toolroll 0.9.96 → 0.9.98

package/dist/operate.js

@@ -9,6 +9,7 @@ import { adapterPolicy } from "./server/route-policy.js";
 import { UNSENT_REPLY_MS } from "./telegram-settings.js";
 import { checkPublicCommand } from "./public-check.js";
 import { leadNameOf } from "./lead-identity.js";
+import { modelName, quickLeadModel } from "./lead-route.js";
 import { maybeTriggerRepair } from "./dispose.js";
 import { CHECK_LEVEL_HINTS, CHECK_LEVEL_WORDS, isCheckLevel, liveQuickCommand, projectCheckLevel, quickVerifyKey, setProjectCheckLevel, setTaskCheckLevel, suggestQuickCommand } from "./check-levels.js";
 import { fileAddTestsTask, requestFollowUpChecks, runFollowUpCheck, runWaitingChecks } from "./result-follow-ups.js";
@@ -122,7 +123,7 @@ import { homedir, hostname } from "node:os";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { releaseStalledUpdate, waitingUpdate } from "./toolroll-update.js";
 import { dur } from "./design/kit.js";
-import { checkoutIdle, setCheckoutIdle, openStore, openStoreNoMigrate, initLocalMode, enrollOwnerPassword, installationCreatedBy, laptopPortOf, recordLaptopPort, localModeOf, localOwnerBinding, archiveTaskFamily, restoreTaskFamily, shipChecksForTask, elapsedSeconds, CONCURRENT_WRITER_WAIT_MS, isDatabaseBusy, databasePath, BUILT_IN, parseCapabilityKey, verifiedAuthor, isDigestTime, predecessorWatches, RESULT_SCREENSHOTS, lifecycleOf, reportLifecycle, beatLifecycle, } from "./store.js";
+import { checkoutIdle, setCheckoutIdle, leadQuickAnswersOn, setLeadQuickAnswers, openStore, openStoreNoMigrate, initLocalMode, enrollOwnerPassword, installationCreatedBy, laptopPortOf, recordLaptopPort, localModeOf, localOwnerBinding, archiveTaskFamily, restoreTaskFamily, shipChecksForTask, elapsedSeconds, CONCURRENT_WRITER_WAIT_MS, isDatabaseBusy, databasePath, BUILT_IN, parseCapabilityKey, verifiedAuthor, isDigestTime, predecessorWatches, RESULT_SCREENSHOTS, lifecycleOf, reportLifecycle, beatLifecycle, } from "./store.js";
 import { createHash, randomBytes, randomInt, randomUUID } from "node:crypto";
 import { claimInstance, clearInstance, openInstanceSocket } from "./console-instance.js";
 import { backgroundOff, backgroundOn, backgroundShow, laptopStatus, laptopStop, restartOwnBuilder } from "./laptop-background.js";
@@ -208,6 +209,7 @@ import { scanRepo } from "./capscan.js";
 import { computeGaps, describeCapability } from "./gaps.js";
 import { ask as promptAsk, askHidden as promptHidden, confirm as promptConfirm, interactive as promptInteractive, underAgent } from "./prompt.js";
 import { runLeadCli, answerContextLines } from "./lead-cli.js";
+import { liveTerminalWanted, processTerminal } from "./lead-cli-live.js";
 import { confirmCoordinatorProposal, dismissCoordinatorProposal } from "./lead-doors.js";
 import { verifyApproverByPassword as approverByPassword } from "./principal.js";
 import { activeRemote, REMOTE_MESSAGES, REMOTE_REFUSED_FLAGS, REMOTE_SCOPES, RemoteRefusal, remoteAllows, remoteLensOf, remoteProjectOf, remoteRowOf, remoteSecret, reproveRemote, withRemote } from "./operate-remote.js";
@@ -279,6 +281,7 @@ import { noticeGitIncidents } from "./git-incident.js";
 import { containmentNotice, containmentStatus, currentContainment, describeContainment, resolveContainment } from "./containment.js";
 import { readPulls } from "./pulls.js";
 import { startMaintenance } from "./maintenance.js";
+import { WakePoker, wakeHubFor } from "./wake-hub.js";
 import { livePin, modelWatchPass } from "./model-catalog.js";
 import { runModelsCommand } from "./models-cli.js";
 import { ALL_PROJECTS, chatApprovalSettings, chatApprovalWords, setChatApproval } from "./chat-approval.js";
@@ -598,6 +601,9 @@ Agents — which provider and model each phase runs on
       [--model <m>] [--weekly-usd <n>] [--daily-turns <n>] --as <you> --token <t>
       membership providers reuse a logged-in local harness with no dollar
       maximum; direct API providers require a key and weekly dollar ceiling
+  toolroll config set|clear|show quick-answers --as <you> --token <t>
+      quick answers on (set) or off (clear): plain status questions go to a
+      faster model on the Claude membership; changes stay on the main model
   toolroll chat --as <you> [--repo <path>…] [--say "…"] [--end]
       [--ceiling-usd <n>] [--json]                 (password at the prompt;
       --token <t> only for scripts — it lands in shell history)
@@ -5101,6 +5107,9 @@ async function configCommand(positional, flags, context) {
         return fail(write, json, "config", "usage", `unknown \`config ${action}\` — try ${CONFIG_ACTIONS.join(", ")}`, EXIT.usage);
     const repoGiven = text(flags, "repo");
     const scope = repoGiven === undefined ? INSTALLATION_SCOPE : canonicalProject(repoGiven) ?? resolve(repoGiven);
+    // Settings → Lead's "Quick answers use a faster model", the same switch (responsive-chat.md §8).
+    if (phase === "quick-answers")
+        return quickAnswersConfig(action ?? "show", repoGiven !== undefined, flags, context);
     if (action === undefined || action === "show") {
         const installation = store.listPhaseConfig(INSTALLATION_SCOPE);
         const project = scope === INSTALLATION_SCOPE ? [] : store.listPhaseConfig(scope);
@@ -6419,8 +6428,22 @@ async function runWatchLoop(args) {
     // an authority this process no longer holds.
     let leaseLost = false;
     const followController = new AbortController();
+    // The process's one wake poller (wake-hub.ts) replaces every per-loop and per-lane 50 ms read of the wake counter.
+    // It only says "look": every claim still re-proves its fences.
+    const hub = wakeHubFor(store);
+    const wakes = new WakePoker();
     args.onFollowController?.(followController);
-    const stopping = () => args.isStopping() || leaseLost;
+    // The loop or a build lane failed (the store could not be read): everything stops, cleans up, and then the first
+    // failure is thrown. Without this a failed lane skipped the cleanup, and a failed loop left its lanes running.
+    let failed = false;
+    let failure;
+    const fail = (error) => {
+        if (!failed)
+            failure = error;
+        failed = true;
+        wakes.poke();
+    };
+    const stopping = () => args.isStopping() || leaseLost || failed;
     const heartbeat = setInterval(() => {
         let renewed = false;
         let problem = "the lease or credential was taken";
@@ -6433,6 +6456,8 @@ async function runWatchLoop(args) {
         if (!renewed && !leaseLost) {
             leaseLost = true;
             followController.abort();
+            // A lost lease ends every doze of this loop and its lanes now, not at the next beat (live-wakeups.md).
+            wakes.poke();
             progress(`watch: ${runner} on ${repo}: ${problem} — stopping without admitting more work`);
         }
     }, WATCH_HEARTBEAT_MS);
@@ -6487,12 +6512,9 @@ async function runWatchLoop(args) {
     const deadline = runFor === null ? null : startedAt + runFor;
     let lastTick = 0;
     let lastBridge = 0;
-    let lastPush = 0;
-    let lastWebhook = 0;
     let ticks = 0;
     let built = 0;
     let brokeCount = 0;
-    const sleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));
     // Reconciliation has its own cadence and sink. Sharing tick's sink would
     // interleave envelopes while a build awaits its provider or project check.
     const sweepOwner = {};
@@ -6517,8 +6539,12 @@ async function runWatchLoop(args) {
                 throw new Error(maintenanceLines.join(" "));
             if (reconciliationFailure !== null)
                 progress("watch: reconciliation recovered — new work may resume");
+            const recovered = !reconciliationReady;
             reconciliationFailure = null;
             reconciliationReady = true;
+            // Admission resumes now: a loop dozing while paused looks again at once.
+            if (recovered)
+                wakes.poke();
             if (!stopping() && store.openedPublications().length > 0) {
                 try {
                     const checks = await observeChecks(store, {
@@ -6646,6 +6672,9 @@ async function runWatchLoop(args) {
         run: async () => { if (await modelWatchPass(store, context.clock()))
             progress("watch: checked models and CLI versions"); },
     });
+    // The process's delivery and fast CI beats (live-wakeups.md): one set however many project loops run.
+    // The fast CI pass runs only while this loop would admit work: not stopping, reconciled, and no update drain.
+    const leaveServiceBeats = joinServiceBeats({ context, progress, ciReady: () => !admissionStopped() });
     // Parallel builds (project-concurrency.ts): this loop is the project's
     // first build lane and keeps every housekeeping duty; extra lanes, up to
     // the project's own number (never past the worker's capacity), only
@@ -6721,16 +6750,16 @@ async function runWatchLoop(args) {
             const seqIdle = store.wakeSeq();
             const dozeUntil = Math.min(Date.now() + tickEveryMs, deadline ?? Number.MAX_SAFE_INTEGER);
             const theirTurnEnded = () => yieldingTo !== null && yieldingSince !== null && passes.lastPass(yieldingTo) > yieldingSince;
-            while (!stopping() && Date.now() < dozeUntil && store.wakeSeq() === seqIdle && !theirTurnEnded()) {
-                await sleep(paused() ? 250 : 50);
-            }
+            // Doze on the shared poller: a wake, the cadence, a stop, a lost lease or the fair-share turn ending.
+            await hub.changed({ baseline: seqIdle, deadline: dozeUntil, until: () => stopping() || theirTurnEnded(), poker: wakes });
         }
     };
     const ensureLanes = () => {
         const facts = slotFacts(null);
         const wanted = effectiveConcurrency(facts.limitOf(repo), facts.capacity);
+        // A lane never rejects: its failure is kept, every doze is woken, and the loop's own cleanup runs before it is thrown.
         while (lanes.length + 1 < wanted && !stopping())
-            lanes.push(buildLane(lanes.length + 1));
+            lanes.push(buildLane(lanes.length + 1).catch(fail));
     };
     let firstLaneYieldingSince = null;
     let firstLaneYieldingTo = null;
@@ -6739,7 +6768,9 @@ async function runWatchLoop(args) {
         await maintenance.runNow();
         while (!stopping() && (deadline === null || Date.now() < deadline)) {
             if (paused()) {
-                await sleep(250);
+                // Paused: look again when the wake moves (pause and resume bump it), when reconciliation recovers (a poke),
+                // or after a second at most, whichever comes first.
+                await hub.changed({ baseline: store.wakeSeq(), deadline: Date.now() + 1_000, until: stopping, poker: wakes });
                 continue;
             }
             ensureLanes();
@@ -6809,25 +6840,8 @@ async function runWatchLoop(args) {
                         (published.failed > 0 ? `, gave up on ${published.failed}` : ""));
                 }
             }
-            // Push rides its OWN cadence, whether or not Telegram holds the wire
-            // (arc 3 finding 8): the pair ledger's claims fence concurrent loops.
-            if (now - lastPush >= 45_000) {
-                lastPush = now;
-                try {
-                    await pushPass(context.store, { configDir: dirname(context.databaseFile), clock: () => new Date() });
-                }
-                catch {
-                    // Push is additive; a broken pass never stops the watch.
-                }
-            }
-            if (now - lastWebhook >= bridgeEveryMs) {
-                lastWebhook = now;
-                const dir = dirname(context.databaseFile);
-                const primary = effectivePrimary(process.env, dir, loadBotToken(process.env, context.telegramTokenFile) !== null);
-                const targets = activeWebhookTargets(process.env, dir, primary.channel);
-                if (targets.length > 0)
-                    await webhookPass(store, { targets, consoleUrl: loadConsoleUrl(process.env, dir), clock: context.clock });
-            }
+            // Web push and outgoing webhooks ride the service's own delivery beat (joinServiceBeats, live-wakeups.md):
+            // every 5 s, and at once when the wake moves with new rows, never behind a build on this path.
             // The embedded follower owns the wire while it lives; the timer-driven
             // pass is the fallback shape for a watch started before a token existed.
             if (follower === null && now - lastBridge >= bridgeEveryMs) {
@@ -6856,7 +6870,7 @@ async function runWatchLoop(args) {
             // due, a signal lands, or the trial window (--for) ends. Reading one
             // integer from SQLite twice a second is the entire idle cost — no
             // token has anywhere to be spent from here.
-            const idleUntil = Math.min(lastTick + tickEveryMs, lastBridge + bridgeEveryMs, lastWebhook + bridgeEveryMs, deadline ?? Number.MAX_SAFE_INTEGER) - Date.now();
+            const idleUntil = Math.min(lastTick + tickEveryMs, lastBridge + bridgeEveryMs, deadline ?? Number.MAX_SAFE_INTEGER) - Date.now();
             // Doze for the WHOLE idle window, waking early only for a signal or a
             // sequence move — not for one 500ms step and then another pass
             // (2026-09-05: that read as two ticks a second, all night, with
@@ -6864,11 +6878,13 @@ async function runWatchLoop(args) {
             const seqIdle = store.wakeSeq();
             const dozeUntil = Date.now() + Math.max(idleUntil, 0);
             const theirTurnEnded = () => firstLaneYieldingTo !== null && firstLaneYieldingSince !== null && passes.lastPass(firstLaneYieldingTo) > firstLaneYieldingSince;
-            while (!stopping() && Date.now() < dozeUntil && store.wakeSeq() === seqIdle && !theirTurnEnded()) {
-                await sleep(50);
-            }
+            await hub.changed({ baseline: seqIdle, deadline: dozeUntil, until: () => stopping() || theirTurnEnded(), poker: wakes });
         }
     }
+    catch (error) {
+        // Kept, not thrown yet: the lanes must see the stop, and the cleanup below must run first.
+        fail(error);
+    }
     finally {
         // Every build lane finishes or hands its attempt back before the
         // loop's lease and episode end.
@@ -6879,6 +6895,7 @@ async function runWatchLoop(args) {
         await flowMoves.stop();
         await flowSteps.stop();
         await modelWatch.stop();
+        await leaveServiceBeats();
         clearInterval(heartbeat);
         followController.abort();
         if (follower !== null)
@@ -6889,6 +6906,8 @@ async function runWatchLoop(args) {
         store.endWatchEpisode(incarnation, { ticks, built, broke: brokeCount }, new Date());
         store.releaseWatchLease(runner, repo, incarnation, new Date());
     }
+    if (failed)
+        throw failure;
     if (leaseLost) {
         return { ok: false, reason: "lease-lost", detail: `the watch lease for ${runner} on ${repo} stopped renewing — another process may have taken this worker over`, ticks, built, broke: brokeCount };
     }
@@ -6958,6 +6977,7 @@ async function watchCommand(flags, context) {
         }
         stopping = true;
         followAbort?.abort();
+        wakeHubFor(context.store).poke();
         graceTimer = setTimeout(hardStop, stopGraceMs);
     };
     process.on("SIGINT", stop);
@@ -10671,6 +10691,8 @@ async function chatCommand(flags, context) {
         ...(context.evidenceRoot === undefined ? {} : { evidenceRoot: context.evidenceRoot }),
         // The console's own address (and its public one): links there read as "the task", "the result", "Settings → Lead".
         appOrigin: [loadConsoleUrl(process.env, dirname(context.databaseFile)), phoneOrigin(process.env, dirname(context.databaseFile))],
+        // A live status line and the answer as it is written, on a real terminal only (tests drive runLeadCli directly).
+        ...(context.leadSeams === undefined && liveTerminalWanted(json, process.env, process.stdout.isTTY === true, () => underAgent(process.env)) ? { liveTerminal: processTerminal() } : {}),
     });
     return result.code;
 }
@@ -12618,6 +12640,8 @@ async function runUpWorkerRole(context, config, port, build) {
         resolveStopped();
         for (const controller of followControllers)
             controller.abort();
+        // Every project loop's doze ends now (wake-hub.ts), not at its next beat.
+        wakeHubFor(store).poke();
         const building = store.liveClaimCount(runnerName, clock());
         if (building > 0) {
             progress(`Stopping: ${building} build(s) running. Waiting up to ${Math.round(config.stopGraceMs / 1000)}s for them to finish; any still running then is saved and resumes when the builder starts again.`);
@@ -14087,3 +14111,191 @@ async function projectFallbackCommand(positional, flags, context) {
         return fail(context.write, context.json, command, "refused", done.problem, EXIT.refused);
     return succeed(context.write, context.json, command, shown(), () => [...words(), "Tasks scoped from now on use this; tasks already approved keep the chain they were approved with."]);
 }
+/** `toolroll config set|clear|show quick-answers`: Settings → Lead's quick-answer switch (responsive-chat.md §8). On
+ * or off is installation-wide, so changing it takes an instance operator's password, as the web page's route does. */
+async function quickAnswersConfig(action, repoGiven, flags, context) {
+    const { store, write, json, clock } = context;
+    const command = `config ${action}`;
+    if (repoGiven)
+        return fail(write, json, command, "usage", "quick answers are installation-wide: no --repo", EXIT.usage);
+    const said = () => {
+        const on = leadQuickAnswersOn(store);
+        const model = quickLeadModel(store);
+        return { payload: { quickAnswers: { on, model } }, lines: () => [on
+                    ? `Quick answers are on: plain status questions are answered by ${modelName(model)}; anything that asks for a change stays on the lead's main model.`
+                    : "Quick answers are off: the lead's main model answers everything."] };
+    };
+    if (action === "show") {
+        const shown = said();
+        return succeed(write, json, command, shown.payload, shown.lines);
+    }
+    const acting = await askCredentials(flags, context);
+    if (acting === null)
+        return fail(write, json, command, "usage", "changing quick answers takes `--as <you> --token <t>`", EXIT.usage);
+    const verified = authenticateApprover(store, acting.name, acting.token);
+    if (!verified.ok || !store.isInstanceOperator(acting.name))
+        return fail(write, json, command, "unauthenticated", "an instance operator changes quick answers, with their password", EXIT.refused);
+    setLeadQuickAnswers(store, action === "set", acting.name, clock());
+    const shown = said();
+    return succeed(write, json, command, shown.payload, shown.lines);
+}
+/** The delivery beat: web push and outgoing webhooks, off the build path. */
+export const DELIVERY_EVERY_MS = 5_000;
+/** The fast CI beat: only while an opened pull request waits on its checks or its merge. */
+export const FAST_CI_EVERY_MS = 30_000;
+/** The most pull requests one fast CI pass reads. */
+export const FAST_CI_LIMIT = 10;
+/** A pull request whose checks read as "none" stays on the fast pass this long after it was last updated: CI that
+ * has not registered yet, not a project without CI, which the 5 minute pass keeps reading. */
+const FAST_CI_NONE_WINDOW_MS = 30 * 60_000;
+const serviceBeats = new WeakMap();
+/** The newest notification id: the delivery beat's high-water mark. */
+function newestNotificationId(store) {
+    return Number(store.handle.prepare("SELECT COALESCE(MAX(id), 0) AS id FROM notification").get()?.["id"] ?? 0);
+}
+/**
+ * The opened pull requests the fast CI pass reads, oldest read or tried (`attempted`) first, at most `limit`: checks not settled (never read,
+ * running, or "none" shortly after an update), or green with its merge still waiting (a merge intent in flight, or a
+ * followed pull request not yet marked ready on its accepted commit). Failing and settled ones stay on the 5 minute pass.
+ */
+export function fastCiWaiting(store, now, limit = FAST_CI_LIMIT, attempted = new Map()) {
+    const waiting = store.openedPublications().filter(publication => {
+        if (publication.prNumber === null)
+            return false;
+        const state = publication.lastCheckState;
+        if (state === null || state === "running")
+            return true;
+        if (state === "none")
+            return now.getTime() - Date.parse(publication.lastCheckAt ?? publication.updatedAt) < FAST_CI_NONE_WINDOW_MS
+                && now.getTime() - Date.parse(publication.updatedAt) < FAST_CI_NONE_WINDOW_MS;
+        if (state !== "passing")
+            return false;
+        const intent = store.mergeIntentFor(publication.id);
+        if (intent !== null && ["pending", "claimed", "waiting-human", "firing"].includes(intent.state))
+            return true;
+        const follow = store.handle.prepare("SELECT flow_card, ready_head, merge_commit FROM pull_request_follow WHERE publication = ?").get(publication.id);
+        return follow !== undefined && follow["flow_card"] == null && follow["merge_commit"] == null && follow["ready_head"] !== publication.headSha;
+    });
+    // Oldest attempt first: a pull request GitHub cannot read still takes its turn, then goes to the back of the line.
+    const last = (one) => {
+        const read = one.lastCheckAt ?? "", tried = attempted.get(one.id) ?? "";
+        return tried > read ? tried : read;
+    };
+    return waiting
+        .sort((a, b) => last(a).localeCompare(last(b)) || a.id - b.id)
+        .slice(0, limit);
+}
+/**
+ * Join this process's service beats: one delivery beat (web push and outgoing webhooks every 5 s, and at once when
+ * the wake moves with new notifications) and one fast CI beat (every 30 s, the existing `observeChecks` reader, only
+ * for pull requests that wait). One set per store, however many project loops join; the last to leave stops them.
+ * Opening a pull request stays on the tick path, and the 5 minute pass alone may set reconciliation ready.
+ */
+export function joinServiceBeats(member) {
+    const store = member.context.store;
+    let beats = serviceBeats.get(store);
+    if (beats === undefined)
+        beats = startServiceBeats(store);
+    beats.members.add(member);
+    const joined = beats;
+    return async () => {
+        if (!joined.members.delete(member) || joined.members.size > 0)
+            return;
+        joined.stopped = true;
+        if (serviceBeats.get(store) === joined)
+            serviceBeats.delete(store);
+        joined.poker.poke();
+        await joined.delivery.stop();
+        await joined.fastCi.stop();
+        await joined.wakeLoop;
+    };
+}
+function startServiceBeats(store) {
+    const anyMember = () => beats.members.values().next().value;
+    let deliveredThrough = newestNotificationId(store);
+    let deliveryProblem = null;
+    // When the fast CI pass last tried each pull request, read or not.
+    const attempted = new Map();
+    const delivery = startMaintenance({
+        intervalMs: DELIVERY_EVERY_MS,
+        shouldStop: () => beats.stopped,
+        onError: error => {
+            const detail = describe(error);
+            if (detail !== deliveryProblem)
+                anyMember()?.progress(`watch: outgoing webhooks failed — ${detail}; they try again in a few seconds`);
+            deliveryProblem = detail;
+        },
+        run: async () => {
+            const member = anyMember();
+            if (member === undefined)
+                return;
+            const { context } = member;
+            const dir = dirname(context.databaseFile);
+            deliveredThrough = newestNotificationId(store);
+            // Push is additive; a broken pass never stops the watch. The pair ledger's claims fence any other sender.
+            try {
+                await pushPass(store, { configDir: dir, clock: () => new Date() });
+            }
+            catch { /* tried again next beat */ }
+            const primary = effectivePrimary(process.env, dir, loadBotToken(process.env, context.telegramTokenFile) !== null);
+            const targets = activeWebhookTargets(process.env, dir, primary.channel);
+            if (targets.length > 0)
+                await webhookPass(store, { targets, consoleUrl: loadConsoleUrl(process.env, dir), clock: context.clock });
+            deliveryProblem = null;
+        },
+    });
+    const fastCi = startMaintenance({
+        intervalMs: FAST_CI_EVERY_MS,
+        shouldStop: () => beats.stopped,
+        // A failed fast pass is skipped: it records nothing and says nothing. The 5 minute pass still reads every PR.
+        onError: () => { },
+        run: async () => {
+            // Every project loop must still stand, read again before each revision, ready mark and merge: a stop, a lost
+            // lease, a failed reconciliation or an update drain that arrives while GitHub answers ends the pass there.
+            const standing = () => !beats.stopped && beats.members.size > 0 && [...beats.members].every(one => one.ciReady());
+            if (!standing())
+                return;
+            const { context, progress } = beats.members.values().next().value;
+            const now = context.clock();
+            const waiting = fastCiWaiting(store, now, FAST_CI_LIMIT, attempted);
+            if (waiting.length === 0)
+                return;
+            // A pull request GitHub would not read keeps its place in line only until the others had their turn.
+            if (attempted.size > 500)
+                attempted.clear();
+            for (const one of waiting)
+                attempted.set(one.id, now.toISOString());
+            const exec = context.publishExec === undefined ? {} : { exec: context.publishExec };
+            const checks = await observeChecks(store, { ...exec, publications: waiting });
+            if (!standing())
+                return;
+            if (checks.failing > 0)
+                progress(`watch: CI is red on ${checks.failing} published PR(s) — the outbox has it`);
+            const followed = await followPullRequests(store, checks.seen, { evidenceRoot: context.evidenceRoot, ...exec, proceed: standing });
+            if (followed.revisions > 0)
+                progress(`watch: filed ${followed.revisions} CI revision(s)`);
+            if (followed.merged > 0)
+                progress(`watch: merged ${followed.merged} pull request(s) whose checks passed`);
+        },
+    });
+    const poker = new WakePoker();
+    const hub = wakeHubFor(store);
+    const beats = { members: new Set(), stopped: false, delivery, fastCi, poker, wakeLoop: Promise.resolve() };
+    // A wake with new notifications sends them now, not at the next beat.
+    beats.wakeLoop = (async () => {
+        while (!beats.stopped) {
+            try {
+                const why = await hub.changed({ baseline: store.wakeSeq(), deadline: Number.MAX_SAFE_INTEGER, until: () => beats.stopped, poker });
+                if (why === "wake" && !beats.stopped && newestNotificationId(store) > deliveredThrough)
+                    void delivery.runNow();
+            }
+            catch {
+                // The store could not be read: the 5 s beat still runs; look again shortly.
+                await new Promise(resolveLater => { const timer = setTimeout(resolveLater, 1_000); timer.unref?.(); });
+            }
+        }
+    })();
+    serviceBeats.set(store, beats);
+    void delivery.runNow();
+    return beats;
+}

package/dist/project-delete.js

@@ -239,6 +239,15 @@ function deleteRows(store, repo, d, now) {
     del("chat_decide_action", IN("task_id"), K);
     del("chat_decide_prompt", IN("task_id"), K);
     del("chat_message_ref", `${IN("decision")} OR ${IN("task_id")} OR ${IN("run")} OR project = ? OR ${IN("notification")} OR ${IN("task_ref")}`, decisions, K, R, repo, notifications, T);
+    // A typed yes to a Start card (one-step-chat.md C5). Its record goes with its message. Where the message stays (it
+    // named no task of this project) but the card's proposal goes, the record is settled instead and forgets the task: a
+    // yes still waiting is then answered by Toolroll as one that started nothing, never handed to the lead.
+    del("chat_typed_start", `provider || ':' || event IN (SELECT value FROM json_each(?))`, conversations);
+    if (tableExists(db, "chat_typed_start")) {
+        db.prepare(`UPDATE chat_typed_start SET outcome = 'not-counted', task_id = NULL, finished = COALESCE(finished, ?) WHERE ${IN("proposal")}`).run(now.toISOString(), proposals);
+        // A yes that started one of this project's tasks, said in a message that stays: the record forgets the task.
+        db.prepare(`UPDATE chat_typed_start SET task_id = NULL WHERE ${IN("task_id")}`).run(K);
+    }
     del("chat_part", `provider || ':' || id IN (${parts})`, conversations, K, R);
     del("chat_event", `provider || ':' || id IN (SELECT value FROM json_each(?))`, conversations);
     del("chat_card_task", IN("task_ref"), T);

package/dist/project-knowledge.d.ts

@@ -22,18 +22,20 @@ export type KnowledgeView = ReturnType<typeof knowledgeView>;
 export declare function knowledgeVersion(store: Store, repo: string, actor: string, revision: number): Knowledge;
 /** Chat reads only an admitted project. Keep the full source in the project UI. */
 export declare function conversationKnowledge(store: Store, repo: string, actor: string, reference?: string, decision?: number): {
-    references?: never;
+    content?: never;
+    history?: never;
     revision: number;
     stale: boolean;
     notice: string;
     title?: never;
-    content?: never;
-    history?: never;
     instructions?: never;
+    references?: never;
     decisions?: never;
     waiting?: never;
 } | {
-    references?: never;
+    content?: never;
+    revision?: never;
+    history?: never;
     stale?: never;
     decision: {
         repo: string;
@@ -52,27 +54,25 @@ export declare function conversationKnowledge(store: Store, repo: string, actor:
     afterwards?: string;
     notice: string;
     title?: never;
-    content?: never;
-    revision?: never;
-    history?: never;
     instructions?: never;
+    references?: never;
     decisions?: never;
     waiting?: never;
 } | {
-    references?: never;
+    history?: never;
     stale?: never;
     revision: number;
     title: string;
     content: string;
     notice: string;
-    history?: never;
     instructions?: never;
+    references?: never;
     decisions?: never;
     waiting?: never;
 } | {
+    content?: never;
     stale?: never;
     title?: never;
-    content?: never;
     revision: number;
     history: {
         revision: number;

package/dist/publish.d.ts

@@ -107,6 +107,8 @@ export type ObservedPullRequest = {
 export declare function observeChecks(store: Store, options: {
     clock?: () => Date;
     exec?: PublishExec;
+    /** Read only these (the fast pass's waiting pull requests, live-wakeups.md); every one is read exactly as below. */
+    publications?: readonly Publication[];
 }): Promise<CheckReport>;
 export declare const MERGE_LEASE_MS: number;
 export declare const FIRING_GRACE_MS: number;

package/dist/publish.js

@@ -304,7 +304,7 @@ export async function observeChecks(store, options) {
     const clock = options.clock ?? (() => new Date());
     const exec = options.exec ?? execRun;
     const report = { observed: 0, failing: 0, resolved: 0, problems: [], seen: [] };
-    for (const publication of store.openedPublications()) {
+    for (const publication of options.publications ?? store.openedPublications()) {
         if (publication.prNumber === null)
             continue;
         // The observation generation is RESERVED before the network call

package/dist/pull-request-flow.d.ts

@@ -129,6 +129,8 @@ export declare function followPullRequests(store: Store, seen: readonly Observed
     evidenceRoot: string;
     exec?: PublishExec;
     clock?: () => Date;
+    /** Asked again before each revision, ready mark and merge: false ends the pass there and writes nothing more. */
+    proceed?: () => boolean;
 }): Promise<FollowReport>;
 /** A person's merge: their password first, then the same checked merge. */
 export declare function mergeAsPerson(store: Store, input: {
@@ -156,6 +158,8 @@ export declare function mergePullRequest(store: Store, input: {
     method?: MergeMethod;
     /** Only a person merging by hand may skip waiting for the full check. */
     anyway?: boolean;
+    /** An automatic pass's standing, read in the write that reserves the merge: false refuses ("halted") and merges nothing. */
+    proceed?: () => boolean;
 }): Promise<Result<{
     commit: string | null;
 }>>;

package/dist/pull-request-flow.js

@@ -285,7 +285,10 @@ export async function followPullRequests(store, seen, options) {
     const exec = options.exec ?? execRun;
     const clock = options.clock ?? (() => new Date());
     const report = { revisions: 0, asked: 0, ready: 0, merged: 0, problems: [] };
+    const halted = () => options.proceed?.() === false;
     for (const one of seen) {
+        if (halted())
+            break;
         const publication = one.publication;
         const follow = followOf(store, publication.id);
         // A flow's Pull request zone follows its own PR: green moves the card on, red takes its failure path.
@@ -313,6 +316,8 @@ export async function followPullRequests(store, seen, options) {
             const check = failingChecks(one.rollup)[0] ?? { name: "a check", url: null };
             const skeleton = ciRevisionNote(check.name, pr, one.headOid, "");
             const excerpt = await logExcerpt(exec, publication.githubRepo, check.url, 490 - skeleton.length);
+            if (halted())
+                break;
             const note = ciRevisionNote(check.name, pr, one.headOid, excerpt);
             const request = createHash("sha256").update(`ci-revision ${publication.githubRepo} ${pr} ${one.headOid}`).digest("hex").slice(0, 32);
             const scope = store.getScope(taskId);
@@ -348,11 +353,17 @@ export async function followPullRequests(store, seen, options) {
             const grant = store.publicationGrantFor(store.refById(publication.taskRef)?.repo ?? "");
             updateFollow(store, publication.id, { ready_head: one.headOid }, clock());
             if (grant?.mergeWhenGreen === true && grant.publishOn === "complete") {
-                const merged = await mergePullRequest(store, { runId: publication.run, by: "merge when checks pass", exec, clock });
+                const merged = await mergePullRequest(store, { runId: publication.run, by: "merge when checks pass", exec, clock,
+                    ...(options.proceed === undefined ? {} : { proceed: options.proceed }) });
                 if (merged.ok) {
                     report.merged++;
                     continue;
                 }
+                // Halted before the merge was reserved: the ready mark is taken back so the next pass merges it, and nobody is asked to.
+                if (merged.reason === "halted") {
+                    updateFollow(store, publication.id, { ready_head: follow.readyHead }, clock());
+                    break;
+                }
                 report.problems.push(`PR #${pr}: ${merged.message}`);
             }
             store.enqueueNotification({
@@ -485,6 +496,8 @@ export async function mergePullRequest(store, input) {
     // One merge at a time, each owning its reservation by its token: a second caller is refused, and each releases only its own.
     const token = randomUUID();
     const reserved = store.transact(() => {
+        if (input.proceed?.() === false)
+            return "halted";
         if (refArchived(store, publication.taskRef))
             return "archived";
         if (store.handle.prepare("SELECT 1 FROM hold WHERE task_ref = ? AND owner_id LIKE 'project-delete:%' AND (until IS NULL OR until > ?)").get(publication.taskRef, clock().toISOString()) !== undefined)
@@ -494,6 +507,8 @@ export async function mergePullRequest(store, input) {
         store.handle.prepare("INSERT OR REPLACE INTO merge_in_flight (publication, task_ref, token, by, at) VALUES (?, ?, ?, ?, ?)").run(publication.id, publication.taskRef, token, input.by, clock().toISOString());
         return "ok";
     });
+    if (reserved === "halted")
+        return refuse("halted", "The worker is stopping or paused, so this merge waits for its next pass.");
     if (reserved === "archived")
         return refuse("archived", "This task is put away. Restore it before merging.");
     if (reserved === "deleting")

package/dist/reply-shape.d.ts

@@ -35,6 +35,15 @@ export declare function linkLabel(url: string, appOrigin?: ShapeOptions["appOrig
  * changes nothing.
  */
 export declare function shapeReply(text: string, options?: ShapeOptions): string;
+/**
+ * A reply still being written, shaped with the final reply's presentation policy (docs/plans/responsive-chat.md §2.2),
+ * except that ids are dropped unless the owner asked for them: whether a reply names several of a kind isn't known
+ * until it ends, so a prefix never keeps them on that ground. Presentation, not redaction.
+ */
+export declare function shapeReplyPrefix(text: string, options?: ShapeOptions): string;
+/** The first window of a shaped text of at most `size` characters, cut where a part would be (never inside code, a link,
+ * a bold anchor or an emoji's two halves). A single link longer than the window stays whole, so the caller measures. */
+export declare function shapedWindow(shaped: string, size: number): string;
 /**
  * A long reply split into parts of at most `size` characters, then each part shaped: the cut is made on the reply as
  * written, at a paragraph or line where possible and never inside code, a link or a bold anchor, so no part carries