toolroll 0.9.98 → 0.9.100

package/dist/coordinator.js

@@ -21,6 +21,7 @@ import { canonicalRepos } from "./runner.js";
 import { fileTaskProposal } from "./proposal.js";
 import { describeScope } from "./scope.js";
 import { reportSummaryFor } from "./lead-tools.js";
+import { claimedNowSql, markedRunningSql } from "./task-moves.js";
 import { taskWorkSummaryOf } from "./work-summary.js";
 import { assignmentOf, assignmentBrief } from "./assignment.js";
 /** Module-private: the ONLY maker, reachable only through the token
@@ -286,8 +287,7 @@ export function statusFor(store, who, now) {
     // finding 6): a live, unexpired, newest-generation claim.
     const running = one(`SELECT COUNT(DISTINCT claim.task_ref) AS n FROM claim
       JOIN task_ref ON task_ref.id = claim.task_ref AND task_ref.backend = 'built-in'
-      WHERE task_ref.repo IN (${sql}) AND claim.released_at IS NULL AND claim.expires_at > ?
-        AND claim.lease_generation = (SELECT MAX(newest.lease_generation) FROM claim AS newest WHERE newest.task_ref = claim.task_ref)`, [now.toISOString()]);
+      WHERE task_ref.repo IN (${sql}) AND ${claimedNowSql}`, [now.toISOString()]);
     const incidents = one(`SELECT COUNT(*) AS n FROM incident JOIN run ON run.id = incident.run
       JOIN task_ref ON task_ref.id = run.task_ref AND task_ref.backend = 'built-in'
       WHERE task_ref.repo IN (${sql}) AND incident.resolved_at IS NULL`);
@@ -298,7 +298,7 @@ export function statusFor(store, who, now) {
     const repos = store.handle
         .prepare(`SELECT task_ref.repo AS repo,
               SUM(CASE WHEN task.state = 'queued' THEN 1 ELSE 0 END) AS queued,
-              SUM(CASE WHEN task.state = 'running' THEN 1 ELSE 0 END) AS running
+              SUM(CASE WHEN ${markedRunningSql} THEN 1 ELSE 0 END) AS running
          FROM task_ref JOIN task ON task.id = task_ref.external_id AND task_ref.backend = 'built-in'
         WHERE task_ref.repo IN (${sql}) GROUP BY task_ref.repo ORDER BY task_ref.repo`)
         .all(...args)

package/dist/demo.js

@@ -1342,7 +1342,7 @@ export function createDemoLead(input) {
                 return id;
         }
     };
-    /** Each stage's store facts, written once, in order. */
+    /** Each stage's store facts, written once, in order. False when the stage can't start (its task was closed). */
     const enterStage = (exchange, stage, at) => {
         const plan = exchange.plan;
         const taskId = exchange.taskId;
@@ -1356,6 +1356,9 @@ export function createDemoLead(input) {
             }
             const route = store.approvedRouteOf(taskId);
             const claimed = acquire(store, ref, CREW, { now: at, token: crewSeen(at), ttlMs: 10 * 60_000 });
+            // A task closed meanwhile (cancelled, say) is not built: no run starts and the story stops here.
+            if (!claimed.ok && (claimed.reason === "closed" || claimed.reason === "no-task"))
+                return false;
             const leaseId = claimed.ok ? claimed.claim.leaseId : `demo-lease-${taskId}`;
             const run = store.startRun({
                 taskRef: ref,
@@ -1379,6 +1382,7 @@ export function createDemoLead(input) {
         }
         if (stage === 3)
             finish(exchange, at);
+        return true;
     };
     const finish = (exchange, at) => {
         const plan = exchange.plan;
@@ -1454,7 +1458,8 @@ export function createDemoLead(input) {
             const current = exchange.stage === null ? -1 : DEMO_STAGES.indexOf(exchange.stage);
             for (let stage = current + 1; stage <= target; stage++) {
                 const at = new Date(exchange.approvedAt + [0, 1, 3, 4][stage] * stepMs);
-                enterStage(exchange, stage, at);
+                if (!enterStage(exchange, stage, at))
+                    break;
                 if (stage < 3)
                     exchange.stage = DEMO_STAGES[stage];
                 else {

package/dist/deploy-phase-data.json

@@ -0,0 +1,21 @@
+{
+  "phases": [
+    { "phase": "preparing", "action": "lift-pause", "flags": ["beforeSwap", "beforePause"] },
+    { "phase": "admission-paused", "action": "lift-pause", "flags": ["beforeSwap"] },
+    { "phase": "frozen", "action": "lift-pause", "flags": ["beforeSwap"] },
+    { "phase": "backup-verified", "action": "lift-pause", "flags": ["beforeSwap"] },
+    { "phase": "rehearsed", "action": "lift-pause", "flags": ["beforeSwap"] },
+    { "phase": "stopping", "action": "roll-back", "flags": [] },
+    { "phase": "stopped", "action": "roll-back", "flags": ["restartable"] },
+    { "phase": "migrating", "action": "roll-back", "flags": ["migrationStarted", "restartable"] },
+    { "phase": "migrated", "action": "roll-back", "flags": ["migrationStarted", "restartable"] },
+    { "phase": "starting", "action": "forward", "flags": [] },
+    { "phase": "started", "action": "forward", "flags": [] },
+    { "phase": "healthy", "action": "forward", "flags": [] },
+    { "phase": "start-failed", "action": "roll-back", "flags": ["migrationStarted", "restartable"] },
+    { "phase": "backup-restored", "action": "roll-back", "flags": ["restartable"] },
+    { "phase": "restored", "action": "roll-back", "flags": [] },
+    { "phase": "released", "action": "none", "flags": [] },
+    { "phase": "deployed", "action": "none", "flags": ["deployed"] }
+  ]
+}

package/dist/deploy-phase.d.ts

@@ -0,0 +1,37 @@
+/** What `toolroll release` does with a deployment that stopped at a phase; "refuse" for a word that is no phase. */
+export type DeployAction = "none" | "lift-pause" | "forward" | "roll-back" | "refuse";
+type RowAction = Exclude<DeployAction, "refuse">;
+type Flag = "beforeSwap" | "beforePause" | "migrationStarted" | "restartable" | "deployed";
+type Row = {
+    readonly phase: string;
+    readonly action: RowAction;
+    readonly flags: readonly Flag[];
+};
+/** The rows of a parsed data file, or an Error naming what is wrong with it. Never a partial table. */
+export declare function deployPhaseRows(data: unknown): readonly Row[];
+/** Every phase, in journal order. */
+export declare const DEPLOY_PHASES: readonly string[];
+export declare const isDeployPhase: (phase: unknown) => phase is string;
+/** The one action a journal's phase calls for; "refuse" for anything that is not a phase. */
+export declare const deployActionOf: (phase: unknown) => DeployAction;
+/** The word itself, or an Error: a journal is never written with a word the table does not hold. */
+export declare function assertDeployPhase(phase: string): string;
+/** The service was never stopped. */
+export declare const BEFORE_SWAP: readonly string[];
+/** Before the swap, with the pause in place. */
+export declare const PAUSED_BEFORE_SWAP: readonly string[];
+/** The candidate's store opened the live database, or the new service ran on it. */
+export declare const MIGRATION_STARTED: readonly string[];
+/** The old service is proved stopped: the previous definition may be started again. */
+export declare const RESTARTABLE: readonly string[];
+/** The new service may be running: never rolled back by a journal alone. */
+export declare const FORWARD_ONLY: readonly string[];
+/** Nothing is left to recover. Not the same as deployed: a released deployment never installed its runtime. */
+export declare const NEEDS_NO_RECOVERY: readonly string[];
+/** The deployment finished and its runtime is the installed one. */
+export declare const isDeployed: (phase: unknown) => boolean;
+/** Stopped where nothing was changed (before its pause), or with nothing left to do. */
+export declare const stoppedWhereNothingChanged: (phase: unknown) => boolean;
+/** The phase a lifted pause leaves behind (release-gate.ts). */
+export declare const RELEASED: string;
+export {};

package/dist/deploy-phase.js

@@ -0,0 +1,64 @@
+/**
+ * The phases of a browser deployment's journal, and what a stopped deployment at each one calls for.
+ *
+ * The rows are data: deploy-phase-data.json beside this file, the one authored list (the build copies it into dist,
+ * scripts/postbuild.mjs). The deploy scripts read the same file through scripts/deploy-phase-table.mjs, where each
+ * column is described. Both sides check its shape the same way; deploy-phase.test.ts holds them to each other and to
+ * its own hand-written expectations.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+const ACTIONS = ["none", "lift-pause", "forward", "roll-back"];
+const FLAGS = ["beforeSwap", "beforePause", "migrationStarted", "restartable", "deployed"];
+/** The rows of a parsed data file, or an Error naming what is wrong with it. Never a partial table. */
+export function deployPhaseRows(data) {
+    const rows = data?.phases;
+    if (!Array.isArray(rows) || rows.length === 0)
+        throw new Error("The deployment phase table has no rows.");
+    const seen = new Set();
+    return Object.freeze(rows.map((row) => {
+        const { phase, action, flags } = (row ?? {});
+        if (typeof phase !== "string" || !/^[a-z]+(-[a-z]+)*$/.test(phase) || seen.has(phase))
+            throw new Error(`The deployment phase table has a bad or repeated phase: ${String(phase)}.`);
+        if (typeof action !== "string" || !ACTIONS.includes(action))
+            throw new Error(`The deployment phase ${phase} has no known action.`);
+        if (!Array.isArray(flags) || flags.some(flag => typeof flag !== "string" || !FLAGS.includes(flag)) || new Set(flags).size !== flags.length)
+            throw new Error(`The deployment phase ${phase} has an unknown or repeated flag.`);
+        seen.add(phase);
+        return Object.freeze({ phase, action: action, flags: Object.freeze([...flags]) });
+    }));
+}
+// By path, not by URL: a test environment that stands in for a browser replaces the global URL.
+const ROWS = deployPhaseRows(JSON.parse(readFileSync(join(import.meta.dirname, "deploy-phase-data.json"), "utf8")));
+const rowOf = (phase) => typeof phase === "string" ? ROWS.find(row => row.phase === phase) : undefined;
+const withFlag = (flag) => Object.freeze(ROWS.filter(row => row.flags.includes(flag)).map(row => row.phase));
+const withAction = (action) => Object.freeze(ROWS.filter(row => row.action === action).map(row => row.phase));
+/** Every phase, in journal order. */
+export const DEPLOY_PHASES = Object.freeze(ROWS.map(row => row.phase));
+export const isDeployPhase = (phase) => rowOf(phase) !== undefined;
+/** The one action a journal's phase calls for; "refuse" for anything that is not a phase. */
+export const deployActionOf = (phase) => rowOf(phase)?.action ?? "refuse";
+/** The word itself, or an Error: a journal is never written with a word the table does not hold. */
+export function assertDeployPhase(phase) {
+    if (!isDeployPhase(phase))
+        throw new Error(`"${String(phase)}" is not a deployment phase; the journal was not written.`);
+    return phase;
+}
+/** The service was never stopped. */
+export const BEFORE_SWAP = withFlag("beforeSwap");
+/** Before the swap, with the pause in place. */
+export const PAUSED_BEFORE_SWAP = Object.freeze(ROWS.filter(row => row.flags.includes("beforeSwap") && !row.flags.includes("beforePause")).map(row => row.phase));
+/** The candidate's store opened the live database, or the new service ran on it. */
+export const MIGRATION_STARTED = withFlag("migrationStarted");
+/** The old service is proved stopped: the previous definition may be started again. */
+export const RESTARTABLE = withFlag("restartable");
+/** The new service may be running: never rolled back by a journal alone. */
+export const FORWARD_ONLY = withAction("forward");
+/** Nothing is left to recover. Not the same as deployed: a released deployment never installed its runtime. */
+export const NEEDS_NO_RECOVERY = withAction("none");
+/** The deployment finished and its runtime is the installed one. */
+export const isDeployed = (phase) => rowOf(phase)?.flags.includes("deployed") === true;
+/** Stopped where nothing was changed (before its pause), or with nothing left to do. */
+export const stoppedWhereNothingChanged = (phase) => { const row = rowOf(phase); return row !== undefined && (row.flags.includes("beforePause") || row.action === "none"); };
+/** The phase a lifted pause leaves behind (release-gate.ts). */
+export const RELEASED = assertDeployPhase("released");

package/dist/deploy-rescue.d.ts

@@ -1,5 +1,6 @@
+import { FORWARD_ONLY } from "./deploy-phase.js";
 /** Phases where the new service may be running: recovery leaves them to the release, which resumes forward. */
-export declare const FORWARD_ONLY: readonly string[];
+export { FORWARD_ONLY };
 export type RescueWorld = {
     /** The live database. */
     database: string;

package/dist/deploy-rescue.js

@@ -18,10 +18,9 @@
  */
 import { realpathSync } from "node:fs";
 import { join } from "node:path";
-import { BEFORE_SWAP } from "./release-gate.js";
+import { BEFORE_SWAP, FORWARD_ONLY, MIGRATION_STARTED, NEEDS_NO_RECOVERY, RESTARTABLE } from "./deploy-phase.js";
 /** Phases where the new service may be running: recovery leaves them to the release, which resumes forward. */
-export const FORWARD_ONLY = Object.freeze(["starting", "started", "healthy"]);
-const FINISHED = Object.freeze(["released", "deployed"]);
+export { FORWARD_ONLY };
 const real = (path) => { try {
     return realpathSync(path);
 }
@@ -39,8 +38,8 @@ export function rescuePlan(phase, journal) {
     if (phase === "stopping") {
         words.push("The old service must already be stopped. Recovery checks for remaining processes and refuses while any may still be running. Stop them through the service owner, then rerun recovery.");
     }
-    if (["stopping", "stopped", "migrating", "migrated", "start-failed", "backup-restored"].includes(phase)) {
-        if (["migrating", "migrated", "start-failed"].includes(phase))
+    if (phase === "stopping" || RESTARTABLE.includes(phase)) {
+        if (MIGRATION_STARTED.includes(phase))
             words.push("Puts the verified backup back first when the previous runtime can't read the migrated database.");
         words.push(`Starts the previous service (${prior}) again and waits for it to answer, past a stopped worker's heartbeat window; then lifts update pause ${id}.`);
     }
@@ -56,7 +55,7 @@ export async function rescueDeployment(stageArg, yes, world) {
             return { ok: false, reason: "usage", message: `${stageArg} is not a deployment stage of this installation (under ${join(world.stateDir, "staged-upgrades")}).` };
     }
     else {
-        const open = all.filter(one => one.journal === null || !FINISHED.includes(String(one.journal["phase"])));
+        const open = all.filter(one => one.journal === null || !NEEDS_NO_RECOVERY.includes(String(one.journal["phase"])));
         if (open.length === 0)
             return { ok: true, acted: false, stage: null, phase: null, words: ["Nothing to recover: every deployment finished or was already put back."] };
         if (open.length > 1)
@@ -74,7 +73,7 @@ export async function rescueDeployment(stageArg, yes, world) {
         return { ok: false, reason: "conflict", message: `That deployment ran on ${String(journal["database"])}, not ${world.database}; nothing was changed.` };
     if (!Number.isSafeInteger(run) || run < 1)
         return { ok: false, reason: "damaged", message: `${join(stage, "deployment.json")} names no builder run, so its commit's recovery can't be found; nothing was changed.` };
-    if (FINISHED.includes(phase))
+    if (NEEDS_NO_RECOVERY.includes(phase))
         return { ok: true, acted: false, stage, phase, words: [`Nothing to recover: that deployment is ${phase}.`] };
     if (FORWARD_ONLY.includes(phase)) {
         return { ok: false, reason: "forward", message: `That deployment is at ${phase}: the new service may be running, so nothing was stopped. Continue it forward with \`toolroll release <branch>\` (it resumes the deployment's finish).` };

package/dist/discord-chat.js

@@ -7,7 +7,7 @@ import { cardWithin } from "./chat-card.js";
 import { chatFlowButtons } from "./chat-flow.js";
 import { refuseResultShots, resultShotsPruned, shotWaitsUntil } from "./result-shots.js";
 import { admitChatEvent } from "./chat-admission.js";
-import { ChatState, ChatDeliveryError, chatHash, partContent, } from "./chat-delivery-state.js";
+import { ChatState, ChatDeliveryError, chatHash, chatRetryAt, partContent, } from "./chat-delivery-state.js";
 import { readChatPart } from "./contracts/chat-content.js";
 import { readDiscordButtonToken, readDiscordComponentInteraction } from "./contracts/discord-callback.js";
 import { processChatEvent, planChatNotifications, channelAccess, chatObject as object, planRoomMessages, heldForWatch, } from "./chat-delivery.js";
@@ -418,8 +418,7 @@ export async function deliverDiscordPart(options) {
         const problem = error instanceof ChatDeliveryError
             ? error
             : new DiscordError("Discord delivery is waiting to retry", 15_000, true);
-        const until = new Date((options.clock?.() ?? new Date()).getTime() +
-            Math.max(problem.retryMs, [5000, 15000, 60000, 300000][Math.min(row.attempts, 3)])).toISOString();
+        const until = chatRetryAt(options.clock?.() ?? new Date(), problem.retryMs, row.attempts);
         state.partFailed(row.id, { problem: problem.message, until, uncertain: problem.uncertain });
         state.setProblem(identity.installation, options.owner, problem.code === "ratelimited" ? "Discord asked us to wait. Saved replies will retry." : problem.message);
         if (problem.code === "ratelimited")

package/dist/dispatch.js

@@ -19,6 +19,7 @@ import { failedAttemptSentence, latestFinishedAttempt } from "./needs-you.js";
 import { buildReviewOf } from "./review-switch.js";
 import { vanishedStopOf, vanishedStopSentence } from "./vanished-retry.js";
 import { routeChangeOf } from "./route-change.js";
+import { wasInterrupted } from "./run-ending.js";
 import { BUILT_IN, refArchived, parseCapabilityKey } from "./store.js";
 import { shortWhen } from "./when-html.js";
 export const DEFAULT_MAX_OPEN_DECISIONS = 5;
@@ -157,7 +158,7 @@ function reviewViewOf(sourceRun, retry) {
         retriesRemaining: retry.retriesRemaining,
         latestRun: retry.latest?.runId ?? null,
         latestReason: retry.latest?.reason ?? null,
-        interrupted: retry.latest !== null && (retry.latest.outcome === "interrupted" || retry.latest.reason === "interrupted"),
+        interrupted: retry.latest !== null && wasInterrupted(retry.latest),
         queued: retry.openRequest === null ? null : { requestedBy: retry.openRequest.requestedBy, origin: retry.openRequest.origin },
     };
 }

package/dist/dispose.d.ts

@@ -1,7 +1,7 @@
 import { STORAGE_HOLD_PREFIX } from "./needs-you.js";
 import { type FailureClass } from "./claim.js";
 import type { BuildResult } from "./builder.js";
-import type { Store } from "./store.js";
+import type { ClosedState, Store } from "./store.js";
 import { type ProofVerdict } from "./proof.js";
 /**
  * Which road is disposing. 'tick' = the unattended loop: full task
@@ -59,6 +59,9 @@ export type Disposition = {
     disposition: string | null;
     strikes: number | null;
     sealed: boolean;
+    /** The state sealed when strikes ran out on a task a person had already closed (disposition "closed"): it is
+     * kept, with no incident, hold or page. Null for every other ending. */
+    closedState: ClosedState | null;
 }
 /** The standalone road's simple record: outcome written, nothing else. */
  | {

package/dist/dispose.js

@@ -316,7 +316,7 @@ function disposeBuildOutcomeLocked(context, result) {
         }
         if (leaseId === undefined) {
             store.finishRun(runId, { outcome: "failed", reason: result.reason, now: clock() });
-            return { kind: "failed", failureClass, disposition: null, strikes: null, sealed: false };
+            return { kind: "failed", failureClass, disposition: null, strikes: null, sealed: false, closedState: null };
         }
         const sealed = finalize(store, leaseId, {
             kind: "failure",
@@ -333,6 +333,7 @@ function disposeBuildOutcomeLocked(context, result) {
             disposition: sealed.ok ? sealed.disposition : null,
             strikes: sealed.ok && "strikes" in sealed ? sealed.strikes : null,
             sealed: sealed.ok,
+            closedState: sealed.ok && sealed.disposition === "closed" ? sealed.state : null,
         };
     }
     if (result.reason === "protected-storage") {

package/dist/fallback.js

@@ -22,6 +22,7 @@ import { isProviderId, validateSpec } from "./provider.js";
 import { providerName } from "./provider-auth.js";
 import { PLAN_LOGIN_PROVABLE } from "./plan-login.js";
 import { canonicalChainJson, chainDigestOf, LIVE_CHAIN_VERSION, liveChainFromJson, machineActing, profileDigestOf } from "./scope.js";
+import { moveTask } from "./task-moves.js";
 export const MAX_FALLBACK_ENTRIES = 3;
 const tablesSeen = new WeakSet();
 function hasTables(store) {
@@ -516,7 +517,7 @@ export function blockAfterSignedOut(store, runId, now) {
         store.handle.prepare("UPDATE run SET reason = 'fallback-signed-out' WHERE id = ? AND outcome = 'refused'").run(runId);
         const ref = store.refForId(run.taskRef);
         if (ref !== null)
-            store.handle.prepare("UPDATE task SET state = 'failed', updated_at = ? WHERE id = ? AND state IN ('queued','running')").run(now.toISOString(), ref.externalId);
+            moveTask(store.handle, ref.externalId, "giveUp", now);
         return true;
     });
 }
@@ -568,7 +569,7 @@ export function moveOnIfExhausted(store, runId, taskId, now) {
     store.handle.prepare("INSERT INTO fallback_move (walk, to_index, from_run, terminal_class, paid, moved_at) VALUES (?, ?, ?, ?, ?, ?)")
         .run(walk.id, run.chainIndex + 1, run.id, evidence.terminalClass, paid ? 1 : 0, now.toISOString());
     store.handle.prepare("UPDATE fallback_walk SET cursor = ? WHERE id = ?").run(run.chainIndex + 1, walk.id);
-    store.handle.prepare("UPDATE task SET state = 'queued', updated_at = ? WHERE id = ? AND state = 'running'").run(now.toISOString(), taskId);
+    moveTask(store.handle, taskId, "requeue", now);
     store.recordAction({ at: now.toISOString(), actor: "toolroll", repo: store.refForId(run.taskRef)?.repo ?? null, taskId, runId: run.id, action: "work moved to fallback agent", outcome: paid ? "paid" : "plan", source: "work", detail: entryWords(to) });
     tell(store, run, taskId, "moved", to, now);
     store.bumpWake();

package/dist/fast-start.js

@@ -31,7 +31,7 @@ import { fileTaskProposal } from "./proposal.js";
 import { releaseCiHoldOf } from "./release-ci-hold.js";
 import { COMPLETION_ACTION, COMPLETION_BY_PERSON } from "./result-completion.js";
 import { deployGateScope, machineActing, propose, releaseCheckScope } from "./scope.js";
-import { BUILT_IN } from "./store.js";
+import { BUILT_IN, withdrawApproval } from "./store.js";
 import { classifyTask, filingSizer, heuristicSizing } from "./task-sizing.js";
 import { issueImported } from "./task-source.js";
 import { titleWithin } from "./task-text.js";
@@ -295,7 +295,7 @@ export function expireFastStarts(store, now) {
         store.transact(() => {
             if (store.currentLiveLease(ref, now) !== null)
                 return;
-            store.handle.prepare(`UPDATE task_scope SET approved_at = NULL, approved_by = NULL, approved_digest = NULL, approved_profile_json = NULL, approved_route_json = NULL, approval_basis = NULL WHERE task_id = ?`).run(task);
+            withdrawApproval(store, { where: "WHERE task_id = ?", args: [task] }, { basisAfter: null, clearRoute: true, clearModeDigest: false });
             store.handle.prepare("UPDATE task_ref SET fast_start_until = NULL WHERE id = ?").run(ref);
             store.recordAction({ at: stamp, actor: "system", repo: row["repo"] === null ? null : String(row["repo"]), taskId: task, runId: null, action: "fast start expired", outcome: "seal cleared", source: "work", detail: `no build started within ${FAST_WINDOW_MS / 60_000} minutes` });
             cleared++;

package/dist/monitoring.js

@@ -19,6 +19,7 @@ import { createHash, createHmac, randomUUID } from "node:crypto";
 import { closeSync, constants, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, writeSync } from "node:fs";
 import { hostname } from "node:os";
 import { basename, join } from "node:path";
+import { wasInterrupted } from "./run-ending.js";
 import { COMPLETION_ACTION } from "./result-completion.js";
 export const SIGNATURE_HEADER = "x-standing-orders-signature";
 const BATCH = 200;
@@ -164,7 +165,7 @@ export function spansFor(store, entries) {
                 continue;
             const root = rootOf(taskId);
             const ref = store.refForId(run.taskRef);
-            const failed = run.outcome === "failed" || run.outcome === "refused" || run.outcome === "interrupted";
+            const failed = run.outcome === "failed" || run.outcome === "refused" || wasInterrupted(run);
             spans.push({
                 traceId: hex(`standing-orders/trace/${root}`, 32), spanId: hex(`standing-orders/run/${run.id}`, 16), parentSpanId: hex(`standing-orders/task/${root}`, 16),
                 name: `${run.role} · ${run.provider}`, kind: 1, startTimeUnixNano: nanos(run.startedAt), endTimeUnixNano: nanos(run.finishedAt),

package/dist/operate.js

@@ -123,7 +123,7 @@ import { homedir, hostname } from "node:os";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { releaseStalledUpdate, waitingUpdate } from "./toolroll-update.js";
 import { dur } from "./design/kit.js";
-import { checkoutIdle, setCheckoutIdle, leadQuickAnswersOn, setLeadQuickAnswers, openStore, openStoreNoMigrate, initLocalMode, enrollOwnerPassword, installationCreatedBy, laptopPortOf, recordLaptopPort, localModeOf, localOwnerBinding, archiveTaskFamily, restoreTaskFamily, shipChecksForTask, elapsedSeconds, CONCURRENT_WRITER_WAIT_MS, isDatabaseBusy, databasePath, BUILT_IN, parseCapabilityKey, verifiedAuthor, isDigestTime, predecessorWatches, RESULT_SCREENSHOTS, lifecycleOf, reportLifecycle, beatLifecycle, } from "./store.js";
+import { requeueEligibility, checkoutIdle, setCheckoutIdle, leadQuickAnswersOn, setLeadQuickAnswers, openStore, openStoreNoMigrate, initLocalMode, enrollOwnerPassword, installationCreatedBy, laptopPortOf, recordLaptopPort, localModeOf, localOwnerBinding, archiveTaskFamily, restoreTaskFamily, shipChecksForTask, elapsedSeconds, CONCURRENT_WRITER_WAIT_MS, isDatabaseBusy, databasePath, BUILT_IN, parseCapabilityKey, verifiedAuthor, isDigestTime, predecessorWatches, RESULT_SCREENSHOTS, lifecycleOf, reportLifecycle, beatLifecycle, } from "./store.js";
 import { createHash, randomBytes, randomInt, randomUUID } from "node:crypto";
 import { claimInstance, clearInstance, openInstanceSocket } from "./console-instance.js";
 import { backgroundOff, backgroundOn, backgroundShow, laptopStatus, laptopStop, restartOwnBuilder } from "./laptop-background.js";
@@ -220,6 +220,7 @@ import { describePublicationGrant, observeChecks, publishPass, sweepMerges, } fr
 import { checkPublishing, publishingOf, savePublishing, followPullRequests, newestPullRequestOf } from "./pull-request-flow.js";
 import { starterOf, startersFor, switchOnStarter } from "./flow-starters.js";
 import { acquire, acquireIfReady, heartbeat, release, reap, currentClaim, DEFAULT_LEASE_MS, SYNC_MAX_AGE_MS, finalize, } from "./claim.js";
+import { moveTask } from "./task-moves.js";
 import { disposeBuildOutcome, holdStaleApproval, regateTask } from "./dispose.js";
 import { proposeGrant, describeGrant, describeWithheld, permits, MUTATION_CLASSES, DEFAULT_MUTATIONS, } from "./grant.js";
 import { builtIn, guarded } from "./backend.js";
@@ -296,6 +297,7 @@ import { machineActing } from "./scope.js";
 import { reevaluateResultRecords } from "./route-results.js";
 import { holdRuleOff, routeRulesPass, taskEvidenceWords } from "./route-rules.js";
 import { ruleHoldOf } from "./route-store.js";
+import { wasInterrupted } from "./run-ending.js";
 import { loginFileOf, migrateLegacyLogin, savedLoginFile, writableLoginFile } from "./login-secrets.js";
 /**
  * 0 done · 1 broke · 2 bad usage · 3 ran fine, the answer is no.
@@ -1672,12 +1674,9 @@ function claimCommand(positional, flags, context) {
             return fail(write, json, "claim", verdict.reason, verdict.message, EXIT.refused);
     }
     const ref = store.refFor(backend, id);
-    const result = acquire(store, ref.id, runner, {
-        now,
-        token,
-        ttlMs: ttl,
-        mutation: mutationFrom(flags, now),
-    });
+    // The grant and the `running` it makes are one transaction (closed-task-claims.md §3.5): nobody can close the task
+    // between them, and a refusal writes neither.
+    const result = claimAndMarkRunning(store, backend, id, ref.id, runner, { now, token, ttlMs: ttl, mutation: mutationFrom(flags, now) });
     if (!result.ok) {
         // Two distinct refusals: somebody HOLDS it right now, or it is
         // RESERVED for a specific worker whoever asks (queue columns, v19).
@@ -1712,24 +1711,12 @@ function claimCommand(positional, flags, context) {
             return fail(write, json, "claim", "archived", `${id} is put away — restore it with \`toolroll task restore ${id}\` first`, EXIT.refused);
         if (result.reason === "draining")
             return fail(write, json, "claim", "draining", `Toolroll is restarting (draining): ${runner} takes no new work until it is back (by ${result.until})`, EXIT.refused, { until: result.until });
+        if (result.reason === "closed")
+            return fail(write, json, "claim", "closed", closedClaimWords(store, id, result.state, now), EXIT.refused, { state: result.state });
+        if (result.reason === "no-task")
+            return fail(write, json, "claim", "no-task", `no task \`${id}\``, EXIT.refused);
         return fail(write, json, "claim", result.reason, `held by ${result.by} until ${result.until}`, EXIT.refused, { holder: result.by, until: result.until });
     }
-    // Taking a task is what makes it running; leaving that to the caller would
-    // let a claimed task keep showing up as queued to anything reading state.
-    // On an idempotent REPLAY the transition runs only as the ONE narrow
-    // repair (external dispatch, finding 36): the stored claim is still the
-    // live lease and the task never left queued — anything else (cancelled,
-    // done, reopened elsewhere) mutates nothing.
-    if (result.replayed === true) {
-        const task = store.getTask(id);
-        const ref = store.lookupRef(id);
-        const stillMine = ref !== null && store.currentLiveLease(ref.id, now) === result.claim.leaseId;
-        if (task !== null && task.state === "queued" && stillMine)
-            store.setTaskState(id, "running", now);
-    }
-    else {
-        store.setTaskState(id, "running", now);
-    }
     return succeed(write, json, "claim", { lease: result.claim, reclaimed: result.reclaimed }, () => [
         `Claimed ${id} as ${runner}.`,
         `  lease   ${result.claim.leaseId}`,
@@ -1751,20 +1738,18 @@ function leaseCommand(command, positional, flags, context) {
     const ttl = readTtl(flags);
     if (ttl === null)
         return fail(write, json, name, "usage", "--ttl takes whole seconds", EXIT.usage);
-    const result = command === "heartbeat" ? heartbeat(store, lease, now, ttl) : release(store, lease, now);
+    // Releasing says the runner is finished with it, not that it succeeded, so a task left running is put back rather
+    // than marked done, in the release's own transaction (releaseToQueue).
+    const result = command === "heartbeat" ? heartbeat(store, lease, now, ttl) : releaseToQueue(store, lease, now);
     if (!result.ok) {
+        if (result.reason === "closed") {
+            return fail(write, json, name, "closed", `this lease ran out and its task is ${result.state} now, so it can't be renewed; stop rather than retry`, EXIT.refused, { state: result.state });
+        }
         const message = result.reason === "fenced"
             ? "superseded — another runner holds this task now; stop rather than retry"
             : "no such lease";
         return fail(write, json, name, result.reason, message, EXIT.refused);
     }
-    if (command === "release") {
-        const task = store.getTask(String(refExternalId(store, result.claim.taskRef)));
-        // Releasing says the runner is finished with it, not that it succeeded, so
-        // a task left running is put back rather than marked done.
-        if (task !== null && task.state === "running")
-            store.setTaskState(task.id, "queued", now);
-    }
     return succeed(write, json, name, { lease: result.claim }, () => [
         command === "heartbeat"
             ? `Still yours until ${result.claim.expiresAt}.`
@@ -3512,7 +3497,7 @@ async function tickCommand(flags, context) {
                             ? "auth-expired — requeued, sign-in needed"
                             : disposition.disposition === "fallback"
                                 ? `out of plan — moved to the next approved agent`
-                                : `${disposition.failureClass}${disposition.disposition === "backoff" ? ` — retry ${disposition.strikes}/3` : disposition.disposition === "stalled" ? " — stalled" : ""}`
+                                : `${disposition.failureClass}${disposition.disposition === "backoff" ? ` — retry ${disposition.strikes}/3` : disposition.disposition === "stalled" ? " — stalled" : disposition.closedState !== null ? ` — the task was already ${disposition.closedState}, so it stays ${disposition.closedState}` : ""}`
                         : "fenced",
                     ...(result.ok ? {} : { detail: result.message.slice(0, 200) }),
                     worktree: leased.worktree.path,
@@ -9543,7 +9528,7 @@ function reviewStatusLines(review, sourceRun) {
         queued: "legacy request retained; the worker will close it without running a model review",
         running: `running — attempt ${review.live?.attempt ?? review.attempts.length} of ${review.cap}`,
         succeeded: `succeeded on attempt ${review.succeeded?.attempt ?? 1} of ${review.cap}`,
-        retryable: `${review.latest?.outcome === "interrupted" || review.latest?.reason === "interrupted" ? "interrupted" : "failed"} on attempt ${review.latest?.attempt ?? review.attempts.length} of ${review.cap} — inspect the saved result; model reviews no longer retry`,
+        retryable: `${review.latest !== null && wasInterrupted(review.latest) ? "interrupted" : "failed"} on attempt ${review.latest?.attempt ?? review.attempts.length} of ${review.cap} — inspect the saved result; model reviews no longer retry`,
         exhausted: `exhausted — all ${review.cap} attempts ended without a review; nothing retries a fourth time`,
     };
     const first = review.state === "queued" && review.attempts.length === 0 ? "queued — waiting for a worker" : word[review.state];
@@ -12066,9 +12051,6 @@ function slug(title, now) {
     const stamp = now.toISOString().slice(11, 19).replace(/:/g, "");
     return words === "" ? `task-${stamp}` : `${words}-${stamp}`;
 }
-function refExternalId(store, taskRef) {
-    return store.externalIdFor(taskRef);
-}
 function describe(error) {
     return error instanceof Error ? error.message : String(error);
 }
@@ -14299,3 +14281,60 @@ function startServiceBeats(store) {
     void delivery.runNow();
     return beats;
 }
+/**
+ * The CLI `claim`'s grant and its `running`, one transaction (docs/plans/closed-task-claims.md §3.5). A fresh grant of
+ * a built-in task moves it to running through the narrow `claim` move; a replay of the same key repairs `running` only
+ * when the task is still queued and the replayed lease is still the live one, as before. A task of another backend is
+ * never written in the built-in table.
+ */
+function claimAndMarkRunning(store, backend, id, taskRef, runner, options) {
+    const { now } = options;
+    return store.transact(() => {
+        const result = acquire(store, taskRef, runner, options);
+        if (!result.ok || backend !== BUILT_IN)
+            return result;
+        if (result.replayed === true) {
+            const task = store.getTask(id);
+            const stillMine = store.currentLiveLease(taskRef, now) === result.claim.leaseId;
+            if (task !== null && task.state === "queued" && stillMine)
+                store.setTaskState(id, "running", now);
+            return result;
+        }
+        // The grant just read this row open in this transaction, so the move cannot miss; if it ever did, throwing rolls
+        // the grant back with it.
+        if (!moveTask(store.handle, id, "claim", now))
+            throw new Error(`claim: ${id} could not be marked running`);
+        store.bumpWake();
+        return result;
+    });
+}
+/**
+ * The refusal words for a claim on a closed task: what state it is in, and only a next step that works for this task
+ * (a requeue the store would accept, a cancelled task reopened through the state verb, otherwise the task itself).
+ */
+function closedClaimWords(store, id, state, now) {
+    const head = `${id} is ${state}, so it can't be claimed.`;
+    if (state === "cancelled")
+        return `${head} To run it again, reopen it: \`toolroll task state ${id} queued\``;
+    if (requeueEligibility(store, id, now).ok)
+        return `${head} To run it again: \`toolroll task requeue ${id}\``;
+    return `${head} See its result: \`toolroll task show ${id}\``;
+}
+/**
+ * `worker release`: hand the lease back and, when this release is the one that ended the claim, put a task left
+ * running back in the queue, in one transaction, so no one can claim it in between (closed-task-claims.md §5). A
+ * duplicate release changes nothing: by then another runner may hold the task.
+ */
+function releaseToQueue(store, lease, now) {
+    return store.transact(() => {
+        const result = release(store, lease, now);
+        if (!result.ok || result.duplicate === true)
+            return result;
+        const ref = store.refForId(result.claim.taskRef);
+        if (ref === null || ref.backend !== BUILT_IN)
+            return result;
+        if (store.getTask(ref.externalId)?.state === "running")
+            store.setTaskState(ref.externalId, "queued", now);
+        return result;
+    });
+}

package/dist/plane-review.js

@@ -30,6 +30,7 @@
 import { scanForSecrets } from "./evidence.js";
 import { scrubIntegrationText } from "./integrations.js";
 import { taskWaitSnapshot } from "./lead-status.js";
+import { wasInterrupted } from "./run-ending.js";
 export const REVIEW_HOURS = 24;
 const EVIDENCE_LINES = 5;
 const WAITING_DAYS = 1;
@@ -73,7 +74,7 @@ export function runCause(run) {
         return "timeout";
     if (reason === "no-handoff")
         return "no-handoff";
-    if (reason === "interrupted" || run.outcome === "interrupted")
+    if (wasInterrupted(run))
         return run.stopped ? null : "orphaned";
     if (PROVIDER_REASONS.has(reason) || run.terminalClass === "transient-throttle")
         return "provider";

package/dist/project-knowledge.d.ts

@@ -22,18 +22,17 @@ export type KnowledgeView = ReturnType<typeof knowledgeView>;
 export declare function knowledgeVersion(store: Store, repo: string, actor: string, revision: number): Knowledge;
 /** Chat reads only an admitted project. Keep the full source in the project UI. */
 export declare function conversationKnowledge(store: Store, repo: string, actor: string, reference?: string, decision?: number): {
-    content?: never;
     history?: never;
     revision: number;
     stale: boolean;
     notice: string;
     title?: never;
+    content?: never;
     instructions?: never;
     references?: never;
     decisions?: never;
     waiting?: never;
 } | {
-    content?: never;
     revision?: never;
     history?: never;
     stale?: never;
@@ -54,6 +53,7 @@ export declare function conversationKnowledge(store: Store, repo: string, actor:
     afterwards?: string;
     notice: string;
     title?: never;
+    content?: never;
     instructions?: never;
     references?: never;
     decisions?: never;
@@ -70,9 +70,9 @@ export declare function conversationKnowledge(store: Store, repo: string, actor:
     decisions?: never;
     waiting?: never;
 } | {
-    content?: never;
     stale?: never;
     title?: never;
+    content?: never;
     revision: number;
     history: {
         revision: number;