

package/dist/store.js

@@ -13,6 +13,8 @@ import { codeMapRemoteChanged, codeMapShapeProblem, forgetCodeMap, V152_ADDED_CO
 import { readStamps, stampDigest, stampRefusal, V154_SCHEMA } from "./check-stamp.js";
 import { FINDING_SOURCES, FINDING_SOURCES_BEFORE_LEAD, V155_SCHEMA, V155_STEPS } from "./fleet-schema.js";
 import { V156_SCHEMA, V156_STEPS } from "./fallback-schema.js";
+import { V158_ADDED_COLUMNS, V158_SCHEMA, V158_STEPS, LEAD_FAILURE_DETAILS, LEAD_ROUTES } from "./lead-latency-schema.js";
+import { V157_SCHEMA, V157_STEPS } from "./chat-live-schema.js";
 import { refArchived, taskArchived } from "./task-archive.js";
 export { refArchived, taskArchived } from "./task-archive.js";
 import { CHAT_PROVIDERS, CHAT_SCHEMA } from "./contracts/chat-tables.js";
@@ -1142,7 +1144,11 @@ const REGISTERED_AT_FILING = "again, as it was filed";
 // v155 adds, and changes no saved row (docs/plans/fleet-follow-through.md): findings and their answers, check repairs,
 // before-and-after evidence and provider captures (V155_SCHEMA, new tables only; fleet-schema.ts).
 // v156 adds fallback chains (V156_SCHEMA, new tables only; fallback-schema.ts), after v155.
-export const SCHEMA_VERSION = 156;
+// v157 is the chat apps' live placeholders (chat-apps slice; merged separately).
+// v158 adds, and changes no saved row (docs/plans/responsive-chat.md, slice 5): the tools each lead step asked for, an
+// exact failure detail on a step and a reply, which model answered a reply (mate_turn.route), and the quick-answer
+// switch (lead_quick_setting). V158_SCHEMA, V158_ADDED_COLUMNS (lead-latency-schema.ts): saved rows read NULL.
+export const SCHEMA_VERSION = 158;
 /** v118: the tables merged into `credential`, in the order they move (a person's API tokens keep their ids first). */
 export const V118_MERGED_TABLES = Object.freeze({ api_token: "person", coordinator_credential: "coordinator", lead_credential: "lead" });
 /** The foreign keys that named a merged table, exactly as their DDL wrote them; each names `credential(id)` instead. */
@@ -1275,7 +1281,7 @@ const V115_DROPPED_REFERENCES = /\s+REFERENCES (?:contestant|contest|tournament_
  * unchanged), and adds the nullable column in V125_ADDED_COLUMNS, checked the same way. v126 only adds a new table
  * (task_source) and the columns in V126_ADDED_COLUMNS (null or 0), checked the same way.
  */
-export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156]);
+export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156, 157, 158]);
 /** v119: the columns it adds, by table, with the value every row saved before it reads (toolroll-update's HISTORY_RULES). */
 export const V119_ADDED_COLUMNS = Object.freeze({
     task_ref: { planning_generation: { definition: "INTEGER NOT NULL DEFAULT 0", saved: "0" } },
@@ -1936,6 +1942,8 @@ export const V153_STEPS = Object.freeze(["plain-tables", "plain-columns"]);
 export const V154_STEPS = Object.freeze(["check-stamps"]);
 export { V155_STEPS };
 export { V156_STEPS };
+export { V157_STEPS };
+export { V158_STEPS };
 /**
  * v135: one approval per release (docs/plans/release-once.md). `release_authority` is the single source of truth for a
  * release a person approved: one row per generation, changed only by compare-and-swap on `rev`, with a lease whose
@@ -5274,6 +5282,17 @@ CREATE INDEX IF NOT EXISTS run_checkpoint_by_task ON run_checkpoint (task_ref, i
     // v156: fallback chains (new tables only). Idempotent, as v155's steps are.
     db.exec(V156_SCHEMA);
     step("fallback-tables");
+    // v157: live replies in Slack, Discord and Teams (new tables only). Idempotent, as v156's step is.
+    db.exec(V157_SCHEMA);
+    step("chat-live-tables");
+    // v158: the lead's latency records and its quick-answer switch (V158_SCHEMA, V158_ADDED_COLUMNS: saved rows read
+    // NULL). Idempotent, as v156's and v157's steps are.
+    db.exec(V158_SCHEMA);
+    step("lead-quick-setting");
+    for (const [table, columns] of Object.entries(V158_ADDED_COLUMNS))
+        for (const [column, { definition }] of Object.entries(columns))
+            addColumn(db, table, column, definition);
+    step("lead-latency-columns");
     // Keep the epoch until reclamation succeeds, including a retry after compaction already committed. A new file has
     // nothing to reclaim.
     if (!fresh)
@@ -13210,9 +13229,9 @@ export class Store {
         const changed = this.db
             .prepare(`UPDATE chat_turn SET state = ?, failure_reason = ?, tokens_in = ?, tokens_out = ?,
            settled_microusd = ?, unknown_spend = ?, reply_bytes = ?, candidate_count = ?, cache_read_tokens = ?, cache_write_tokens = ?,
-           model_reported = ?, provider_turns = ?, reported_cost_usd = ?, billing_reported = ?, finished_at = ?
+           model_reported = ?, provider_turns = ?, reported_cost_usd = ?, billing_reported = ?, tools = ?, failure_detail = ?, finished_at = ?
          WHERE id = ? AND generation = ? AND state IN ('queued','running')`)
-            .run(outcome.state, outcome.failureReason ?? null, outcome.tokensIn ?? null, outcome.tokensOut ?? null, outcome.settledMicrousd, outcome.unknownSpend === true ? 1 : 0, outcome.replyBytes ?? null, outcome.candidateCount ?? null, outcome.cacheReadTokens ?? null, outcome.cacheWriteTokens ?? null, reportedModelOf(outcome.modelReported), providerTurnsOf(outcome.providerTurns), reportedCostUsdOf(outcome.reportedCostUsd), outcome.billingReported === "subscription" || outcome.billingReported === "api-key" ? outcome.billingReported : null, now.toISOString(), id, generation);
+            .run(outcome.state, outcome.failureReason ?? null, outcome.tokensIn ?? null, outcome.tokensOut ?? null, outcome.settledMicrousd, outcome.unknownSpend === true ? 1 : 0, outcome.replyBytes ?? null, outcome.candidateCount ?? null, outcome.cacheReadTokens ?? null, outcome.cacheWriteTokens ?? null, reportedModelOf(outcome.modelReported), providerTurnsOf(outcome.providerTurns), reportedCostUsdOf(outcome.reportedCostUsd), outcome.billingReported === "subscription" || outcome.billingReported === "api-key" ? outcome.billingReported : null, outcome.tools === undefined ? null : JSON.stringify(outcome.tools.filter(name => /^[a-z_]{1,64}$/.test(name)).slice(0, 32)), outcome.failureDetail != null && LEAD_FAILURE_DETAILS.includes(outcome.failureDetail) ? outcome.failureDetail : null, now.toISOString(), id, generation);
         return Number(changed.changes) === 1;
     }
     /**
@@ -18016,9 +18035,9 @@ export class Store {
                 return false;
             const settled = outcome.unknownSpend === true ? Math.max(Number(before["reserved"]), outcome.settledMicrousd) : outcome.settledMicrousd;
             const changed = this.db
-                .prepare(`UPDATE mate_turn SET state = ?, settled_microusd = ?, tokens_in = ?, tokens_out = ?, failure_reason = ?, finished_at = ?
+                .prepare(`UPDATE mate_turn SET state = ?, settled_microusd = ?, tokens_in = ?, tokens_out = ?, failure_reason = ?, failure_detail = ?, finished_at = ?
            WHERE id = ? AND generation = ? AND state IN ('queued','running')`)
-                .run(outcome.state, settled, outcome.tokensIn, outcome.tokensOut, outcome.failureReason ?? null, now.toISOString(), id, generation);
+                .run(outcome.state, settled, outcome.tokensIn, outcome.tokensOut, outcome.failureReason ?? null, outcome.failureDetail != null && LEAD_FAILURE_DETAILS.includes(outcome.failureDetail) ? outcome.failureDetail : null, now.toISOString(), id, generation);
             if (Number(changed.changes) !== 1)
                 return false;
             this.db.prepare("UPDATE lead_session SET spent_microusd = spent_microusd + ? WHERE id = ?").run(settled, Number(before["session"]));
@@ -21235,6 +21254,8 @@ function readLeadTurn(row) {
         tokensIn: maybeN("tokens_in"),
         tokensOut: maybeN("tokens_out"),
         failureReason: maybe("failure_reason"),
+        failureDetail: LEAD_FAILURE_DETAILS.includes(row["failure_detail"]) ? row["failure_detail"] : null,
+        route: LEAD_ROUTES.includes(row["route"]) ? row["route"] : null,
     };
 }
 function readVerifyCommand(row) {
@@ -23173,3 +23194,35 @@ function widenFindingSources(db) {
     const columns = db.prepare("PRAGMA table_info(finding)").all().map(one => String(one["name"]));
     rebuildExact(db, "finding", named(stored), named(stored.replace(FINDING_SOURCES_BEFORE_LEAD, FINDING_SOURCES)), columns);
 }
+/** A thread's newest lead turn, whatever its state; null before its first. What a surface reads back to say how the
+ * last reply ended after a restart (docs/plans/responsive-chat.md §3.4): the saved row, never process memory. */
+export function latestLeadTurnOfThread(store, thread) {
+    const row = store.handle.prepare("SELECT * FROM mate_turn WHERE thread = ? ORDER BY id DESC LIMIT 1").get(thread);
+    return row === undefined ? null : readLeadTurn(row);
+}
+/** Settings → Lead's "Quick answers use a faster model" (v158): absent reads off, the shipped default
+ * (docs/plans/responsive-chat.md §8: on only once the lead-answer eval passes). */
+export function leadQuickAnswersOn(store) {
+    const row = store.handle.prepare("SELECT enabled FROM lead_quick_setting WHERE id = 1").get();
+    return row !== undefined && Number(row["enabled"]) === 1;
+}
+/** Turn quick answers on or off, recording who and when (the caller proved the person may change the lead's settings). */
+export function setLeadQuickAnswers(store, enabled, by, now) {
+    store.handle.prepare(`INSERT INTO lead_quick_setting (id, enabled, updated_by, updated_at) VALUES (1, ?, ?, ?)
+    ON CONFLICT(id) DO UPDATE SET enabled = excluded.enabled, updated_by = excluded.updated_by, updated_at = excluded.updated_at`).run(enabled ? 1 : 0, by, now.toISOString());
+}
+/** Which model answers a running reply (v158): written at admission and when a quick step hands over to the main model.
+ * Only the turn's own running generation may write it. */
+export function setLeadTurnRoute(store, turn, generation, route) {
+    if (!LEAD_ROUTES.includes(route))
+        return false;
+    return Number(store.handle.prepare("UPDATE mate_turn SET route = ? WHERE id = ? AND generation = ? AND state = 'running'").run(route, turn, generation).changes) === 1;
+}
+/** Whether a new message in this thread may be the answer to the lead's own question (ask_owner): the thread's newest
+ * reply asked one, less than LEAD_ASK_TTL_MS ago. Conservative on purpose: the quick-answer router (§8) keeps such a
+ * message on the main model. */
+export function leadAskAwaitsAnswer(store, thread, now) {
+    const row = store.handle.prepare(`SELECT a.created_at AS at FROM lead_message m JOIN lead_ask a ON a.turn = m.turn JOIN mate_turn t ON t.id = m.turn
+      WHERE m.id = (SELECT MAX(id) FROM lead_message WHERE thread = ? AND role = 'assistant') AND t.state = 'answered'`).get(thread);
+    return row !== undefined && Date.parse(String(row["at"])) + LEAD_ASK_TTL_MS > now.getTime();
+}

package/dist/subscription-chat.d.ts

@@ -27,6 +27,7 @@ export type SubscriptionLeadRunner = (request: SubscriptionLeadRequest) => Promi
 } | {
     ok: false;
     problem: string;
+    quiet?: boolean;
 }>;
 /** The model-visible request. Tool results are already redacted by leadView. */
 export declare function composeSubscriptionLeadPrompt(request: Omit<SubscriptionLeadRequest, "provider" | "model" | "timeoutMs" | "signal">): string;
@@ -49,4 +50,5 @@ export declare function performSubscriptionLeadRequest(request: SubscriptionLead
 } | {
     ok: false;
     problem: string;
+    quiet?: boolean;
 }>;

package/dist/subscription-chat.js

@@ -260,8 +260,10 @@ export async function performSubscriptionLeadRequest(request, runner = run) {
             processGroup: true,
             ...(streaming ? { onStdout: claudeStreamReader(request.onText) } : {}),
         });
+        // Whether the harness wrote anything at all before its deadline (v158, responsive-chat.md §7.5): a silent one never
+        // started answering; one with output was answering slowly. Recorded, never shown.
         if (result.timedOut)
-            return { ok: false, problem: "timeout" };
+            return { ok: false, problem: "timeout", quiet: result.stdout.trim() === "" };
         if (result.notFound)
             return { ok: false, problem: "not-found" };
         // v105: a streamed Claude turn says its plan's usage windows, and (once it answered) how this computer's Claude bills

package/dist/teams-chat.d.ts

@@ -1,8 +1,11 @@
-import { ChatState, type ChatIdentity } from "./chat-delivery-state.js";
+import { ChatState, type ChatEvent, type ChatIdentity } from "./chat-delivery-state.js";
+import { type ChatAckHooks, type ChatLiveTransport, type LiveReplies } from "./chat-live.js";
 import { type ChatDeliveryOptions } from "./chat-delivery.js";
 import { type TeamsApi } from "./teams-api.js";
-export type TeamsChatOptions = Omit<ChatDeliveryOptions, "state" | "label" | "member" | "partSize" | "maxProposal"> & {
+export type TeamsChatOptions = Omit<ChatDeliveryOptions, "state" | "label" | "member" | "partSize" | "maxProposal" | "live"> & {
     api: TeamsApi;
+    /** The live "Working on it…" message (chat-live.ts): on in the worker. */
+    liveReplies?: LiveReplies;
 };
 export declare const teamsUserId: (v: unknown) => v is string;
 /** A conversation id; a channel post's carries its thread as ";messageid=<first message>" (v89). */
@@ -27,3 +30,7 @@ export declare function teamsCard(text: string, actions: Record<string, unknown>
 export declare function teamsMessages(text: string, markdown: boolean, last: (text: string) => Record<string, unknown>): Record<string, unknown>[];
 /** Send the next pending part: a plain message, an edit, or a card with its tokens. */
 export declare function deliverTeamsPart(options: TeamsChatOptions): Promise<boolean>;
+/** The live message for one owner message: a plain Markdown activity, replaced whole (PUT) on every edit. */
+export declare function teamsLive(options: Pick<TeamsChatOptions, "api" | "identity">, state: ChatState, event: ChatEvent, spacingMs?: number): ChatLiveTransport | null;
+/** Teams gives bots no reactions: the arrival ack is "typing…", with nothing to take off. */
+export declare function teamsAckHooks(options: Pick<TeamsChatOptions, "api" | "identity">, state: ChatState): ChatAckHooks;

package/dist/teams-chat.js

@@ -4,6 +4,7 @@ import { resultShotsPruned } from "./result-shots.js";
 import { chatQuestionButtons } from "./subagent-question.js";
 import { chatAskButtons } from "./chat-ask.js";
 import { ChatDeliveryError, ChatState, chatHash, partContent } from "./chat-delivery-state.js";
+import { isLiveMessage, liveSpacingOf, underCooldown } from "./chat-live.js";
 import { channelAccess, chatObject as object, heldForWatch, planChatNotifications, planRoomMessages, processChatEvent, splitChatText } from "./chat-delivery.js";
 import { PLATFORM_LIMITS } from "./text-limits.js";
 import { LEAD_MESSAGE_MAX_CHARS } from "./lead.js";
@@ -14,6 +15,9 @@ import { admitChatEvent } from "./chat-admission.js";
 import { chatResultHref } from "./chat-controls.js";
 import { TeamsError } from "./teams-api.js";
 import { readTeamsSubmit } from "./contracts/teams-callback.js";
+import { readChatPart } from "./contracts/chat-content.js";
+const TEAMS_GONE = "Teams refused the request (404)";
+const TEAMS_SLOW = "Teams asked to slow down";
 const serviceKey = (conversation) => `serviceUrl:${conversation}`;
 export const teamsUserId = (v) => typeof v === "string" && /^29:[A-Za-z0-9_=-]{10,200}$/.test(v);
 /** A conversation id; a channel post's carries its thread as ";messageid=<first message>" (v89). */
@@ -43,6 +47,7 @@ export async function teamsMember(api, state, installation, member, channel) {
         return false;
     }
 }
+const teamsRateLimited = (error) => error instanceof TeamsError && error.code === TEAMS_SLOW ? error.retryMs : null;
 export const teamsDelivery = (options) => {
     const state = new ChatState(options.store, "teams");
     return {
@@ -52,12 +57,13 @@ export const teamsDelivery = (options) => {
         member: (member, channel) => teamsMember(options.api, state, options.identity.installation, member, channel),
         // "Typing…" while the lead works; Teams gives bots no reactions, so there is no 👍 here.
         warm: (event) => ({
-            typing: async () => {
+            typing: underCooldown(state, options.identity.installation, teamsRateLimited, () => options.clock?.() ?? new Date(), async () => {
                 const serviceUrl = state.meta(options.identity.installation, serviceKey(event.channel));
                 if (serviceUrl !== null)
                     await options.api("POST", serviceUrl, `/v3/conversations/${encodeURIComponent(event.channel)}/activities`, { type: "typing" });
-            },
+            }),
         }),
+        ...(options.liveReplies ? { live: (event) => teamsLive(options, state, event, liveSpacingOf(options.liveReplies)) } : {}),
         partSize: 3500,
         maxProposal: 6000,
     };
@@ -246,8 +252,50 @@ export async function deliverTeamsPart(options) {
             state.dropPart(row.id, error.message);
             return true;
         }
+        // The live message the reply was to replace is gone: the reply goes out as a new message.
+        const saved = readChatPart(row.payload), content = saved.ok ? saved.value : null;
+        if (content?.edit !== undefined && error instanceof TeamsError && error.code === TEAMS_GONE && isLiveMessage(state, row.event, content.edit)) {
+            const { edit: _edit, ...asNew } = content;
+            state.repaint(row.id, asNew);
+            return true;
+        }
         const problem = error instanceof TeamsError ? error : new TeamsError("Teams delivery failed", 15_000, true);
         state.partFailed(row.id, { problem: problem.message, until: new Date(now.getTime() + problem.retryMs).toISOString(), uncertain: problem.uncertain }, 20);
         return true;
     }
 }
+/** The live message for one owner message: a plain Markdown activity, replaced whole (PUT) on every edit. */
+export function teamsLive(options, state, event, spacingMs) {
+    const serviceUrl = state.meta(options.identity.installation, serviceKey(event.channel));
+    if (serviceUrl === null)
+        return null;
+    const activities = `/v3/conversations/${encodeURIComponent(event.channel)}/activities`;
+    const body = (text) => ({ type: "message", text, textFormat: "markdown" });
+    return {
+        platform: "teams",
+        ...(spacingMs === undefined ? {} : { spacingMs }),
+        limit: PLATFORM_LIMITS.teams - 200,
+        create: async (text) => {
+            const answer = await options.api("POST", serviceUrl, activities, body(text));
+            if (typeof answer.id !== "string" || answer.id === "")
+                throw new TeamsError("Teams did not confirm the message", 15_000, true);
+            return answer.id;
+        },
+        edit: async (message, text) => { await options.api("PUT", serviceUrl, `${activities}/${encodeURIComponent(message)}`, body(text)); },
+        rateLimited: error => error instanceof TeamsError && error.code === TEAMS_SLOW ? error.retryMs : null,
+        uncertain: error => !(error instanceof TeamsError) || error.uncertain,
+    };
+}
+/** Teams gives bots no reactions: the arrival ack is "typing…", with nothing to take off. */
+export function teamsAckHooks(options, state) {
+    return {
+        typing: async (event) => {
+            const serviceUrl = state.meta(options.identity.installation, serviceKey(event.channel));
+            if (serviceUrl !== null)
+                await options.api("POST", serviceUrl, `/v3/conversations/${encodeURIComponent(event.channel)}/activities`, { type: "typing" });
+        },
+        refused: () => false,
+        settled: () => false,
+        rateLimited: error => error instanceof TeamsError && error.code === TEAMS_SLOW ? error.retryMs : null,
+    };
+}

package/dist/teams.js

@@ -8,7 +8,8 @@ import { abortablePause, workChatQueue } from "./chat-follow.js";
 import { ChatState } from "./chat-delivery-state.js";
 import { chatObject as object } from "./chat-delivery.js";
 import { loadTeamsCredentials, teamsAccessToken, teamsApi, verifyTeamsToken, TeamsError } from "./teams-api.js";
-import { deliverTeamsPart, planTeamsNotifications, planTeamsRooms, processTeamsEvent, receiveTeams } from "./teams-chat.js";
+import { deliverTeamsPart, planTeamsNotifications, planTeamsRooms, processTeamsEvent, receiveTeams, teamsAckHooks } from "./teams-chat.js";
+import { runChatAcks } from "./chat-live.js";
 import { limitWords } from "./request-budget.js";
 export const TEAMS_ACTIVITY_BYTES = 64 * 1024;
 export const TEAMS_MESSAGES_PATH = "/teams/messages";
@@ -95,7 +96,7 @@ export async function followTeams(options) {
         options.signal.addEventListener("abort", stop, { once: true });
         const heartbeat = setInterval(() => { if (!same() || !state.lease(credentials.installation, owner, new Date()))
             stop(); }, 10_000);
-        const chat = { ...options, identity: credentials, owner, api: teamsApi(credentials, options.fetcher), canNotify: options.notifications, current: same };
+        const chat = { ...options, identity: credentials, owner, api: teamsApi(credentials, options.fetcher), canNotify: options.notifications, current: same, liveReplies: true };
         try {
             // Connected means the app can sign in; inbound reachability is the operator's endpoint to verify.
             try {
@@ -107,6 +108,8 @@ export async function followTeams(options) {
                 await pause(30_000);
                 continue;
             }
+            // "typing…" on each owner message as it arrives (the receiver saves it, maybe in another process), beside the queue.
+            runChatAcks({ state, installation: credentials.installation, owner, current: same, hooks: teamsAckHooks(chat, state), same, signal: options.signal });
             await workChatQueue({
                 same,
                 ready: () => !(state.retryAt(credentials.installation) > new Date().toISOString()),

package/dist/teardown-git.js

@@ -737,8 +737,8 @@ const WORKTREE_STATE_DIRS = ["sequencer", "rebase-merge", "rebase-apply"];
  * state, a split index's shared files); and the object store (the common `objects`, and a submodule git directory's
  * own under modules/): its fan-out folders' entries for links, `info` and `pack` all the way down, but not each loose
  * object (a big repository has very many, and hard-linked objects are legitimate). Any link is refused, so is a folder
- * that can't be listed, and so is any file walked deep with a second hard link (git appends to a log in place). The
- * exemption is by place only: an `objects` anywhere else (under refs/, logs/, worktrees/) is walked like the rest. For each one found, where it leads (for an incident's record).
+ * that can't be listed, and so is any file walked deep with a second hard link (git appends to a log in place), but for
+ * another checkout's index (siblingIndexes: still never a link). The exemptions are by place only: an `objects` anywhere else (under refs/, logs/, worktrees/) is walked like the rest. For each one found, where it leads (for an incident's record).
  *
  * Checked when the view is made and again after git ran; between the two, a process that outlived the agent's turn
  * can still swap one of these for a link and have git write through it mid-command. That window is an accepted
@@ -749,6 +749,7 @@ function pinned(dirs) {
     const seen = new Set();
     let budget = 400_000;
     const stores = objectStores(dirs.common);
+    const siblings = siblingIndexes(dirs);
     /** `deep`: every entry all the way down, each file held to one hard link. `shallow`: the folder's own entries
      * checked for links only. `store`: an object store (objects/: its fan-out folders shallow, `info` and `pack` deep
      * without the hard-link test). A link, or a folder that can't be listed, is swapped. */
@@ -776,7 +777,10 @@ function pinned(dirs) {
             swapped.push({ path, leadsTo: real });
             return;
         }
-        if (held.isFile() && mode === "deep" && held.nlink > 1) {
+        // Another checkout's own index, by exact place (siblingIndexes): held to being no link, but a second name is not
+        // counted. A tool in that checkout may hard-link it for a moment (Claude Code's security-guidance plugin does, to
+        // diff against a copy), and git never writes another checkout's index, nor any index in place.
+        if (held.isFile() && mode === "deep" && held.nlink > 1 && !siblings.has(path)) {
             swapped.push({ path, leadsTo: null });
             return;
         }
@@ -886,6 +890,32 @@ function objectStores(common) {
     visit(join(common, "modules"), 0);
     return stores;
 }
+/**
+ * The index files of the repository's other checkouts, by exact place, enumerated before the walk: `index` directly in
+ * each worktree folder of the common `worktrees` that isn't this checkout's own git directory, and, for a linked
+ * checkout, the main checkout's `index` in the common folder. The walk still refuses any of them that is a link; it
+ * only doesn't count a second hard link to one (pinned). The view links only this checkout's own index, and git writes
+ * an index only by renaming a new file over it, so a hard link at another checkout's can't take a write of the plane's
+ * anywhere. Measured (Nov 2026): Claude Code's security-guidance plugin hard-links the index of the checkout a session
+ * runs in to a temporary copy for up to seconds at a time, and a release gate that ran meanwhile in another checkout of
+ * the repository was stopped as an incident naming that checkout's index.
+ */
+function siblingIndexes(dirs) {
+    const indexes = new Set();
+    if (dirs.linked)
+        indexes.add(join(dirs.common, "index"));
+    let ids = [];
+    try {
+        ids = readdirSync(join(dirs.common, "worktrees"));
+    }
+    catch { /* none (an unlistable folder is the walk's to refuse) */ }
+    for (const id of ids) {
+        const folder = join(dirs.common, "worktrees", id);
+        if (folder !== dirs.gitdir)
+            indexes.add(join(folder, "index"));
+    }
+    return indexes;
+}
 function anchorOf(path) {
     const anchor = [];
     for (let at = path;; at = dirname(at)) {

package/dist/telegram-lead.d.ts

@@ -2,6 +2,7 @@ import { type PhoneLink } from "./chat-channel.js";
 export { channelRepos as telegramConversationRepos, resolveChannelLead as resolveTelegramLead, tooLongText, whichTaskText, replyContextFor, NO_PHONE_LINK, NO_TASK_LINK, proposalLink, confirmedLink, proposalPreview, proposalOutcomeText, handoffCardText, confirmedCardText, CHAT_ACTION_PARITY as TELEGRAM_ACTION_PARITY, parityGaps, type PhoneLink, type ResolvedLead, type ParitySupport } from "./chat-channel.js";
 import { type LeadAsk, type Store, type TelegramBinding } from "./store.js";
 import type { SubscriptionLeadRunner } from "./subscription-chat.js";
+import { type TelegramLiveTiming } from "./telegram-live.js";
 import type { TelegramTransport } from "./telegram.js";
 import { type TelegramCallbackButton, type TelegramUpdate } from "./contracts/telegram-callback.js";
 /** How long one claimed turn may go without a heartbeat before another poller may take it over. */
@@ -39,6 +40,8 @@ export type TelegramConversationOptions = {
         ok: false;
         message: string;
     }>;
+    /** Injected by tests: the live reply's timings (telegram-live.ts); production uses its defaults. */
+    liveTiming?: TelegramLiveTiming;
 };
 /** One Bot API call, the shape telegram.ts injects. */
 export type Transport = TelegramTransport;

package/dist/telegram-lead.js

@@ -31,7 +31,7 @@ import { ceilingDigestOf, verifyApproverStanding } from "./principal.js";
 import { LEAD_ASK_OTHER } from "./store.js";
 import { phoneText } from "./telegram-status.js";
 import { shapeReplyParts, telegramReply } from "./reply-shape.js";
-import { WARM_EMOJI, warmTurn } from "./chat-warmth.js";
+import { createTelegramLiveDraft, forgetWaitingDraft, telegramAck, telegramWaitingDraft } from "./telegram-live.js";
 import { TeamLeads } from "./team-leads.js";
 import { chatResultHref } from "./chat-controls.js";
 import { resultImageFileName, safeResultImageCaption, verifyResultImage } from "./chat-evidence.js";
@@ -373,8 +373,26 @@ const ANSWERED_SENDING = "answered:sending";
  */
 async function runTelegramConversation(row, args) {
     const { store, botId, transport, owner, clock, readProjects, options, report, only } = args;
-    const finish = (result) => store.finishTelegramConversation(row.id, owner, result, clock());
+    /** The row's live binding as it arrived (pairing alone: a reaction or a waiting draft carries no project data). */
+    const stillPaired = () => {
+        const live = store.liveTelegramBindingById(row.binding);
+        return live !== null && live.botId === botId && live.approverGeneration === row.approverGeneration && store.accountOf(live.approver)?.role === "approver";
+    };
+    const finish = (result) => {
+        const done = store.finishTelegramConversation(row.id, owner, result, clock());
+        // Answered (every part sent) or failed (its notice tried): the 👀 comes off, after what was delivered. Never awaited.
+        if (done && (result.state === "done" || result.state === "failed")) {
+            forgetWaitingDraft(botId, row.id);
+            void telegramAck({ store, botId, transport, clock, chatId: row.chatId, messageId: row.messageId, on: false, paired: stillPaired, ...(options.liveTiming?.ackGapMs === undefined ? {} : { gapMs: options.liveTiming.ackGapMs }) });
+        }
+        return done;
+    };
     const held = () => store.renewTelegramConversation(row.id, owner, CONVERSATION_CLAIM_MS, clock());
+    /** The claim, read (a draft never renews it: only the turn's own heartbeat and durable steps do). */
+    const claimed = () => {
+        const now = store.getTelegramConversation(row.id);
+        return now !== null && now.claimOwner === owner && now.claimExpiresAt !== null && now.claimExpiresAt > clock().toISOString();
+    };
     const ageMs = clock().getTime() - Date.parse(row.createdAt);
     const requeue = async (outcome) => {
         // A turn already admitted for it waits for that turn's own outcome (bounded by the turn's deadline); waiting for the
@@ -390,6 +408,10 @@ async function runTelegramConversation(row, args) {
         // Behind the person's own earlier messages: said once, then it waits quietly.
         if (outcome === "backlog" && row.outcome !== "backlog")
             await notify("Queued behind your earlier messages. It goes to the lead once they're answered.");
+        // Waiting for the lead: a draft that says so, refreshed while it waits (never over this chat's running turn).
+        if (outcome === "busy" || outcome === "backlog") {
+            await telegramWaitingDraft({ store, botId, transport, clock, chatId: row.chatId, binding: row.binding, draftId: row.id, allowed: () => stillPaired() && claimed(), ...(options.liveTiming === undefined ? {} : { timing: options.liveTiming }) });
+        }
         finish({ state: "queued", outcome, nextAttemptAt: new Date(clock().getTime() + CONVERSATION_RETRY_MS).toISOString() });
     };
     // 1. The exact binding the message arrived under must still be the live one.
@@ -677,7 +699,7 @@ async function runTelegramConversation(row, args) {
             return;
         }
         if (turn.state !== "answered") {
-            await notify(leadFailureText(turn.failureReason, store.leadTurnCostUnconfirmed(turn.id)));
+            await notify(leadFailureText(turn.failureReason, store.leadTurnCostUnconfirmed(turn.id), turn.failureDetail ?? null));
             finish({ state: "failed", outcome: `replayed:${turn.failureReason ?? "failed"}` });
             report.refused++;
             return;
@@ -777,10 +799,41 @@ async function runTelegramConversation(row, args) {
     // crash gets the original turn back, never a second dispatch.
     const heartbeat = setInterval(() => { held(); }, 30_000);
     heartbeat.unref?.();
-    // Once the turn reaches a tool step: a 👍 on the owner's message, and "typing…" while the lead works.
-    const warm = warmTurn({
-        react: () => transport("setMessageReaction", { chat_id: chatId, message_id: Number(row.messageId), reaction: [{ type: "emoji", emoji: WARM_EMOJI }] }),
-        typing: () => transport("sendChatAction", { chat_id: chatId, action: "typing" }),
+    // The live reply: one draft in this private chat with the status line and the reply as it is written
+    // (telegram-live.ts). A draft with words goes out only after the full fence: this exact binding, approver and the
+    // ceiling the turn opened under (the registry read at most every 5 s), the turn still running under the generation it
+    // first ran with, and this row's claim, re-checked after the read.
+    let draftGeneration = null;
+    let draftRegistry = null;
+    const turnStillRunning = (turnId) => {
+        const turn = store.getLeadTurn(turnId);
+        if (turn === null || turn.state !== "running" || turn.session !== session.id || turn.thread !== thread.id)
+            return false;
+        draftGeneration ??= turn.generation;
+        return turn.generation === draftGeneration;
+    };
+    const draftStanding = async (turnId) => {
+        if (!turnStillRunning(turnId) || !claimed())
+            return false;
+        if (draftRegistry === null || clock().getTime() - draftRegistry.at > 5_000) {
+            try {
+                draftRegistry = { at: clock().getTime(), repos: await readProjects() };
+            }
+            catch {
+                draftRegistry = null;
+                return false;
+            }
+        }
+        const read = draftRegistry.repos;
+        const problem = await telegramChannelProblem(store, { botId, bindingId: binding.id, approverGeneration: binding.approverGeneration, repos: who.repos }, async () => read);
+        return problem === null && turnStillRunning(turnId) && claimed();
+    };
+    const live = createTelegramLiveDraft({
+        store, botId, transport, clock, chatId, binding: binding.id, draftId: row.id,
+        // Shaped as the final reply is: for this message, with the phone's own trusted origin.
+        shape: { asked: row.text, appOrigin: options.phoneOrigin?.() ?? null },
+        standing: draftStanding, paired: () => pairingProblem() === null,
+        ...(options.liveTiming === undefined ? {} : { timing: options.liveTiming }),
     });
     const replyImage = row.replyTo === null ? undefined : store.telegramMessageBindings(binding, row.replyTo).find(one => one.taskId === row.taskId && one.run === row.sourceRun && one.image !== undefined)?.image;
     let outcome;
@@ -790,12 +843,13 @@ async function runTelegramConversation(row, args) {
             ...(row.context === null ? {} : { context: row.context }),
             ...(replyImage === undefined ? {} : { replyImage }),
             ...(options.subscriptionRunner === undefined ? {} : { subscriptionRunner: options.subscriptionRunner }),
-            clock, evidenceRoot: options.evidenceRoot, revalidate, mediaDelivery: "documents", channel: "telegram", onProgress: warm.onProgress,
+            clock, evidenceRoot: options.evidenceRoot, revalidate, mediaDelivery: "documents", channel: "telegram", onProgress: live.onProgress,
         });
     }
     finally {
         clearInterval(heartbeat);
-        warm.stop();
+        // Closed, and its draft in flight settled, before anything durable: no draft can land after the answer or a notice.
+        await live.close();
     }
     const receipt = store.leadRequestReceipt(session.id, row.request);
     if (receipt !== null)

package/dist/telegram-live.d.ts

@@ -0,0 +1,116 @@
+/**
+ * The paired phone's live reply (docs/plans/responsive-chat.md §3.1): a 👀 on the owner's message as soon as it is
+ * saved, and while the lead works one Bot API message draft (`sendMessageDraft`, private chats only) that shows the
+ * status line and the reply as it is written.
+ *
+ * Nothing here is durable or authoritative. A draft is Telegram's "temporary 30-second preview": it disappears when the
+ * bot sends a message or when it is not refreshed, so a draft that is never replaced is harmless. The answer itself is
+ * still the planned, receipted `sendMessage` parts (telegram-lead.ts), sent only after this turn's sender has closed.
+ * Drafts carry words only: no keyboard, no card, no token. Every draft that carries more than Telegram's own empty
+ * "Thinking…" placeholder is sent only after the caller's full standing check (live pairing, approver, the project
+ * ceiling the turn opened under, the turn still running under its generation, the row's claim).
+ *
+ * Rate: Telegram's own retry_after is shared with every other send (`telegramRetryAt` / `deferTelegram`). While it
+ * holds, an ack waits and a draft is dropped (the answer and failure notices go first, acks next, drafts last); a
+ * draft that is asked to pause widens this turn's spacing.
+ */
+import type { LeadProgress } from "./lead-progress.js";
+import { type LiveView } from "./live-reply.js";
+import { type ShapeOptions, type TelegramEntity } from "./reply-shape.js";
+import type { Store } from "./store.js";
+import type { TelegramTransport } from "./telegram.js";
+/** The acknowledgement on the owner's message: "seen, working on it". Removed once the answer or the failure notice is
+ * delivered; never replaced by a "done" mark (an answer isn't finished work). */
+export declare const ACK_EMOJI = "\uD83D\uDC40";
+/** At most one reaction change per chat this often; a burst waits its turn, in order. */
+export declare const ACK_GAP_MS = 1000;
+/** Drafts start this far apart and widen (doubling, up to the cap) whenever Telegram asks for a pause. */
+export declare const DRAFT_SPACING_MS = 1200;
+/** Telegram keeps a draft about 30 seconds: one that has not changed is sent again after this long. */
+export declare const DRAFT_KEEPALIVE_MS = 25000;
+/** Telegram's message limit, counted after entities (UTF-16 units, as JS strings are). */
+export declare const TELEGRAM_TEXT_MAX = 4096;
+/** Test seams for the timings above (production uses the defaults). */
+export type TelegramLiveTiming = {
+    ackGapMs?: number;
+    draftSpacingMs?: number;
+    keepAliveMs?: number;
+};
+export type DraftEntity = TelegramEntity | {
+    type: "italic";
+    offset: number;
+    length: number;
+};
+export type DraftPayload = {
+    text: string;
+    entities: DraftEntity[];
+};
+/** The body of a writing draft within `budget` characters once rendered: cut at a safe place in the shaped text first
+ * (never inside code, a link, a bold anchor or an emoji), rendered, measured, and cut smaller if it still doesn't fit.
+ * A body that can't fit (a single link longer than the budget) shows nothing. */
+export declare function draftBody(shaped: string, budget: number): DraftPayload;
+/**
+ * One live view as a draft: the status line in italics, then (once text exists) the partial reply as text plus
+ * entities, never Markdown. Plain "Thinking…" is Telegram's own empty-text placeholder. Closed views send nothing.
+ */
+export declare function telegramDraftOf(view: LiveView): DraftPayload | null;
+/**
+ * Put 👀 on the owner's message (`on`) or take it off. Best effort and never awaited by the caller's durable work: a
+ * missing pairing, a failure or a long pause skips it silently. `paired` is re-checked at the moment of sending; a
+ * reaction carries no project data, so the pairing alone fences it. Resolves once this change was tried.
+ */
+export declare function telegramAck(args: {
+    store: Store;
+    botId: string;
+    transport: TelegramTransport;
+    clock: () => Date;
+    chatId: string;
+    messageId: string;
+    on: boolean;
+    paired: () => boolean;
+    gapMs?: number;
+}): Promise<void>;
+export type TelegramLiveDraft = {
+    /** The turn's progress listener (runLeadTurn's `onProgress`). */
+    onProgress: (event: LeadProgress) => void;
+    /** Stop: nothing more is sent, and the draft in flight has settled when this resolves. Durable delivery comes after. */
+    close: () => Promise<void>;
+    /** The turn the drafts follow, once it started. */
+    readonly turn: number | null;
+};
+/**
+ * One running turn's draft. `standing` is the caller's full proof for a draft that carries words (it may await; the
+ * close is re-checked after it); `paired` is enough for Telegram's empty "Thinking…". A draft Telegram refuses outright
+ * (not a pause, not a lost answer) turns this turn's drafts off; previews are best effort.
+ */
+export declare function createTelegramLiveDraft(args: {
+    store: Store;
+    botId: string;
+    transport: TelegramTransport;
+    clock: () => Date;
+    chatId: string;
+    binding: number;
+    draftId: number;
+    shape: ShapeOptions;
+    standing: (turn: number) => Promise<boolean>;
+    paired: () => boolean;
+    timing?: TelegramLiveTiming;
+}): TelegramLiveDraft;
+/**
+ * A message waiting for the lead (busy, or behind the owner's earlier messages): "Waiting for your earlier messages…"
+ * as a draft, refreshed only after the keep-alive interval, and never while this chat's running turn has its own
+ * draft. Carries no project data: the pairing and the claim fence it.
+ */
+export declare function telegramWaitingDraft(args: {
+    store: Store;
+    botId: string;
+    transport: TelegramTransport;
+    clock: () => Date;
+    chatId: string;
+    binding: number;
+    draftId: number;
+    allowed: () => boolean;
+    timing?: TelegramLiveTiming;
+}): Promise<void>;
+/** The message is answered or failed: its waiting draft is forgotten. */
+export declare function forgetWaitingDraft(botId: string, draftId: number): void;