toolroll 0.9.99 → 0.9.100

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.9.100 — 2026-11-10
+
+- **An update whose new version never starts completely is now rolled back without asking you to unload the service by hand.** When Toolroll can prove the service still loaded is the one this update installed, running its new version on this database, it stops that service itself and puts the previous version back. If anything doesn't match, nothing is stopped and the message says why.
+- **An agent cut short shows as Stopped, not Failed.** When a restart or a stop ends an agent's run before it finishes, the run now shows as Stopped, so Failed means the work itself failed.
+- **A chat message that was dropped stays dropped.** When a chat is disconnected while Toolroll is still working on a message from it, the late answer is no longer saved or sent, and a dropped part of a reply is never brought back by a later update.
+- **Teams keeps trying to send, like Slack and Discord.** A reply Teams fails to take is no longer given up after 20 tries. It waits longer between tries (up to 5 minutes) and goes out when Teams takes it. The three apps now share one retry rule.
+- **People lists only invites that can still be used.** An invite that was already used no longer shows as open.
+- **A claim on a finished task is refused, and says why.** `toolroll claim` on a task that is done, failed or cancelled now answers `closed` with the task's state and a next step that works for that task (`task requeue` when a rerun would be accepted, `task state <id> queued` for a cancelled task, otherwise `task show`). Before, it took the task and marked it running again. A worker whose lease ran out can't renew it onto a task that was closed meanwhile either (`heartbeat` answers `closed`).
+- **`toolroll worker release` hands a task back in one step.** Releasing the lease and putting the task back in the queue now happen together, so another worker can no longer claim the task in between and then see it marked as waiting. Releasing the same lease twice changes nothing the second time.
+- **No false "stalled, retry it" notice for a task that is already closed.** When a build or scouting attempt uses up its retries on a task a person already marked done, failed or cancelled, the task keeps that state, and no incident, hold or notification is added. The failed attempt is still recorded.
+
 ## 0.9.99 — 2026-11-09
 
 - **A Toolroll update interrupted while the new service was starting no longer gets stuck.** Before, an update killed in that short window left new work paused until someone edited a file by hand. Running the release again now finishes the update when the new service is running, and puts the previous service back once the new one is proved gone. Nothing is stopped on a guess: a new service that is loaded but never answers is left alone, and the message names the one command that stops it.

package/dist/acp-check.js

@@ -21,7 +21,7 @@ import { dirname, join } from "node:path";
 import { ACP_AGENTS, isAcpProvider } from "./acp-agents.js";
 import { ACP_CONFORMANCE_VERSION, launchOf } from "./acp-attest.js";
 import { inspectAcpAgent } from "./acp-inspect.js";
-import { acquire, acquireForCheck, heartbeat, release } from "./claim.js";
+import { acquireForCheck, acquireForCheckCleanup, heartbeat, release } from "./claim.js";
 import { invokeAgent } from "./invoke.js";
 import { BUILT_IN } from "./store.js";
 export const CHECK_PROMPTS = {
@@ -74,7 +74,9 @@ async function settleChecks(job, clock) {
             if (lease !== null)
                 release(store, lease, clock());
             const fresh = `agent-check-${request.id}-settle-${randomBytes(4).toString("hex")}`;
-            const took = acquire(store, ref, job.runner, { now: clock(), token: job.token, newLeaseId: () => fresh, ttlMs: SETTLE_HOLD_MS, incarnation: job.watch.owner });
+            // Cleanup's own door: it may claim the check's task even when that task is done, failed or cancelled, proved
+            // against this check row, this runner and this attempt (claim.ts acquireForCheckCleanup).
+            const took = acquireForCheckCleanup(store, request.id, attempt, job.runner, { now: clock(), token: job.token, newLeaseId: () => fresh, ttlMs: SETTLE_HOLD_MS, incarnation: job.watch.owner });
             if (!took.ok || !store.setAcpCheckLease(request.id, fresh)) {
                 if (took.ok)
                     release(store, fresh, clock());

package/dist/agent-state.js

@@ -6,6 +6,7 @@
  */
 import { agentFactsFor, agentGroupOf } from "./agents-board.js";
 import { stuckSince } from "./agent-board.js";
+import { wasInterrupted } from "./run-ending.js";
 import { flowDefinitionOf } from "./flow-engine.js";
 import { runActivityOf } from "./task-activity.js";
 import { workStateRows } from "./work-index.js";
@@ -48,7 +49,7 @@ export function factsOfAttempt(facts, activityAt, paused, now, decisionOpen) {
     if (facts.outcome === "built" || facts.outcome === "no-change")
         return { activity: "finished", outcome: facts.outcome, obligation: false, unread };
     // Stopped by a person or a restart, in either spelling (a legacy outcome, or a failure whose reason is the interruption).
-    if (facts.outcome === "interrupted" || facts.outcome === "refused" || (facts.outcome === "failed" && facts.reason === "interrupted"))
+    if (wasInterrupted(facts) || facts.outcome === "refused")
         return { activity: "stopped", outcome: "none", obligation: false, unread };
     // A parked attempt asks only while its decision is unanswered (when known) and its task is open.
     if (facts.outcome === "parked")

package/dist/agents-board.js

@@ -13,6 +13,7 @@ import { readVerifiedArtifact } from "./evidence.js";
 import { failedAttemptSentence } from "./needs-you.js";
 import { projectName } from "./project.js";
 import { providerName } from "./provider-auth.js";
+import { wasInterrupted } from "./run-ending.js";
 import { runActivityOf } from "./task-activity.js";
 export const AGENT_GROUPS = [
     { key: "needs-you", label: "Needs you" },
@@ -117,8 +118,8 @@ export function agentGroupOf(facts, activityAt, now) {
         return { group: facts.seen || facts.legacy ? "idle" : "done", label };
     }
     if (SETTLED_TASK.has(facts.taskState))
-        return { group: "idle", label: facts.outcome === "interrupted" ? "Stopped" : "Failed" };
-    return { group: "needs-you", label: facts.outcome === "parked" ? "Needs a decision" : facts.outcome === "interrupted" ? "Stopped" : facts.outcome === "refused" ? "Not started" : "Failed" };
+        return { group: "idle", label: wasInterrupted(facts) ? "Stopped" : "Failed" };
+    return { group: "needs-you", label: facts.outcome === "parked" ? "Needs a decision" : wasInterrupted(facts) ? "Stopped" : facts.outcome === "refused" ? "Not started" : "Failed" };
 }
 const sealed = new Map();
 /** A finished attempt's sealed diff stats (cached by artifact: sealed bytes never change). */

package/dist/agents-live.js

@@ -5,16 +5,17 @@
  */
 import { attemptKeyOf, agentNowForRun, openAgentQuestions } from "./agent-board.js";
 import { agentsLiveRuns } from "./store.js";
+import { wasInterrupted } from "./run-ending.js";
 /** An ended agent stays on the grid this long, then leaves (it remains on the List). */
 export const LIVE_ENDED_KEEP_MS = 10 * 60_000;
-const stateOf = (outcome) => outcome === null ? "working" : outcome === "built" || outcome === "no-change" ? "done" : outcome === "parked" ? "parked" : outcome === "interrupted" ? "stopped" : "failed";
+const stateOf = (run) => run.outcome === null ? "working" : run.outcome === "built" || run.outcome === "no-change" ? "done" : run.outcome === "parked" ? "parked" : wasInterrupted(run) ? "stopped" : "failed";
 /** The grid's tiles for one viewer: `canSee` is the caller's proof (ceiling and account access) for each run. */
 export function agentsLiveOf(store, now, viewer) {
     const tiles = [];
     for (const run of agentsLiveRuns(store, new Date(now.getTime() - LIVE_ENDED_KEEP_MS))) {
         if (!viewer.canSee(run))
             continue;
-        let state = stateOf(run.outcome);
+        let state = stateOf(run);
         let why = null, quietSince = null;
         if (state === "working") {
             try {

package/dist/approval-authority.d.ts

@@ -39,7 +39,8 @@ export declare const carrySealSql: (scope: string) => string;
  * SQL: a task that belongs to a release authority (its anchor, or a carried commit) dispatches only as the current
  * generation's tip while the release is open and unexpired, with the anchor's approver still an active approver who
  * can reach the project and the anchor's approval on its exact sealed digest. A task that belongs to no release passes.
- * The claim and build belts read the whole predicate (scope.ts liveReleaseOf) besides.
+ * The claim and build belts read the whole predicate (scope.ts liveReleaseOf) besides. "Open and unexpired" here is
+ * release-authority.ts releaseStateAt(a, now) === "open", written in SQL.
  */
 export declare const releaseStandsSql: (scope: string, now: string) => string;
 /** SQL: a machine made this seal — any proof at the seal's instant that isn't a person's (whatever its detail says,

package/dist/approval-authority.js

@@ -89,7 +89,8 @@ export const carrySealSql = (scope) => `EXISTS (SELECT 1 FROM release_carry rc2
  * SQL: a task that belongs to a release authority (its anchor, or a carried commit) dispatches only as the current
  * generation's tip while the release is open and unexpired, with the anchor's approver still an active approver who
  * can reach the project and the anchor's approval on its exact sealed digest. A task that belongs to no release passes.
- * The claim and build belts read the whole predicate (scope.ts liveReleaseOf) besides.
+ * The claim and build belts read the whole predicate (scope.ts liveReleaseOf) besides. "Open and unexpired" here is
+ * release-authority.ts releaseStateAt(a, now) === "open", written in SQL.
  */
 export const releaseStandsSql = (scope, now) => `((NOT EXISTS (SELECT 1 FROM release_authority rx WHERE rx.anchor_task = ${scope}.task_id)
       AND NOT EXISTS (SELECT 1 FROM release_carry cx WHERE cx.task_id = ${scope}.task_id))

package/dist/chat-ask.js

@@ -1,4 +1,4 @@
-import { chatHash, partContent, savedChatPart } from "./chat-delivery-state.js";
+import { chatHash, partContent } from "./chat-delivery-state.js";
 import { LEAD_ASK_OTHER } from "./store.js";
 /** Whether a task (the execution shown, never only its family's root) moved past a lead's question asked at `since`:
  * its plan was rewritten or approved, or a new attempt of it started. The options answered a state that is gone. A run
@@ -48,7 +48,9 @@ function repaint(state, part, event, line, now) {
     }
     const before = partContent(String(row["payload"]));
     const content = { text: `${before.text}\n\n${line}`.slice(0, 3400), edit: event.ts, ...(before.channel === undefined ? {} : { channel: before.channel }) };
-    state.prepare("UPDATE chat_part SET payload=?,state='pending',next_at=NULL WHERE provider=:provider AND id=?").run(savedChatPart(content), part);
+    // A question that was dropped isn't brought back: the line goes as a new message, the same as one too old to edit.
+    if (!state.repaint(part, content))
+        state.plan(event.id, [{ text: line }], now);
     state.finish(event.id);
 }
 /** A tapped ask button, inside the action's transaction; false when the token isn't one. */

package/dist/chat-core.js

@@ -8,6 +8,8 @@
  * Imports the store's types only, so the store can build its Telegram methods on it.
  */
 import { createHash } from "node:crypto";
+/** The result a waiting event is dropped with when its chat is disconnected (kept only when it had none). */
+const REVOKED = "revoked";
 export const chatHash = (text) => createHash("sha256").update(text).digest("hex");
 export const PAIRING_CODE_TTL_MS = 10 * 60_000;
 const str = (value) => (value === null || value === undefined ? null : String(value));
@@ -141,7 +143,7 @@ export class ChatCore {
                 this.prepare(`UPDATE ${table} SET consumed = ? WHERE provider = :provider AND binding = ? AND consumed IS NULL`).run(stamp, binding.id);
             for (const table of ["chat_flow_prompt", "chat_question_prompt"])
                 this.prepare(`UPDATE ${table} SET consumed = ? WHERE provider = :provider AND binding = ? AND consumed IS NULL`).run(stamp, binding.id);
-            this.prepare("UPDATE chat_event SET state = 'dropped', payload = '{}', problem = 'Chat disconnected', result = COALESCE(result, 'revoked') WHERE provider = :provider AND binding = ? AND state = 'queued'").run(binding.id);
+            this.prepare("UPDATE chat_event SET state = 'dropped', payload = '{}', problem = 'Chat disconnected', result = COALESCE(result, ?) WHERE provider = :provider AND binding = ? AND state = 'queued'").run(REVOKED, binding.id);
             this.prepare(`UPDATE chat_part SET state = 'dropped', problem = 'Chat disconnected' WHERE provider = :provider AND state = 'pending'
         AND event IN (SELECT id FROM chat_event WHERE provider = :provider AND binding = ?)`).run(binding.id);
             return revoked;
@@ -153,7 +155,7 @@ export class ChatCore {
             for (const binding of this.bindings(installation))
                 this.revokeBinding(binding, now, by);
             this.prepare("UPDATE chat_pair SET consumed = ? WHERE provider = :provider AND (installation = ? OR installation IS NULL) AND consumed IS NULL").run(now.toISOString(), installation);
-            this.prepare("UPDATE chat_event SET state = 'dropped', payload = '{}', problem = 'Chat disconnected', result = COALESCE(result, 'revoked') WHERE provider = :provider AND installation = ? AND state = 'queued' AND kind <> 'update'").run(installation);
+            this.prepare("UPDATE chat_event SET state = 'dropped', payload = '{}', problem = 'Chat disconnected', result = COALESCE(result, ?) WHERE provider = :provider AND installation = ? AND state = 'queued' AND kind <> 'update'").run(REVOKED, installation);
             this.prepare(`UPDATE chat_part SET state = 'dropped', problem = 'Chat disconnected' WHERE provider = :provider AND state = 'pending'
         AND event IN (SELECT id FROM chat_event WHERE provider = :provider AND installation = ?)`).run(installation);
         });

package/dist/chat-decide.js

@@ -13,7 +13,7 @@
  * offer, mint and answer these through the same tokens (the `channel` column). Every act runs through the door the
  * console uses. */
 import { routeChangeOf } from "./route-change.js";
-import { NIGHTLY_CHECK_ONLY, RELEASE_MERGES_ONLY, nightlyTaskRef, releaseTaskRef } from "./store.js";
+import { CONFIRM_TTL_MS, NIGHTLY_CHECK_ONLY, RELEASE_MERGES_ONLY, nightlyTaskRef, releaseTaskRef } from "./store.js";
 import { isAcpProfile } from "./acp-agents.js";
 import { DECIDE_ACTS, readDecideActionRow } from "./contracts/chat-callback-rows.js";
 import { createHash, randomBytes } from "node:crypto";
@@ -60,7 +60,6 @@ export const DECIDE_LABELS = {
 };
 const OFFER_TTL_MS = 7 * 86_400_000;
 const CHANNEL_NAMES = { telegram: "Telegram", slack: "Slack", discord: "Discord", teams: "Teams" };
-const CONFIRM_TTL_MS = 10 * 60_000;
 const PROMPT_TTL_MS = 30 * 60_000;
 export const WHAT_SHOULD_CHANGE = "What should change?";
 const sha = (text) => createHash("sha256").update(text).digest("hex");

package/dist/chat-delivery-state.d.ts

@@ -58,12 +58,21 @@ export declare class ChatState extends ChatMessages {
     event(id: string): ChatEvent | null;
     next(installation: string, now: Date): ChatEvent | null;
     defer(event: string, problem: string, until: Date): void;
+    /**
+     * Mark an event handled: done (or dropped). For a message this runs when its reply is planned, before any part is
+     * sent; so on these apps done does not mean the person has the reply. Ask `unsent()` in chat-message-states.ts for
+     * that. Dropped is final: an event dropped while its handler was still working (the chat was disconnected) is
+     * never written back to done.
+     */
     finish(event: string, dropped?: boolean): void;
     /** Point an event at the binding its pairing made. */
     setEventBinding(event: string, binding: number): void;
     part(id: number): ChatPart | null;
-    /** The reply to an event, part by part, with each part's buttons minted with it; the event is then handled. Planned once. */
-    plan(event: string, parts: ChatContent[], now: Date): void;
+    /**
+     * The reply to an event, part by part, with each part's buttons minted with it; the event is then handled. Planned
+     * once. A dropped event gets no reply: nothing is saved, no button is minted, and the answer is false.
+     */
+    plan(event: string, parts: ChatContent[], now: Date): boolean;
     /** A proposal card's buttons on its part: earlier ones on that part are spent. Yes and Cancel last ten minutes. */
     tokens(part: number, proposal: number, phases: Array<"confirm" | "dismiss" | "yes" | "cancel">, now: Date): void;
     /** A proposal card's live buttons on one part, in the order they were minted. */
@@ -84,22 +93,36 @@ export declare class ChatState extends ChatMessages {
      * (chat-decide.ts) now ride that message, and any older ones on it stop working; a "What should change?" names it.
      */
     partSent(id: number, message: string | null, now: Date, attempt?: boolean): void;
-    /** Not sent this time: counted, named, and (when the answer was lost rather than refused) counted as uncertain. */
+    /**
+     * Not sent this time: counted, named, and (when the answer was lost rather than refused) counted as uncertain. The
+     * part stays pending. A failed send never drops it on any app: it goes when the app says it can never be sent, or
+     * when the chat is disconnected.
+     */
     partFailed(id: number, failure: {
         problem: string;
         until: string;
         uncertain: boolean;
-    }, giveUpAfter?: number): void;
+    }): void;
     /** One person's replies still waiting to send, and those that could not be delivered (settings show both). */
     partCounts(binding: number): {
         pending: number;
         dropped: number;
     };
-    /** Replace a part's content and send it again (a repaint after a tap). */
-    repaint(id: number, content: ChatContent): void;
+    /**
+     * Replace a part's content and send it again (a repaint after a tap). A dropped part stays dropped: it was given up
+     * on, or its chat disconnected, and new content doesn't bring it back. False then, so the caller can say it another way.
+     */
+    repaint(id: number, content: ChatContent): boolean;
 }
 /** A saved part's content. One that can't be read is a delivery problem that names the field, never a guess. */
 export declare function partContent(payload: string): ChatContent;
+/** The least time before a failed part is sent again, by how many times it has failed. The last step repeats. */
+export declare const CHAT_RETRY_STEPS_MS: readonly [5000, 15000, 60000, 300000];
+/**
+ * When a part that failed to send is tried again: after the app's own wait or the step for its count of failures,
+ * whichever is longer. One rule for Slack, Discord and Teams.
+ */
+export declare function chatRetryAt(now: Date, retryMs: number, attempts: number): string;
 export declare class ChatDeliveryError extends Error {
     readonly code: string;
     readonly retryMs: number;

package/dist/chat-delivery-state.js

@@ -1,8 +1,9 @@
 /** Durable chat receipts on the shared chat core: what each app's chats sent us and what we plan to send them. */
 import { randomBytes } from "node:crypto";
-import { LEAD_ASK_TTL_MS } from "./store.js";
+import { CONFIRM_TTL_MS, LEAD_ASK_TTL_MS } from "./store.js";
 import { ChatCore, chatHash } from "./chat-core.js";
 import { ChatMessages } from "./chat-messages.js";
+import { unsentPart } from "./chat-message-states.js";
 import { readChatPart, savedChatEventBody, savedChatPart } from "./contracts/chat-content.js";
 export { savedChatPart, chatHash };
 const DAY_MS = 86_400_000;
@@ -52,8 +53,14 @@ export class ChatState extends ChatMessages {
     defer(event, problem, until) {
         this.prepare("UPDATE chat_event SET next_at = ?, problem = ? WHERE provider = :provider AND id = ? AND state = 'queued'").run(until.toISOString(), problem, event);
     }
+    /**
+     * Mark an event handled: done (or dropped). For a message this runs when its reply is planned, before any part is
+     * sent; so on these apps done does not mean the person has the reply. Ask `unsent()` in chat-message-states.ts for
+     * that. Dropped is final: an event dropped while its handler was still working (the chat was disconnected) is
+     * never written back to done.
+     */
     finish(event, dropped = false) {
-        this.prepare("UPDATE chat_event SET state = ?, payload = '{}' WHERE provider = :provider AND id = ?").run(dropped ? "dropped" : "done", event);
+        this.prepare("UPDATE chat_event SET state = ?, payload = '{}' WHERE provider = :provider AND id = ? AND state <> 'dropped'").run(dropped ? "dropped" : "done", event);
     }
     /** Point an event at the binding its pairing made. */
     setEventBinding(event, binding) {
@@ -62,9 +69,14 @@ export class ChatState extends ChatMessages {
     part(id) {
         return this.prepare("SELECT * FROM chat_part WHERE provider = :provider AND id = ?").get(id) ?? null;
     }
-    /** The reply to an event, part by part, with each part's buttons minted with it; the event is then handled. Planned once. */
+    /**
+     * The reply to an event, part by part, with each part's buttons minted with it; the event is then handled. Planned
+     * once. A dropped event gets no reply: nothing is saved, no button is minted, and the answer is false.
+     */
     plan(event, parts, now) {
-        this.store.transact(() => {
+        return this.store.transact(() => {
+            if (this.prepare("SELECT state FROM chat_event WHERE provider = :provider AND id = ?").get(event)?.["state"] === "dropped")
+                return false;
             for (const [ordinal, part] of parts.entries()) {
                 if (this.prepare("SELECT 1 AS hit FROM chat_part WHERE provider = :provider AND event = ? AND ordinal = ?").get(event, ordinal) !== undefined)
                     continue;
@@ -95,13 +107,14 @@ export class ChatState extends ChatMessages {
                             .run(token(), id, part.flow.card, part.flow.entry, action, now.toISOString(), new Date(now.getTime() + 7 * DAY_MS).toISOString());
             }
             this.finish(event);
+            return true;
         });
     }
     /** A proposal card's buttons on its part: earlier ones on that part are spent. Yes and Cancel last ten minutes. */
     tokens(part, proposal, phases, now) {
         this.prepare("UPDATE chat_action SET consumed = ? WHERE provider = :provider AND part = ? AND consumed IS NULL").run(now.toISOString(), part);
         for (const phase of phases)
-            this.prepare("INSERT INTO chat_action (provider, token, part, proposal, phase, created, expires) VALUES (:provider, ?, ?, ?, ?, ?, ?)").run(randomBytes(16).toString("hex"), part, proposal, phase, now.toISOString(), new Date(now.getTime() + (phase === "yes" || phase === "cancel" ? 600_000 : DAY_MS)).toISOString());
+            this.prepare("INSERT INTO chat_action (provider, token, part, proposal, phase, created, expires) VALUES (:provider, ?, ?, ?, ?, ?, ?)").run(randomBytes(16).toString("hex"), part, proposal, phase, now.toISOString(), new Date(now.getTime() + (phase === "yes" || phase === "cancel" ? CONFIRM_TTL_MS : DAY_MS)).toISOString());
     }
     /** A proposal card's live buttons on one part, in the order they were minted. */
     partTokens(part, now) {
@@ -160,21 +173,28 @@ export class ChatState extends ChatMessages {
                 this.prepare("UPDATE chat_decide_prompt SET message = ? WHERE channel = :provider AND id = ? AND message IS NULL").run(placed, content.prompt);
         });
     }
-    /** Not sent this time: counted, named, and (when the answer was lost rather than refused) counted as uncertain. */
-    partFailed(id, failure, giveUpAfter) {
-        this.prepare(`UPDATE chat_part SET attempts = attempts + 1, uncertain = uncertain + ?, next_at = ?, problem = ?,
-      state = CASE WHEN ? IS NOT NULL AND attempts >= ? THEN 'dropped' ELSE state END WHERE provider = :provider AND id = ?`)
-            .run(failure.uncertain ? 1 : 0, failure.until, failure.problem, giveUpAfter ?? null, giveUpAfter ?? 0, id);
+    /**
+     * Not sent this time: counted, named, and (when the answer was lost rather than refused) counted as uncertain. The
+     * part stays pending. A failed send never drops it on any app: it goes when the app says it can never be sent, or
+     * when the chat is disconnected.
+     */
+    partFailed(id, failure) {
+        this.prepare("UPDATE chat_part SET attempts = attempts + 1, uncertain = uncertain + ?, next_at = ?, problem = ? WHERE provider = :provider AND id = ?")
+            .run(failure.uncertain ? 1 : 0, failure.until, failure.problem, id);
     }
     /** One person's replies still waiting to send, and those that could not be delivered (settings show both). */
     partCounts(binding) {
-        const row = this.prepare(`SELECT SUM(p.state = 'pending') AS pending, SUM(p.state = 'dropped') AS dropped FROM chat_part p
+        const row = this.prepare(`SELECT SUM(${unsentPart("p")}) AS pending, SUM(p.state = 'dropped') AS dropped FROM chat_part p
       JOIN chat_event e ON e.provider = p.provider AND e.id = p.event WHERE p.provider = :provider AND e.binding = ?`).get(binding);
         return { pending: Number(row?.["pending"] ?? 0), dropped: Number(row?.["dropped"] ?? 0) };
     }
-    /** Replace a part's content and send it again (a repaint after a tap). */
+    /**
+     * Replace a part's content and send it again (a repaint after a tap). A dropped part stays dropped: it was given up
+     * on, or its chat disconnected, and new content doesn't bring it back. False then, so the caller can say it another way.
+     */
     repaint(id, content) {
-        this.prepare("UPDATE chat_part SET payload = ?, state = 'pending', next_at = NULL WHERE provider = :provider AND id = ?").run(savedChatPart(content), id);
+        return Number(this.prepare("UPDATE chat_part SET payload = ?, state = 'pending', next_at = NULL WHERE provider = :provider AND id = ? AND state <> 'dropped'")
+            .run(savedChatPart(content), id).changes) === 1;
     }
 }
 /** A saved part's content. One that can't be read is a delivery problem that names the field, never a guess. */
@@ -184,6 +204,16 @@ export function partContent(payload) {
         throw new ChatDeliveryError(`This saved message can't be read: ${read.issues.map(issue => issue.line).join("; ")}`, 0, false, true);
     return read.value;
 }
+/** The least time before a failed part is sent again, by how many times it has failed. The last step repeats. */
+export const CHAT_RETRY_STEPS_MS = [5000, 15000, 60000, 300000];
+/**
+ * When a part that failed to send is tried again: after the app's own wait or the step for its count of failures,
+ * whichever is longer. One rule for Slack, Discord and Teams.
+ */
+export function chatRetryAt(now, retryMs, attempts) {
+    const step = CHAT_RETRY_STEPS_MS[Math.min(Math.max(attempts, 0), CHAT_RETRY_STEPS_MS.length - 1)];
+    return new Date(now.getTime() + Math.max(retryMs, step)).toISOString();
+}
 export class ChatDeliveryError extends Error {
     code;
     retryMs;

package/dist/chat-delivery.js

@@ -117,6 +117,8 @@ const decideRows = (rows) => rows.map(row => row.map(one => "token" in one ? { l
 function mintDecide(options, binding, target, offer, now) {
     return { rows: decideRows(mintDecideButtons(options.store, decideSeat(options.state, binding), target, offer, now).rows) };
 }
+/** Said when a card that still waits for a tap can no longer be shown again in the chat. */
+const CARD_GONE = "This card can't be updated here now. Open Toolroll to finish this.";
 /**
  * A decide button (chat-decide.ts), inside the tap's transaction: the same door, words and two taps as on Telegram.
  * The card it rode is repainted in place; Request changes asks for the next message; a merge goes out after.
@@ -138,7 +140,10 @@ function applyChatDecideTap(options, event, binding, token, repos, now) {
     if (tapped.edit !== undefined && row !== undefined && card !== null) {
         const { decide: _decide, link: _link, also: _also, edit: _edit, ...kept } = card;
         repainted = { ...kept, text: tapped.edit.text, ...(tapped.edit.rows.length === 0 ? {} : { decide: { rows: decideRows(tapped.edit.rows) } }) };
-        state.repaint(Number(row["id"]), repainted);
+        // A card that was dropped isn't brought back: what happened goes as a new message. A step that waits for a second
+        // tap can't be shown on it, so the person is sent to the task.
+        if (!state.repaint(Number(row["id"]), repainted))
+            replies.push({ text: tapped.edit.tokens.length === 0 ? tapped.ack : CARD_GONE });
     }
     else
         replies.push({ text: tapped.ack });
@@ -726,10 +731,12 @@ export function applyChatAction(options, event, binding, repos) {
                     content.link = link;
             }
         }
-        // Repaint the original persisted card; retain one placement and fresh tokens.
-        state
-            .prepare("UPDATE chat_part SET payload=?,state='pending',next_at=NULL WHERE provider=:provider AND id=?")
-            .run(savedChatPart(content), action.part);
+        // Repaint the original persisted card; retain one placement and fresh tokens. A card that was dropped isn't brought
+        // back: an outcome goes as a new message, and a card that still waits for a tap sends the person to Toolroll.
+        if (!state.repaint(action.part, content)) {
+            const { edit: _edit, proposal: _proposal, phase: _phase, ...asNew } = content;
+            state.plan(event.id, [content.proposal === undefined ? asNew : { text: CARD_GONE }], now);
+        }
         if (!content.proposal)
             state
                 .prepare("UPDATE chat_action SET consumed=? WHERE provider=:provider AND proposal=? AND consumed IS NULL")

package/dist/chat-flow.js

@@ -35,7 +35,7 @@ import { renderReply } from "./reply-shape.js";
 import { deciderOf, replyTarget } from "./flows.js";
 import { LEAD_MESSAGE_MAX_CHARS } from "./lead.js";
 import { verifyApproverStanding } from "./principal.js";
-import { chatHash, partContent, savedChatPart } from "./chat-delivery-state.js";
+import { chatHash, partContent } from "./chat-delivery-state.js";
 import { readHeldWords } from "./contracts/chat-content.js";
 import { FLOW_DECIDE_KEY, flowDecisionAt } from "./telegram-flow.js";
 import { phoneCommand } from "./telegram-status.js";
@@ -144,14 +144,16 @@ const retire = (state, card, entry, now) => {
     state.prepare("UPDATE chat_flow_choice SET consumed=? WHERE provider=:provider AND card=? AND entry=? AND consumed IS NULL").run(now.toISOString(), card, entry);
     state.prepare("UPDATE chat_flow_prompt SET consumed=? WHERE provider=:provider AND card=? AND entry=? AND consumed IS NULL").run(now.toISOString(), card, entry);
 };
-/** Show the tapped notice again with what happened, and without its buttons. */
-function repaint(state, part, event, line) {
+/** Show the tapped notice again with what happened, and without its buttons. A notice that was dropped isn't brought
+ * back: the line goes as a new message. */
+function repaint(state, part, event, line, now) {
     const row = state.prepare("SELECT payload FROM chat_part WHERE provider=:provider AND id=?").get(part);
     const before = row === undefined ? { text: "" } : partContent(String(row["payload"]));
     // An item list (flow-items.ts) stays whole and keeps its bold titles and labelled links; only plain text is capped.
     const content = { text: before.voice === true ? `${before.text}\n\n${line}` : `${before.text}\n\n${line}`.slice(0, PART_CHARS + 400), edit: event.ts, ...(before.voice === true ? { voice: true } : {}),
         ...(before.link === undefined ? {} : { link: before.link }), ...(before.channel === undefined ? {} : { channel: before.channel }) };
-    state.prepare("UPDATE chat_part SET payload=?,state='pending',next_at=NULL WHERE provider=:provider AND id=?").run(savedChatPart(content), part);
+    if (!state.repaint(part, content))
+        state.plan(event.id, [{ text: line }], now);
 }
 /**
  * A tapped flow button, inside the action's transaction. false when the
@@ -177,7 +179,7 @@ export function applyChatFlowTap(options, event, binding, token, repos, now) {
     const waiting = flowDecisionAt(store, card, entry);
     if (waiting === null) {
         retire(state, card, entry, now);
-        repaint(state, part, event, "This card has moved on since; nothing was changed.");
+        repaint(state, part, event, "This card has moved on since; nothing was changed.", now);
         state.finish(event.id);
         return true;
     }
@@ -199,7 +201,7 @@ export function applyChatFlowTap(options, event, binding, token, repos, now) {
         }
         retire(state, card, entry, now);
         store.retireTelegramFlowVisit(card, entry, now);
-        repaint(state, part, event, `✅ You approved it. ${decided.said}`);
+        repaint(state, part, event, `✅ You approved it. ${decided.said}`, now);
         state.finish(event.id);
         return true;
     }
@@ -234,7 +236,7 @@ function applyChatChoiceTap(options, event, binding, token, repos, now) {
     const visit = flowChoiceAt(store, card, entry);
     if (visit === null) {
         retire(state, card, entry, now);
-        repaint(state, part, event, "This card has moved on since; nothing was changed.");
+        repaint(state, part, event, "This card has moved on since; nothing was changed.", now);
         state.finish(event.id);
         return true;
     }
@@ -254,7 +256,7 @@ function applyChatChoiceTap(options, event, binding, token, repos, now) {
     }
     retire(state, card, entry, now);
     store.retireFlowChoices(card, entry, now);
-    repaint(state, part, event, `✅ You chose “${label}”. ${chosen.said}`);
+    repaint(state, part, event, `✅ You chose “${label}”. ${chosen.said}`, now);
     state.finish(event.id);
     return true;
 }
@@ -349,7 +351,7 @@ function applyChatNoteTap(options, event, binding, token, repos, now) {
     }
     const part = Number(tapped["part"]), card = Number(tapped["card"]), entry = Number(tapped["entry"]);
     if (tapped["consumed"] !== null || String(tapped["expires"]) <= now.toISOString()) {
-        repaint(state, part, event, "That choice was already made, or the card moved on; nothing was changed.");
+        repaint(state, part, event, "That choice was already made, or the card moved on; nothing was changed.", now);
         state.finish(event.id);
         return true;
     }
@@ -358,7 +360,7 @@ function applyChatNoteTap(options, event, binding, token, repos, now) {
     const kept = typeof tapped["words"] === "string" ? readHeldWords(tapped["words"]) : null;
     const words = kept?.ok === true ? kept.value : null;
     if (held === null || words === null) {
-        repaint(state, part, event, "That message is no longer kept; nothing was changed.");
+        repaint(state, part, event, "That message is no longer kept; nothing was changed.", now);
         state.finish(event.id);
         return true;
     }
@@ -366,12 +368,12 @@ function applyChatNoteTap(options, event, binding, token, repos, now) {
         // Passed on as the message it was, to the lead, once.
         state.enqueue({ id: chatHash(`${held.id}:lead`), installation: held.installation, binding: held.binding, kind: "message", channel: held.channel, member: held.member,
             ts: held.ts, thread: held.thread, payload: { ...words, lead: true }, created: now.toISOString() });
-        repaint(state, part, event, "Passed to the lead.");
+        repaint(state, part, event, "Passed to the lead.", now);
         state.finish(event.id);
         return true;
     }
     if (flowChoiceAt(store, card, entry) === null) {
-        repaint(state, part, event, "That choice was already made, or the card moved on; nothing was changed.");
+        repaint(state, part, event, "That choice was already made, or the card moved on; nothing was changed.", now);
         state.finish(event.id);
         return true;
     }
@@ -380,7 +382,7 @@ function applyChatNoteTap(options, event, binding, token, repos, now) {
         state.finish(event.id, true);
         return true;
     }
-    repaint(state, part, event, done.ok ? `↩️ ${done.said}` : done.said);
+    repaint(state, part, event, done.ok ? `↩️ ${done.said}` : done.said, now);
     state.finish(event.id);
     return true;
 }

package/dist/chat-live.js

@@ -25,6 +25,7 @@
  */
 import { createLiveReply, createLiveSender, LIVE_STATUS } from "./live-reply.js";
 import { renderReply, shapeReplyParts } from "./reply-shape.js";
+import { unsent } from "./chat-message-states.js";
 /** The live message's fixed words. */
 export const LIVE_WORDS = {
     working: "Working on it…",
@@ -131,7 +132,9 @@ export function planWithLive(state, event, parts, now) {
     state.store.transact(() => {
         const row = liveRow(state, event);
         const onto = row !== null && row.message !== null && (row.state === "placed" || row.state === "abandoned") && editable(parts[0]);
-        state.plan(event, onto ? [{ ...parts[0], edit: row.message }, ...parts.slice(1)] : parts, now);
+        // A dropped event gets no reply, so its live message is left as it is.
+        if (!state.plan(event, onto ? [{ ...parts[0], edit: row.message }, ...parts.slice(1)] : parts, now))
+            return;
         if (row === null)
             return;
         if (onto)
@@ -352,7 +355,7 @@ export async function ackPass(input) {
     if (hooks.unreact !== undefined) {
         const done = eventOf(state.prepare(`SELECT a.event FROM chat_ack a JOIN chat_event e ON e.provider = a.provider AND e.id = a.event
       WHERE a.provider = :provider AND a.state = 'sent' AND e.installation = ? AND e.state IN ('done','dropped')
-        AND NOT EXISTS (SELECT 1 FROM chat_part p WHERE p.provider = a.provider AND p.event = a.event AND p.state = 'pending')
+        AND NOT ${unsent("e")}
       ORDER BY a.created LIMIT 1`).get(installation));
         if (done !== null) {
             try {

package/dist/chat-message-states.d.ts

@@ -0,0 +1,75 @@
+/**
+ * An incoming chat message (a `chat_event` row of kind 'message'): what its states mean, the result words it is
+ * settled with, and the one question "which replies have not reached the person yet".
+ *
+ * States (contracts/chat-tables.ts): queued, running, done, failed, dropped.
+ *
+ * What `done` means differs by app, and nothing should read more into it than this:
+ *  - Telegram: done after every planned part of the reply was sent (or dropped as moot, such as a card whose
+ *    proposal was already answered elsewhere). It is written by `ChatMessages.finishMessage`, only by the claim
+ *    holder and only from 'running'.
+ *  - Slack, Discord and Teams: done as soon as the reply is planned, before any of it is sent. `ChatState.plan`
+ *    writes the parts and then `ChatState.finish` marks the row done in the same transaction; the parts go out
+ *    later, part by part, through `chat_part`.
+ * So `done` means "the message needs no more work from the lead", never "the person has the reply". To ask whether
+ * a reply has reached the person, use `unsent()` / `unsentPart()` below, which look at the parts themselves and
+ * give the same answer on every app.
+ *
+ * `failed` is used by Telegram only. `dropped` means the chat was disconnected (or an app gave the event up) while
+ * it waited; Telegram rows read a dropped row as failed. Dropped is final: `ChatState.finish` never writes over it,
+ * and `ChatState.plan` saves no reply for it.
+ */
+import type { ResolvedLead } from "./chat-channel.js";
+import type { LeadFailure, LeadRefusal } from "./lead.js";
+/**
+ * Every fixed result word a message row can be written with. These are stored in `chat_event.result`, so each one
+ * must stay byte-identical: renaming one would change what older rows mean.
+ */
+export declare const CHAT_MESSAGE_OUTCOMES: readonly ["answered", "replayed", "typed-start", "busy", "backlog", "replayed:running", "registry-unavailable", "registry-unavailable:admitted", "delivering", "answered:sending", "unpaired", "unsent:no-session", "replayed:missing", "typed-start:not-counted", "revoked"];
+export type ChatMessageFixedOutcome = (typeof CHAT_MESSAGE_OUTCOMES)[number];
+/** Words a message is queued under while it waits for another attempt (telegram-lead.ts `requeue`). */
+export declare const CHAT_WAIT_OUTCOMES: readonly ["busy", "backlog", "replayed:running", "registry-unavailable", "registry-unavailable:admitted"];
+export type ChatWaitOutcome = (typeof CHAT_WAIT_OUTCOMES)[number];
+/** Waiting for the lead itself (it is answering, or earlier messages wait first): the two-hour bound applies. */
+export declare const CHAT_LEAD_WAITS: readonly ["busy", "backlog"];
+export type ChatLeadWait = (typeof CHAT_LEAD_WAITS)[number];
+/** Waiting on a turn that was already admitted: no age bound (the turn's own deadline ends it). */
+export declare const CHAT_ADMITTED_WAITS: readonly ["replayed:running", "registry-unavailable:admitted"];
+/** The words a row is marked done with (the reply was sent). */
+export type ChatDoneOutcome = "answered" | "replayed" | "typed-start";
+type RefusedReason = LeadRefusal | Extract<ResolvedLead, {
+    ok: false;
+}>["reason"];
+/**
+ * Every result word, including the forms that carry a detail after a prefix or a suffix. Build the detailed forms
+ * with `chatOutcome` below, never by joining strings at the call site.
+ */
+export type ChatMessageOutcome = ChatMessageFixedOutcome | `${ChatWaitOutcome}:gave-up` | `refused:${RefusedReason}` | `failed:${LeadFailure}` | `replayed:${string}` | `unsent:gave-up:${string}` | `unsent:${string}`;
+/** Builders for the result words that carry a detail. The stored text is exactly what the old string joins wrote. */
+export declare const chatOutcome: {
+    /** A wait that ran past its age bound. */
+    readonly gaveUp: <W extends ChatWaitOutcome>(wait: W) => `${W}:gave-up`;
+    /** The lead refused the turn, or no session could be resolved for it. */
+    readonly refused: <R extends RefusedReason>(reason: R) => `refused:${R}`;
+    /** The turn ran and failed. */
+    readonly failed: <R extends LeadFailure>(reason: R) => `failed:${R}`;
+    /** The recovered turn had ended without an answer: its failure reason as the turn row stores it ("failed" when none). */
+    readonly replayedFailed: (reason: string | null) => `replayed:${string}`;
+    /** The reply could not go out: the chat or its projects changed (the problem in words). */
+    readonly unsent: (problem: string) => `unsent:${string}`;
+    /** The reply was still unsent a day after it was planned (the last send error, or "unsent"). */
+    readonly unsentGaveUp: (error: string | null) => `unsent:gave-up:${string}`;
+};
+/** Is this word one of the waits for the lead itself (busy or backlog)? */
+export declare function isLeadWait(outcome: string | null): outcome is ChatLeadWait;
+/** Is this word a wait on a turn that was already admitted (no age bound)? */
+export declare function isAdmittedWait(outcome: string | null): boolean;
+/** SQL: this `chat_part` row (by its alias) has not reached the person: planned and neither sent nor dropped. */
+export declare function unsentPart(part: string): string;
+/**
+ * SQL: the `chat_event` row (by its alias or table name) has a reply part that has not reached the person yet.
+ * The one answer to "is anything of this reply unsent?" on every app; wrap it in NOT for "everything reached them
+ * or was dropped". `part` names the inner alias when the caller's query already uses the default.
+ */
+export declare function unsent(event: string, part?: string): string;
+export {};