toolroll 0.9.99 → 0.9.100

package/dist/discord-chat.js

@@ -7,7 +7,7 @@ import { cardWithin } from "./chat-card.js";
 import { chatFlowButtons } from "./chat-flow.js";
 import { refuseResultShots, resultShotsPruned, shotWaitsUntil } from "./result-shots.js";
 import { admitChatEvent } from "./chat-admission.js";
-import { ChatState, ChatDeliveryError, chatHash, partContent, } from "./chat-delivery-state.js";
+import { ChatState, ChatDeliveryError, chatHash, chatRetryAt, partContent, } from "./chat-delivery-state.js";
 import { readChatPart } from "./contracts/chat-content.js";
 import { readDiscordButtonToken, readDiscordComponentInteraction } from "./contracts/discord-callback.js";
 import { processChatEvent, planChatNotifications, channelAccess, chatObject as object, planRoomMessages, heldForWatch, } from "./chat-delivery.js";
@@ -418,8 +418,7 @@ export async function deliverDiscordPart(options) {
         const problem = error instanceof ChatDeliveryError
             ? error
             : new DiscordError("Discord delivery is waiting to retry", 15_000, true);
-        const until = new Date((options.clock?.() ?? new Date()).getTime() +
-            Math.max(problem.retryMs, [5000, 15000, 60000, 300000][Math.min(row.attempts, 3)])).toISOString();
+        const until = chatRetryAt(options.clock?.() ?? new Date(), problem.retryMs, row.attempts);
         state.partFailed(row.id, { problem: problem.message, until, uncertain: problem.uncertain });
         state.setProblem(identity.installation, options.owner, problem.code === "ratelimited" ? "Discord asked us to wait. Saved replies will retry." : problem.message);
         if (problem.code === "ratelimited")

package/dist/dispatch.js

@@ -19,6 +19,7 @@ import { failedAttemptSentence, latestFinishedAttempt } from "./needs-you.js";
 import { buildReviewOf } from "./review-switch.js";
 import { vanishedStopOf, vanishedStopSentence } from "./vanished-retry.js";
 import { routeChangeOf } from "./route-change.js";
+import { wasInterrupted } from "./run-ending.js";
 import { BUILT_IN, refArchived, parseCapabilityKey } from "./store.js";
 import { shortWhen } from "./when-html.js";
 export const DEFAULT_MAX_OPEN_DECISIONS = 5;
@@ -157,7 +158,7 @@ function reviewViewOf(sourceRun, retry) {
         retriesRemaining: retry.retriesRemaining,
         latestRun: retry.latest?.runId ?? null,
         latestReason: retry.latest?.reason ?? null,
-        interrupted: retry.latest !== null && (retry.latest.outcome === "interrupted" || retry.latest.reason === "interrupted"),
+        interrupted: retry.latest !== null && wasInterrupted(retry.latest),
         queued: retry.openRequest === null ? null : { requestedBy: retry.openRequest.requestedBy, origin: retry.openRequest.origin },
     };
 }

package/dist/dispose.d.ts

@@ -1,7 +1,7 @@
 import { STORAGE_HOLD_PREFIX } from "./needs-you.js";
 import { type FailureClass } from "./claim.js";
 import type { BuildResult } from "./builder.js";
-import type { Store } from "./store.js";
+import type { ClosedState, Store } from "./store.js";
 import { type ProofVerdict } from "./proof.js";
 /**
  * Which road is disposing. 'tick' = the unattended loop: full task
@@ -59,6 +59,9 @@ export type Disposition = {
     disposition: string | null;
     strikes: number | null;
     sealed: boolean;
+    /** The state sealed when strikes ran out on a task a person had already closed (disposition "closed"): it is
+     * kept, with no incident, hold or page. Null for every other ending. */
+    closedState: ClosedState | null;
 }
 /** The standalone road's simple record: outcome written, nothing else. */
  | {

package/dist/dispose.js

@@ -316,7 +316,7 @@ function disposeBuildOutcomeLocked(context, result) {
         }
         if (leaseId === undefined) {
             store.finishRun(runId, { outcome: "failed", reason: result.reason, now: clock() });
-            return { kind: "failed", failureClass, disposition: null, strikes: null, sealed: false };
+            return { kind: "failed", failureClass, disposition: null, strikes: null, sealed: false, closedState: null };
         }
         const sealed = finalize(store, leaseId, {
             kind: "failure",
@@ -333,6 +333,7 @@ function disposeBuildOutcomeLocked(context, result) {
             disposition: sealed.ok ? sealed.disposition : null,
             strikes: sealed.ok && "strikes" in sealed ? sealed.strikes : null,
             sealed: sealed.ok,
+            closedState: sealed.ok && sealed.disposition === "closed" ? sealed.state : null,
         };
     }
     if (result.reason === "protected-storage") {

package/dist/fallback.js

@@ -22,6 +22,7 @@ import { isProviderId, validateSpec } from "./provider.js";
 import { providerName } from "./provider-auth.js";
 import { PLAN_LOGIN_PROVABLE } from "./plan-login.js";
 import { canonicalChainJson, chainDigestOf, LIVE_CHAIN_VERSION, liveChainFromJson, machineActing, profileDigestOf } from "./scope.js";
+import { moveTask } from "./task-moves.js";
 export const MAX_FALLBACK_ENTRIES = 3;
 const tablesSeen = new WeakSet();
 function hasTables(store) {
@@ -516,7 +517,7 @@ export function blockAfterSignedOut(store, runId, now) {
         store.handle.prepare("UPDATE run SET reason = 'fallback-signed-out' WHERE id = ? AND outcome = 'refused'").run(runId);
         const ref = store.refForId(run.taskRef);
         if (ref !== null)
-            store.handle.prepare("UPDATE task SET state = 'failed', updated_at = ? WHERE id = ? AND state IN ('queued','running')").run(now.toISOString(), ref.externalId);
+            moveTask(store.handle, ref.externalId, "giveUp", now);
         return true;
     });
 }
@@ -568,7 +569,7 @@ export function moveOnIfExhausted(store, runId, taskId, now) {
     store.handle.prepare("INSERT INTO fallback_move (walk, to_index, from_run, terminal_class, paid, moved_at) VALUES (?, ?, ?, ?, ?, ?)")
         .run(walk.id, run.chainIndex + 1, run.id, evidence.terminalClass, paid ? 1 : 0, now.toISOString());
     store.handle.prepare("UPDATE fallback_walk SET cursor = ? WHERE id = ?").run(run.chainIndex + 1, walk.id);
-    store.handle.prepare("UPDATE task SET state = 'queued', updated_at = ? WHERE id = ? AND state = 'running'").run(now.toISOString(), taskId);
+    moveTask(store.handle, taskId, "requeue", now);
     store.recordAction({ at: now.toISOString(), actor: "toolroll", repo: store.refForId(run.taskRef)?.repo ?? null, taskId, runId: run.id, action: "work moved to fallback agent", outcome: paid ? "paid" : "plan", source: "work", detail: entryWords(to) });
     tell(store, run, taskId, "moved", to, now);
     store.bumpWake();

package/dist/fast-start.js

@@ -31,7 +31,7 @@ import { fileTaskProposal } from "./proposal.js";
 import { releaseCiHoldOf } from "./release-ci-hold.js";
 import { COMPLETION_ACTION, COMPLETION_BY_PERSON } from "./result-completion.js";
 import { deployGateScope, machineActing, propose, releaseCheckScope } from "./scope.js";
-import { BUILT_IN } from "./store.js";
+import { BUILT_IN, withdrawApproval } from "./store.js";
 import { classifyTask, filingSizer, heuristicSizing } from "./task-sizing.js";
 import { issueImported } from "./task-source.js";
 import { titleWithin } from "./task-text.js";
@@ -295,7 +295,7 @@ export function expireFastStarts(store, now) {
         store.transact(() => {
             if (store.currentLiveLease(ref, now) !== null)
                 return;
-            store.handle.prepare(`UPDATE task_scope SET approved_at = NULL, approved_by = NULL, approved_digest = NULL, approved_profile_json = NULL, approved_route_json = NULL, approval_basis = NULL WHERE task_id = ?`).run(task);
+            withdrawApproval(store, { where: "WHERE task_id = ?", args: [task] }, { basisAfter: null, clearRoute: true, clearModeDigest: false });
             store.handle.prepare("UPDATE task_ref SET fast_start_until = NULL WHERE id = ?").run(ref);
             store.recordAction({ at: stamp, actor: "system", repo: row["repo"] === null ? null : String(row["repo"]), taskId: task, runId: null, action: "fast start expired", outcome: "seal cleared", source: "work", detail: `no build started within ${FAST_WINDOW_MS / 60_000} minutes` });
             cleared++;

package/dist/monitoring.js

@@ -19,6 +19,7 @@ import { createHash, createHmac, randomUUID } from "node:crypto";
 import { closeSync, constants, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, writeSync } from "node:fs";
 import { hostname } from "node:os";
 import { basename, join } from "node:path";
+import { wasInterrupted } from "./run-ending.js";
 import { COMPLETION_ACTION } from "./result-completion.js";
 export const SIGNATURE_HEADER = "x-standing-orders-signature";
 const BATCH = 200;
@@ -164,7 +165,7 @@ export function spansFor(store, entries) {
                 continue;
             const root = rootOf(taskId);
             const ref = store.refForId(run.taskRef);
-            const failed = run.outcome === "failed" || run.outcome === "refused" || run.outcome === "interrupted";
+            const failed = run.outcome === "failed" || run.outcome === "refused" || wasInterrupted(run);
             spans.push({
                 traceId: hex(`standing-orders/trace/${root}`, 32), spanId: hex(`standing-orders/run/${run.id}`, 16), parentSpanId: hex(`standing-orders/task/${root}`, 16),
                 name: `${run.role} · ${run.provider}`, kind: 1, startTimeUnixNano: nanos(run.startedAt), endTimeUnixNano: nanos(run.finishedAt),

package/dist/operate.js

@@ -123,7 +123,7 @@ import { homedir, hostname } from "node:os";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { releaseStalledUpdate, waitingUpdate } from "./toolroll-update.js";
 import { dur } from "./design/kit.js";
-import { checkoutIdle, setCheckoutIdle, leadQuickAnswersOn, setLeadQuickAnswers, openStore, openStoreNoMigrate, initLocalMode, enrollOwnerPassword, installationCreatedBy, laptopPortOf, recordLaptopPort, localModeOf, localOwnerBinding, archiveTaskFamily, restoreTaskFamily, shipChecksForTask, elapsedSeconds, CONCURRENT_WRITER_WAIT_MS, isDatabaseBusy, databasePath, BUILT_IN, parseCapabilityKey, verifiedAuthor, isDigestTime, predecessorWatches, RESULT_SCREENSHOTS, lifecycleOf, reportLifecycle, beatLifecycle, } from "./store.js";
+import { requeueEligibility, checkoutIdle, setCheckoutIdle, leadQuickAnswersOn, setLeadQuickAnswers, openStore, openStoreNoMigrate, initLocalMode, enrollOwnerPassword, installationCreatedBy, laptopPortOf, recordLaptopPort, localModeOf, localOwnerBinding, archiveTaskFamily, restoreTaskFamily, shipChecksForTask, elapsedSeconds, CONCURRENT_WRITER_WAIT_MS, isDatabaseBusy, databasePath, BUILT_IN, parseCapabilityKey, verifiedAuthor, isDigestTime, predecessorWatches, RESULT_SCREENSHOTS, lifecycleOf, reportLifecycle, beatLifecycle, } from "./store.js";
 import { createHash, randomBytes, randomInt, randomUUID } from "node:crypto";
 import { claimInstance, clearInstance, openInstanceSocket } from "./console-instance.js";
 import { backgroundOff, backgroundOn, backgroundShow, laptopStatus, laptopStop, restartOwnBuilder } from "./laptop-background.js";
@@ -220,6 +220,7 @@ import { describePublicationGrant, observeChecks, publishPass, sweepMerges, } fr
 import { checkPublishing, publishingOf, savePublishing, followPullRequests, newestPullRequestOf } from "./pull-request-flow.js";
 import { starterOf, startersFor, switchOnStarter } from "./flow-starters.js";
 import { acquire, acquireIfReady, heartbeat, release, reap, currentClaim, DEFAULT_LEASE_MS, SYNC_MAX_AGE_MS, finalize, } from "./claim.js";
+import { moveTask } from "./task-moves.js";
 import { disposeBuildOutcome, holdStaleApproval, regateTask } from "./dispose.js";
 import { proposeGrant, describeGrant, describeWithheld, permits, MUTATION_CLASSES, DEFAULT_MUTATIONS, } from "./grant.js";
 import { builtIn, guarded } from "./backend.js";
@@ -296,6 +297,7 @@ import { machineActing } from "./scope.js";
 import { reevaluateResultRecords } from "./route-results.js";
 import { holdRuleOff, routeRulesPass, taskEvidenceWords } from "./route-rules.js";
 import { ruleHoldOf } from "./route-store.js";
+import { wasInterrupted } from "./run-ending.js";
 import { loginFileOf, migrateLegacyLogin, savedLoginFile, writableLoginFile } from "./login-secrets.js";
 /**
  * 0 done · 1 broke · 2 bad usage · 3 ran fine, the answer is no.
@@ -1672,12 +1674,9 @@ function claimCommand(positional, flags, context) {
             return fail(write, json, "claim", verdict.reason, verdict.message, EXIT.refused);
     }
     const ref = store.refFor(backend, id);
-    const result = acquire(store, ref.id, runner, {
-        now,
-        token,
-        ttlMs: ttl,
-        mutation: mutationFrom(flags, now),
-    });
+    // The grant and the `running` it makes are one transaction (closed-task-claims.md §3.5): nobody can close the task
+    // between them, and a refusal writes neither.
+    const result = claimAndMarkRunning(store, backend, id, ref.id, runner, { now, token, ttlMs: ttl, mutation: mutationFrom(flags, now) });
     if (!result.ok) {
         // Two distinct refusals: somebody HOLDS it right now, or it is
         // RESERVED for a specific worker whoever asks (queue columns, v19).
@@ -1712,24 +1711,12 @@ function claimCommand(positional, flags, context) {
             return fail(write, json, "claim", "archived", `${id} is put away — restore it with \`toolroll task restore ${id}\` first`, EXIT.refused);
         if (result.reason === "draining")
             return fail(write, json, "claim", "draining", `Toolroll is restarting (draining): ${runner} takes no new work until it is back (by ${result.until})`, EXIT.refused, { until: result.until });
+        if (result.reason === "closed")
+            return fail(write, json, "claim", "closed", closedClaimWords(store, id, result.state, now), EXIT.refused, { state: result.state });
+        if (result.reason === "no-task")
+            return fail(write, json, "claim", "no-task", `no task \`${id}\``, EXIT.refused);
         return fail(write, json, "claim", result.reason, `held by ${result.by} until ${result.until}`, EXIT.refused, { holder: result.by, until: result.until });
     }
-    // Taking a task is what makes it running; leaving that to the caller would
-    // let a claimed task keep showing up as queued to anything reading state.
-    // On an idempotent REPLAY the transition runs only as the ONE narrow
-    // repair (external dispatch, finding 36): the stored claim is still the
-    // live lease and the task never left queued — anything else (cancelled,
-    // done, reopened elsewhere) mutates nothing.
-    if (result.replayed === true) {
-        const task = store.getTask(id);
-        const ref = store.lookupRef(id);
-        const stillMine = ref !== null && store.currentLiveLease(ref.id, now) === result.claim.leaseId;
-        if (task !== null && task.state === "queued" && stillMine)
-            store.setTaskState(id, "running", now);
-    }
-    else {
-        store.setTaskState(id, "running", now);
-    }
     return succeed(write, json, "claim", { lease: result.claim, reclaimed: result.reclaimed }, () => [
         `Claimed ${id} as ${runner}.`,
         `  lease   ${result.claim.leaseId}`,
@@ -1751,20 +1738,18 @@ function leaseCommand(command, positional, flags, context) {
     const ttl = readTtl(flags);
     if (ttl === null)
         return fail(write, json, name, "usage", "--ttl takes whole seconds", EXIT.usage);
-    const result = command === "heartbeat" ? heartbeat(store, lease, now, ttl) : release(store, lease, now);
+    // Releasing says the runner is finished with it, not that it succeeded, so a task left running is put back rather
+    // than marked done, in the release's own transaction (releaseToQueue).
+    const result = command === "heartbeat" ? heartbeat(store, lease, now, ttl) : releaseToQueue(store, lease, now);
     if (!result.ok) {
+        if (result.reason === "closed") {
+            return fail(write, json, name, "closed", `this lease ran out and its task is ${result.state} now, so it can't be renewed; stop rather than retry`, EXIT.refused, { state: result.state });
+        }
         const message = result.reason === "fenced"
             ? "superseded — another runner holds this task now; stop rather than retry"
             : "no such lease";
         return fail(write, json, name, result.reason, message, EXIT.refused);
     }
-    if (command === "release") {
-        const task = store.getTask(String(refExternalId(store, result.claim.taskRef)));
-        // Releasing says the runner is finished with it, not that it succeeded, so
-        // a task left running is put back rather than marked done.
-        if (task !== null && task.state === "running")
-            store.setTaskState(task.id, "queued", now);
-    }
     return succeed(write, json, name, { lease: result.claim }, () => [
         command === "heartbeat"
             ? `Still yours until ${result.claim.expiresAt}.`
@@ -3512,7 +3497,7 @@ async function tickCommand(flags, context) {
                             ? "auth-expired — requeued, sign-in needed"
                             : disposition.disposition === "fallback"
                                 ? `out of plan — moved to the next approved agent`
-                                : `${disposition.failureClass}${disposition.disposition === "backoff" ? ` — retry ${disposition.strikes}/3` : disposition.disposition === "stalled" ? " — stalled" : ""}`
+                                : `${disposition.failureClass}${disposition.disposition === "backoff" ? ` — retry ${disposition.strikes}/3` : disposition.disposition === "stalled" ? " — stalled" : disposition.closedState !== null ? ` — the task was already ${disposition.closedState}, so it stays ${disposition.closedState}` : ""}`
                         : "fenced",
                     ...(result.ok ? {} : { detail: result.message.slice(0, 200) }),
                     worktree: leased.worktree.path,
@@ -9543,7 +9528,7 @@ function reviewStatusLines(review, sourceRun) {
         queued: "legacy request retained; the worker will close it without running a model review",
         running: `running — attempt ${review.live?.attempt ?? review.attempts.length} of ${review.cap}`,
         succeeded: `succeeded on attempt ${review.succeeded?.attempt ?? 1} of ${review.cap}`,
-        retryable: `${review.latest?.outcome === "interrupted" || review.latest?.reason === "interrupted" ? "interrupted" : "failed"} on attempt ${review.latest?.attempt ?? review.attempts.length} of ${review.cap} — inspect the saved result; model reviews no longer retry`,
+        retryable: `${review.latest !== null && wasInterrupted(review.latest) ? "interrupted" : "failed"} on attempt ${review.latest?.attempt ?? review.attempts.length} of ${review.cap} — inspect the saved result; model reviews no longer retry`,
         exhausted: `exhausted — all ${review.cap} attempts ended without a review; nothing retries a fourth time`,
     };
     const first = review.state === "queued" && review.attempts.length === 0 ? "queued — waiting for a worker" : word[review.state];
@@ -12066,9 +12051,6 @@ function slug(title, now) {
     const stamp = now.toISOString().slice(11, 19).replace(/:/g, "");
     return words === "" ? `task-${stamp}` : `${words}-${stamp}`;
 }
-function refExternalId(store, taskRef) {
-    return store.externalIdFor(taskRef);
-}
 function describe(error) {
     return error instanceof Error ? error.message : String(error);
 }
@@ -14299,3 +14281,60 @@ function startServiceBeats(store) {
     void delivery.runNow();
     return beats;
 }
+/**
+ * The CLI `claim`'s grant and its `running`, one transaction (docs/plans/closed-task-claims.md §3.5). A fresh grant of
+ * a built-in task moves it to running through the narrow `claim` move; a replay of the same key repairs `running` only
+ * when the task is still queued and the replayed lease is still the live one, as before. A task of another backend is
+ * never written in the built-in table.
+ */
+function claimAndMarkRunning(store, backend, id, taskRef, runner, options) {
+    const { now } = options;
+    return store.transact(() => {
+        const result = acquire(store, taskRef, runner, options);
+        if (!result.ok || backend !== BUILT_IN)
+            return result;
+        if (result.replayed === true) {
+            const task = store.getTask(id);
+            const stillMine = store.currentLiveLease(taskRef, now) === result.claim.leaseId;
+            if (task !== null && task.state === "queued" && stillMine)
+                store.setTaskState(id, "running", now);
+            return result;
+        }
+        // The grant just read this row open in this transaction, so the move cannot miss; if it ever did, throwing rolls
+        // the grant back with it.
+        if (!moveTask(store.handle, id, "claim", now))
+            throw new Error(`claim: ${id} could not be marked running`);
+        store.bumpWake();
+        return result;
+    });
+}
+/**
+ * The refusal words for a claim on a closed task: what state it is in, and only a next step that works for this task
+ * (a requeue the store would accept, a cancelled task reopened through the state verb, otherwise the task itself).
+ */
+function closedClaimWords(store, id, state, now) {
+    const head = `${id} is ${state}, so it can't be claimed.`;
+    if (state === "cancelled")
+        return `${head} To run it again, reopen it: \`toolroll task state ${id} queued\``;
+    if (requeueEligibility(store, id, now).ok)
+        return `${head} To run it again: \`toolroll task requeue ${id}\``;
+    return `${head} See its result: \`toolroll task show ${id}\``;
+}
+/**
+ * `worker release`: hand the lease back and, when this release is the one that ended the claim, put a task left
+ * running back in the queue, in one transaction, so no one can claim it in between (closed-task-claims.md §5). A
+ * duplicate release changes nothing: by then another runner may hold the task.
+ */
+function releaseToQueue(store, lease, now) {
+    return store.transact(() => {
+        const result = release(store, lease, now);
+        if (!result.ok || result.duplicate === true)
+            return result;
+        const ref = store.refForId(result.claim.taskRef);
+        if (ref === null || ref.backend !== BUILT_IN)
+            return result;
+        if (store.getTask(ref.externalId)?.state === "running")
+            store.setTaskState(ref.externalId, "queued", now);
+        return result;
+    });
+}

package/dist/plane-review.js

@@ -30,6 +30,7 @@
 import { scanForSecrets } from "./evidence.js";
 import { scrubIntegrationText } from "./integrations.js";
 import { taskWaitSnapshot } from "./lead-status.js";
+import { wasInterrupted } from "./run-ending.js";
 export const REVIEW_HOURS = 24;
 const EVIDENCE_LINES = 5;
 const WAITING_DAYS = 1;
@@ -73,7 +74,7 @@ export function runCause(run) {
         return "timeout";
     if (reason === "no-handoff")
         return "no-handoff";
-    if (reason === "interrupted" || run.outcome === "interrupted")
+    if (wasInterrupted(run))
         return run.stopped ? null : "orphaned";
     if (PROVIDER_REASONS.has(reason) || run.terminalClass === "transient-throttle")
         return "provider";

package/dist/project-knowledge.d.ts

@@ -22,18 +22,17 @@ export type KnowledgeView = ReturnType<typeof knowledgeView>;
 export declare function knowledgeVersion(store: Store, repo: string, actor: string, revision: number): Knowledge;
 /** Chat reads only an admitted project. Keep the full source in the project UI. */
 export declare function conversationKnowledge(store: Store, repo: string, actor: string, reference?: string, decision?: number): {
-    content?: never;
     history?: never;
     revision: number;
     stale: boolean;
     notice: string;
     title?: never;
+    content?: never;
     instructions?: never;
     references?: never;
     decisions?: never;
     waiting?: never;
 } | {
-    content?: never;
     revision?: never;
     history?: never;
     stale?: never;
@@ -54,6 +53,7 @@ export declare function conversationKnowledge(store: Store, repo: string, actor:
     afterwards?: string;
     notice: string;
     title?: never;
+    content?: never;
     instructions?: never;
     references?: never;
     decisions?: never;
@@ -70,9 +70,9 @@ export declare function conversationKnowledge(store: Store, repo: string, actor:
     decisions?: never;
     waiting?: never;
 } | {
-    content?: never;
     stale?: never;
     title?: never;
+    content?: never;
     revision: number;
     history: {
         revision: number;

package/dist/release-authority.d.ts

@@ -7,6 +7,15 @@ import { type ReleasePolicy, type ReleaseTerms } from "./contracts/release-terms
 import type { Store } from "./store.js";
 export type ReleaseState = "open" | "deploying" | "merge-reserved" | "merged" | "revoked" | "expired" | "superseded";
 export declare const LIVE_RELEASE_STATES: readonly ReleaseState[];
+/**
+ * Whether an authority's approval has run out at `now`. Nothing writes the `expired` state: expiry is worked out from
+ * `expires_at` here, and every reader that asks whether an authority is still good asks through this (or
+ * releaseStateAt). The one SQL reader, approval-authority.ts releaseStandsSql, states the same rule in SQL.
+ */
+export declare function releaseExpiredAt(a: Pick<ReleaseAuthority, "state" | "expiresAt">, now: Date): boolean;
+/** An authority's state as read at `now`: a live one (open, deploying, merge-reserved) past its time reads as `expired`;
+ * an ended one keeps the state it ended in. */
+export declare function releaseStateAt(a: Pick<ReleaseAuthority, "state" | "expiresAt">, now: Date): ReleaseState;
 /** One generation of a release a person approved: the single source of truth for it. */
 export type ReleaseAuthority = {
     id: number;

package/dist/release-authority.js

@@ -5,6 +5,19 @@
  */
 import { readReleasePolicy } from "./contracts/release-terms.js";
 export const LIVE_RELEASE_STATES = ["open", "deploying", "merge-reserved"];
+/**
+ * Whether an authority's approval has run out at `now`. Nothing writes the `expired` state: expiry is worked out from
+ * `expires_at` here, and every reader that asks whether an authority is still good asks through this (or
+ * releaseStateAt). The one SQL reader, approval-authority.ts releaseStandsSql, states the same rule in SQL.
+ */
+export function releaseExpiredAt(a, now) {
+    return a.state === "expired" || a.expiresAt <= now.toISOString();
+}
+/** An authority's state as read at `now`: a live one (open, deploying, merge-reserved) past its time reads as `expired`;
+ * an ended one keeps the state it ended in. */
+export function releaseStateAt(a, now) {
+    return LIVE_RELEASE_STATES.includes(a.state) && releaseExpiredAt(a, now) ? "expired" : a.state;
+}
 function readReleaseAuthority(row) {
     const text = (key) => row[key] == null ? null : String(row[key]);
     let policy = null;

package/dist/release-auto.js

@@ -26,7 +26,7 @@ import { releaseCheckStanding } from "./check-failure.js";
 import { CARRY_RULES, rulePath } from "./release-carry.js";
 import { AUTO_EVIDENCE_ACTION, AUTO_WITHDRAWN_ACTION, LIVE_RELEASE_STATES, RELEASE_APPROVAL_ACTION, releaseAuthorityOfTask, releaseAutoApproves, releaseApprovalSetting } from "./release-authority.js";
 import { autoReleaseApprovalOf, personApprovalOf } from "./scope.js";
-import { releaseOperations, revokeRelease } from "./store.js";
+import { releaseOperations, revokeRelease, withdrawApproval } from "./store.js";
 import { RELEASE_CI_HELD_ACTION, RELEASE_CI_PASSED_ACTION, RELEASE_CI_RUNNING_WORDS, releaseCiHoldOf, releaseCiRunningOf } from "./release-ci-hold.js";
 import { verificationEvidence } from "./verification-evidence.js";
 import { nightlyDebtHold } from "./nightly-github.js";
@@ -87,8 +87,7 @@ export function setReleaseApproval(store, repo, auto, by, now) {
  * marked withdrawn, so no later reading — the setting turned on again included — lets it stand. */
 function unseal(store, taskId, now) {
     withdraw(store, taskId, now);
-    store.handle.prepare(`UPDATE task_scope SET approved_at = NULL, approved_by = NULL, approved_digest = NULL, approved_profile_json = NULL,
-      approved_route_json = NULL, approval_basis = NULL, mode_digest = NULL WHERE task_id = ? AND approval_basis IN ('auto-check', 'auto-green')`).run(taskId);
+    withdrawApproval(store, { where: "WHERE task_id = ? AND approval_basis IN ('auto-check', 'auto-green')", args: [taskId] }, { basisAfter: null, clearRoute: true, clearModeDigest: true });
 }
 /** Mark a task's automatic seal's evidence withdrawn for good (its seal row may stay while an issued merge reconciles). */
 function withdraw(store, taskId, now) {

package/dist/release-gate.js

@@ -27,7 +27,7 @@ import { BEFORE_SWAP, RELEASED } from "./deploy-phase.js";
 /** The journal phases a deployment passes before it stops the old service (deploy-phase.ts, the one table). */
 export { BEFORE_SWAP };
 /** Journal fields that only the swap and later phases write. */
-const SWAP_FIELDS = ["stoppingService", "codingBackupBeforeSwap", "migration", "newService", "deployedAt"];
+const SWAP_FIELDS = ["stoppingService", "codingBackupBeforeSwap", "migration", "newService", "deployedAt", "launchd", "newServiceStop"];
 const GATE_ID = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;
 const refuse = (reason, message) => ({ ok: false, reason, message: `${message} The update pause was left as it is.` });
 /** The owner id written into the live pause's triggers, when there is one pause and it names one id. */

package/dist/release-view.js

@@ -6,6 +6,7 @@
 import { liveReleaseOf } from "./scope.js";
 import { nightlyReleaseLines } from "./nightly-github.js";
 import { releaseAuthorityOfTask, releaseCarries } from "./store.js";
+import { releaseStateAt } from "./release-authority.js";
 export function releaseViewOf(store, taskId, now, obligations = () => []) {
     const found = releaseAuthorityOfTask(store, taskId);
     if (found === null)
@@ -18,7 +19,7 @@ export function releaseViewOf(store, taskId, now, obligations = () => []) {
     return {
         kind: found.carry === null ? "anchor" : "carried",
         authority: a.id, version: a.version, pr: a.pr, state: a.state,
-        carrying: a.state === "open" && live.applies && live.ok, why: live.applies && !live.ok ? live.why : null,
+        carrying: releaseStateAt(a, now) === "open" && live.applies && live.ok, why: live.applies && !live.ok ? live.why : null,
         approver: anchor?.approvedBy ?? null, anchorTask: a.anchorTask, tipTask: a.tipTask, expiresAt: a.expiresAt,
         landed: releaseCarries(store, a.id).flatMap(carry => carry.commits.map(commit => ({ sha: commit.sha, task: carry.taskId, files: commit.files }))),
         obligations: obligations(a.id),

package/dist/release.js

@@ -667,6 +667,17 @@ export async function runRelease(options, adapters) {
                 return head !== null && head !== j.candidate.sha ? head : null;
             });
         };
+        /**
+         * Move the release back to an earlier step: write the fields the caller names (and only those), drop the named steps'
+         * intents, set the step, and save the journal. Every step-back goes through here.
+         */
+        const rewindTo = (step, fields, dropIntents = []) => {
+            Object.assign(j, fields);
+            for (const one of dropIntents)
+                delete j.intents[one];
+            j.step = step;
+            save();
+        };
         const restart = async (head, updated = false) => {
             // The step this commit was at ends here: the release goes on with the new commit (and, filed again, a new task).
             mark(j.step, "failed", `${j.branch} moved to ${head.slice(0, 7)}`);
@@ -678,16 +689,10 @@ export async function runRelease(options, adapters) {
                 const carried = await rel.carry(j.authority.id, head, randomUUID(), epoch);
                 if (carried.ok) {
                     const view = await rel.authority(carried.taskId);
+                    // The candidate is written before the gate is read, as it always was: a gate that fails leaves it moved.
                     j.candidate = { sha: head, tree };
-                    j.task = { id: carried.taskId, scopeDigest: (await adapters.toolroll.gate(carried.taskId)).scopeDigest };
-                    j.check = null;
-                    j.completion = null;
-                    j.landed = view?.landed ?? j.landed ?? [];
-                    delete j.intents.check;
-                    delete j.intents.complete;
-                    j.step = "check";
-                    j.stopped = null;
-                    save();
+                    const task = { id: carried.taskId, scopeDigest: (await adapters.toolroll.gate(carried.taskId)).scopeDigest };
+                    rewindTo("check", { task, check: null, completion: null, landed: view?.landed ?? j.landed ?? [], stopped: null }, ["check", "complete"]);
                     say(`  carried the approval to ${head.slice(0, 7)} (task ${carried.taskId})`);
                     return;
                 }
@@ -695,30 +700,16 @@ export async function runRelease(options, adapters) {
             }
             else
                 say(`  ${j.branch} moved to ${head.slice(0, 7)}: filing it for approval`);
-            j.candidate = { sha: head, tree };
-            j.task = { id: gateTaskId(j.packageVersion, head), scopeDigest: null };
-            j.approval = null;
-            j.check = null;
-            j.completion = null;
-            j.authority = null;
-            j.auto = null;
             epoch = null;
-            delete j.intents.gate;
-            delete j.intents.check;
-            delete j.intents.complete;
-            j.step = "gate";
-            j.stopped = null;
-            save();
+            rewindTo("gate", { candidate: { sha: head, tree }, task: { id: gateTaskId(j.packageVersion, head), scopeDigest: null },
+                approval: null, check: null, completion: null, authority: null, auto: null, stopped: null }, ["gate", "check", "complete"]);
         };
         /**
          * The automatic road ended without an approval: the plane takes its `auto-check` back (the task asks a person, its
          * passing check kept) and tells the owner; the release waits at approval for a person, as without the setting.
          */
         const autoRefused = async (why) => {
-            j.auto = { state: "refused", why };
-            j.check = null;
-            j.step = "approval";
-            save();
+            rewindTo("approval", { auto: { state: "refused", why }, check: null });
             await rel?.auto?.giveUp(j.task.id, why);
             throw new Stop("approval", `Not approved automatically: ${why}. A person approves task ${j.task.id} (\`toolroll task approve ${j.task.id} --digest ${j.task.scopeDigest}\`, or the console), then rerun \`${resume}\`.`);
         };
@@ -1053,10 +1044,7 @@ export async function runRelease(options, adapters) {
                                 }
                                 catch (error) {
                                     if (error instanceof Stop && error.reason === "ci-failed") {
-                                        j.auto = { state: "refused", why: error.message };
-                                        j.check = null;
-                                        j.step = "approval";
-                                        save();
+                                        rewindTo("approval", { auto: { state: "refused", why: error.message }, check: null });
                                         await rel?.auto?.giveUp(j.task.id, error.message.replace(/\.$/, ""));
                                     }
                                     throw error;

package/dist/result-shots.js

@@ -169,6 +169,6 @@ export function refuseResultShots(state, store, part, content, app, now) {
     const title = chatTitle(store, content.image?.taskId ?? content.task ?? "");
     const line = { text: `Screenshots for ${title} weren't sent: the ${app} app isn't allowed to upload files here.`,
         ...(content.task === undefined ? {} : { task: content.task }), ...(content.run === undefined ? {} : { run: content.run }) };
-    state.prepare("UPDATE chat_part SET payload=?,state='pending',next_at=NULL,problem=NULL,file=NULL,uploaded=0,uncertain=0,created=? WHERE provider=:provider AND id=?").run(savedChatPart(line), now.toISOString(), part.id);
+    state.prepare("UPDATE chat_part SET payload=?,state='pending',next_at=NULL,problem=NULL,file=NULL,uploaded=0,uncertain=0,created=? WHERE provider=:provider AND id=? AND state<>'dropped'").run(savedChatPart(line), now.toISOString(), part.id);
     state.prepare("UPDATE chat_part SET state='dropped',problem='Uploads are not allowed here' WHERE provider=:provider AND event=? AND id<>? AND state='pending'").run(part.event, part.id);
 }

package/dist/route-results.js

@@ -14,6 +14,7 @@ import { INELIGIBLE_REASONS, REASON_WORDS, selectionSchema, } from "./contracts/
 import { changedFilesOf, COMPLETION_ACTION } from "./result-completion.js";
 import { runAccounting } from "./store.js";
 import { INFRASTRUCTURE_TERMINALS, saveResultRecord } from "./route-store.js";
+import { wasInterrupted } from "./run-ending.js";
 // The execution class and the cohort snapshot live with their writer (route-store.ts), which store.ts imports: kept
 // light so the store's module graph doesn't reach the evaluator's readers.
 export { cohortOf, EXEC_CLASS_OF_REASON, execClassOf } from "./route-store.js";
@@ -49,7 +50,7 @@ function classOfRun(run, kept) {
         return kept;
     if (run.terminalClass != null && INFRASTRUCTURE_TERMINALS.has(run.terminalClass))
         return "infrastructure";
-    if ((run.outcome === "interrupted" || run.reason === "interrupted") && run.providerStartedAt === null)
+    if (wasInterrupted(run) && run.providerStartedAt === null)
         return "infrastructure";
     return "model";
 }

package/dist/run-ending.d.ts

@@ -0,0 +1,21 @@
+/**
+ * How a run ended, asked one way.
+ *
+ * "Interrupted" is stored in two spellings. Every ending written today is the outcome `failed` with the reason
+ * `interrupted`. Rows written between schema 25 and 114 carry the outcome `interrupted` itself (a held session cut
+ * down mid-flight) and still read. A check that knows only one spelling treats the same event two ways, so every check
+ * asks here.
+ */
+export declare function wasInterrupted(run: {
+    outcome: string | null;
+    reason?: string | null;
+}): boolean;
+/**
+ * The spelling written today, and only it. The roads that hand an interrupted attempt's draft to the next attempt
+ * (salvage in the checkout, the recovery grant, the check a run never reached) ask this one: they were built for the
+ * runs that write it, and reading the old spelling there would widen what they recover.
+ */
+export declare function endedInterrupted(run: {
+    outcome: unknown;
+    reason?: unknown;
+}): boolean;

package/dist/run-ending.js

@@ -0,0 +1,19 @@
+/**
+ * How a run ended, asked one way.
+ *
+ * "Interrupted" is stored in two spellings. Every ending written today is the outcome `failed` with the reason
+ * `interrupted`. Rows written between schema 25 and 114 carry the outcome `interrupted` itself (a held session cut
+ * down mid-flight) and still read. A check that knows only one spelling treats the same event two ways, so every check
+ * asks here.
+ */
+export function wasInterrupted(run) {
+    return run.outcome === "interrupted" || (run.outcome === "failed" && run.reason === "interrupted");
+}
+/**
+ * The spelling written today, and only it. The roads that hand an interrupted attempt's draft to the next attempt
+ * (salvage in the checkout, the recovery grant, the check a run never reached) ask this one: they were built for the
+ * runs that write it, and reading the old spelling there would widen what they recover.
+ */
+export function endedInterrupted(run) {
+    return run.outcome === "failed" && run.reason === "interrupted";
+}