toolroll 0.9.97 → 0.9.99

package/dist/lead-tools.js

@@ -17,6 +17,7 @@ import { taskControlOf } from "./task-control.js";
 import { taskWorkSummaryOf } from "./work-summary.js";
 import { assignmentOf, assignmentBrief } from "./assignment.js";
 import { validateScopeText, validateTaskText } from "./task-text.js";
+import { fastRefusalWords } from "./fast-start.js";
 import { conversationKnowledge, knowledgeView } from "./project-knowledge.js";
 import { fixTaskOf, flakyList, flakyShow } from "./flaky.js";
 import { cancelCommitment, CHECK_RESULTS, conditionWords, latestResultRun, recordCommitment, RUN_OUTCOMES, TASK_STATES } from "./lead-commitments.js";
@@ -393,7 +394,7 @@ export function agentsOver(store, taskId, now) {
 export const LEAD_CORE_TOOLS = new Set([
     "find_tools", "get_brief", "recap", "list_repos", "get_project_context", "get_project_activity", "search_project_memory", "get_capabilities",
     "list_tasks", "get_task", "get_result", "get_diff", "get_check_log", "list_decisions", "get_decision",
-    "get_actions", "get_action_status", "propose_action", "propose_task", "propose_scope", "propose_steer",
+    "get_actions", "get_action_status", "propose_action", "propose_task", "propose_start", "propose_scope", "propose_steer",
     "propose_answer", "propose_review", "remember", "ask_owner", "commit_to",
     // The lead's queue verbs: basic, and small enough that deferring them saves almost nothing.
     "queue", "propose_next", "propose_reserve", "propose_hold", "propose_unhold", "propose_cancel",
@@ -596,7 +597,7 @@ const LEAD_TOOL_HANDLERS = {
     },
     get_actions: {
         description: "List shared actions and required inputs. All channels use the same approvals.",
-        handle: () => ({ ok: true, body: { actions: Object.entries(CHAT_ACTIONS).filter(([operation]) => !operation.startsWith('flow_') && !operation.startsWith('subagent_')).map(([operation, value]) => ({ operation, label: value.label, secureReview: value.protected, inputs: CHAT_ACTION_FIELDS[operation].filter(field => field !== 'nonce' && field !== 'files') })), notice: 'Passwords and credentials never belong in a tool call or conversation. Secure review links complete protected actions.' } }),
+        handle: () => ({ ok: true, body: { actions: Object.entries(CHAT_ACTIONS).filter(([operation]) => !operation.startsWith('flow_') && !operation.startsWith('subagent_') && operation !== 'task_start').map(([operation, value]) => ({ operation, label: value.label, secureReview: value.protected, inputs: CHAT_ACTION_FIELDS[operation].filter(field => field !== 'nonce' && field !== 'files') })), notice: 'Passwords and credentials never belong in a tool call or conversation. Secure review links complete protected actions.' } }),
     },
     propose_action: {
         description: "Read get_actions and relevant skills/evidence first. Save an exact-state proposal only; protected or long terms require full secure review.",
@@ -608,6 +609,9 @@ const LEAD_TOOL_HANDLERS = {
                 return { ok: false, message: 'Use propose_flow for flows.' };
             if (operation.startsWith('subagent_'))
                 return { ok: false, message: 'Use propose_subagent for subagents.' };
+            // A Start card is drafted only by propose_start, whose preview comes from the turn loop, never from arguments.
+            if (operation === 'task_start')
+                return { ok: false, message: 'Use propose_start for a small change to start now.' };
             const input = { ...args };
             delete input['operation'];
             if (operation.startsWith('skill_') || operation.startsWith('knowledge_') || operation.startsWith('tool_') || operation === 'mode_revoke' || operation === 'memory_decide') {
@@ -1709,7 +1713,7 @@ const LEAD_TOOL_HANDLERS = {
         },
     },
     search_project_memory: {
-        description: "Search decisions, instructions, references, lessons and the conversations you may read, across your projects. Read-only; cite the kind and id of what you rely on.",
+        description: "Search decisions, instructions, references, lessons and the conversations you may read, across your projects. Read-only; name what you rely on by what it settled ('you chose Postgres in March'); give its kind and id when asked.",
         handle: (ctx, args) => {
             const repo = args['repo'] === undefined ? null : repoPathOf(ctx.who, args['repo']);
             if (args['repo'] !== undefined && repo === null)
@@ -1925,6 +1929,35 @@ const LEAD_TOOL_HANDLERS = {
             return { ok: true, body: { proposal: id, kind: "task", repo: args["repo"], deliverable: report ? "report" : "branch", planning: report ? "not needed for a scout" : planning, awaiting: "the operator's confirmation" } };
         },
     },
+    propose_start: {
+        description: "The person asked for one small, clear change to be done now. Toolroll decides whether it can start right away; if not, you get an ordinary task card. title is the change in their words, one line.",
+        handle: (ctx, args) => {
+            const checked = startInputOf(ctx, args);
+            if (!checked.ok)
+                return { ok: false, message: checked.message };
+            const { repo, repoId, title } = checked.input;
+            // Eligible: a Start card from the loop's own preview (the request names it back; the card checks it is this
+            // person's, this turn's, on chat). Anything else: today's task card, built directly, and why in the body.
+            const prepared = ctx.startPrepared;
+            let why = fastRefusalWords(prepared === undefined ? "classifier" : prepared.eligible ? "classifier" : prepared.reason);
+            if (prepared !== undefined && prepared.eligible) {
+                try {
+                    const action = prepareSharedAction(ctx.store, ctx.who, "task_start", { repo, preview: prepared.preview }, ctx.evidenceRoot, ctx.now, ctx.turn);
+                    const id = ctx.draft("action", { ...action });
+                    if (id === null)
+                        return tooMany();
+                    return { ok: true, body: { proposal: id, kind: "action", label: action.title, startsNow: true, awaiting: "the person's own yes on Start work", executed: false } };
+                }
+                catch (error) {
+                    why = error instanceof Error ? error.message : why;
+                }
+            }
+            const id = ctx.draft("task", { repo, repoId, title, goal: title, not: null, touches: [], acceptance: [{ id: "c1", statement: title, evidence: ["manual-review"] }], planning: "skip", report: false });
+            if (id === null)
+                return tooMany();
+            return { ok: true, body: { proposal: id, kind: "task", repo: repoId, startsNow: false, why, awaiting: "the operator's confirmation" } };
+        },
+    },
     propose_sweep: {
         description: "Several independent items under ONE shared rule set (a bug sweep, a batch of small fixes): 2-20 items, each becomes its own task in its own worktree, started with one approval, at most max_parallel (default 3) at once, each reporting a verdict into one table. brief holds the shared rules every item gets (e.g. reproduce first; 'not reproducible' is a valid result; prove the fix); each item is only its own report. Not for one task, and not for steps that depend on each other.",
         handle: (ctx, args) => {
@@ -2515,3 +2548,33 @@ export function executeLeadTool(ctx, name, args, view) {
 export function toolResultBytes(text) {
     return Buffer.byteLength(JSON.stringify(text), "utf8");
 }
+/** What propose_start may start with, checked before Toolroll asks the classifier (docs/plans/one-step-chat.md C3): the
+ * call's contract, the same memory and capability checks every proposal makes, never a team chat, a project the person
+ * can reach now, and the same text and secret checks as propose_task. The conversation loop runs this, and only then
+ * prepares a preview; the handler runs it again. Invalid input never reaches the classifier. */
+export function startInputOf(ctx, args) {
+    const tool = LEAD_TOOLS.find(one => one.name === "propose_start");
+    if (tool === undefined)
+        return { ok: false, message: "propose_start isn't available." };
+    const read = tool.read(ctx, args);
+    if (!read.ok)
+        return { ok: false, message: read.issues.map(one => one.line).join("\n") };
+    const unchecked = memoryUnsearched(ctx, "propose_start", read.value) ?? capabilitiesUnread(ctx, "propose_start", read.value);
+    if (unchecked !== null && !unchecked.ok)
+        return { ok: false, message: unchecked.message };
+    // A start is the person's own yes in their own chat with you: a shared team chat proposes an ordinary task.
+    if (teamRoomOf(ctx.store, ctx.thread) !== null)
+        return { ok: false, message: "Starting work in one step is for the person's own chat. Use propose_task here." };
+    const repo = repoPathOf(ctx.who, read.value["repo"]);
+    if (repo === null || !ctx.store.accountCanAccess(ctx.who.name, repo))
+        return { ok: false, message: "repo must be one of the ids from list_repos" };
+    const title = read.value["title"];
+    if (typeof title !== "string")
+        return { ok: false, message: "title is the change, one line" };
+    const badText = validateTaskText({ title, goal: title, outOfScope: null });
+    if (badText !== null)
+        return { ok: false, message: badText.message };
+    if (scanForSecrets(title).length > 0)
+        return { ok: false, message: "Task text cannot contain credentials." };
+    return { ok: true, input: { repo, repoId: String(read.value["repo"]), title } };
+}

package/dist/lead-voice.js

@@ -11,7 +11,7 @@ import { BATCH_MS, chatText, chatTitle } from "./chat-voice.js";
 import { BUILT_IN, refArchived } from "./store.js";
 import { leadNameOf } from "./lead-identity.js";
 import { leadLapsed } from "./task-status.js";
-import { phoneText as plain } from "./telegram-status.js";
+import { publicChatText as plain } from "./chat-display.js";
 export const LEAD_SAY_KIND = "lead-say";
 /** Repaints the owner's task card when the lead takes a task on: it never makes a new message in quiet chat. */
 export const LEAD_ON_IT_KIND = "lead-on-it";

package/dist/lead.js

@@ -9,7 +9,8 @@ import { LEAD_MAX_CALLS_PER_STEP, LEAD_MAX_STEPS, LEAD_TOOL_RESULT_CAP_BYTES, TU
 import { redactSecretLines, scanForSecrets } from "./evidence.js";
 import { redactSecretAssignments } from "./builder.js";
 import { LEAD_CONTRACT } from "./lead-contract.js";
-import { LEAD_CORE_TOOLS, LEAD_MAX_PROPOSALS_PER_TURN, LEAD_TOOL_SCHEMAS, executeLeadTool, isLeadTool, leadViewContextFor, projectLabelForLead, redactForLead, toolResultBytes } from "./lead-tools.js";
+import { LEAD_CORE_TOOLS, LEAD_MAX_PROPOSALS_PER_TURN, LEAD_TOOL_SCHEMAS, executeLeadTool, isLeadTool, leadViewContextFor, projectLabelForLead, redactForLead, startInputOf, toolResultBytes } from "./lead-tools.js";
+import { prepareChatStart } from "./fast-start.js";
 import { composeSubscriptionLeadPrompt, performSubscriptionLeadRequest } from "./subscription-chat.js";
 import { LEAD_REPLY_LIMITS, leadContext } from './lead-context.js';
 import { shortenAsk } from './text-limits.js';
@@ -616,9 +617,24 @@ export async function runLeadTurn(input) {
             progress({ kind: "tool", turn: turnId, step: steps, id: progressId, label: leadToolLabel(call.name) });
             // A registered tool this request did not advertise is refused before it is read or run (the only production
             // caller of executeLeadTool): the model learns the road (find_tools, then the next step) and the reply goes on.
+            const toolContext = () => ({ store, who, now: clock(), draft, selectEvidence, ...(input.replyImage === undefined ? {} : { replyImage: input.replyImage }), step: steps, readDecisions, readResults, searchedMemory, checkedCapabilities, ask, findTools, ...(input.integrations === undefined ? {} : { integrations: input.integrations }), thread: thread.id, turn: turnId, ...(promiseChannelOfTurn(input.channel) === undefined ? {} : { channel: promiseChannelOfTurn(input.channel) }), ...(input.evidenceRoot === undefined ? {} : { evidenceRoot: input.evidenceRoot }), ...(input.mediaDelivery === undefined ? {} : { mediaDelivery: input.mediaDelivery }) });
+            // propose_start (docs/plans/one-step-chat.md C3), after the advertisement gate: its input is validated first (so
+            // invalid input never reaches the classifier), then Toolroll prepares this call's own preview in this turn (up to
+            // the classifier's budget), then the person's standing and the thread are re-proved after that wait, and only then
+            // does the tool run, with the preview in this call's own context. The model's arguments never name it.
+            let startPrepared;
+            if (call.name === "propose_start" && advertisedNames.has(call.name)) {
+                const checked = startInputOf(toolContext(), call.args);
+                if (checked.ok) {
+                    startPrepared = await prepareChatStart(store, { actor: who.name, repo: checked.input.repo, title: checked.input.title, turn: turnId }, clock());
+                    const changed = guard(await revalidated());
+                    if (changed !== null)
+                        return changed;
+                }
+            }
             const outcome = !advertisedNames.has(call.name)
                 ? { ok: false, message: `${call.name} isn't available in this step. Call find_tools with what you want to do; tools it finds can be called from your next step.` }
-                : executeLeadTool({ store, who, now: clock(), draft, selectEvidence, ...(input.replyImage === undefined ? {} : { replyImage: input.replyImage }), step: steps, readDecisions, readResults, searchedMemory, checkedCapabilities, ask, findTools, ...(input.integrations === undefined ? {} : { integrations: input.integrations }), thread: thread.id, turn: turnId, ...(promiseChannelOfTurn(input.channel) === undefined ? {} : { channel: promiseChannelOfTurn(input.channel) }), ...(input.evidenceRoot === undefined ? {} : { evidenceRoot: input.evidenceRoot }), ...(input.mediaDelivery === undefined ? {} : { mediaDelivery: input.mediaDelivery }) }, call.name, call.args, view);
+                : executeLeadTool({ ...toolContext(), ...(startPrepared === undefined ? {} : { startPrepared }) }, call.name, call.args, view);
             let displayOutcome = { state: "succeeded" };
             if (!outcome.ok) {
                 const reason = leadToolFailureReason(call.name, outcome.message);

package/dist/local-owner.js

@@ -181,6 +181,8 @@ export const CHAT_ACTION_LOCAL_ACTS = Object.freeze({
     result_accept: "complete-task",
     task_cancel: "stop-run",
     task_resume: "resume-run",
+    // A Start card: the fast start's own act (approve() allows it only with a fast marker).
+    task_start: "build-now",
 });
 /** Every task card operation (chat-task-actions.ts), decided for the local owner. */
 export const CHAT_TASK_ACTION_LOCAL_ACTS = Object.freeze({

package/dist/one-step-chat-schema.d.ts

@@ -0,0 +1,22 @@
+/**
+ * v159: one-step start from chat (docs/plans/one-step-chat.md). Adds only: a saved row reads as it did. Kept beside
+ * nothing else so the update road can read the lists without the store, and so the version is easy to renumber.
+ *
+ * - `fast_preview.turn`: the lead turn a chat start's preview was prepared in (fast-start.ts prepareChatStart). Saved
+ *   rows read NULL; a chat preview without a turn is unusable, and the form's previews never have one.
+ * - `chat_typed_start` (C5): a typed yes to a Start card, recorded with the inbound message in the transaction that saves
+ *   it (typed-start.ts): which card it answered (the proposal and the chat message that carried it), the card's action
+ *   stamp then, how it was tied to the card (`reply` to it, or the `next` message after it), and once settled, the
+ *   outcome and the task it started. A new table: nothing saved changes. `proposal` is a plain number, not a reference:
+ *   the record has to outlive its card. Ending the chat deletes the card's proposal, and a yes already recorded for it
+ *   must still be answered by Toolroll ("didn't start anything") and never handed to the lead as a new message. Proposal
+ *   ids are never reused (AUTOINCREMENT), so a kept number can't come to name another card.
+ */
+export declare const V159_SCHEMA = "\nCREATE TABLE IF NOT EXISTS chat_typed_start (\n  provider     TEXT NOT NULL CHECK (provider IN ('telegram')),\n  event        TEXT NOT NULL,\n  proposal     INTEGER NOT NULL,\n  card_message TEXT NOT NULL,\n  stamp        TEXT NOT NULL,\n  how          TEXT NOT NULL CHECK (how IN ('reply', 'next')),\n  created      TEXT NOT NULL,\n  outcome      TEXT CHECK (outcome IS NULL OR outcome IN ('started', 'refused', 'not-counted')),\n  task_id      TEXT,\n  finished     TEXT,\n  PRIMARY KEY (provider, event),\n  FOREIGN KEY (provider, event) REFERENCES chat_event(provider, id)\n);\nCREATE INDEX IF NOT EXISTS chat_typed_start_proposal ON chat_typed_start (proposal);\n";
+export declare const V159_ADDED_COLUMNS: Readonly<Record<string, Readonly<Record<string, {
+    definition: string;
+    saved: string;
+}>>>>;
+export declare const V159_TABLES: readonly ["chat_typed_start"];
+/** The v159 migration's steps, in order (a test seam may stop after each). */
+export declare const V159_STEPS: readonly ["one-step-chat-tables", "one-step-chat-columns"];

package/dist/one-step-chat-schema.js

@@ -0,0 +1,37 @@
+/**
+ * v159: one-step start from chat (docs/plans/one-step-chat.md). Adds only: a saved row reads as it did. Kept beside
+ * nothing else so the update road can read the lists without the store, and so the version is easy to renumber.
+ *
+ * - `fast_preview.turn`: the lead turn a chat start's preview was prepared in (fast-start.ts prepareChatStart). Saved
+ *   rows read NULL; a chat preview without a turn is unusable, and the form's previews never have one.
+ * - `chat_typed_start` (C5): a typed yes to a Start card, recorded with the inbound message in the transaction that saves
+ *   it (typed-start.ts): which card it answered (the proposal and the chat message that carried it), the card's action
+ *   stamp then, how it was tied to the card (`reply` to it, or the `next` message after it), and once settled, the
+ *   outcome and the task it started. A new table: nothing saved changes. `proposal` is a plain number, not a reference:
+ *   the record has to outlive its card. Ending the chat deletes the card's proposal, and a yes already recorded for it
+ *   must still be answered by Toolroll ("didn't start anything") and never handed to the lead as a new message. Proposal
+ *   ids are never reused (AUTOINCREMENT), so a kept number can't come to name another card.
+ */
+export const V159_SCHEMA = `
+CREATE TABLE IF NOT EXISTS chat_typed_start (
+  provider     TEXT NOT NULL CHECK (provider IN ('telegram')),
+  event        TEXT NOT NULL,
+  proposal     INTEGER NOT NULL,
+  card_message TEXT NOT NULL,
+  stamp        TEXT NOT NULL,
+  how          TEXT NOT NULL CHECK (how IN ('reply', 'next')),
+  created      TEXT NOT NULL,
+  outcome      TEXT CHECK (outcome IS NULL OR outcome IN ('started', 'refused', 'not-counted')),
+  task_id      TEXT,
+  finished     TEXT,
+  PRIMARY KEY (provider, event),
+  FOREIGN KEY (provider, event) REFERENCES chat_event(provider, id)
+);
+CREATE INDEX IF NOT EXISTS chat_typed_start_proposal ON chat_typed_start (proposal);
+`;
+export const V159_ADDED_COLUMNS = Object.freeze({
+    fast_preview: { turn: { definition: "INTEGER", saved: "NULL" } },
+});
+export const V159_TABLES = Object.freeze(["chat_typed_start"]);
+/** The v159 migration's steps, in order (a test seam may stop after each). */
+export const V159_STEPS = Object.freeze(["one-step-chat-tables", "one-step-chat-columns"]);

package/dist/operate.d.ts

@@ -5,7 +5,7 @@ import { type TriggerIo } from "./flow-triggers.js";
 import { type GhRead } from "./nightly-github.js";
 import type { StepIo } from "./flow-steps.js";
 import type { FetchLike } from "./flow-share.js";
-import { type Store } from "./store.js";
+import { type Store, type Publication } from "./store.js";
 import { type LaptopSeams } from "./laptop-background.js";
 import { type DispatchAdapter } from "./sync.js";
 import { type ParentToRole, type RolePort, type UpRoleStart, type UpStartAuthority } from "./up-processes.js";
@@ -373,3 +373,29 @@ export declare function upLaptopPortCandidates(store: Store, fromSeam?: readonly
 /** The watch loop's background learning pass (docs/plans/learning-loops.md): advisory reads, each project at most every
  * 30 minutes through the plane's own gh. A failure here never reaches the loop: it is tried on the next pass. */
 export declare function refreshLearning(store: Store, now: () => Date, reads?: GhRead): Promise<void>;
+/** A project loop's share in its process's service beats. */
+export type ServiceBeatMember = {
+    context: Context;
+    progress: (line: string) => void;
+    /** This loop's reconciliation stands and it is not stopping: the fast CI pass runs only while every member's does. */
+    ciReady: () => boolean;
+};
+/** The delivery beat: web push and outgoing webhooks, off the build path. */
+export declare const DELIVERY_EVERY_MS = 5000;
+/** The fast CI beat: only while an opened pull request waits on its checks or its merge. */
+export declare const FAST_CI_EVERY_MS = 30000;
+/** The most pull requests one fast CI pass reads. */
+export declare const FAST_CI_LIMIT = 10;
+/**
+ * The opened pull requests the fast CI pass reads, oldest read or tried (`attempted`) first, at most `limit`: checks not settled (never read,
+ * running, or "none" shortly after an update), or green with its merge still waiting (a merge intent in flight, or a
+ * followed pull request not yet marked ready on its accepted commit). Failing and settled ones stay on the 5 minute pass.
+ */
+export declare function fastCiWaiting(store: Store, now: Date, limit?: number, attempted?: ReadonlyMap<number, string>): Publication[];
+/**
+ * Join this process's service beats: one delivery beat (web push and outgoing webhooks every 5 s, and at once when
+ * the wake moves with new notifications) and one fast CI beat (every 30 s, the existing `observeChecks` reader, only
+ * for pull requests that wait). One set per store, however many project loops join; the last to leave stops them.
+ * Opening a pull request stays on the tick path, and the 5 minute pass alone may set reconciliation ready.
+ */
+export declare function joinServiceBeats(member: ServiceBeatMember): () => Promise<void>;

package/dist/operate.js

@@ -281,6 +281,7 @@ import { noticeGitIncidents } from "./git-incident.js";
 import { containmentNotice, containmentStatus, currentContainment, describeContainment, resolveContainment } from "./containment.js";
 import { readPulls } from "./pulls.js";
 import { startMaintenance } from "./maintenance.js";
+import { WakePoker, wakeHubFor } from "./wake-hub.js";
 import { livePin, modelWatchPass } from "./model-catalog.js";
 import { runModelsCommand } from "./models-cli.js";
 import { ALL_PROJECTS, chatApprovalSettings, chatApprovalWords, setChatApproval } from "./chat-approval.js";
@@ -6427,8 +6428,22 @@ async function runWatchLoop(args) {
     // an authority this process no longer holds.
     let leaseLost = false;
     const followController = new AbortController();
+    // The process's one wake poller (wake-hub.ts) replaces every per-loop and per-lane 50 ms read of the wake counter.
+    // It only says "look": every claim still re-proves its fences.
+    const hub = wakeHubFor(store);
+    const wakes = new WakePoker();
     args.onFollowController?.(followController);
-    const stopping = () => args.isStopping() || leaseLost;
+    // The loop or a build lane failed (the store could not be read): everything stops, cleans up, and then the first
+    // failure is thrown. Without this a failed lane skipped the cleanup, and a failed loop left its lanes running.
+    let failed = false;
+    let failure;
+    const fail = (error) => {
+        if (!failed)
+            failure = error;
+        failed = true;
+        wakes.poke();
+    };
+    const stopping = () => args.isStopping() || leaseLost || failed;
     const heartbeat = setInterval(() => {
         let renewed = false;
         let problem = "the lease or credential was taken";
@@ -6441,6 +6456,8 @@ async function runWatchLoop(args) {
         if (!renewed && !leaseLost) {
             leaseLost = true;
             followController.abort();
+            // A lost lease ends every doze of this loop and its lanes now, not at the next beat (live-wakeups.md).
+            wakes.poke();
             progress(`watch: ${runner} on ${repo}: ${problem} — stopping without admitting more work`);
         }
     }, WATCH_HEARTBEAT_MS);
@@ -6495,12 +6512,9 @@ async function runWatchLoop(args) {
     const deadline = runFor === null ? null : startedAt + runFor;
     let lastTick = 0;
     let lastBridge = 0;
-    let lastPush = 0;
-    let lastWebhook = 0;
     let ticks = 0;
     let built = 0;
     let brokeCount = 0;
-    const sleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));
     // Reconciliation has its own cadence and sink. Sharing tick's sink would
     // interleave envelopes while a build awaits its provider or project check.
     const sweepOwner = {};
@@ -6525,8 +6539,12 @@ async function runWatchLoop(args) {
                 throw new Error(maintenanceLines.join(" "));
             if (reconciliationFailure !== null)
                 progress("watch: reconciliation recovered — new work may resume");
+            const recovered = !reconciliationReady;
             reconciliationFailure = null;
             reconciliationReady = true;
+            // Admission resumes now: a loop dozing while paused looks again at once.
+            if (recovered)
+                wakes.poke();
             if (!stopping() && store.openedPublications().length > 0) {
                 try {
                     const checks = await observeChecks(store, {
@@ -6654,6 +6672,9 @@ async function runWatchLoop(args) {
         run: async () => { if (await modelWatchPass(store, context.clock()))
             progress("watch: checked models and CLI versions"); },
     });
+    // The process's delivery and fast CI beats (live-wakeups.md): one set however many project loops run.
+    // The fast CI pass runs only while this loop would admit work: not stopping, reconciled, and no update drain.
+    const leaveServiceBeats = joinServiceBeats({ context, progress, ciReady: () => !admissionStopped() });
     // Parallel builds (project-concurrency.ts): this loop is the project's
     // first build lane and keeps every housekeeping duty; extra lanes, up to
     // the project's own number (never past the worker's capacity), only
@@ -6729,16 +6750,16 @@ async function runWatchLoop(args) {
             const seqIdle = store.wakeSeq();
             const dozeUntil = Math.min(Date.now() + tickEveryMs, deadline ?? Number.MAX_SAFE_INTEGER);
             const theirTurnEnded = () => yieldingTo !== null && yieldingSince !== null && passes.lastPass(yieldingTo) > yieldingSince;
-            while (!stopping() && Date.now() < dozeUntil && store.wakeSeq() === seqIdle && !theirTurnEnded()) {
-                await sleep(paused() ? 250 : 50);
-            }
+            // Doze on the shared poller: a wake, the cadence, a stop, a lost lease or the fair-share turn ending.
+            await hub.changed({ baseline: seqIdle, deadline: dozeUntil, until: () => stopping() || theirTurnEnded(), poker: wakes });
         }
     };
     const ensureLanes = () => {
         const facts = slotFacts(null);
         const wanted = effectiveConcurrency(facts.limitOf(repo), facts.capacity);
+        // A lane never rejects: its failure is kept, every doze is woken, and the loop's own cleanup runs before it is thrown.
         while (lanes.length + 1 < wanted && !stopping())
-            lanes.push(buildLane(lanes.length + 1));
+            lanes.push(buildLane(lanes.length + 1).catch(fail));
     };
     let firstLaneYieldingSince = null;
     let firstLaneYieldingTo = null;
@@ -6747,7 +6768,9 @@ async function runWatchLoop(args) {
         await maintenance.runNow();
         while (!stopping() && (deadline === null || Date.now() < deadline)) {
             if (paused()) {
-                await sleep(250);
+                // Paused: look again when the wake moves (pause and resume bump it), when reconciliation recovers (a poke),
+                // or after a second at most, whichever comes first.
+                await hub.changed({ baseline: store.wakeSeq(), deadline: Date.now() + 1_000, until: stopping, poker: wakes });
                 continue;
             }
             ensureLanes();
@@ -6817,25 +6840,8 @@ async function runWatchLoop(args) {
                         (published.failed > 0 ? `, gave up on ${published.failed}` : ""));
                 }
             }
-            // Push rides its OWN cadence, whether or not Telegram holds the wire
-            // (arc 3 finding 8): the pair ledger's claims fence concurrent loops.
-            if (now - lastPush >= 45_000) {
-                lastPush = now;
-                try {
-                    await pushPass(context.store, { configDir: dirname(context.databaseFile), clock: () => new Date() });
-                }
-                catch {
-                    // Push is additive; a broken pass never stops the watch.
-                }
-            }
-            if (now - lastWebhook >= bridgeEveryMs) {
-                lastWebhook = now;
-                const dir = dirname(context.databaseFile);
-                const primary = effectivePrimary(process.env, dir, loadBotToken(process.env, context.telegramTokenFile) !== null);
-                const targets = activeWebhookTargets(process.env, dir, primary.channel);
-                if (targets.length > 0)
-                    await webhookPass(store, { targets, consoleUrl: loadConsoleUrl(process.env, dir), clock: context.clock });
-            }
+            // Web push and outgoing webhooks ride the service's own delivery beat (joinServiceBeats, live-wakeups.md):
+            // every 5 s, and at once when the wake moves with new rows, never behind a build on this path.
             // The embedded follower owns the wire while it lives; the timer-driven
             // pass is the fallback shape for a watch started before a token existed.
             if (follower === null && now - lastBridge >= bridgeEveryMs) {
@@ -6864,7 +6870,7 @@ async function runWatchLoop(args) {
             // due, a signal lands, or the trial window (--for) ends. Reading one
             // integer from SQLite twice a second is the entire idle cost — no
             // token has anywhere to be spent from here.
-            const idleUntil = Math.min(lastTick + tickEveryMs, lastBridge + bridgeEveryMs, lastWebhook + bridgeEveryMs, deadline ?? Number.MAX_SAFE_INTEGER) - Date.now();
+            const idleUntil = Math.min(lastTick + tickEveryMs, lastBridge + bridgeEveryMs, deadline ?? Number.MAX_SAFE_INTEGER) - Date.now();
             // Doze for the WHOLE idle window, waking early only for a signal or a
             // sequence move — not for one 500ms step and then another pass
             // (2026-09-05: that read as two ticks a second, all night, with
@@ -6872,11 +6878,13 @@ async function runWatchLoop(args) {
             const seqIdle = store.wakeSeq();
             const dozeUntil = Date.now() + Math.max(idleUntil, 0);
             const theirTurnEnded = () => firstLaneYieldingTo !== null && firstLaneYieldingSince !== null && passes.lastPass(firstLaneYieldingTo) > firstLaneYieldingSince;
-            while (!stopping() && Date.now() < dozeUntil && store.wakeSeq() === seqIdle && !theirTurnEnded()) {
-                await sleep(50);
-            }
+            await hub.changed({ baseline: seqIdle, deadline: dozeUntil, until: () => stopping() || theirTurnEnded(), poker: wakes });
         }
     }
+    catch (error) {
+        // Kept, not thrown yet: the lanes must see the stop, and the cleanup below must run first.
+        fail(error);
+    }
     finally {
         // Every build lane finishes or hands its attempt back before the
         // loop's lease and episode end.
@@ -6887,6 +6895,7 @@ async function runWatchLoop(args) {
         await flowMoves.stop();
         await flowSteps.stop();
         await modelWatch.stop();
+        await leaveServiceBeats();
         clearInterval(heartbeat);
         followController.abort();
         if (follower !== null)
@@ -6897,6 +6906,8 @@ async function runWatchLoop(args) {
         store.endWatchEpisode(incarnation, { ticks, built, broke: brokeCount }, new Date());
         store.releaseWatchLease(runner, repo, incarnation, new Date());
     }
+    if (failed)
+        throw failure;
     if (leaseLost) {
         return { ok: false, reason: "lease-lost", detail: `the watch lease for ${runner} on ${repo} stopped renewing — another process may have taken this worker over`, ticks, built, broke: brokeCount };
     }
@@ -6966,6 +6977,7 @@ async function watchCommand(flags, context) {
         }
         stopping = true;
         followAbort?.abort();
+        wakeHubFor(context.store).poke();
         graceTimer = setTimeout(hardStop, stopGraceMs);
     };
     process.on("SIGINT", stop);
@@ -12628,6 +12640,8 @@ async function runUpWorkerRole(context, config, port, build) {
         resolveStopped();
         for (const controller of followControllers)
             controller.abort();
+        // Every project loop's doze ends now (wake-hub.ts), not at its next beat.
+        wakeHubFor(store).poke();
         const building = store.liveClaimCount(runnerName, clock());
         if (building > 0) {
             progress(`Stopping: ${building} build(s) running. Waiting up to ${Math.round(config.stopGraceMs / 1000)}s for them to finish; any still running then is saved and resumes when the builder starts again.`);
@@ -14125,3 +14139,163 @@ async function quickAnswersConfig(action, repoGiven, flags, context) {
     const shown = said();
     return succeed(write, json, command, shown.payload, shown.lines);
 }
+/** The delivery beat: web push and outgoing webhooks, off the build path. */
+export const DELIVERY_EVERY_MS = 5_000;
+/** The fast CI beat: only while an opened pull request waits on its checks or its merge. */
+export const FAST_CI_EVERY_MS = 30_000;
+/** The most pull requests one fast CI pass reads. */
+export const FAST_CI_LIMIT = 10;
+/** A pull request whose checks read as "none" stays on the fast pass this long after it was last updated: CI that
+ * has not registered yet, not a project without CI, which the 5 minute pass keeps reading. */
+const FAST_CI_NONE_WINDOW_MS = 30 * 60_000;
+const serviceBeats = new WeakMap();
+/** The newest notification id: the delivery beat's high-water mark. */
+function newestNotificationId(store) {
+    return Number(store.handle.prepare("SELECT COALESCE(MAX(id), 0) AS id FROM notification").get()?.["id"] ?? 0);
+}
+/**
+ * The opened pull requests the fast CI pass reads, oldest read or tried (`attempted`) first, at most `limit`: checks not settled (never read,
+ * running, or "none" shortly after an update), or green with its merge still waiting (a merge intent in flight, or a
+ * followed pull request not yet marked ready on its accepted commit). Failing and settled ones stay on the 5 minute pass.
+ */
+export function fastCiWaiting(store, now, limit = FAST_CI_LIMIT, attempted = new Map()) {
+    const waiting = store.openedPublications().filter(publication => {
+        if (publication.prNumber === null)
+            return false;
+        const state = publication.lastCheckState;
+        if (state === null || state === "running")
+            return true;
+        if (state === "none")
+            return now.getTime() - Date.parse(publication.lastCheckAt ?? publication.updatedAt) < FAST_CI_NONE_WINDOW_MS
+                && now.getTime() - Date.parse(publication.updatedAt) < FAST_CI_NONE_WINDOW_MS;
+        if (state !== "passing")
+            return false;
+        const intent = store.mergeIntentFor(publication.id);
+        if (intent !== null && ["pending", "claimed", "waiting-human", "firing"].includes(intent.state))
+            return true;
+        const follow = store.handle.prepare("SELECT flow_card, ready_head, merge_commit FROM pull_request_follow WHERE publication = ?").get(publication.id);
+        return follow !== undefined && follow["flow_card"] == null && follow["merge_commit"] == null && follow["ready_head"] !== publication.headSha;
+    });
+    // Oldest attempt first: a pull request GitHub cannot read still takes its turn, then goes to the back of the line.
+    const last = (one) => {
+        const read = one.lastCheckAt ?? "", tried = attempted.get(one.id) ?? "";
+        return tried > read ? tried : read;
+    };
+    return waiting
+        .sort((a, b) => last(a).localeCompare(last(b)) || a.id - b.id)
+        .slice(0, limit);
+}
+/**
+ * Join this process's service beats: one delivery beat (web push and outgoing webhooks every 5 s, and at once when
+ * the wake moves with new notifications) and one fast CI beat (every 30 s, the existing `observeChecks` reader, only
+ * for pull requests that wait). One set per store, however many project loops join; the last to leave stops them.
+ * Opening a pull request stays on the tick path, and the 5 minute pass alone may set reconciliation ready.
+ */
+export function joinServiceBeats(member) {
+    const store = member.context.store;
+    let beats = serviceBeats.get(store);
+    if (beats === undefined)
+        beats = startServiceBeats(store);
+    beats.members.add(member);
+    const joined = beats;
+    return async () => {
+        if (!joined.members.delete(member) || joined.members.size > 0)
+            return;
+        joined.stopped = true;
+        if (serviceBeats.get(store) === joined)
+            serviceBeats.delete(store);
+        joined.poker.poke();
+        await joined.delivery.stop();
+        await joined.fastCi.stop();
+        await joined.wakeLoop;
+    };
+}
+function startServiceBeats(store) {
+    const anyMember = () => beats.members.values().next().value;
+    let deliveredThrough = newestNotificationId(store);
+    let deliveryProblem = null;
+    // When the fast CI pass last tried each pull request, read or not.
+    const attempted = new Map();
+    const delivery = startMaintenance({
+        intervalMs: DELIVERY_EVERY_MS,
+        shouldStop: () => beats.stopped,
+        onError: error => {
+            const detail = describe(error);
+            if (detail !== deliveryProblem)
+                anyMember()?.progress(`watch: outgoing webhooks failed — ${detail}; they try again in a few seconds`);
+            deliveryProblem = detail;
+        },
+        run: async () => {
+            const member = anyMember();
+            if (member === undefined)
+                return;
+            const { context } = member;
+            const dir = dirname(context.databaseFile);
+            deliveredThrough = newestNotificationId(store);
+            // Push is additive; a broken pass never stops the watch. The pair ledger's claims fence any other sender.
+            try {
+                await pushPass(store, { configDir: dir, clock: () => new Date() });
+            }
+            catch { /* tried again next beat */ }
+            const primary = effectivePrimary(process.env, dir, loadBotToken(process.env, context.telegramTokenFile) !== null);
+            const targets = activeWebhookTargets(process.env, dir, primary.channel);
+            if (targets.length > 0)
+                await webhookPass(store, { targets, consoleUrl: loadConsoleUrl(process.env, dir), clock: context.clock });
+            deliveryProblem = null;
+        },
+    });
+    const fastCi = startMaintenance({
+        intervalMs: FAST_CI_EVERY_MS,
+        shouldStop: () => beats.stopped,
+        // A failed fast pass is skipped: it records nothing and says nothing. The 5 minute pass still reads every PR.
+        onError: () => { },
+        run: async () => {
+            // Every project loop must still stand, read again before each revision, ready mark and merge: a stop, a lost
+            // lease, a failed reconciliation or an update drain that arrives while GitHub answers ends the pass there.
+            const standing = () => !beats.stopped && beats.members.size > 0 && [...beats.members].every(one => one.ciReady());
+            if (!standing())
+                return;
+            const { context, progress } = beats.members.values().next().value;
+            const now = context.clock();
+            const waiting = fastCiWaiting(store, now, FAST_CI_LIMIT, attempted);
+            if (waiting.length === 0)
+                return;
+            // A pull request GitHub would not read keeps its place in line only until the others had their turn.
+            if (attempted.size > 500)
+                attempted.clear();
+            for (const one of waiting)
+                attempted.set(one.id, now.toISOString());
+            const exec = context.publishExec === undefined ? {} : { exec: context.publishExec };
+            const checks = await observeChecks(store, { ...exec, publications: waiting });
+            if (!standing())
+                return;
+            if (checks.failing > 0)
+                progress(`watch: CI is red on ${checks.failing} published PR(s) — the outbox has it`);
+            const followed = await followPullRequests(store, checks.seen, { evidenceRoot: context.evidenceRoot, ...exec, proceed: standing });
+            if (followed.revisions > 0)
+                progress(`watch: filed ${followed.revisions} CI revision(s)`);
+            if (followed.merged > 0)
+                progress(`watch: merged ${followed.merged} pull request(s) whose checks passed`);
+        },
+    });
+    const poker = new WakePoker();
+    const hub = wakeHubFor(store);
+    const beats = { members: new Set(), stopped: false, delivery, fastCi, poker, wakeLoop: Promise.resolve() };
+    // A wake with new notifications sends them now, not at the next beat.
+    beats.wakeLoop = (async () => {
+        while (!beats.stopped) {
+            try {
+                const why = await hub.changed({ baseline: store.wakeSeq(), deadline: Number.MAX_SAFE_INTEGER, until: () => beats.stopped, poker });
+                if (why === "wake" && !beats.stopped && newestNotificationId(store) > deliveredThrough)
+                    void delivery.runNow();
+            }
+            catch {
+                // The store could not be read: the 5 s beat still runs; look again shortly.
+                await new Promise(resolveLater => { const timer = setTimeout(resolveLater, 1_000); timer.unref?.(); });
+            }
+        }
+    })();
+    serviceBeats.set(store, beats);
+    void delivery.runNow();
+    return beats;
+}