toolroll 0.9.97 → 0.9.99

package/dist/project-delete.js

@@ -239,6 +239,15 @@ function deleteRows(store, repo, d, now) {
     del("chat_decide_action", IN("task_id"), K);
     del("chat_decide_prompt", IN("task_id"), K);
     del("chat_message_ref", `${IN("decision")} OR ${IN("task_id")} OR ${IN("run")} OR project = ? OR ${IN("notification")} OR ${IN("task_ref")}`, decisions, K, R, repo, notifications, T);
+    // A typed yes to a Start card (one-step-chat.md C5). Its record goes with its message. Where the message stays (it
+    // named no task of this project) but the card's proposal goes, the record is settled instead and forgets the task: a
+    // yes still waiting is then answered by Toolroll as one that started nothing, never handed to the lead.
+    del("chat_typed_start", `provider || ':' || event IN (SELECT value FROM json_each(?))`, conversations);
+    if (tableExists(db, "chat_typed_start")) {
+        db.prepare(`UPDATE chat_typed_start SET outcome = 'not-counted', task_id = NULL, finished = COALESCE(finished, ?) WHERE ${IN("proposal")}`).run(now.toISOString(), proposals);
+        // A yes that started one of this project's tasks, said in a message that stays: the record forgets the task.
+        db.prepare(`UPDATE chat_typed_start SET task_id = NULL WHERE ${IN("task_id")}`).run(K);
+    }
     del("chat_part", `provider || ':' || id IN (${parts})`, conversations, K, R);
     del("chat_event", `provider || ':' || id IN (SELECT value FROM json_each(?))`, conversations);
     del("chat_card_task", IN("task_ref"), T);

package/dist/project-knowledge.d.ts

@@ -22,17 +22,20 @@ export type KnowledgeView = ReturnType<typeof knowledgeView>;
 export declare function knowledgeVersion(store: Store, repo: string, actor: string, revision: number): Knowledge;
 /** Chat reads only an admitted project. Keep the full source in the project UI. */
 export declare function conversationKnowledge(store: Store, repo: string, actor: string, reference?: string, decision?: number): {
+    content?: never;
+    history?: never;
     revision: number;
     stale: boolean;
     notice: string;
     title?: never;
-    content?: never;
-    history?: never;
     instructions?: never;
     references?: never;
     decisions?: never;
     waiting?: never;
 } | {
+    content?: never;
+    revision?: never;
+    history?: never;
     stale?: never;
     decision: {
         repo: string;
@@ -51,28 +54,25 @@ export declare function conversationKnowledge(store: Store, repo: string, actor:
     afterwards?: string;
     notice: string;
     title?: never;
-    content?: never;
-    revision?: never;
-    history?: never;
     instructions?: never;
     references?: never;
     decisions?: never;
     waiting?: never;
 } | {
+    history?: never;
     stale?: never;
     revision: number;
     title: string;
     content: string;
     notice: string;
-    history?: never;
     instructions?: never;
     references?: never;
     decisions?: never;
     waiting?: never;
 } | {
+    content?: never;
     stale?: never;
     title?: never;
-    content?: never;
     revision: number;
     history: {
         revision: number;

package/dist/publish.d.ts

@@ -107,6 +107,8 @@ export type ObservedPullRequest = {
 export declare function observeChecks(store: Store, options: {
     clock?: () => Date;
     exec?: PublishExec;
+    /** Read only these (the fast pass's waiting pull requests, live-wakeups.md); every one is read exactly as below. */
+    publications?: readonly Publication[];
 }): Promise<CheckReport>;
 export declare const MERGE_LEASE_MS: number;
 export declare const FIRING_GRACE_MS: number;

package/dist/publish.js

@@ -304,7 +304,7 @@ export async function observeChecks(store, options) {
     const clock = options.clock ?? (() => new Date());
     const exec = options.exec ?? execRun;
     const report = { observed: 0, failing: 0, resolved: 0, problems: [], seen: [] };
-    for (const publication of store.openedPublications()) {
+    for (const publication of options.publications ?? store.openedPublications()) {
         if (publication.prNumber === null)
             continue;
         // The observation generation is RESERVED before the network call

package/dist/pull-request-flow.d.ts

@@ -129,6 +129,8 @@ export declare function followPullRequests(store: Store, seen: readonly Observed
     evidenceRoot: string;
     exec?: PublishExec;
     clock?: () => Date;
+    /** Asked again before each revision, ready mark and merge: false ends the pass there and writes nothing more. */
+    proceed?: () => boolean;
 }): Promise<FollowReport>;
 /** A person's merge: their password first, then the same checked merge. */
 export declare function mergeAsPerson(store: Store, input: {
@@ -156,6 +158,8 @@ export declare function mergePullRequest(store: Store, input: {
     method?: MergeMethod;
     /** Only a person merging by hand may skip waiting for the full check. */
     anyway?: boolean;
+    /** An automatic pass's standing, read in the write that reserves the merge: false refuses ("halted") and merges nothing. */
+    proceed?: () => boolean;
 }): Promise<Result<{
     commit: string | null;
 }>>;

package/dist/pull-request-flow.js

@@ -285,7 +285,10 @@ export async function followPullRequests(store, seen, options) {
     const exec = options.exec ?? execRun;
     const clock = options.clock ?? (() => new Date());
     const report = { revisions: 0, asked: 0, ready: 0, merged: 0, problems: [] };
+    const halted = () => options.proceed?.() === false;
     for (const one of seen) {
+        if (halted())
+            break;
         const publication = one.publication;
         const follow = followOf(store, publication.id);
         // A flow's Pull request zone follows its own PR: green moves the card on, red takes its failure path.
@@ -313,6 +316,8 @@ export async function followPullRequests(store, seen, options) {
             const check = failingChecks(one.rollup)[0] ?? { name: "a check", url: null };
             const skeleton = ciRevisionNote(check.name, pr, one.headOid, "");
             const excerpt = await logExcerpt(exec, publication.githubRepo, check.url, 490 - skeleton.length);
+            if (halted())
+                break;
             const note = ciRevisionNote(check.name, pr, one.headOid, excerpt);
             const request = createHash("sha256").update(`ci-revision ${publication.githubRepo} ${pr} ${one.headOid}`).digest("hex").slice(0, 32);
             const scope = store.getScope(taskId);
@@ -348,11 +353,17 @@ export async function followPullRequests(store, seen, options) {
             const grant = store.publicationGrantFor(store.refById(publication.taskRef)?.repo ?? "");
             updateFollow(store, publication.id, { ready_head: one.headOid }, clock());
             if (grant?.mergeWhenGreen === true && grant.publishOn === "complete") {
-                const merged = await mergePullRequest(store, { runId: publication.run, by: "merge when checks pass", exec, clock });
+                const merged = await mergePullRequest(store, { runId: publication.run, by: "merge when checks pass", exec, clock,
+                    ...(options.proceed === undefined ? {} : { proceed: options.proceed }) });
                 if (merged.ok) {
                     report.merged++;
                     continue;
                 }
+                // Halted before the merge was reserved: the ready mark is taken back so the next pass merges it, and nobody is asked to.
+                if (merged.reason === "halted") {
+                    updateFollow(store, publication.id, { ready_head: follow.readyHead }, clock());
+                    break;
+                }
                 report.problems.push(`PR #${pr}: ${merged.message}`);
             }
             store.enqueueNotification({
@@ -485,6 +496,8 @@ export async function mergePullRequest(store, input) {
     // One merge at a time, each owning its reservation by its token: a second caller is refused, and each releases only its own.
     const token = randomUUID();
     const reserved = store.transact(() => {
+        if (input.proceed?.() === false)
+            return "halted";
         if (refArchived(store, publication.taskRef))
             return "archived";
         if (store.handle.prepare("SELECT 1 FROM hold WHERE task_ref = ? AND owner_id LIKE 'project-delete:%' AND (until IS NULL OR until > ?)").get(publication.taskRef, clock().toISOString()) !== undefined)
@@ -494,6 +507,8 @@ export async function mergePullRequest(store, input) {
         store.handle.prepare("INSERT OR REPLACE INTO merge_in_flight (publication, task_ref, token, by, at) VALUES (?, ?, ?, ?, ?)").run(publication.id, publication.taskRef, token, input.by, clock().toISOString());
         return "ok";
     });
+    if (reserved === "halted")
+        return refuse("halted", "The worker is stopping or paused, so this merge waits for its next pass.");
     if (reserved === "archived")
         return refuse("archived", "This task is put away. Restore it before merging.");
     if (reserved === "deleting")

package/dist/release-adapters.js

@@ -18,7 +18,8 @@ import { callLabel, readOnlyCall, retryCall, retryingExec, writeWithRecheck } fr
 const sqlite = () => createRequire(import.meta.url)("node:sqlite");
 import { PROTECTION_MINIMUM_CHECKS, PROTECTION_REPORT_ONLY_CHECKS } from "./release.js";
 import { activeUpdateWork } from "./desktop-update-gate.js";
-import { BEFORE_SWAP, gateOwner } from "./release-gate.js";
+import { BEFORE_SWAP, deployActionOf, stoppedWhereNothingChanged } from "./deploy-phase.js";
+import { gateOwner } from "./release-gate.js";
 import { findCliLinks, switchCliLinks } from "./release-links.js";
 import { databasePath, finishReleaseOperation, requireFreshReleaseApproval, openStore, releaseAuthorityOfTask, releaseCarries, releaseOperations, renewReleaseLease, reserveRelease, runReleaseOperation, Store, recordReleaseStep, releaseIssuerGone, takeReleaseLease, } from "./store.js";
 import { acquireDeploymentLock } from "./deploy-lock.js";
@@ -62,8 +63,6 @@ const ownCli = () => {
     const bin = join(dirname(fileURLToPath(import.meta.url)), "bin.js");
     return existsSync(bin) ? [process.execPath, bin] : ["toolroll"];
 };
-/** Journal phases the deployment's finish accepts (scripts/deploy-phases.mjs finish): the new service runs, unproven. */
-const FINISHES_FORWARD = Object.freeze(["started", "healthy"]);
 const cleanEnv = (extra = {}) => {
     const env = { ...process.env, ...extra };
     delete env["NODE_OPTIONS"];
@@ -580,23 +579,40 @@ export function releaseAdapters(options) {
                 const running = (options.processes ?? processes)().filter(one => one.command.includes("deploy-browser.mjs") && one.command.includes(stage));
                 if (running.length > 0)
                     return { ok: false, message: `the deployment is still running (process ${running.map(one => one.pid).join(", ")}); let it finish, then rerun` };
-                // The new service started (deploy-rescue.ts FORWARD_ONLY): recovery refuses to roll it back, so the release
-                // resumes it forward with the deployment's own finish (health, both consoles, leases, then the pause lifted).
+                // The new service was started (the phase table's "forward" rows, deploy-phase.ts): the release resumes it
+                // forward with the deployment's own finish (health, both consoles, leases, then the pause lifted).
                 // Finishing deploys, so the candidate is proven first, as for a deploy.
-                const phase = (() => { try {
+                const journalPhase = () => { try {
                     return object(JSON.parse(readFileSync(join(stage, "deployment.json"), "utf8")))["phase"];
                 }
                 catch {
                     return undefined;
-                } })();
-                if (FINISHES_FORWARD.includes(String(phase))) {
+                } };
+                const phase = journalPhase();
+                if (deployActionOf(phase) === "forward") {
                     const proven = proveCandidate(runId);
-                    if (!proven.ok)
-                        return stopped(stage, proven.message);
-                    const finished = await deployScript(worktree, stage, runId, proven, ["--yes", "--phase", "finish"]);
-                    if (finished.code === 0)
+                    let why;
+                    if (proven.ok) {
+                        const finished = await deployScript(worktree, stage, runId, proven, ["--yes", "--phase", "finish"]);
+                        if (finished.code === 0)
+                            return { ok: true };
+                        why = `${tail(finished)} (the deployment journal is at ${String(phase)}; finishing it forward stopped; ${join(stage, "deployment.json")})`;
+                    }
+                    else
+                        why = proven.message;
+                    // Once the new service was recorded as started, a journal alone never rolls it back: the release stops here.
+                    // Still at "starting" (killed while waiting for the new service; finish only looks, and it did not find it
+                    // running): the deployment's own recovery puts the previous service back, and only when it proves the new
+                    // one gone. That needs no approval of the candidate, exactly as below.
+                    if (journalPhase() !== "starting")
+                        return stopped(stage, why);
+                    const recorded = recordedCommit(runId);
+                    if (recorded === null)
+                        return stopped(stage, why);
+                    const back = await deployScript(worktree, stage, runId, recorded, ["--phase", "recover"]);
+                    if (back.code === 0)
                         return { ok: true };
-                    return stopped(stage, `${tail(finished)} (the deployment journal is at ${String(phase)}; finishing it forward stopped; ${join(stage, "deployment.json")})`);
+                    return stopped(stage, `${why} The previous service was not put back either: ${tail(back)}`);
                 }
                 // Recovery needs no approval, but it runs only the recorded commit's own script, extracted by this runtime.
                 const recorded = recordedCommit(runId);
@@ -642,7 +658,7 @@ export function releaseAdapters(options) {
                 catch {
                     return false;
                 }
-                return phase === "preparing" || phase === "released" || phase === "deployed";
+                return stoppedWhereNothingChanged(phase);
             },
             async cliLinks() { return findCliLinks(); },
             async switchLinks(links, bin, version) {

package/dist/release-gate.d.ts

@@ -18,9 +18,10 @@
  * Anything missing, damaged or contradicting refuses and leaves the pause as it is. Without --yes it only shows the
  * proof; with --yes it lifts that one pause (the owner is checked again inside the same write) and journals it.
  */
+import { BEFORE_SWAP } from "./deploy-phase.js";
 import type { Database } from "./store.js";
-/** The journal phases a deployment passes before it stops the old service (deploy-phases.mjs). */
-export declare const BEFORE_SWAP: readonly string[];
+/** The journal phases a deployment passes before it stops the old service (deploy-phase.ts, the one table). */
+export { BEFORE_SWAP };
 export type GateReleaseWorld = {
     /** The live database file. */
     database: string;
@@ -81,4 +82,3 @@ export type GateReleaseOutcome = {
 };
 /** Prove, then (with `yes`) lift exactly that pause and journal the release in the deployment's own journal. */
 export declare function releaseGate(id: string, world: GateReleaseWorld, yes: boolean): GateReleaseOutcome;
-export {};

package/dist/release-gate.js

@@ -23,8 +23,9 @@ import { join } from "node:path";
 import { durableJson } from "./desktop-update.js";
 import { removeUpdateGate, updateGateOwned } from "./desktop-update-gate.js";
 import { acquireDeploymentLock } from "./deploy-lock.js";
-/** The journal phases a deployment passes before it stops the old service (deploy-phases.mjs). */
-export const BEFORE_SWAP = Object.freeze(["preparing", "admission-paused", "frozen", "backup-verified", "rehearsed"]);
+import { BEFORE_SWAP, RELEASED } from "./deploy-phase.js";
+/** The journal phases a deployment passes before it stops the old service (deploy-phase.ts, the one table). */
+export { BEFORE_SWAP };
 /** Journal fields that only the swap and later phases write. */
 const SWAP_FIELDS = ["stoppingService", "codingBackupBeforeSwap", "migration", "newService", "deployedAt"];
 const GATE_ID = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;
@@ -121,7 +122,9 @@ export function proveBeforeSwap(id, world) {
     if (staged.length > 0)
         return refuse("after-swap", `Process ${staged.map(one => one.pid).join(", ")} runs from the staged runtime ${r.nextRuntime}.`);
     const supervisor = processes.find(one => one.command.includes(`${r.priorRuntime}/controller-service.js`));
-    const worker = processes.find(one => one.command.includes(`${r.priorRuntime}/cli.js up --db ${world.database}`));
+    // The database as a whole argument: an `up` on a path that only begins with this database's is another service's.
+    const upHere = `${r.priorRuntime}/cli.js up --db ${world.database}`;
+    const worker = processes.find(one => one.command.split(upHere).slice(1).some(rest => rest === "" || /^\s/.test(rest)));
     if (supervisor === undefined || worker === undefined)
         return refuse("conflict", `The service is not running from ${r.priorRuntime}, so it can't be shown that the swap never began.`);
     proof.push(`The service runs from ${r.priorRuntime} (process ${supervisor.pid}); nothing runs from the staged runtime, and no deployment is running.`);
@@ -163,7 +166,7 @@ export function releaseGate(id, world, yes) {
             // The owner is checked again within removeUpdateGate's short write transaction.
             removeUpdateGate(db, id);
             durableJson(journalFile, {
-                ...fresh.journal, phase: "released", updatedAt: world.now().toISOString(),
+                ...fresh.journal, phase: RELEASED, updatedAt: world.now().toISOString(),
                 releasedBeforeSwap: { at: world.now().toISOString(), by: "toolroll release --release-gate", from: fresh.journal.phase, proof: fresh.proof },
             });
             return { ok: true, released: true, id, stage: fresh.stage, proof: fresh.proof };

package/dist/release-next.d.ts

@@ -1,3 +1,4 @@
+import { deployActionOf, type DeployAction } from "./deploy-phase.js";
 import { type RescueWorld } from "./deploy-rescue.js";
 import { type GateReleaseWorld } from "./release-gate.js";
 import { type ReleaseJournal } from "./release.js";
@@ -29,9 +30,8 @@ export type SettleWorld = {
     rescue: RescueWorld;
     gate: GateReleaseWorld;
 };
-export type DeployAction = "none" | "lift-pause" | "forward" | "roll-back" | "refuse";
-/** The one action a deployment's journal calls for. */
-export declare function deployActionOf(phase: unknown): DeployAction;
+/** The one action a deployment's journal calls for: a row of the one phase table (deploy-phase.ts). */
+export { deployActionOf, type DeployAction };
 /** Settle what a stopped deployment left, saying what was done. A refusal stops the release before it does anything. */
 export declare function settleDeployment(world: SettleWorld, say: (line: string) => void): Promise<{
     ok: true;

package/dist/release-next.js

@@ -11,8 +11,9 @@
 import { closeSync, mkdirSync, openSync, readdirSync, readFileSync, rmSync, writeSync } from "node:fs";
 import { hostname } from "node:os";
 import { dirname, join } from "node:path";
-import { FORWARD_ONLY, rescueDeployment } from "./deploy-rescue.js";
-import { BEFORE_SWAP, releaseGate } from "./release-gate.js";
+import { deployActionOf } from "./deploy-phase.js";
+import { rescueDeployment } from "./deploy-rescue.js";
+import { releaseGate } from "./release-gate.js";
 import { journalFile, readJournal } from "./release.js";
 import { autoPublishHeld, PUBLISH_ALLOWED_ACTION } from "./release-auto.js";
 import { sameMachineHost } from "./machine-identity.js";
@@ -78,18 +79,8 @@ export async function takeReleaseRun(stateDir, branch, say, seams = {}) {
         await sleep(seams.pollMs ?? 5_000);
     }
 }
-/** The one action a deployment's journal calls for. */
-export function deployActionOf(phase) {
-    if (typeof phase !== "string")
-        return "refuse";
-    if (phase === "released" || phase === "deployed")
-        return "none";
-    if (BEFORE_SWAP.includes(phase))
-        return "lift-pause";
-    if (FORWARD_ONLY.includes(phase))
-        return "forward";
-    return "roll-back";
-}
+/** The one action a deployment's journal calls for: a row of the one phase table (deploy-phase.ts). */
+export { deployActionOf };
 /** Settle what a stopped deployment left, saying what was done. A refusal stops the release before it does anything. */
 export async function settleDeployment(world, say) {
     const open = world.rescue.journals().filter(one => deployActionOf(one.journal?.["phase"]) !== "none");
@@ -99,8 +90,14 @@ export async function settleDeployment(world, say) {
         return { ok: false, message: `${open.length} deployments are unfinished: ${open.map(one => one.stage).join(", ")}. Nothing was changed.` };
     const { stage, journal } = open[0];
     const action = deployActionOf(journal?.["phase"]);
-    if (action === "refuse")
-        return { ok: false, message: `The deployment journal in ${stage} can't be read. Nothing was changed.` };
+    if (action === "refuse") {
+        // A word this version's table does not hold (a newer candidate's, or damage) is never acted on by itself: the
+        // deployment's own recovery knows its own phases, and the person starts it.
+        const phase = journal?.["phase"];
+        return typeof phase === "string"
+            ? { ok: false, message: `The deployment in ${stage} stopped at a step this version doesn't know (${/^[a-z-]{1,40}$/.test(phase) ? phase : "not a plain word"}). Nothing was changed. Its own recovery can decide: \`toolroll release --recover-deploy --yes\`.` }
+            : { ok: false, message: `The deployment journal in ${stage} can't be read. Nothing was changed.` };
+    }
     if (action === "forward") {
         say("Finishing the deployment that was under way.");
         return { ok: true };

package/dist/reply-voice.d.ts

@@ -0,0 +1,23 @@
+export type ReplyVoice = {
+    /** Characters of the shaped reply. */
+    characters: number;
+    sentences: number;
+    /** The `PLAIN_WORDS` rows said outside code, plus "owner" when the reply calls the person "the owner". */
+    internalWords: string[];
+    /** Opens with its own steps or a filler word ("I checked", "Let me", "Sure,") instead of the answer. */
+    narratedOpening: boolean;
+};
+/** A reply longer than this is counted as long in the eval's report. */
+export declare const LONG_REPLY_CHARACTERS = 320;
+export declare function replyVoice(reply: string): ReplyVoice;
+export type VoiceSummary = {
+    answers: number;
+    medianCharacters: number;
+    /** Share of answers over `LONG_REPLY_CHARACTERS`, from 0 to 1. */
+    longShare: number;
+    /** Internal words said, summed over the answers. */
+    internalWords: number;
+    narratedOpenings: number;
+};
+/** One model's answers, summed up for the report. */
+export declare function summarizeVoice(voices: readonly ReplyVoice[]): VoiceSummary;

package/dist/reply-voice.js

@@ -0,0 +1,37 @@
+/**
+ * How a lead reply reads (docs/plans/lead-voice.md, V3): its length, its sentences, the internal words it says and
+ * whether it opens by describing its own steps. Measured on the shaped text a person sees, never the raw reply.
+ * A measure for the lead-answer eval's report; nothing gates on it and no reply is rewritten from it.
+ */
+import { PLAIN_WORDS } from "./plain-words.js";
+import { shapeReply } from "./reply-shape.js";
+/** A reply longer than this is counted as long in the eval's report. */
+export const LONG_REPLY_CHARACTERS = 320;
+const CODE = /```[\s\S]*?(?:```|$)|`[^`\n]+`/g;
+const OWNER_AS_ADDRESS = /(?<![\w-])the\s+owner(?![\w-])/i;
+const NARRATED_OPENING = /^(?:i\s+checked|i\s+looked\s+at|let\s+me|certainly|sure,)/i;
+export function replyVoice(reply) {
+    const shaped = shapeReply(reply);
+    const prose = shaped.replace(CODE, " ");
+    const internalWords = PLAIN_WORDS.filter(one => one.pattern.test(prose)).map(one => one.never);
+    if (OWNER_AS_ADDRESS.test(prose))
+        internalWords.push("owner");
+    return {
+        characters: shaped.length,
+        sentences: prose.split(/(?<=[.!?])\s+|\n+/).filter(part => /[\p{L}\p{N}]/u.test(part)).length,
+        internalWords,
+        narratedOpening: NARRATED_OPENING.test(shaped.trimStart()),
+    };
+}
+/** One model's answers, summed up for the report. */
+export function summarizeVoice(voices) {
+    const sorted = voices.map(one => one.characters).sort((a, b) => a - b);
+    const mid = Math.floor(sorted.length / 2);
+    return {
+        answers: voices.length,
+        medianCharacters: sorted.length === 0 ? 0 : sorted.length % 2 === 1 ? sorted[mid] : (sorted[mid - 1] + sorted[mid]) / 2,
+        longShare: voices.length === 0 ? 0 : voices.filter(one => one.characters > LONG_REPLY_CHARACTERS).length / voices.length,
+        internalWords: voices.reduce((sum, one) => sum + one.internalWords.length, 0),
+        narratedOpenings: voices.filter(one => one.narratedOpening).length,
+    };
+}

package/dist/scope.d.ts

@@ -796,10 +796,15 @@ export declare function fileAndSealUnderMode(store: Store, input: ScopeInput & {
     detail?: string;
 };
 export declare function approve(store: Store, taskId: string, by: string, now: Date, sawDigest: string, token: string, mutation?: Mutation, 
-/** A fast start (fast-start.ts): Build is this same yes, with its marker in the proof. Only that road passes it. */
+/** A fast start (fast-start.ts): Build is this same yes, with its marker in the proof. Only that road passes it.
+ * `typed`: a typed yes to a Start card (one-step-chat.md C5), the message that was the yes, recorded beside the marker. */
 fastStart?: {
     rule: string;
     at: string;
+    typed?: {
+        provider: string;
+        event: string;
+    };
 }, 
 /** A person's own yes in chat (owner's decision, docs/plans/toolroll-cards.md): their tap or signed-in click stands in
  * for a password, so `token` is unused. Every rule below still applies. The caller has proved the person is the one

package/dist/scope.js

@@ -1075,7 +1075,8 @@ export function fileAndSealUnderMode(store, input) {
     });
 }
 export function approve(store, taskId, by, now, sawDigest, token, mutation = {}, 
-/** A fast start (fast-start.ts): Build is this same yes, with its marker in the proof. Only that road passes it. */
+/** A fast start (fast-start.ts): Build is this same yes, with its marker in the proof. Only that road passes it.
+ * `typed`: a typed yes to a Start card (one-step-chat.md C5), the message that was the yes, recorded beside the marker. */
 fastStart, 
 /** A person's own yes in chat (owner's decision, docs/plans/toolroll-cards.md): their tap or signed-in click stands in
  * for a password, so `token` is unused. Every rule below still applies. The caller has proved the person is the one
@@ -1216,7 +1217,7 @@ export const APPROVAL_PROOF = "approval proved";
 export const approvalProofDetail = (at, generation, digest, local) => `${new Date(at).toISOString()} · generation ${generation}${local === undefined ? "" : ` · local ${local.generation} ${local.transport}`} · digest ${digest}`;
 /** A fast start's proof: the v1 record proofDetailOf reads, with the marker. `local` keeps the legacy words
  * localSealStandsSql reads, so a local owner's seal stands on the same rule. */
-const fastProofDetail = (fastStart) => (at, generation, digest, local) => JSON.stringify({ v: 1, at: new Date(at).toISOString(), generation, digest, fastStart, ...(local === undefined ? {} : { local: `proof · local ${local.generation} ${local.transport} · seal` }) });
+const fastProofDetail = ({ typed, ...fastStart }) => (at, generation, digest, local) => JSON.stringify({ v: 1, at: new Date(at).toISOString(), generation, digest, fastStart, ...(typed === undefined ? {} : { typed: { provider: typed.provider, event: typed.event } }), ...(local === undefined ? {} : { local: `proof · local ${local.generation} ${local.transport} · seal` }) });
 /** The proof of THIS approval: the approver's own row for these exact bytes (never another approval's words). */
 export function approvalProofOf(store, taskId, by, digest) {
     const rows = store.handle.prepare("SELECT outcome, detail FROM action_ledger WHERE task_id = ? AND action = ? AND actor = ? ORDER BY id DESC LIMIT 50").all(taskId, APPROVAL_PROOF, by);

package/dist/server/chat.js

@@ -780,7 +780,7 @@ export function createChatHandlers(runtime) {
         const cardJson = String(request.headers["accept"] ?? "").includes("application/json") && !body.has("nonce");
         const cardAnswer = (status, ok, said, taskId = null) => respond(response, status, "application/json", JSON.stringify({ ok, said, taskId }));
         if (principal === null)
-            return cardJson ? cardAnswer(403, false, "Your approver standing changed. Sign in again.") : refuse(response, who, 403, "your approver standing changed — sign in again", back);
+            return cardJson ? cardAnswer(403, false, "Your sign-in changed. Sign in again.") : refuse(response, who, 403, "Your sign-in changed. Sign in again.", back);
         if (op === "dismiss") {
             const dismissed = dismissLeadProposal(store, principal, id, now);
             if (cardJson)
@@ -849,7 +849,7 @@ export function createChatHandlers(runtime) {
             return refuse(response, who, 403, "proposals are confirmed from the browser or the CLI");
         const principal = leadPrincipal(who);
         if (principal === null)
-            return refuse(response, who, 403, "your approver standing changed — sign in again", "/chat");
+            return refuse(response, who, 403, "Your sign-in changed. Sign in again.", "/chat");
         const id = Number(url.pathname.split("/")[2]);
         store.sweepCoordinatorProposals(now);
         const back = body.get("return") === null ? "/chat" : safeReturn(body.get("return"));
@@ -919,7 +919,7 @@ export function createChatHandlers(runtime) {
         if (who.role === "approver" && enabled.billing === "subscription" && unbound) {
             const principal = leadPrincipal(who);
             if (principal === null)
-                return wantsJson ? said(403, "your approver standing changed — sign in again") : refuse(response, who, 403, "your approver standing changed — sign in again", back);
+                return wantsJson ? said(403, "Your sign-in changed. Sign in again.") : refuse(response, who, 403, "Your sign-in changed. Sign in again.", back);
             const sentRequest = body.get("request");
             if (sentRequest !== null && (body.getAll("request").length !== 1 || !/^[a-f0-9]{32}$/.test(sentRequest)))
                 return said(409, "This conversation changed. Reload it before sending your message.");
@@ -961,7 +961,7 @@ export function createChatHandlers(runtime) {
             const requestId = sentRequest ?? randomBytes(16).toString("hex");
             const principal = leadPrincipal(who);
             if (principal === null)
-                return wantsJson ? said(403, "your approver standing changed — sign in again") : refuse(response, who, 403, "your approver standing changed — sign in again", back);
+                return wantsJson ? said(403, "Your sign-in changed. Sign in again.") : refuse(response, who, 403, "Your sign-in changed. Sign in again.", back);
             const message = (body.get("message") ?? "").trim();
             if (message === "" || message.length > LEAD_MESSAGE_MAX_CHARS) {
                 return said(400, `a message is 1 to ${LEAD_MESSAGE_MAX_CHARS} characters`, leadSession.id);

package/dist/server/chrome.js

@@ -726,7 +726,7 @@ export function workToolRows(scoped = false, _offersChat = false, offersCode = f
         { key: "tasks", href: "/tasks", label: "Task list", hint: "everything, filterable by state" },
         { key: "recipes", href: "/recipes", label: "Recipes", hint: "choose, customize, and reuse a workflow" },
         { key: "workbench", href: "/tasks?scope=all", label: "Every project", hint: "every project's tasks in one list" },
-        { key: "ledger", href: "/ledger", label: "Action ledger", hint: "who acted, what happened, and the result" },
+        { key: "ledger", href: "/ledger", label: "Audit log", hint: "who acted, what happened, and the result" },
         { key: "spend", href: "/spend", label: "Spend", hint: "what agent work cost, and monthly budgets" },
     ];
     return scoped ? rows.filter(row => row.key !== "workbench" && row.key !== "spend") : rows;
@@ -737,7 +737,7 @@ export function settingsRows(scoped = false, offersSettings = false) {
         { key: "fleet", href: "/fleet", label: "Fleet", hint: "who is working, and on what" },
         { key: "caps", href: "/caps", label: "Requirements", hint: "tools and credentials builds need" },
         { key: "people", href: "/people", label: "People", hint: "who can sign in, and what they have done" },
-        { key: "mode", href: "/mode", label: "Operating mode", hint: "the signed posture this repository runs under" },
+        { key: "mode", href: "/mode", label: "Operating mode", hint: "how much this project may do without asking" },
         { key: "system", href: "/system", label: "System", hint: "workers, providers, and grants" },
     ];
     return scoped ? rows.filter(row => row.key === "people" || row.key === "settings") : rows;

package/dist/server/home.d.ts

@@ -1,7 +1,7 @@
 /**
  * Home ("/", UI revamp wave B): one sentence that answers "what needs me?", four counts read from the same work index
- * the Tasks list filters (so a count and the list it opens always agree), what waits on this person grouped by what it
- * asks, what is running, and the lead's message box. Reads only: every act keeps its own route and rules (an agent's
+ * the Tasks list filters (so a count and the list it opens always agree), the work in three groups (Waiting on you,
+ * Working, Done; home-groups.ts), and the lead's message box. Reads only: every act keeps its own route and rules (an agent's
  * question is answered through POST /d/<id>/answer, the same one-click act as its own page).
  */
 import type { BrowserHomeView } from "../browser-workspace.js";
@@ -37,5 +37,6 @@ export declare function homeSentence(needs: number, perProject: readonly {
     name: string;
     needs: number;
 }[], scope: string | null, any: boolean): string;
-/** Home's view for one person and scope, from two reads of the work index (what waits, what runs). */
+/** Home's view for one person and scope, from four reads of the work index (what waits on you, what runs, what waits on
+ * Toolroll, what was done), grouped by the one rule every surface shares (home-groups.ts). */
 export declare function homeView(facts: HomeFacts): BrowserHomeView;