toolroll 0.9.99 → 0.9.101

package/dist/settings-groups-ui.js

@@ -148,7 +148,7 @@ export function generalGroup(facts, flags) {
             formRow("Theme", "Light, dark, or whatever this device uses.", postForm("/settings/appearance", html `<div class="k-seg" role="group" aria-label="Theme">${themeButton("system", "Match device")}${themeButton("light", "Light")}${themeButton("dark", "Dark")}</div>`, { returnTo: "/settings/general" })),
             kitSectionForm({ proof: "appearance", action: "/settings/appearance", id: "accent", gate: true, hidden: { return: "/settings/general" },
                 body: joinHtml([
-                    formRow("Accent", "Buttons and focus. Amber always means “needs you” and can’t be changed.", select({ name: "accent", label: "Accent", current: facts.accent, items: [...ACCENT_CHOICES.map(one => [one.hex, one.id === "ink" ? "Ink (default)" : one.name]), ...(custom === null ? [] : [[custom, `Your own colour (${custom})`]])] })),
+                    formRow("Accent", "Buttons, focus and what needs you.", select({ name: "accent", label: "Accent", current: facts.accent, items: [...ACCENT_CHOICES.map(one => [one.hex, one.id === "ink" ? "Ink (default)" : one.name]), ...(custom === null ? [] : [[custom, `Your own colour (${custom})`]])] })),
                     accentNoteWords === null ? "" : note(accentNoteWords),
                 ]) }),
             disclose("Use your own colour", kitSectionForm({ proof: "appearance", action: "/settings/appearance", id: "accent-own", gate: true, hidden: { return: "/settings/general" },

package/dist/setup-guide.d.ts

@@ -15,12 +15,12 @@ export declare function detectPreparation(repo: string): {
 } | null;
 /** Browser installation may write only this known file inside its project. */
 export declare function previewProjectInstructions(repo: string): {
-    content?: never;
     ok: false;
     message: string;
     plan?: never;
     fingerprint?: never;
     installed?: never;
+    content?: never;
 } | {
     message?: never;
     ok: true;
@@ -30,10 +30,10 @@ export declare function previewProjectInstructions(repo: string): {
     installed: boolean;
 };
 export declare function addProjectInstructions(repo: string, fingerprint: string): {
-    content?: never;
     ok: false;
     message: string;
     plan?: never;
     fingerprint?: never;
     installed?: never;
+    content?: never;
 } | import("./skills.js").InstallResult;

package/dist/slack-chat.js

@@ -11,7 +11,7 @@ import { processChatEvent, planChatNotifications, channelAccess, planRoomMessage
 import { proposalPreview, proposalLink, proposalOutcomeText, armedCardText, armedYesLabel, } from "./chat-channel.js";
 import { LEAD_MESSAGE_MAX_CHARS } from "./lead.js";
 import { renderReply } from "./reply-shape.js";
-import { ChatDeliveryError, ChatState, chatHash, partContent } from "./chat-delivery-state.js";
+import { ChatDeliveryError, ChatState, chatHash, chatRetryAt, partContent } from "./chat-delivery-state.js";
 import { readChatPart } from "./contracts/chat-content.js";
 import { readSlackBlockActions, readSlackButton, SLACK_LINK_ACTION } from "./contracts/slack-callback.js";
 import { object, slackId, slackTs, slackMember, SlackError, uploadSlackBytes, } from "./slack-api.js";
@@ -444,8 +444,7 @@ export async function deliverSlackPart(options) {
             ? error
             : new SlackError("Slack delivery is waiting to retry", 15_000, true);
         state.setProblem(identity.installation, options.owner, problem.message);
-        const until = new Date(nowOf(options).getTime() +
-            Math.max(problem.retryMs, [5000, 15000, 60000, 300000][Math.min(row.attempts, 3)])).toISOString();
+        const until = chatRetryAt(nowOf(options), problem.retryMs, row.attempts);
         state.partFailed(row.id, { problem: problem.message, until, uncertain: problem.uncertain });
         if (problem.code === "ratelimited")
             state.deferUntil(identity.installation, until);

package/dist/store.d.ts

@@ -3,6 +3,7 @@ import { type WritesMode } from "./writes-mode.js";
 import { type CheckAccess } from "./check-access.js";
 import { type ProjectSandbox } from "./project-sandbox.js";
 import type { FencePolicy } from "./agent-fence.js";
+import type { ChatMessageOutcome } from "./chat-message-states.js";
 import { type NetworkProfile, type ProjectNetwork, type RunNetworkRecord } from "./egress.js";
 import { type AcpLaunch } from "./acp-attest.js";
 import { type CheckStamp, type StampReading } from "./check-stamp.js";
@@ -1805,8 +1806,8 @@ export type TelegramConversation = {
     nextAttemptAt: string | null;
     session: number | null;
     turn: number | null;
-    /** A short outcome word: answered, replayed, refused:<reason>, failed:<reason>, revoked, … */
-    outcome: string | null;
+    /** Its result word (chat-message-states.ts); a row written by an older version may hold a word no longer listed. */
+    outcome: ChatMessageOutcome | null;
     replyMessageId: string | null;
     createdAt: string;
     startedAt: string | null;
@@ -8552,3 +8553,61 @@ export declare function setLeadTurnRoute(store: Store, turn: number, generation:
  * reply asked one, less than LEAD_ASK_TTL_MS ago. Conservative on purpose: the quick-answer router (§8) keeps such a
  * message on the main model. */
 export declare function leadAskAwaitsAnswer(store: Store, thread: number, now: Date): boolean;
+/** When an invite can still be used: not revoked, not consumed, not expired, and fewer than ten admitted attempts.
+ * One bound parameter: the current time as an ISO string. Every read and write that asks "is this invite usable" uses
+ * this fragment, so the join page, the attempt counter, the join terms and the open-invites list agree. */
+export declare const INVITE_USABLE_SQL = "revoked_at IS NULL AND consumed_at IS NULL AND expires_at > ? AND attempts < 10";
+/** How long a confirm step stays open: the Yes and Cancel buttons shown after a first tap, in every chat app. */
+export declare const CONFIRM_TTL_MS: number;
+/**
+ * Withdraw task approvals: the one statement every withdrawal runs. It always clears approved_at, approved_by,
+ * approved_digest and approved_profile_json, and sets approval_basis to `basisAfter`. The callers differ in what else
+ * they clear, so that stays theirs to say: `clearRoute` clears approved_route_json, `clearModeDigest` clears
+ * mode_digest. `where` is the caller's own WHERE clause (starting with WHERE) with its bound values; it is always a
+ * fixed string in our code, never built from input. The check and the write are one statement. Returns the rows changed.
+ */
+export declare function withdrawApproval(store: Store, rows: {
+    where: string;
+    args: readonly (string | number | null)[];
+}, writes: {
+    basisAfter: "password" | null;
+    clearRoute: boolean;
+    clearModeDigest: boolean;
+}): number;
+/**
+ * Whether `requeueTask` would run this task again, read without writing anything: the same checks in the same order,
+ * so the requeue itself and every sentence that offers it agree. Read inside the caller's transaction.
+ */
+export declare function requeueEligibility(store: Store, taskId: string, now: Date): {
+    ok: true;
+    taskRef: number;
+    incidents: number[];
+    state: string;
+    rejectedRun: number | null;
+} | {
+    ok: false;
+    reason: "unknown-task" | "not-stalled" | "claimed" | "accepted-result" | "published" | "archived";
+};
+/** The three closed states (docs/plans/closed-task-claims.md). */
+export type ClosedState = Extract<TaskState, "done" | "failed" | "cancelled">;
+export declare function isClosedState(state: string): state is ClosedState;
+/**
+ * What this database knows about the task behind a reference, for a claim: a built-in task's row and state, a
+ * built-in reference with no task row, or a task of another backend (its state lives in that tracker, not here).
+ * Read inside the caller's transaction, so the answer holds until it commits.
+ */
+export declare function taskStateForClaim(store: Store, taskRef: number): {
+    kind: "built-in";
+    state: TaskState;
+} | {
+    kind: "missing";
+} | {
+    kind: "outside";
+};
+/**
+ * Check cleanup's proof (acp-check.ts settleChecks, claim.ts acquireForCheckCleanup): the task reference of check
+ * `checkId` when that check belongs to `runner`, has finished (passed or failed) and is not yet settled, is held right
+ * now by exactly this cleanup `attempt`, and is bound to the built-in task named from the check row's own id. Null
+ * otherwise. Every fact comes from rows only code writes; read inside the caller's transaction.
+ */
+export declare function checkCleanupTaskOf(store: Store, checkId: number, runner: string, attempt: string, now: Date): number | null;

package/dist/store.js

@@ -16,7 +16,7 @@ import { V156_SCHEMA, V156_STEPS } from "./fallback-schema.js";
 import { V158_ADDED_COLUMNS, V158_SCHEMA, V158_STEPS, LEAD_FAILURE_DETAILS, LEAD_ROUTES } from "./lead-latency-schema.js";
 import { V157_SCHEMA, V157_STEPS } from "./chat-live-schema.js";
 import { V159_ADDED_COLUMNS, V159_SCHEMA, V159_STEPS } from "./one-step-chat-schema.js";
-import { refArchived, taskArchived } from "./task-archive.js";
+import { refArchived, taskArchived, taskCancelled } from "./task-archive.js";
 export { refArchived, taskArchived } from "./task-archive.js";
 import { CHAT_PROVIDERS, CHAT_SCHEMA } from "./contracts/chat-tables.js";
 import {} from "./chat-core.js";
@@ -129,8 +129,10 @@ import { configBase, envValue, namedPath } from "./names.js";
 import { PULL_REQUEST_SCHEMA } from "./pull-request-schema.js";
 import { chatTurnAmountOf, combineReportedModels, providerTurnsOf, reportedCostUsdOf, reportedModelOf, runAmountOf } from "./reported-usage.js";
 import { usageOf } from "./run-efficiency.js";
+import { endedInterrupted, wasInterrupted } from "./run-ending.js";
 import { YOUIYOUX_FILED_VIA } from "./contracts/youiyoux-request.js";
 import { cardShowsScope, cardTermsDigest, shownTermsDigest } from "./chat-terms.js";
+import { markedRunningSql, moveTask } from "./task-moves.js";
 // PR #263 follow-up: the built-ins the Store money seal uses, captured as this module is evaluated, so code that later
 // replaces `Object.defineProperty` and the like can't fool the seal or the lock (lockStoreMoneyMethods refuses when
 // they've been replaced). The four sealed method references are recorded once, at the seal, in SEALED_MONEY_METHODS.
@@ -6768,10 +6770,7 @@ export class Store {
                     return { ok: true };
                 }
                 const prior = this.db.prepare("SELECT state FROM task WHERE id = ?").get(id);
-                const { changes } = this.db
-                    .prepare("UPDATE task SET state = ?, updated_at = ? WHERE id = ?")
-                    .run(state, now.toISOString(), id);
-                if (Number(changes) === 0)
+                if (!moveTask(this.db, id, "set", now, state))
                     return { ok: false, reason: "unknown-task" };
                 if (state === "done" && prior?.["state"] !== "done") {
                     const done = this.lookupRef(id);
@@ -7588,9 +7587,7 @@ export class Store {
                 .prepare(`UPDATE external_mirror SET dispatch_ok = 1, close_generation = NULL, reopened_by = ?, reopened_at = ?
             WHERE local_task_id = ?`)
                 .run(by, now.toISOString(), localTaskId);
-            this.db
-                .prepare("UPDATE task SET state = 'queued', updated_at = ? WHERE id = ?")
-                .run(now.toISOString(), localTaskId);
+            moveTask(this.db, localTaskId, "reopen", now);
             this.noteLifecycle({ taskRef, kind: "task-queued", identity: `t${taskRef}`, subject: "Back in the queue", body: "The tracker item is open again; another attempt can start.", link: chatControlHref("task", localTaskId) }, now);
             this.bumpWake();
             return { ok: true };
@@ -8076,7 +8073,11 @@ export class Store {
      * exactly what the signed digest was bound to. Returns false when the
      * scope vanished mid-ceremony. */
     sealScopeApproval(taskId, by, now, mutation = {}, basis, approverKind) {
-        return (this.once(mutation, "sealScopeApproval", () => {
+        // ONE TRANSACTION, the primitive's own (Codex review of the steps page, round 2): every check below is read in
+        // the same write transaction as the seal and the release authority it opens, so a task cancelled or put away on
+        // another connection can't slip between the check and the write, and a seal whose release authority can't open
+        // rolls back whole even when the caller opened no transaction. Reentrant: inside a caller's transaction it joins.
+        const seal = () => this.once(mutation, "sealScopeApproval", () => {
             // ONLY A PERSON'S SEAL HAS NO BASIS (approval policy, phase 1): with none given this is the person's
             // ceremony (scope.ts approve), so a machine — the lead's token, a remote API run — never mints one, whatever
             // road it came by.
@@ -8085,6 +8086,10 @@ export class Store {
             // A PUT-AWAY TASK (v145, task-tidy.md) is never approved, by any road: restore it first.
             if (taskArchived(this, taskId))
                 return false;
+            // A CANCELLED TASK the same (Codex review of the steps page, finding 2): no seal, and so no release authority,
+            // is written for work that was cancelled — whichever road asks (a stale form, the CLI, a rule, the schedule).
+            if (taskCancelled(this, taskId))
+                return false;
             // A RELEASE WAITING FOR CI (Codex review round 1, finding 4): filed while its pull request's checks still ran,
             // only the automatic road (which proves CI itself) seals it until the plane read exact-head CI passing.
             if (basis?.kind !== "auto-check" && basis?.kind !== "auto-green" && releaseCiHoldOf(this, taskId) !== null)
@@ -8311,7 +8316,10 @@ export class Store {
                 }
             }
             return changed.changes > 0;
-        }) === true);
+        }) === true;
+        // Already inside a transaction (a caller's transact(), or a savepoint opened outside one): it joins that one,
+        // which owns the commit and the rollback. Otherwise it opens its own.
+        return this.db.isTransaction === true ? seal() : this.transact(seal);
     }
     /** Whether this task's scope carries a LIVE seal: approved, and the
      * approved digest is the current one (a rewritten scope unseals). The
@@ -8514,10 +8522,7 @@ export class Store {
                              WHERE tr.backend = 'built-in' AND tr.external_id = task_scope.task_id
                                AND claim.released_at IS NULL AND claim.expires_at > ?)`;
         const demoted = this.db.prepare(`SELECT task_id FROM task_scope ${demotable}`).all(digest, now.toISOString()).map(row => String(row["task_id"]));
-        this.db
-            .prepare(`UPDATE task_scope SET approved_at = NULL, approved_by = NULL, approved_digest = NULL,
-                approved_profile_json = NULL, approval_basis = 'password', mode_digest = NULL ${demotable}`)
-            .run(digest, now.toISOString());
+        withdrawApproval(this, { where: demotable, args: [digest, now.toISOString()] }, { basisAfter: "password", clearRoute: false, clearModeDigest: true });
         this.db.prepare("DELETE FROM plan_authorization WHERE basis = 'grant' AND mode_digest = ?").run(digest);
         for (const taskId of demoted) {
             const ref = this.lookupRef(taskId);
@@ -8562,12 +8567,7 @@ export class Store {
             .prepare(`SELECT task_id FROM task_scope ${demotable}`)
             .all(...demotableArgs)
             .map(row => String(row["task_id"]));
-        this.db
-            .prepare(`UPDATE task_scope
-            SET approved_at = NULL, approved_by = NULL, approved_digest = NULL,
-                approved_profile_json = NULL, approval_basis = 'password', mode_digest = NULL
-          ${demotable}`)
-            .run(...demotableArgs);
+        withdrawApproval(this, { where: demotable, args: demotableArgs }, { basisAfter: "password", clearRoute: false, clearModeDigest: true });
         for (const taskId of demoted) {
             const ref = this.lookupRef(taskId);
             if (ref === null)
@@ -9263,7 +9263,7 @@ export class Store {
      * false: the disclosure boundary is one indistinguishable page (D6). */
     inviteIsLive(tokenValue, now) {
         const row = this.db
-            .prepare("SELECT 1 AS hit FROM invite WHERE token_hash = ? AND revoked_at IS NULL AND consumed_at IS NULL AND expires_at > ? AND attempts < 10")
+            .prepare(`SELECT 1 AS hit FROM invite WHERE token_hash = ? AND ${INVITE_USABLE_SQL}`)
             .get(createHash("sha256").update(tokenValue, "utf8").digest("hex"), now.toISOString());
         return row !== undefined;
     }
@@ -9276,7 +9276,7 @@ export class Store {
     admitInviteAttempt(tokenValue, now) {
         const row = this.db
             .prepare(`UPDATE invite SET attempts = attempts + 1
-          WHERE token_hash = ? AND revoked_at IS NULL AND consumed_at IS NULL AND expires_at > ? AND attempts < 10
+          WHERE token_hash = ? AND ${INVITE_USABLE_SQL}
           RETURNING role, minted_by`)
             .get(createHash("sha256").update(tokenValue, "utf8").digest("hex"), now.toISOString());
         return row === undefined
@@ -9297,6 +9297,8 @@ export class Store {
             // concurrent join must read as 'gone' — the indistinguishable dead
             // shape — never as a name collision that discloses the winner.
             const hash = createHash("sha256").update(args.tokenValue, "utf8").digest("hex");
+            // Not INVITE_USABLE_SQL on purpose: admitInviteAttempt has already counted this submission, so the tenth
+            // admitted attempt arrives here with attempts = 10 and must still be able to join.
             const live = this.db
                 .prepare("SELECT 1 AS hit FROM invite WHERE token_hash = ? AND revoked_at IS NULL AND consumed_at IS NULL AND expires_at > ?")
                 .get(hash, now.toISOString());
@@ -9609,7 +9611,7 @@ export class Store {
      * never leave the store; an invite is named by its row id. */
     openInvites(now) {
         return this.db
-            .prepare("SELECT id, role, minted_by, minted_at, expires_at, attempts, projects_json FROM invite WHERE revoked_at IS NULL AND consumed_at IS NULL AND expires_at > ? ORDER BY id")
+            .prepare(`SELECT id, role, minted_by, minted_at, expires_at, attempts, projects_json FROM invite WHERE ${INVITE_USABLE_SQL} ORDER BY id`)
             .all(now.toISOString())
             .map(row => ({
             id: Number(row["id"]),
@@ -11930,53 +11932,11 @@ export class Store {
      * is still the one just approved, read inside this transaction ("moved" otherwise). */
     expect) {
         return this.transact(() => {
-            const ref = this.db
-                .prepare("SELECT id FROM task_ref WHERE backend = ? AND external_id = ?")
-                .get(BUILT_IN, taskId);
-            if (ref === undefined)
-                return { ok: false, reason: "unknown-task" };
-            const taskRef = Number(ref["id"]);
-            // A put-away task (v145) is restored before it runs again.
-            if (refArchived(this, taskRef))
-                return { ok: false, reason: "archived" };
-            const stamp = now.toISOString();
-            if (this.hasLiveClaim(taskRef, now))
-                return { ok: false, reason: "claimed" };
-            const incidents = this.db
-                .prepare(`SELECT incident.id FROM incident
-           JOIN run ON run.id = incident.run
-           WHERE run.task_ref = ? AND incident.resolved_at IS NULL`)
-                .all(taskRef)
-                .map(row => Number(row["id"]));
-            const state = String(this.db.prepare("SELECT state FROM task WHERE id = ?").get(taskId)?.["state"]);
-            // A finished task whose last result was rejected — a failed gate, a
-            // contradicting review, a refuted proof — runs again on the SAME
-            // filing: the branch keeps the earlier attempt, the sealed diff still
-            // spans from the original base, and a corrected candidate needs a
-            // re-scope, not a new task. An accepted or published result is final
-            // here; it is revised through a revision or its pull request.
-            let rejectedRun = null;
-            if (state === "done") {
-                // The guards hold whether or not an incident is open: a finished
-                // task's last result decides, and an accepted or published one is
-                // never reopened by resolving an incident beside it.
-                const last = this.db
-                    .prepare("SELECT id FROM run WHERE task_ref = ? AND role = 'builder' AND finished_at IS NOT NULL ORDER BY id DESC LIMIT 1")
-                    .get(taskRef);
-                if (last === undefined) {
-                    if (incidents.length === 0)
-                        return { ok: false, reason: "not-stalled" };
-                }
-                else {
-                    rejectedRun = Number(last["id"]);
-                    const final = this.finalResultReason(rejectedRun);
-                    if (final !== null)
-                        return { ok: false, reason: final };
-                }
-            }
-            else if (incidents.length === 0 && state !== "failed") {
-                return { ok: false, reason: "not-stalled" };
-            }
+            // Who may run again is one read, shared with the claim refusal's words (requeueEligibility, end of file).
+            const eligible = requeueEligibility(this, taskId, now);
+            if (!eligible.ok)
+                return eligible;
+            const { taskRef, incidents, state, rejectedRun } = eligible;
             if (expect !== undefined) {
                 const scope = this.db.prepare("SELECT digest, approved_digest FROM task_scope WHERE task_id = ?").get(taskId);
                 if (state !== "done" || rejectedRun !== expect.run || scope === undefined || String(scope["digest"]) !== expect.scopeDigest ||
@@ -11990,9 +11950,7 @@ export class Store {
             // A person's Retry is a new person act: a fast start gets a new start window. A machine's never does.
             if (!machineActing())
                 this.db.prepare("UPDATE task_ref SET fast_start_until = ? WHERE id = ? AND fast_start_until IS NOT NULL").run(new Date(now.getTime() + 30 * 60_000).toISOString(), taskRef);
-            this.db
-                .prepare("UPDATE task SET state = 'queued', updated_at = ? WHERE id = ? AND state IN ('failed','queued','done')")
-                .run(stamp, taskId);
+            moveTask(this.db, taskId, "retry", now);
             // The stall's page is answered by the act itself.
             this.resolveEpisode(`stalled:${taskRef}`, now);
             this.noteLifecycle({
@@ -13511,7 +13469,7 @@ export class Store {
         if (taskId === null)
             return;
         const role = String(prior["role"]);
-        const stopped = result.outcome === "failed" && result.reason === "interrupted" && this.stopOf(id) !== null;
+        const stopped = wasInterrupted(result) && this.stopOf(id) !== null;
         if (role === "builder") {
             if (stopped) {
                 this.noteLifecycle({ taskRef, run: id, kind: "run-stopped", identity: `r${id}`, subject: `Build #${id} stopped`, body: "Its work is preserved. Resume this attempt from the task page when ready.", link: chatControlHref("recovery", taskId) }, now);
@@ -14079,7 +14037,7 @@ export class Store {
             return `run #${parent.id} left its draft in ${parent.worktree ?? "no worktree"} on ${parent.branch ?? "no branch"}, not ${run.worktree} on ${run.branch}`;
         // An attempt that stopped before its handoff (run 2085) left its work in
         // place for exactly this: the retry inherits it, like an interrupted one's.
-        const interrupted = parent.outcome === null || (parent.outcome === "failed" && (parent.reason === "interrupted" || parent.reason === "no-handoff"));
+        const interrupted = parent.outcome === null || endedInterrupted(parent) || (parent.outcome === "failed" && parent.reason === "no-handoff");
         if (!interrupted)
             return `run #${parent.id} ended as ${parent.outcome}${parent.reason === null ? "" : ` (${parent.reason})`} — only an interrupted attempt's draft is recovered`;
         if (parent.outcome === null && this.liveClaimByLease(parent.leaseId, now) !== null)
@@ -18731,7 +18689,7 @@ export class Store {
         const q = this.db
             .prepare(`SELECT
            SUM(CASE WHEN task.state = 'queued' THEN 1 ELSE 0 END) AS queued,
-           SUM(CASE WHEN task.state = 'running' THEN 1 ELSE 0 END) AS running
+           SUM(CASE WHEN ${markedRunningSql} THEN 1 ELSE 0 END) AS running
            FROM task JOIN task_ref ON task_ref.backend = 'built-in' AND task_ref.external_id = task.id
           WHERE task_ref.repo = ? AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)`)
             .get(repo);
@@ -21761,7 +21719,7 @@ export function serializeReleaseTerms(terms) {
 }
 // ---- one approval per release: the authority record (release-once.md, part 1) --------------------------------------
 export { LIVE_RELEASE_STATES, belongsToRelease, newestReleaseGeneration, outstandingReleaseOperations, releaseAuthority, releaseAuthorityOfTask, releaseCarries, releaseCarryTo, releaseOperation, releaseOperations, releaseSealProblem, } from "./release-authority.js";
-import { LIVE_RELEASE_STATES, autoEvidenceOf, belongsToRelease, newestReleaseGeneration, outstandingReleaseOperations, releaseAuthority, releaseCarryTo, releaseOperation, releaseSealProblem, } from "./release-authority.js";
+import { LIVE_RELEASE_STATES, autoEvidenceOf, belongsToRelease, releaseExpiredAt, newestReleaseGeneration, outstandingReleaseOperations, releaseAuthority, releaseCarryTo, releaseOperation, releaseSealProblem, } from "./release-authority.js";
 /**
  * Open a release's authority for a person's seal of its terms (inside the seal's transaction): the next generation,
  * superseding the live one. False when it can't (releaseSealProblem), which refuses the seal.
@@ -21836,7 +21794,7 @@ export function reserveRelease(store, input) {
             return { ok: false, why: "This release still waits for GitHub CI. Resume it with `toolroll release`." };
         const at = input.now.toISOString();
         // Expiry stops every live state; an operation already reserved settles only through reconciliation.
-        if (a.expiresAt <= at)
+        if (releaseExpiredAt(a, input.now))
             return { ok: false, why: "The release approval expired." };
         if (a.tipTask !== input.taskId || a.tipSha !== input.candidate)
             return { ok: false, why: `Task ${input.taskId} is not the release's current commit.` };
@@ -21882,7 +21840,7 @@ export function runReleaseOperation(store, id, epoch, now, issuer = currentRelea
         if (releaseCiRunningOf(store, op.taskId) !== null)
             return false;
         // Past the expiry nothing new starts; the reserved operation is settled by reconciliation instead.
-        if (a.expiresAt <= now.toISOString())
+        if (releaseExpiredAt(a, now))
             return false;
         // The lease that reserved it still holds (a person's direct deploy: still no coordinator holding the release), and
         // the live-release predicate still accepts it, at this moment (review round 1).
@@ -22644,7 +22602,7 @@ export function restoreTaskFamily(store, taskId, by, now, guard) {
  */
 export function liveInviteTerms(store, tokenValue, now) {
     const row = store.handle
-        .prepare("SELECT role, minted_by, expires_at, projects_json FROM invite WHERE token_hash = ? AND revoked_at IS NULL AND consumed_at IS NULL AND expires_at > ? AND attempts < 10")
+        .prepare(`SELECT role, minted_by, expires_at, projects_json FROM invite WHERE token_hash = ? AND ${INVITE_USABLE_SQL}`)
         .get(createHash("sha256").update(tokenValue, "utf8").digest("hex"), now.toISOString());
     if (row === undefined)
         return null;
@@ -23249,3 +23207,106 @@ export function leadAskAwaitsAnswer(store, thread, now) {
       WHERE m.id = (SELECT MAX(id) FROM lead_message WHERE thread = ? AND role = 'assistant') AND t.state = 'answered'`).get(thread);
     return row !== undefined && Date.parse(String(row["at"])) + LEAD_ASK_TTL_MS > now.getTime();
 }
+/** When an invite can still be used: not revoked, not consumed, not expired, and fewer than ten admitted attempts.
+ * One bound parameter: the current time as an ISO string. Every read and write that asks "is this invite usable" uses
+ * this fragment, so the join page, the attempt counter, the join terms and the open-invites list agree. */
+export const INVITE_USABLE_SQL = "revoked_at IS NULL AND consumed_at IS NULL AND expires_at > ? AND attempts < 10";
+/** How long a confirm step stays open: the Yes and Cancel buttons shown after a first tap, in every chat app. */
+export const CONFIRM_TTL_MS = 10 * 60_000;
+/**
+ * Withdraw task approvals: the one statement every withdrawal runs. It always clears approved_at, approved_by,
+ * approved_digest and approved_profile_json, and sets approval_basis to `basisAfter`. The callers differ in what else
+ * they clear, so that stays theirs to say: `clearRoute` clears approved_route_json, `clearModeDigest` clears
+ * mode_digest. `where` is the caller's own WHERE clause (starting with WHERE) with its bound values; it is always a
+ * fixed string in our code, never built from input. The check and the write are one statement. Returns the rows changed.
+ */
+export function withdrawApproval(store, rows, writes) {
+    const set = ["approved_at = NULL", "approved_by = NULL", "approved_digest = NULL", "approved_profile_json = NULL",
+        ...(writes.clearRoute ? ["approved_route_json = NULL"] : []), "approval_basis = ?", ...(writes.clearModeDigest ? ["mode_digest = NULL"] : [])];
+    return Number(store.handle.prepare(`UPDATE task_scope SET ${set.join(", ")} ${rows.where}`).run(writes.basisAfter, ...rows.args).changes);
+}
+/**
+ * Whether `requeueTask` would run this task again, read without writing anything: the same checks in the same order,
+ * so the requeue itself and every sentence that offers it agree. Read inside the caller's transaction.
+ */
+export function requeueEligibility(store, taskId, now) {
+    const db = store.handle;
+    const ref = db.prepare("SELECT id FROM task_ref WHERE backend = ? AND external_id = ?").get(BUILT_IN, taskId);
+    if (ref === undefined)
+        return { ok: false, reason: "unknown-task" };
+    const taskRef = Number(ref["id"]);
+    // A put-away task (v145) is restored before it runs again.
+    if (refArchived(store, taskRef))
+        return { ok: false, reason: "archived" };
+    if (store.hasLiveClaim(taskRef, now))
+        return { ok: false, reason: "claimed" };
+    const incidents = db
+        .prepare(`SELECT incident.id FROM incident
+       JOIN run ON run.id = incident.run
+       WHERE run.task_ref = ? AND incident.resolved_at IS NULL`)
+        .all(taskRef)
+        .map(row => Number(row["id"]));
+    const state = String(db.prepare("SELECT state FROM task WHERE id = ?").get(taskId)?.["state"]);
+    // A finished task whose last result was rejected — a failed gate, a
+    // contradicting review, a refuted proof — runs again on the SAME
+    // filing: the branch keeps the earlier attempt, the sealed diff still
+    // spans from the original base, and a corrected candidate needs a
+    // re-scope, not a new task. An accepted or published result is final
+    // here; it is revised through a revision or its pull request.
+    let rejectedRun = null;
+    if (state === "done") {
+        // The guards hold whether or not an incident is open: a finished
+        // task's last result decides, and an accepted or published one is
+        // never reopened by resolving an incident beside it.
+        const last = db
+            .prepare("SELECT id FROM run WHERE task_ref = ? AND role = 'builder' AND finished_at IS NOT NULL ORDER BY id DESC LIMIT 1")
+            .get(taskRef);
+        if (last === undefined) {
+            if (incidents.length === 0)
+                return { ok: false, reason: "not-stalled" };
+        }
+        else {
+            rejectedRun = Number(last["id"]);
+            const final = store.finalResultReason(rejectedRun);
+            if (final !== null)
+                return { ok: false, reason: final };
+        }
+    }
+    else if (incidents.length === 0 && state !== "failed") {
+        return { ok: false, reason: "not-stalled" };
+    }
+    return { ok: true, taskRef, incidents, state, rejectedRun };
+}
+export function isClosedState(state) {
+    return state === "done" || state === "failed" || state === "cancelled";
+}
+/**
+ * What this database knows about the task behind a reference, for a claim: a built-in task's row and state, a
+ * built-in reference with no task row, or a task of another backend (its state lives in that tracker, not here).
+ * Read inside the caller's transaction, so the answer holds until it commits.
+ */
+export function taskStateForClaim(store, taskRef) {
+    const row = store.handle.prepare(`SELECT task_ref.backend AS backend, task.state AS state FROM task_ref
+    LEFT JOIN task ON task.id = task_ref.external_id AND task_ref.backend = ?
+    WHERE task_ref.id = ?`).get(BUILT_IN, taskRef);
+    if (row === undefined)
+        return { kind: "missing" };
+    if (String(row["backend"]) !== BUILT_IN)
+        return { kind: "outside" };
+    if (row["state"] === null || row["state"] === undefined)
+        return { kind: "missing" };
+    return { kind: "built-in", state: String(row["state"]) };
+}
+/**
+ * Check cleanup's proof (acp-check.ts settleChecks, claim.ts acquireForCheckCleanup): the task reference of check
+ * `checkId` when that check belongs to `runner`, has finished (passed or failed) and is not yet settled, is held right
+ * now by exactly this cleanup `attempt`, and is bound to the built-in task named from the check row's own id. Null
+ * otherwise. Every fact comes from rows only code writes; read inside the caller's transaction.
+ */
+export function checkCleanupTaskOf(store, checkId, runner, attempt, now) {
+    const row = store.handle.prepare(`SELECT r.task_ref AS ref FROM acp_check_request r
+    JOIN task_ref t ON t.id = r.task_ref AND t.backend = ? AND t.external_id = 'agent-check-' || r.id
+    WHERE r.id = ? AND r.runner = ? AND r.state IN ('passed','failed') AND r.settled_at IS NULL
+      AND r.settle_by = ? AND r.settle_until > ?`).get(BUILT_IN, checkId, runner, attempt, now.toISOString());
+    return row === undefined ? null : Number(row["ref"]);
+}

package/dist/subagent-question.js

@@ -11,7 +11,7 @@
  * the person it was asked of. Answered anywhere, every button retires.
  */
 import { randomBytes } from "node:crypto";
-import { partContent, savedChatPart } from "./chat-delivery-state.js";
+import { partContent } from "./chat-delivery-state.js";
 import { answerSubagentQuestion } from "./subagent-work.js";
 import { labelOf } from "./subagent-admin.js";
 import { telegramButton } from "./contracts/telegram-callback.js";
@@ -97,12 +97,14 @@ export function chatQuestionButtons(state, part, now) {
     return state.prepare("SELECT token,choice FROM chat_question_action WHERE provider=:provider AND part=? AND consumed IS NULL AND expires>? ORDER BY rowid").all(part, now.toISOString())
         .map(one => ({ token: String(one.token), label: (labels.get(one.choice ?? "") ?? IN_WORDS).slice(0, 75), words: one.choice === null }));
 }
-/** Show the tapped notice again with the answer, and without its buttons. */
-function repaint(state, part, event, line) {
+/** Show the tapped notice again with the answer, and without its buttons. A notice that was dropped isn't brought back:
+ * the line goes as a new message. */
+function repaint(state, part, event, line, now) {
     const row = state.prepare("SELECT payload FROM chat_part WHERE provider=:provider AND id=?").get(part);
     const before = row === undefined ? { text: "" } : partContent(String(row["payload"]));
     const content = { text: `${before.text}\n\n${line}`.slice(0, 3400), edit: event.ts, ...(before.link === undefined ? {} : { link: before.link }), ...(before.channel === undefined ? {} : { channel: before.channel }) };
-    state.prepare("UPDATE chat_part SET payload=?,state='pending',next_at=NULL WHERE provider=:provider AND id=?").run(savedChatPart(content), part);
+    if (!state.repaint(part, content))
+        state.plan(event.id, [{ text: line }], now);
 }
 /** A tapped question button, inside the action's transaction; false when the token isn't one. */
 export function applyChatQuestionTap(options, event, binding, token, now) {
@@ -120,7 +122,7 @@ export function applyChatQuestionTap(options, event, binding, token, now) {
     const question = store.subagentQuestion(questionId);
     if (action["consumed"] !== null || String(action["expires"]) <= now.toISOString() || question === null || question.state !== "open") {
         retireEverywhere(store, questionId, now, state);
-        repaint(state, part, event, "This was already answered.");
+        repaint(state, part, event, "This was already answered.", now);
         state.finish(event.id);
         return true;
     }
@@ -139,7 +141,7 @@ export function applyChatQuestionTap(options, event, binding, token, now) {
     }
     retireEverywhere(store, questionId, now, state);
     const label = question.options.find(one => one.id === action["choice"])?.label ?? String(action["choice"]);
-    repaint(state, part, event, `✅ You answered: ${label}. ${answered.said}`);
+    repaint(state, part, event, `✅ You answered: ${label}. ${answered.said}`, now);
     state.finish(event.id);
     return true;
 }

package/dist/surface.js

@@ -366,10 +366,10 @@ const GUIDE_ROWS = [
             { name: "runner", takesValue: true, meaning: "your registered worker name" },
             { name: "token", takesValue: true, meaning: "the worker's token" },
             { name: "ttl", takesValue: true, meaning: "lease seconds" }],
-        notableReasons: ["held", "fenced", "unapproved", "reserved", "external", "claimed", "not-ready"] },
+        notableReasons: ["held", "fenced", "unapproved", "reserved", "external", "claimed", "not-ready", "closed"] },
     { invocation: "heartbeat", synopsis: "still working; extends the lease", audience: "agent", agentMayInvoke: true, mutation: "identity-idempotent",
         positionals: [{ name: "lease", required: true, meaning: "the lease id" }],
-        flags: [jsonFlag, dbFlag], notableReasons: ["not-leased", "fenced"] },
+        flags: [jsonFlag, dbFlag], notableReasons: ["not-leased", "fenced", "closed"] },
     { invocation: "worker release", synopsis: "done with it; fenced if superseded", audience: "agent", agentMayInvoke: true, mutation: "identity-idempotent",
         positionals: [{ name: "lease", required: true, meaning: "the lease id" }],
         flags: [jsonFlag, dbFlag], notableReasons: ["not-leased", "fenced"] },

package/dist/task-archive.d.ts

@@ -8,3 +8,6 @@ export declare function taskArchived(store: Store, taskId: string): boolean;
 /** Whether a flow card's work is put away: its current task or its first build task (a later stage keeps the first
  * and may clear the current one). Read from the card's own row now, so a put away that committed first holds it. */
 export declare function cardTaskArchived(store: Store, cardId: number): boolean;
+/** Whether the built-in task with this id is cancelled. Every door that approves, seals or carries a release asks
+ * this beside the put-away check: a cancelled task takes no new yes (fail closed), by any road. */
+export declare function taskCancelled(store: Store, taskId: string): boolean;

package/dist/task-archive.js

@@ -14,3 +14,8 @@ export function cardTaskArchived(store, cardId) {
     return store.handle.prepare(`SELECT 1 FROM flow_card c JOIN task_ref r ON r.backend = 'built-in' AND r.external_id IN (c.task, c.primary_task)
     JOIN task_archive a ON a.task_ref = r.id WHERE c.id = ?`).get(cardId) !== undefined;
 }
+/** Whether the built-in task with this id is cancelled. Every door that approves, seals or carries a release asks
+ * this beside the put-away check: a cancelled task takes no new yes (fail closed), by any road. */
+export function taskCancelled(store, taskId) {
+    return store.handle.prepare("SELECT 1 FROM task WHERE id = ? AND state = 'cancelled'").get(taskId) !== undefined;
+}