toolroll 0.9.97 → 0.9.98

package/dist/one-step-chat-schema.d.ts

@@ -0,0 +1,22 @@
+/**
+ * v159: one-step start from chat (docs/plans/one-step-chat.md). Adds only: a saved row reads as it did. Kept beside
+ * nothing else so the update road can read the lists without the store, and so the version is easy to renumber.
+ *
+ * - `fast_preview.turn`: the lead turn a chat start's preview was prepared in (fast-start.ts prepareChatStart). Saved
+ *   rows read NULL; a chat preview without a turn is unusable, and the form's previews never have one.
+ * - `chat_typed_start` (C5): a typed yes to a Start card, recorded with the inbound message in the transaction that saves
+ *   it (typed-start.ts): which card it answered (the proposal and the chat message that carried it), the card's action
+ *   stamp then, how it was tied to the card (`reply` to it, or the `next` message after it), and once settled, the
+ *   outcome and the task it started. A new table: nothing saved changes. `proposal` is a plain number, not a reference:
+ *   the record has to outlive its card. Ending the chat deletes the card's proposal, and a yes already recorded for it
+ *   must still be answered by Toolroll ("didn't start anything") and never handed to the lead as a new message. Proposal
+ *   ids are never reused (AUTOINCREMENT), so a kept number can't come to name another card.
+ */
+export declare const V159_SCHEMA = "\nCREATE TABLE IF NOT EXISTS chat_typed_start (\n  provider     TEXT NOT NULL CHECK (provider IN ('telegram')),\n  event        TEXT NOT NULL,\n  proposal     INTEGER NOT NULL,\n  card_message TEXT NOT NULL,\n  stamp        TEXT NOT NULL,\n  how          TEXT NOT NULL CHECK (how IN ('reply', 'next')),\n  created      TEXT NOT NULL,\n  outcome      TEXT CHECK (outcome IS NULL OR outcome IN ('started', 'refused', 'not-counted')),\n  task_id      TEXT,\n  finished     TEXT,\n  PRIMARY KEY (provider, event),\n  FOREIGN KEY (provider, event) REFERENCES chat_event(provider, id)\n);\nCREATE INDEX IF NOT EXISTS chat_typed_start_proposal ON chat_typed_start (proposal);\n";
+export declare const V159_ADDED_COLUMNS: Readonly<Record<string, Readonly<Record<string, {
+    definition: string;
+    saved: string;
+}>>>>;
+export declare const V159_TABLES: readonly ["chat_typed_start"];
+/** The v159 migration's steps, in order (a test seam may stop after each). */
+export declare const V159_STEPS: readonly ["one-step-chat-tables", "one-step-chat-columns"];

package/dist/one-step-chat-schema.js

@@ -0,0 +1,37 @@
+/**
+ * v159: one-step start from chat (docs/plans/one-step-chat.md). Adds only: a saved row reads as it did. Kept beside
+ * nothing else so the update road can read the lists without the store, and so the version is easy to renumber.
+ *
+ * - `fast_preview.turn`: the lead turn a chat start's preview was prepared in (fast-start.ts prepareChatStart). Saved
+ *   rows read NULL; a chat preview without a turn is unusable, and the form's previews never have one.
+ * - `chat_typed_start` (C5): a typed yes to a Start card, recorded with the inbound message in the transaction that saves
+ *   it (typed-start.ts): which card it answered (the proposal and the chat message that carried it), the card's action
+ *   stamp then, how it was tied to the card (`reply` to it, or the `next` message after it), and once settled, the
+ *   outcome and the task it started. A new table: nothing saved changes. `proposal` is a plain number, not a reference:
+ *   the record has to outlive its card. Ending the chat deletes the card's proposal, and a yes already recorded for it
+ *   must still be answered by Toolroll ("didn't start anything") and never handed to the lead as a new message. Proposal
+ *   ids are never reused (AUTOINCREMENT), so a kept number can't come to name another card.
+ */
+export const V159_SCHEMA = `
+CREATE TABLE IF NOT EXISTS chat_typed_start (
+  provider     TEXT NOT NULL CHECK (provider IN ('telegram')),
+  event        TEXT NOT NULL,
+  proposal     INTEGER NOT NULL,
+  card_message TEXT NOT NULL,
+  stamp        TEXT NOT NULL,
+  how          TEXT NOT NULL CHECK (how IN ('reply', 'next')),
+  created      TEXT NOT NULL,
+  outcome      TEXT CHECK (outcome IS NULL OR outcome IN ('started', 'refused', 'not-counted')),
+  task_id      TEXT,
+  finished     TEXT,
+  PRIMARY KEY (provider, event),
+  FOREIGN KEY (provider, event) REFERENCES chat_event(provider, id)
+);
+CREATE INDEX IF NOT EXISTS chat_typed_start_proposal ON chat_typed_start (proposal);
+`;
+export const V159_ADDED_COLUMNS = Object.freeze({
+    fast_preview: { turn: { definition: "INTEGER", saved: "NULL" } },
+});
+export const V159_TABLES = Object.freeze(["chat_typed_start"]);
+/** The v159 migration's steps, in order (a test seam may stop after each). */
+export const V159_STEPS = Object.freeze(["one-step-chat-tables", "one-step-chat-columns"]);

package/dist/operate.d.ts

@@ -5,7 +5,7 @@ import { type TriggerIo } from "./flow-triggers.js";
 import { type GhRead } from "./nightly-github.js";
 import type { StepIo } from "./flow-steps.js";
 import type { FetchLike } from "./flow-share.js";
-import { type Store } from "./store.js";
+import { type Store, type Publication } from "./store.js";
 import { type LaptopSeams } from "./laptop-background.js";
 import { type DispatchAdapter } from "./sync.js";
 import { type ParentToRole, type RolePort, type UpRoleStart, type UpStartAuthority } from "./up-processes.js";
@@ -373,3 +373,29 @@ export declare function upLaptopPortCandidates(store: Store, fromSeam?: readonly
 /** The watch loop's background learning pass (docs/plans/learning-loops.md): advisory reads, each project at most every
  * 30 minutes through the plane's own gh. A failure here never reaches the loop: it is tried on the next pass. */
 export declare function refreshLearning(store: Store, now: () => Date, reads?: GhRead): Promise<void>;
+/** A project loop's share in its process's service beats. */
+export type ServiceBeatMember = {
+    context: Context;
+    progress: (line: string) => void;
+    /** This loop's reconciliation stands and it is not stopping: the fast CI pass runs only while every member's does. */
+    ciReady: () => boolean;
+};
+/** The delivery beat: web push and outgoing webhooks, off the build path. */
+export declare const DELIVERY_EVERY_MS = 5000;
+/** The fast CI beat: only while an opened pull request waits on its checks or its merge. */
+export declare const FAST_CI_EVERY_MS = 30000;
+/** The most pull requests one fast CI pass reads. */
+export declare const FAST_CI_LIMIT = 10;
+/**
+ * The opened pull requests the fast CI pass reads, oldest read or tried (`attempted`) first, at most `limit`: checks not settled (never read,
+ * running, or "none" shortly after an update), or green with its merge still waiting (a merge intent in flight, or a
+ * followed pull request not yet marked ready on its accepted commit). Failing and settled ones stay on the 5 minute pass.
+ */
+export declare function fastCiWaiting(store: Store, now: Date, limit?: number, attempted?: ReadonlyMap<number, string>): Publication[];
+/**
+ * Join this process's service beats: one delivery beat (web push and outgoing webhooks every 5 s, and at once when
+ * the wake moves with new notifications) and one fast CI beat (every 30 s, the existing `observeChecks` reader, only
+ * for pull requests that wait). One set per store, however many project loops join; the last to leave stops them.
+ * Opening a pull request stays on the tick path, and the 5 minute pass alone may set reconciliation ready.
+ */
+export declare function joinServiceBeats(member: ServiceBeatMember): () => Promise<void>;

package/dist/operate.js

@@ -281,6 +281,7 @@ import { noticeGitIncidents } from "./git-incident.js";
 import { containmentNotice, containmentStatus, currentContainment, describeContainment, resolveContainment } from "./containment.js";
 import { readPulls } from "./pulls.js";
 import { startMaintenance } from "./maintenance.js";
+import { WakePoker, wakeHubFor } from "./wake-hub.js";
 import { livePin, modelWatchPass } from "./model-catalog.js";
 import { runModelsCommand } from "./models-cli.js";
 import { ALL_PROJECTS, chatApprovalSettings, chatApprovalWords, setChatApproval } from "./chat-approval.js";
@@ -6427,8 +6428,22 @@ async function runWatchLoop(args) {
     // an authority this process no longer holds.
     let leaseLost = false;
     const followController = new AbortController();
+    // The process's one wake poller (wake-hub.ts) replaces every per-loop and per-lane 50 ms read of the wake counter.
+    // It only says "look": every claim still re-proves its fences.
+    const hub = wakeHubFor(store);
+    const wakes = new WakePoker();
     args.onFollowController?.(followController);
-    const stopping = () => args.isStopping() || leaseLost;
+    // The loop or a build lane failed (the store could not be read): everything stops, cleans up, and then the first
+    // failure is thrown. Without this a failed lane skipped the cleanup, and a failed loop left its lanes running.
+    let failed = false;
+    let failure;
+    const fail = (error) => {
+        if (!failed)
+            failure = error;
+        failed = true;
+        wakes.poke();
+    };
+    const stopping = () => args.isStopping() || leaseLost || failed;
     const heartbeat = setInterval(() => {
         let renewed = false;
         let problem = "the lease or credential was taken";
@@ -6441,6 +6456,8 @@ async function runWatchLoop(args) {
         if (!renewed && !leaseLost) {
             leaseLost = true;
             followController.abort();
+            // A lost lease ends every doze of this loop and its lanes now, not at the next beat (live-wakeups.md).
+            wakes.poke();
             progress(`watch: ${runner} on ${repo}: ${problem} — stopping without admitting more work`);
         }
     }, WATCH_HEARTBEAT_MS);
@@ -6495,12 +6512,9 @@ async function runWatchLoop(args) {
     const deadline = runFor === null ? null : startedAt + runFor;
     let lastTick = 0;
     let lastBridge = 0;
-    let lastPush = 0;
-    let lastWebhook = 0;
     let ticks = 0;
     let built = 0;
     let brokeCount = 0;
-    const sleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));
     // Reconciliation has its own cadence and sink. Sharing tick's sink would
     // interleave envelopes while a build awaits its provider or project check.
     const sweepOwner = {};
@@ -6525,8 +6539,12 @@ async function runWatchLoop(args) {
                 throw new Error(maintenanceLines.join(" "));
             if (reconciliationFailure !== null)
                 progress("watch: reconciliation recovered — new work may resume");
+            const recovered = !reconciliationReady;
             reconciliationFailure = null;
             reconciliationReady = true;
+            // Admission resumes now: a loop dozing while paused looks again at once.
+            if (recovered)
+                wakes.poke();
             if (!stopping() && store.openedPublications().length > 0) {
                 try {
                     const checks = await observeChecks(store, {
@@ -6654,6 +6672,9 @@ async function runWatchLoop(args) {
         run: async () => { if (await modelWatchPass(store, context.clock()))
             progress("watch: checked models and CLI versions"); },
     });
+    // The process's delivery and fast CI beats (live-wakeups.md): one set however many project loops run.
+    // The fast CI pass runs only while this loop would admit work: not stopping, reconciled, and no update drain.
+    const leaveServiceBeats = joinServiceBeats({ context, progress, ciReady: () => !admissionStopped() });
     // Parallel builds (project-concurrency.ts): this loop is the project's
     // first build lane and keeps every housekeeping duty; extra lanes, up to
     // the project's own number (never past the worker's capacity), only
@@ -6729,16 +6750,16 @@ async function runWatchLoop(args) {
             const seqIdle = store.wakeSeq();
             const dozeUntil = Math.min(Date.now() + tickEveryMs, deadline ?? Number.MAX_SAFE_INTEGER);
             const theirTurnEnded = () => yieldingTo !== null && yieldingSince !== null && passes.lastPass(yieldingTo) > yieldingSince;
-            while (!stopping() && Date.now() < dozeUntil && store.wakeSeq() === seqIdle && !theirTurnEnded()) {
-                await sleep(paused() ? 250 : 50);
-            }
+            // Doze on the shared poller: a wake, the cadence, a stop, a lost lease or the fair-share turn ending.
+            await hub.changed({ baseline: seqIdle, deadline: dozeUntil, until: () => stopping() || theirTurnEnded(), poker: wakes });
         }
     };
     const ensureLanes = () => {
         const facts = slotFacts(null);
         const wanted = effectiveConcurrency(facts.limitOf(repo), facts.capacity);
+        // A lane never rejects: its failure is kept, every doze is woken, and the loop's own cleanup runs before it is thrown.
         while (lanes.length + 1 < wanted && !stopping())
-            lanes.push(buildLane(lanes.length + 1));
+            lanes.push(buildLane(lanes.length + 1).catch(fail));
     };
     let firstLaneYieldingSince = null;
     let firstLaneYieldingTo = null;
@@ -6747,7 +6768,9 @@ async function runWatchLoop(args) {
         await maintenance.runNow();
         while (!stopping() && (deadline === null || Date.now() < deadline)) {
             if (paused()) {
-                await sleep(250);
+                // Paused: look again when the wake moves (pause and resume bump it), when reconciliation recovers (a poke),
+                // or after a second at most, whichever comes first.
+                await hub.changed({ baseline: store.wakeSeq(), deadline: Date.now() + 1_000, until: stopping, poker: wakes });
                 continue;
             }
             ensureLanes();
@@ -6817,25 +6840,8 @@ async function runWatchLoop(args) {
                         (published.failed > 0 ? `, gave up on ${published.failed}` : ""));
                 }
             }
-            // Push rides its OWN cadence, whether or not Telegram holds the wire
-            // (arc 3 finding 8): the pair ledger's claims fence concurrent loops.
-            if (now - lastPush >= 45_000) {
-                lastPush = now;
-                try {
-                    await pushPass(context.store, { configDir: dirname(context.databaseFile), clock: () => new Date() });
-                }
-                catch {
-                    // Push is additive; a broken pass never stops the watch.
-                }
-            }
-            if (now - lastWebhook >= bridgeEveryMs) {
-                lastWebhook = now;
-                const dir = dirname(context.databaseFile);
-                const primary = effectivePrimary(process.env, dir, loadBotToken(process.env, context.telegramTokenFile) !== null);
-                const targets = activeWebhookTargets(process.env, dir, primary.channel);
-                if (targets.length > 0)
-                    await webhookPass(store, { targets, consoleUrl: loadConsoleUrl(process.env, dir), clock: context.clock });
-            }
+            // Web push and outgoing webhooks ride the service's own delivery beat (joinServiceBeats, live-wakeups.md):
+            // every 5 s, and at once when the wake moves with new rows, never behind a build on this path.
             // The embedded follower owns the wire while it lives; the timer-driven
             // pass is the fallback shape for a watch started before a token existed.
             if (follower === null && now - lastBridge >= bridgeEveryMs) {
@@ -6864,7 +6870,7 @@ async function runWatchLoop(args) {
             // due, a signal lands, or the trial window (--for) ends. Reading one
             // integer from SQLite twice a second is the entire idle cost — no
             // token has anywhere to be spent from here.
-            const idleUntil = Math.min(lastTick + tickEveryMs, lastBridge + bridgeEveryMs, lastWebhook + bridgeEveryMs, deadline ?? Number.MAX_SAFE_INTEGER) - Date.now();
+            const idleUntil = Math.min(lastTick + tickEveryMs, lastBridge + bridgeEveryMs, deadline ?? Number.MAX_SAFE_INTEGER) - Date.now();
             // Doze for the WHOLE idle window, waking early only for a signal or a
             // sequence move — not for one 500ms step and then another pass
             // (2026-09-05: that read as two ticks a second, all night, with
@@ -6872,11 +6878,13 @@ async function runWatchLoop(args) {
             const seqIdle = store.wakeSeq();
             const dozeUntil = Date.now() + Math.max(idleUntil, 0);
             const theirTurnEnded = () => firstLaneYieldingTo !== null && firstLaneYieldingSince !== null && passes.lastPass(firstLaneYieldingTo) > firstLaneYieldingSince;
-            while (!stopping() && Date.now() < dozeUntil && store.wakeSeq() === seqIdle && !theirTurnEnded()) {
-                await sleep(50);
-            }
+            await hub.changed({ baseline: seqIdle, deadline: dozeUntil, until: () => stopping() || theirTurnEnded(), poker: wakes });
         }
     }
+    catch (error) {
+        // Kept, not thrown yet: the lanes must see the stop, and the cleanup below must run first.
+        fail(error);
+    }
     finally {
         // Every build lane finishes or hands its attempt back before the
         // loop's lease and episode end.
@@ -6887,6 +6895,7 @@ async function runWatchLoop(args) {
         await flowMoves.stop();
         await flowSteps.stop();
         await modelWatch.stop();
+        await leaveServiceBeats();
         clearInterval(heartbeat);
         followController.abort();
         if (follower !== null)
@@ -6897,6 +6906,8 @@ async function runWatchLoop(args) {
         store.endWatchEpisode(incarnation, { ticks, built, broke: brokeCount }, new Date());
         store.releaseWatchLease(runner, repo, incarnation, new Date());
     }
+    if (failed)
+        throw failure;
     if (leaseLost) {
         return { ok: false, reason: "lease-lost", detail: `the watch lease for ${runner} on ${repo} stopped renewing — another process may have taken this worker over`, ticks, built, broke: brokeCount };
     }
@@ -6966,6 +6977,7 @@ async function watchCommand(flags, context) {
         }
         stopping = true;
         followAbort?.abort();
+        wakeHubFor(context.store).poke();
         graceTimer = setTimeout(hardStop, stopGraceMs);
     };
     process.on("SIGINT", stop);
@@ -12628,6 +12640,8 @@ async function runUpWorkerRole(context, config, port, build) {
         resolveStopped();
         for (const controller of followControllers)
             controller.abort();
+        // Every project loop's doze ends now (wake-hub.ts), not at its next beat.
+        wakeHubFor(store).poke();
         const building = store.liveClaimCount(runnerName, clock());
         if (building > 0) {
             progress(`Stopping: ${building} build(s) running. Waiting up to ${Math.round(config.stopGraceMs / 1000)}s for them to finish; any still running then is saved and resumes when the builder starts again.`);
@@ -14125,3 +14139,163 @@ async function quickAnswersConfig(action, repoGiven, flags, context) {
     const shown = said();
     return succeed(write, json, command, shown.payload, shown.lines);
 }
+/** The delivery beat: web push and outgoing webhooks, off the build path. */
+export const DELIVERY_EVERY_MS = 5_000;
+/** The fast CI beat: only while an opened pull request waits on its checks or its merge. */
+export const FAST_CI_EVERY_MS = 30_000;
+/** The most pull requests one fast CI pass reads. */
+export const FAST_CI_LIMIT = 10;
+/** A pull request whose checks read as "none" stays on the fast pass this long after it was last updated: CI that
+ * has not registered yet, not a project without CI, which the 5 minute pass keeps reading. */
+const FAST_CI_NONE_WINDOW_MS = 30 * 60_000;
+const serviceBeats = new WeakMap();
+/** The newest notification id: the delivery beat's high-water mark. */
+function newestNotificationId(store) {
+    return Number(store.handle.prepare("SELECT COALESCE(MAX(id), 0) AS id FROM notification").get()?.["id"] ?? 0);
+}
+/**
+ * The opened pull requests the fast CI pass reads, oldest read or tried (`attempted`) first, at most `limit`: checks not settled (never read,
+ * running, or "none" shortly after an update), or green with its merge still waiting (a merge intent in flight, or a
+ * followed pull request not yet marked ready on its accepted commit). Failing and settled ones stay on the 5 minute pass.
+ */
+export function fastCiWaiting(store, now, limit = FAST_CI_LIMIT, attempted = new Map()) {
+    const waiting = store.openedPublications().filter(publication => {
+        if (publication.prNumber === null)
+            return false;
+        const state = publication.lastCheckState;
+        if (state === null || state === "running")
+            return true;
+        if (state === "none")
+            return now.getTime() - Date.parse(publication.lastCheckAt ?? publication.updatedAt) < FAST_CI_NONE_WINDOW_MS
+                && now.getTime() - Date.parse(publication.updatedAt) < FAST_CI_NONE_WINDOW_MS;
+        if (state !== "passing")
+            return false;
+        const intent = store.mergeIntentFor(publication.id);
+        if (intent !== null && ["pending", "claimed", "waiting-human", "firing"].includes(intent.state))
+            return true;
+        const follow = store.handle.prepare("SELECT flow_card, ready_head, merge_commit FROM pull_request_follow WHERE publication = ?").get(publication.id);
+        return follow !== undefined && follow["flow_card"] == null && follow["merge_commit"] == null && follow["ready_head"] !== publication.headSha;
+    });
+    // Oldest attempt first: a pull request GitHub cannot read still takes its turn, then goes to the back of the line.
+    const last = (one) => {
+        const read = one.lastCheckAt ?? "", tried = attempted.get(one.id) ?? "";
+        return tried > read ? tried : read;
+    };
+    return waiting
+        .sort((a, b) => last(a).localeCompare(last(b)) || a.id - b.id)
+        .slice(0, limit);
+}
+/**
+ * Join this process's service beats: one delivery beat (web push and outgoing webhooks every 5 s, and at once when
+ * the wake moves with new notifications) and one fast CI beat (every 30 s, the existing `observeChecks` reader, only
+ * for pull requests that wait). One set per store, however many project loops join; the last to leave stops them.
+ * Opening a pull request stays on the tick path, and the 5 minute pass alone may set reconciliation ready.
+ */
+export function joinServiceBeats(member) {
+    const store = member.context.store;
+    let beats = serviceBeats.get(store);
+    if (beats === undefined)
+        beats = startServiceBeats(store);
+    beats.members.add(member);
+    const joined = beats;
+    return async () => {
+        if (!joined.members.delete(member) || joined.members.size > 0)
+            return;
+        joined.stopped = true;
+        if (serviceBeats.get(store) === joined)
+            serviceBeats.delete(store);
+        joined.poker.poke();
+        await joined.delivery.stop();
+        await joined.fastCi.stop();
+        await joined.wakeLoop;
+    };
+}
+function startServiceBeats(store) {
+    const anyMember = () => beats.members.values().next().value;
+    let deliveredThrough = newestNotificationId(store);
+    let deliveryProblem = null;
+    // When the fast CI pass last tried each pull request, read or not.
+    const attempted = new Map();
+    const delivery = startMaintenance({
+        intervalMs: DELIVERY_EVERY_MS,
+        shouldStop: () => beats.stopped,
+        onError: error => {
+            const detail = describe(error);
+            if (detail !== deliveryProblem)
+                anyMember()?.progress(`watch: outgoing webhooks failed — ${detail}; they try again in a few seconds`);
+            deliveryProblem = detail;
+        },
+        run: async () => {
+            const member = anyMember();
+            if (member === undefined)
+                return;
+            const { context } = member;
+            const dir = dirname(context.databaseFile);
+            deliveredThrough = newestNotificationId(store);
+            // Push is additive; a broken pass never stops the watch. The pair ledger's claims fence any other sender.
+            try {
+                await pushPass(store, { configDir: dir, clock: () => new Date() });
+            }
+            catch { /* tried again next beat */ }
+            const primary = effectivePrimary(process.env, dir, loadBotToken(process.env, context.telegramTokenFile) !== null);
+            const targets = activeWebhookTargets(process.env, dir, primary.channel);
+            if (targets.length > 0)
+                await webhookPass(store, { targets, consoleUrl: loadConsoleUrl(process.env, dir), clock: context.clock });
+            deliveryProblem = null;
+        },
+    });
+    const fastCi = startMaintenance({
+        intervalMs: FAST_CI_EVERY_MS,
+        shouldStop: () => beats.stopped,
+        // A failed fast pass is skipped: it records nothing and says nothing. The 5 minute pass still reads every PR.
+        onError: () => { },
+        run: async () => {
+            // Every project loop must still stand, read again before each revision, ready mark and merge: a stop, a lost
+            // lease, a failed reconciliation or an update drain that arrives while GitHub answers ends the pass there.
+            const standing = () => !beats.stopped && beats.members.size > 0 && [...beats.members].every(one => one.ciReady());
+            if (!standing())
+                return;
+            const { context, progress } = beats.members.values().next().value;
+            const now = context.clock();
+            const waiting = fastCiWaiting(store, now, FAST_CI_LIMIT, attempted);
+            if (waiting.length === 0)
+                return;
+            // A pull request GitHub would not read keeps its place in line only until the others had their turn.
+            if (attempted.size > 500)
+                attempted.clear();
+            for (const one of waiting)
+                attempted.set(one.id, now.toISOString());
+            const exec = context.publishExec === undefined ? {} : { exec: context.publishExec };
+            const checks = await observeChecks(store, { ...exec, publications: waiting });
+            if (!standing())
+                return;
+            if (checks.failing > 0)
+                progress(`watch: CI is red on ${checks.failing} published PR(s) — the outbox has it`);
+            const followed = await followPullRequests(store, checks.seen, { evidenceRoot: context.evidenceRoot, ...exec, proceed: standing });
+            if (followed.revisions > 0)
+                progress(`watch: filed ${followed.revisions} CI revision(s)`);
+            if (followed.merged > 0)
+                progress(`watch: merged ${followed.merged} pull request(s) whose checks passed`);
+        },
+    });
+    const poker = new WakePoker();
+    const hub = wakeHubFor(store);
+    const beats = { members: new Set(), stopped: false, delivery, fastCi, poker, wakeLoop: Promise.resolve() };
+    // A wake with new notifications sends them now, not at the next beat.
+    beats.wakeLoop = (async () => {
+        while (!beats.stopped) {
+            try {
+                const why = await hub.changed({ baseline: store.wakeSeq(), deadline: Number.MAX_SAFE_INTEGER, until: () => beats.stopped, poker });
+                if (why === "wake" && !beats.stopped && newestNotificationId(store) > deliveredThrough)
+                    void delivery.runNow();
+            }
+            catch {
+                // The store could not be read: the 5 s beat still runs; look again shortly.
+                await new Promise(resolveLater => { const timer = setTimeout(resolveLater, 1_000); timer.unref?.(); });
+            }
+        }
+    })();
+    serviceBeats.set(store, beats);
+    void delivery.runNow();
+    return beats;
+}

package/dist/project-delete.js

@@ -239,6 +239,15 @@ function deleteRows(store, repo, d, now) {
     del("chat_decide_action", IN("task_id"), K);
     del("chat_decide_prompt", IN("task_id"), K);
     del("chat_message_ref", `${IN("decision")} OR ${IN("task_id")} OR ${IN("run")} OR project = ? OR ${IN("notification")} OR ${IN("task_ref")}`, decisions, K, R, repo, notifications, T);
+    // A typed yes to a Start card (one-step-chat.md C5). Its record goes with its message. Where the message stays (it
+    // named no task of this project) but the card's proposal goes, the record is settled instead and forgets the task: a
+    // yes still waiting is then answered by Toolroll as one that started nothing, never handed to the lead.
+    del("chat_typed_start", `provider || ':' || event IN (SELECT value FROM json_each(?))`, conversations);
+    if (tableExists(db, "chat_typed_start")) {
+        db.prepare(`UPDATE chat_typed_start SET outcome = 'not-counted', task_id = NULL, finished = COALESCE(finished, ?) WHERE ${IN("proposal")}`).run(now.toISOString(), proposals);
+        // A yes that started one of this project's tasks, said in a message that stays: the record forgets the task.
+        db.prepare(`UPDATE chat_typed_start SET task_id = NULL WHERE ${IN("task_id")}`).run(K);
+    }
     del("chat_part", `provider || ':' || id IN (${parts})`, conversations, K, R);
     del("chat_event", `provider || ':' || id IN (SELECT value FROM json_each(?))`, conversations);
     del("chat_card_task", IN("task_ref"), T);

package/dist/project-knowledge.d.ts

@@ -22,17 +22,20 @@ export type KnowledgeView = ReturnType<typeof knowledgeView>;
 export declare function knowledgeVersion(store: Store, repo: string, actor: string, revision: number): Knowledge;
 /** Chat reads only an admitted project. Keep the full source in the project UI. */
 export declare function conversationKnowledge(store: Store, repo: string, actor: string, reference?: string, decision?: number): {
+    content?: never;
+    history?: never;
     revision: number;
     stale: boolean;
     notice: string;
     title?: never;
-    content?: never;
-    history?: never;
     instructions?: never;
     references?: never;
     decisions?: never;
     waiting?: never;
 } | {
+    content?: never;
+    revision?: never;
+    history?: never;
     stale?: never;
     decision: {
         repo: string;
@@ -51,28 +54,25 @@ export declare function conversationKnowledge(store: Store, repo: string, actor:
     afterwards?: string;
     notice: string;
     title?: never;
-    content?: never;
-    revision?: never;
-    history?: never;
     instructions?: never;
     references?: never;
     decisions?: never;
     waiting?: never;
 } | {
+    history?: never;
     stale?: never;
     revision: number;
     title: string;
     content: string;
     notice: string;
-    history?: never;
     instructions?: never;
     references?: never;
     decisions?: never;
     waiting?: never;
 } | {
+    content?: never;
     stale?: never;
     title?: never;
-    content?: never;
     revision: number;
     history: {
         revision: number;

package/dist/publish.d.ts

@@ -107,6 +107,8 @@ export type ObservedPullRequest = {
 export declare function observeChecks(store: Store, options: {
     clock?: () => Date;
     exec?: PublishExec;
+    /** Read only these (the fast pass's waiting pull requests, live-wakeups.md); every one is read exactly as below. */
+    publications?: readonly Publication[];
 }): Promise<CheckReport>;
 export declare const MERGE_LEASE_MS: number;
 export declare const FIRING_GRACE_MS: number;

package/dist/publish.js

@@ -304,7 +304,7 @@ export async function observeChecks(store, options) {
     const clock = options.clock ?? (() => new Date());
     const exec = options.exec ?? execRun;
     const report = { observed: 0, failing: 0, resolved: 0, problems: [], seen: [] };
-    for (const publication of store.openedPublications()) {
+    for (const publication of options.publications ?? store.openedPublications()) {
         if (publication.prNumber === null)
             continue;
         // The observation generation is RESERVED before the network call

package/dist/pull-request-flow.d.ts

@@ -129,6 +129,8 @@ export declare function followPullRequests(store: Store, seen: readonly Observed
     evidenceRoot: string;
     exec?: PublishExec;
     clock?: () => Date;
+    /** Asked again before each revision, ready mark and merge: false ends the pass there and writes nothing more. */
+    proceed?: () => boolean;
 }): Promise<FollowReport>;
 /** A person's merge: their password first, then the same checked merge. */
 export declare function mergeAsPerson(store: Store, input: {
@@ -156,6 +158,8 @@ export declare function mergePullRequest(store: Store, input: {
     method?: MergeMethod;
     /** Only a person merging by hand may skip waiting for the full check. */
     anyway?: boolean;
+    /** An automatic pass's standing, read in the write that reserves the merge: false refuses ("halted") and merges nothing. */
+    proceed?: () => boolean;
 }): Promise<Result<{
     commit: string | null;
 }>>;

package/dist/pull-request-flow.js

@@ -285,7 +285,10 @@ export async function followPullRequests(store, seen, options) {
     const exec = options.exec ?? execRun;
     const clock = options.clock ?? (() => new Date());
     const report = { revisions: 0, asked: 0, ready: 0, merged: 0, problems: [] };
+    const halted = () => options.proceed?.() === false;
     for (const one of seen) {
+        if (halted())
+            break;
         const publication = one.publication;
         const follow = followOf(store, publication.id);
         // A flow's Pull request zone follows its own PR: green moves the card on, red takes its failure path.
@@ -313,6 +316,8 @@ export async function followPullRequests(store, seen, options) {
             const check = failingChecks(one.rollup)[0] ?? { name: "a check", url: null };
             const skeleton = ciRevisionNote(check.name, pr, one.headOid, "");
             const excerpt = await logExcerpt(exec, publication.githubRepo, check.url, 490 - skeleton.length);
+            if (halted())
+                break;
             const note = ciRevisionNote(check.name, pr, one.headOid, excerpt);
             const request = createHash("sha256").update(`ci-revision ${publication.githubRepo} ${pr} ${one.headOid}`).digest("hex").slice(0, 32);
             const scope = store.getScope(taskId);
@@ -348,11 +353,17 @@ export async function followPullRequests(store, seen, options) {
             const grant = store.publicationGrantFor(store.refById(publication.taskRef)?.repo ?? "");
             updateFollow(store, publication.id, { ready_head: one.headOid }, clock());
             if (grant?.mergeWhenGreen === true && grant.publishOn === "complete") {
-                const merged = await mergePullRequest(store, { runId: publication.run, by: "merge when checks pass", exec, clock });
+                const merged = await mergePullRequest(store, { runId: publication.run, by: "merge when checks pass", exec, clock,
+                    ...(options.proceed === undefined ? {} : { proceed: options.proceed }) });
                 if (merged.ok) {
                     report.merged++;
                     continue;
                 }
+                // Halted before the merge was reserved: the ready mark is taken back so the next pass merges it, and nobody is asked to.
+                if (merged.reason === "halted") {
+                    updateFollow(store, publication.id, { ready_head: follow.readyHead }, clock());
+                    break;
+                }
                 report.problems.push(`PR #${pr}: ${merged.message}`);
             }
             store.enqueueNotification({
@@ -485,6 +496,8 @@ export async function mergePullRequest(store, input) {
     // One merge at a time, each owning its reservation by its token: a second caller is refused, and each releases only its own.
     const token = randomUUID();
     const reserved = store.transact(() => {
+        if (input.proceed?.() === false)
+            return "halted";
         if (refArchived(store, publication.taskRef))
             return "archived";
         if (store.handle.prepare("SELECT 1 FROM hold WHERE task_ref = ? AND owner_id LIKE 'project-delete:%' AND (until IS NULL OR until > ?)").get(publication.taskRef, clock().toISOString()) !== undefined)
@@ -494,6 +507,8 @@ export async function mergePullRequest(store, input) {
         store.handle.prepare("INSERT OR REPLACE INTO merge_in_flight (publication, task_ref, token, by, at) VALUES (?, ?, ?, ?, ?)").run(publication.id, publication.taskRef, token, input.by, clock().toISOString());
         return "ok";
     });
+    if (reserved === "halted")
+        return refuse("halted", "The worker is stopping or paused, so this merge waits for its next pass.");
     if (reserved === "archived")
         return refuse("archived", "This task is put away. Restore it before merging.");
     if (reserved === "deleting")

package/dist/reply-voice.d.ts

@@ -0,0 +1,23 @@
+export type ReplyVoice = {
+    /** Characters of the shaped reply. */
+    characters: number;
+    sentences: number;
+    /** The `PLAIN_WORDS` rows said outside code, plus "owner" when the reply calls the person "the owner". */
+    internalWords: string[];
+    /** Opens with its own steps or a filler word ("I checked", "Let me", "Sure,") instead of the answer. */
+    narratedOpening: boolean;
+};
+/** A reply longer than this is counted as long in the eval's report. */
+export declare const LONG_REPLY_CHARACTERS = 320;
+export declare function replyVoice(reply: string): ReplyVoice;
+export type VoiceSummary = {
+    answers: number;
+    medianCharacters: number;
+    /** Share of answers over `LONG_REPLY_CHARACTERS`, from 0 to 1. */
+    longShare: number;
+    /** Internal words said, summed over the answers. */
+    internalWords: number;
+    narratedOpenings: number;
+};
+/** One model's answers, summed up for the report. */
+export declare function summarizeVoice(voices: readonly ReplyVoice[]): VoiceSummary;