src/jobs-seat.ts

Functions

Imports

It imports src/agents.ts, src/bench-run-key.ts, src/env.ts, src/gate-policy.ts, src/github/client.ts, src/github/contents.ts, src/job-claims.ts, src/job-outcomes.ts, src/job-signing.ts, src/job-touches.ts, src/jobs-holder.ts, src/jobs-mirror.ts, src/jobs-schema.ts, src/jobs-transition.ts, src/signed-docs.ts. Imported by src/bench.ts, src/controls-perform.ts, src/controls-plan.ts, src/jobs.ts, src/merge-resume.ts, src/stale-jobs.ts.

Source

1import type { Env } from "./env";
2import type { Agent } from "./agents";
3import {
4  corruptRequirement,
5  missingForJob,
6  outsideJobNamespace,
7  swallowedParamTag,
8  swallowedTagRefusal,
9  type JobRow,
10  CORRECTION_CAP,
11  RETRY_CAP_REASON,
12  atCorrectionCap,
13} from "./jobs-schema";
14import { approveByPolicy, classifyCommand, type GateClass } from "./gate-policy";
15import { readRepoFile } from "./github/contents";
16import { ghFetch, parsePrUrl, resolveRepo, type PrUrl } from "./github/client";
17import { verifySignedBody } from "./signed-docs";
18import { outcomeFrom, outcomeStatement, readJobUsage, verifyEvidence } from "./job-outcomes";
19import { jobAudit, mirrorStatements, resumeNoteFields, type ResumeNote } from "./jobs-mirror";
20import { signJobText } from "./job-signing";
21import { commandFromSummary, completeAsSeat, completeJob, completeWithoutClaim, failJob, recordAsSeat } from "./jobs-holder";
22import { actorKind, touchStatement } from "./job-touches";
23import type { ClaimInput, ClaimRaw } from "./job-claims";
24import { readReproReceipt } from "./bench-run-key";
25import {
26  actorShapeRefusal,
27  callerIsSeat,
28  correctionsForWork,
29  guardedTransition,
30  markJobFailed,
31  movedBeforeFailing,
32  readJob,
33  recordShortfall,
34  refuse,
35  type JobResult,
36} from "./jobs-transition";
37
38// The transitions made on a job the caller does not hold: the seat's fail and release,
39// supersede and resume.
40
41// The seat stepping in, on a job it does not hold.
42//
43// Every other transition keys on `claimed_by = <caller>`, which stops two drivers
44// treading on each other but leaves no way to close a job whose driver is gone: the
45// machine was turned off, the session died, the work was superseded from a chat.
46//
47// The seat only: the admin, or a caller holding can_merge (callerIsSeat), the rule
48// supersede and resume use. The seat that decides is routinely not the session that
49// held the job, and the seat key holds can_merge without being the admin. No driver
50// holds can_merge, so a driver still cannot fail another driver's job.
51//
52// It refuses a job that is already finished rather than rewriting one, and says so
53// rather than reporting a no-op as success. The mirror and audit row ride in the same
54// guarded batch as every other transition.
55//
56// `opts.extra` rides in the same guarded batch, so a caller's own write commits only
57// with the fail; `opts.outcome: false` writes no outcome row, for a fail that is not the
58// holder's (the bench score step, src/bench.ts finishRun).
59export async function adminFailJob(
60  env: Env,
61  agent: Agent,
62  now: Date,
63  id: string,
64  reason: string,
65  opts: { extra?: D1PreparedStatement[]; outcome?: boolean } = {}
66): Promise<JobResult> {
67  if (!callerIsSeat(agent)) {
68    return refuse(
69      "admin-fail",
70      `${agent.actor} may only fail a job it holds. Failing somebody else's job is the seat's act, and this caller holds neither the admin identity nor can_merge.`
71    );
72  }
73  if (!reason?.trim()) return refuse("admin-fail", "fail needs a reason. A failed job with no reason is one nobody can retry or rule on.");
74  const current = await readJob(env.DB, id);
75  if (!current) return refuse("admin-fail", `no job ${id}.`);
76  // The job's own namespace, since a seat key may be scoped narrower than the admin.
77  const outside = outsideJobNamespace(agent, current.namespace);
78  if (outside) return refuse("admin-fail", `${agent.actor} cannot fail ${id} ('${current.title}'): ${outside}`);
79  if (current.status !== "queued" && current.status !== "claimed" && current.status !== "blocked") {
80    return refuse("admin-fail", `${id} is already ${current.status}; there is nothing to fail.`);
81  }
82  const job: JobRow = { ...current, status: "failed", result_summary: reason, updated_at: now.toISOString() };
83  const statements = [
84    env.DB.prepare(
85      `UPDATE jobs SET status = 'failed', result_summary = ?3, summary_sig = NULL, updated_at = ?2
86       WHERE id = ?1 AND status IN ('queued', 'claimed', 'blocked') RETURNING id`
87    ).bind(id, now.toISOString(), reason),
88    ...(await mirrorStatements(env, job, "job-admin-fail", agent.actor)),
89    jobAudit(env.DB, agent.actor, "job-admin-fail", job, { status: job.status, reason, held_by: job.claimed_by }),
90    // The seat ending a job is a touch, and ends a gate's wait when the job is blocked;
91    // a gate a resume already answered is not this touch's wait.
92    touchStatement(env.DB, {
93      job_id: id,
94      namespace: job.namespace,
95      kind: "admin_fail",
96      actor: agent.actor,
97      actor_kind: actorKind(agent.actor, { seat: true }),
98      detail: { reason, from: current.status, held_by: current.claimed_by },
99      sinceGate: current.status === "blocked",
100      at: now.toISOString(),
101    }),
102  ];
103  // An outcome row, for the same reason `fail` writes one: a job the seat had to close
104  // because its driver never came back is the kind of ending the record should show.
105  //
106  // Only when somebody held it. A queued job the seat cancelled was never worked, and
107  // inventing an agent would put a failure on a credential that had not touched the
108  // job. No evidence argument either: the seat did not do the work.
109  if (job.claimed_by && opts.outcome !== false) {
110    const verdict = await verifyEvidence(env, job.namespace, undefined);
111    statements.push(outcomeStatement(env.DB, outcomeFrom(job, verdict, now, await readJobUsage(env.DB, job.id))));
112  }
113  if (!(await guardedTransition(env, current, [...statements, ...(opts.extra ?? [])]))) {
114    const moved = await readJob(env.DB, id);
115    return refuse(
116      "admin-fail",
117      `${id} changed between reading it and failing it: it is now ${moved?.status ?? "gone"}${moved?.claimed_by ? `, held by ${moved.claimed_by}` : ""}. Nothing was written; look again before failing it.`
118    );
119  }
120  return { ok: true, action: "admin-fail", job };
121}
122
123// fail through the capsid_work_jobs tool. The holder failing its own job is an ordinary fail. The
124// seat failing a job somebody else holds, or nobody holds, is adminFailJob. Anyone else
125// gets failJob's own refusal for a job it does not hold.
126//
127// The claim goes to the holder path only. The seat failing somebody else's job made no
128// claim about that work, so adminFailJob records none.
129export async function failAsCaller(
130  env: Env,
131  agent: Agent,
132  now: Date,
133  id: string,
134  reason: string,
135  said: { claim?: ClaimInput; raw?: ClaimRaw } = {}
136): Promise<JobResult> {
137  const current = await readJob(env.DB, id);
138  if (current && current.claimed_by !== agent.actor && callerIsSeat(agent)) {
139    // A claim is the holder's account of its own work. The seat failing a job it does
140    // not hold has none to give, and one sent anyway is refused rather than dropped, so
141    // nobody reads a silence as a recorded claim.
142    const sent = typeof said.claim === "string" ? said.claim.trim() !== "" : said.claim !== undefined;
143    if (sent) {
144      return refuse(
145        "fail",
146        `${id} is held by ${current.claimed_by ?? "nobody"}, so this is the seat's fail and takes no claim: a claim is the holder's account of its own work. Send it without claim.`
147      );
148    }
149    return adminFailJob(env, agent, now, id, reason);
150  }
151  return failJob(env, agent, now, id, reason, said);
152}
153
154// The seat completing a job another credential blocked, the way it can fail one. The job
155// stays held by the driver that did the work, so job_outcomes.agent credits that driver;
156// resume with take then complete makes the seat the holder and credits the seat. The
157// outcome is verified through the same path as a holder's complete (the pull request in
158// result_ref or evidence.prs is read from GitHub), the audit row `job-admin-complete`
159// names the seat as actor and the holder in held_by, and the seat's claim is recorded
160// under the seat, not the driver. Blocked only: a queued job was never worked, a claimed
161// one has a holder who completes it, and a finished one is not reopened.
162//
163// The close is a human touch (kind admin_complete, migrations/0031), written in the same
164// batch as the audit row, so the human-effort log shows the job needed the seat.
165async function adminCompleteJob(
166  env: Env,
167  agent: Agent,
168  now: Date,
169  id: string,
170  args: Parameters<typeof completeJob>[4]
171): Promise<JobResult> {
172  if (!callerIsSeat(agent)) {
173    return refuse(
174      "complete",
175      `${agent.actor} may only complete a job it holds. Completing somebody else's blocked job is the seat's act, and this caller holds neither the admin identity nor can_merge.`
176    );
177  }
178  const current = await readJob(env.DB, id);
179  if (!current) return refuse("complete", `no job ${id}.`);
180  // The job's own namespace, since a seat key may be scoped narrower than the admin.
181  const outside = outsideJobNamespace(agent, current.namespace);
182  if (outside) return refuse("complete", `${agent.actor} cannot complete ${id} ('${current.title}'): ${outside}`);
183  return completeAsSeat(env, agent, now, id, args);
184}
185
186// record through the work queue tool: the seat writing the outcome of work done on a
187// queued job without a claim. The seat only, as for completing a job
188// somebody else blocked, because an outcome credits work and a driver could otherwise
189// record work it did not do. The evidence is verified against GitHub as for a complete.
190export async function recordAsCaller(env: Env, agent: Agent, now: Date, id: string, args: Parameters<typeof completeJob>[4]): Promise<JobResult> {
191  if (!callerIsSeat(agent)) {
192    return refuse("record", `${agent.actor} may not record an outcome without a claim. That is the seat's act (the admin identity or can_merge); a driver claims the job and completes it.`);
193  }
194  const current = await readJob(env.DB, id);
195  if (!current) return refuse("record", `no job ${id}.`);
196  const outside = outsideJobNamespace(agent, current.namespace);
197  if (outside) return refuse("record", `${agent.actor} cannot record ${id} ('${current.title}'): ${outside}`);
198  return recordAsSeat(env, agent, now, id, args);
199}
200
201// The pull request is the claim (job_e68de044f8a4; Dustin, 2026-10-10, plan step 2). A
202// cloud session signs in as the admin login, which may hold one claim, so it works a job
203// without claiming it, the way Copilot, Codex and Claude Code Projects work a task: one
204// branch and one pull request. Any caller holding the write grant on the job's
205// namespace completes the QUEUED job by naming that pull request, and the outcome credits
206// the caller. It runs the record path (completeWithoutClaim): the same review gate, GitHub
207// verification, outcome row and overlap check as a complete. record stays the seat's, for
208// closing work somebody else did.
209//
210// What a claim would have asked of the caller is asked here, since no claim was made: the
211// job's required_flags and min_record. Every named pull request must be on one of the
212// namespace's repos, and at least one must be named, because without one nothing a
213// reviewer or auto-merge can read ties the work to the job. And at least one named pull
214// request's body must name this job id, as auto-merge's body_names_job asks: otherwise any
215// pull request on a mapped repo would close any queued job (Grok audit 2026-10-21, CA-3).
216// GitHub unreachable refuses, since nothing then shows the pull request is this job's.
217async function completeUnclaimed(env: Env, agent: Agent, now: Date, current: JobRow, args: Parameters<typeof completeJob>[4]): Promise<JobResult> {
218  const id = current.id;
219  const outside = outsideJobNamespace(agent, current.namespace);
220  if (outside) return refuse("complete", `${agent.actor} cannot complete ${id} ('${current.title}'): ${outside}`);
221  const refs = [args.result_ref, ...(args.evidence?.prs ?? [])].filter((ref): ref is string => Boolean(ref));
222  const prs = refs.map((ref) => ({ ref, pr: parsePrUrl(ref) })).filter((p): p is { ref: string; pr: PrUrl } => p.pr !== null);
223  if (prs.length === 0) {
224    return refuse(
225      "complete",
226      `${id} is queued and nobody holds it. A job worked without a claim is completed by naming its pull request (a pull request URL in result_ref or evidence.prs): the pull request is the claim. Nothing was written.`
227    );
228  }
229  let named = false;
230  for (const { ref, pr } of prs) {
231    let mapped: { owner: string; repo: string };
232    try {
233      mapped = await resolveRepo(env, current.namespace, `${pr.owner}/${pr.repo}`);
234    } catch {
235      return refuse("complete", `${ref} is not on a repo mapped to ${current.namespace}, so it is not shown to be ${id}'s work. Nothing was written.`);
236    }
237    if (!named) named = await prBodyNames(env, mapped.owner, mapped.repo, pr.number, id);
238  }
239  if (!named) {
240    return refuse(
241      "complete",
242      `none of the named pull requests has ${id} in its description (or GitHub could not be read), so none is shown to be this job's work. Put the job id in the pull request body and complete again. Nothing was written.`
243    );
244  }
245  const missing = missingForJob(agent, current.namespace, current.required_scopes);
246  if (missing) return refuse("complete", `${agent.actor} cannot complete ${id} ('${current.title}') without a claim: ${missing} A claim would have refused it too. Nothing was written.`);
247  const shortfall = await recordShortfall(env.DB, agent.actor, current);
248  if (shortfall) return refuse("complete", `${agent.actor} cannot complete ${id} ('${current.title}') without a claim: ${shortfall} A claim would have refused it too. Nothing was written.`);
249  return completeWithoutClaim(env, agent, now, id, args);
250}
251
252// Whether the pull request's body names the job id. A failed read is false.
253async function prBodyNames(env: Env, owner: string, repo: string, number: number, id: string): Promise<boolean> {
254  try {
255    const resp = await ghFetch(env, owner, repo, `/repos/${owner}/${repo}/pulls/${number}`);
256    if (!resp.ok) return false;
257    const body = ((await resp.json()) as { body?: string | null }).body ?? "";
258    return new RegExp(`\\b${id}\\b`).test(body);
259  } catch {
260    return false;
261  }
262}
263
264// complete through the capsid_work_jobs tool. The holder completing its own job is an ordinary
265// complete. A queued job nobody holds is completed without a claim (completeUnclaimed). The
266// seat completing a job somebody else holds is adminCompleteJob. Anyone else gets
267// completeJob's own refusal for a job it does not hold.
268export async function completeAsCaller(
269  env: Env,
270  agent: Agent,
271  now: Date,
272  id: string,
273  args: Parameters<typeof completeJob>[4]
274): Promise<JobResult> {
275  // An argument completeJob refuses before it reads anything is refused the same way here.
276  if (!args.result_summary?.trim()) return completeJob(env, agent, now, id, args);
277  // A bench run proves the fix before it may call its job done (the methods paper's
278  // protocol, section 2): the harness ran the test the agent named on the base and on
279  // its diff, and saw it fail and then pass (src/bench-run-key.ts readReproReceipt). What
280  // the agent says about its own test counts for nothing. Without that receipt, "not
281  // done, here's why" is the outcome the job asks for, and fail records it.
282  if (agent.benchRun) {
283    const receipt = await readReproReceipt(env.DB, agent.benchRun.run);
284    const missing = !receipt
285      ? "the harness has no check of a reproduction test for this run (name the test with bench-repro before phase one ends)"
286      : receipt.passed
287      ? null
288      : `the harness's check of your reproduction test did not pass: ${receipt.reason}`;
289    if (missing) {
290      return refuse(
291        "complete",
292        `${id} was not completed: ${missing}. A bench run completes its job only when the harness saw its test fail on the base and pass on its diff. ` +
293          `Call fail with the reason instead; "not done, here's why" is a good outcome.`
294      );
295    }
296  }
297  const current = await readJob(env.DB, id);
298  if (current && current.status === "queued" && current.claimed_by === null) return completeUnclaimed(env, agent, now, current, args);
299  if (current && current.claimed_by !== agent.actor && callerIsSeat(agent)) return adminCompleteJob(env, agent, now, id, args);
300  return completeJob(env, agent, now, id, args);
301}
302
303// Release: the seat returning a claimed job to the queue when its holder is gone (the
304// session ended, the machine was turned off). A claim has no lease and never expires,
305// so without it the job stays held by a holder that is gone.
306//
307// Not an ending, so no outcome row: the job is worked again and ends with a real one.
308// A job whose work already landed is released too, and the next session completes it
309// with the pull request as evidence, which the Worker verifies. The seat did not do
310// the work, so it does not report it done.
311//
312// claimed_at is kept, so the job's duration runs from its first claim. The UPDATE is
313// keyed on the holder read, so a claim that changed hands in between is not released
314// out from under the new holder.
315export async function releaseJob(env: Env, agent: Agent, now: Date, id: string, reason: string): Promise<JobResult> {
316  if (!callerIsSeat(agent)) {
317    return refuse(
318      "release",
319      `${agent.actor} cannot release a job. Releasing a claim somebody else holds is the seat's act, and this caller holds neither the admin identity nor can_merge.`
320    );
321  }
322  if (!reason?.trim()) {
323    return refuse("release", "release needs a reason: why the holder is not coming back. It is recorded in the audit row.");
324  }
325  const swallowed = swallowedParamTag(reason);
326  if (swallowed) return refuse("release", swallowedTagRefusal("reason", swallowed));
327  const current = await readJob(env.DB, id);
328  if (!current) return refuse("release", `no job ${id}.`);
329  const outside = outsideJobNamespace(agent, current.namespace);
330  if (outside) return refuse("release", `${agent.actor} cannot release ${id} ('${current.title}'): ${outside}`);
331  if (current.status !== "claimed") {
332    return refuse(
333      "release",
334      `${id} is ${current.status}, not claimed. Release returns a claimed job to the queue; a blocked job is resumed, a queued one is already free, and a finished one is not reopened.`
335    );
336  }
337  if (current.claimed_by === agent.actor) {
338    return refuse("release", `${id} is held by ${agent.actor} itself. A holder ends its own claim with fail or block.`);
339  }
340  const job: JobRow = { ...current, status: "queued", claimed_by: null, updated_at: now.toISOString() };
341  const won = await guardedTransition(env, current, [
342    env.DB.prepare(
343      `UPDATE jobs SET status = 'queued', claimed_by = NULL, updated_at = ?2
344       WHERE id = ?1 AND status = 'claimed' AND claimed_by = ?3 RETURNING id`
345    ).bind(id, now.toISOString(), current.claimed_by),
346    ...(await mirrorStatements(env, job, "job-released", agent.actor)),
347    jobAudit(env.DB, agent.actor, "job-released", job, { reason, held_by: current.claimed_by }),
348    touchStatement(env.DB, {
349      job_id: id,
350      namespace: job.namespace,
351      kind: "release",
352      actor: agent.actor,
353      actor_kind: actorKind(agent.actor, { seat: true }),
354      detail: { reason, held_by: current.claimed_by },
355      sinceGate: false, // only a claimed job is released, so no gate is open
356      at: now.toISOString(),
357    }),
358  ]);
359  if (!won) {
360    const moved = await readJob(env.DB, id);
361    return refuse(
362      "release",
363      `${id} changed between reading it and releasing it: it is now ${moved?.status ?? "gone"}${moved?.claimed_by ? `, held by ${moved.claimed_by}` : ""}. Nothing was written.`
364    );
365  }
366  return { ok: true, action: "release", job };
367}
368
369// Supersede: the seat replacing a job before any work was done on it, for a corrected
370// or reposted body, a reorder or a withdrawal. Without it the only way to close such a
371// job is to claim it and fail it, and the history fills with failures that never
372// happened.
373//
374// No outcome row, no pull request rows, no attribution. Nothing was attempted, so a
375// row here would put a failure on a credential that did no work.
376//
377// Allowed from `queued` by any caller that may write the job's namespace, since nobody
378// holds it. From `claimed`, only while the row records no work (no gate hit, no
379// resume, no correction, no result_ref), and only by the holder or the seat
380// (callerIsSeat). Anything later is ended by `fail` or the Portal's Mark failed.
381//
382// The whole rule is in the one keyed UPDATE. The checks before it only choose the
383// refusal message; a driver that hits a gate between the read and the write leaves no
384// row to supersede, rather than being superseded out from under its work.
385
386/** Why a job's row shows work was done on it, or null. */
387export function workRecorded(job: JobRow): string | null {
388  const done: string[] = [];
389  if (job.blocked_count > 0) done.push(`it has hit a gate ${job.blocked_count} time${job.blocked_count === 1 ? "" : "s"}`);
390  if (job.resumed_count > 0) done.push(`it has been resumed ${job.resumed_count} time${job.resumed_count === 1 ? "" : "s"}`);
391  if (job.corrections_count > 0) done.push(`it has been sent back for correction ${job.corrections_count} time${job.corrections_count === 1 ? "" : "s"}`);
392  if (job.result_ref) done.push(`it records a result_ref (${job.result_ref})`);
393  return done.length ? done.join(", ") : null;
394}
395
396// `extra` rides in the same guarded batch, so a caller's own write commits only with the
397// supersede (the bench score step, src/bench.ts finishRun).
398export async function supersedeJob(
399  env: Env,
400  agent: Agent,
401  now: Date,
402  id: string,
403  args: { reason: string; replaced_by?: string },
404  extra: D1PreparedStatement[] = []
405): Promise<JobResult> {
406  const reason = args.reason?.trim();
407  if (!reason) {
408    return refuse("supersede", "supersede needs a reason: what replaced this job, or why it was withdrawn.");
409  }
410  const swallowed = swallowedParamTag(args.reason);
411  if (swallowed) return refuse("supersede", swallowedTagRefusal("reason", swallowed));
412
413  const current = await readJob(env.DB, id);
414  if (!current) return refuse("supersede", `no job ${id}.`);
415  // The job's own namespace, asked here for the reason resume asks it: the tool's
416  // check saw only the namespace argument, which an id-based call may omit.
417  const outside = outsideJobNamespace(agent, current.namespace);
418  if (outside) return refuse("supersede", `${agent.actor} cannot supersede ${id} ('${current.title}'): ${outside}`);
419
420  const replacedBy = args.replaced_by?.trim() || null;
421  if (replacedBy) {
422    if (replacedBy === id) return refuse("supersede", `${id} cannot be replaced by itself.`);
423    const replacement = await env.DB.prepare("SELECT id, namespace FROM jobs WHERE id = ?1")
424      .bind(replacedBy)
425      .first<{ id: string; namespace: string }>();
426    if (!replacement) return refuse("supersede", `no job ${replacedBy}. replaced_by names the job that replaces this one, and it must exist.`);
427    if (replacement.namespace !== current.namespace) {
428      return refuse(
429        "supersede",
430        `${replacedBy} is in ${replacement.namespace} and ${id} is in ${current.namespace}. A job is replaced by work in its own namespace.`
431      );
432    }
433  }
434
435  if (current.status !== "queued" && current.status !== "claimed") {
436    return refuse(
437      "supersede",
438      `${id} is ${current.status}. Supersede closes a queued job, or a claimed one with no work recorded; ${current.status === "blocked" ? "a blocked job has hit a gate, so it is failed instead" : "a finished job is not rewritten"}.`
439    );
440  }
441  if (current.status === "claimed") {
442    const isSeat = callerIsSeat(agent);
443    if (current.claimed_by !== agent.actor && !isSeat) {
444      return refuse(
445        "supersede",
446        `${id} is held by ${current.claimed_by}, not by ${agent.actor}. Superseding a job somebody else holds is the seat's act, and this caller holds neither the admin identity nor can_merge.`
447      );
448    }
449    const work = workRecorded(current);
450    if (work) return refuse("supersede", `${id} has work recorded on it: ${work}. Fail it instead; supersede is for a job replaced before any work was done.`);
451  }
452
453  const summary = replacedBy ? `Superseded by ${replacedBy}: ${reason}` : `Superseded: ${reason}`;
454  // ?4 is the holder read above, so a claim that went to another driver between the
455  // read and this write is not superseded out from under the new one.
456  const job: JobRow = { ...current, status: "superseded", result_summary: summary, updated_at: now.toISOString() };
457  // The guard makes the mirror and audit row commit only with the UPDATE: a row that
458  // changed since the read (a gate hit, a claim) aborts all three.
459  const won = await guardedTransition(env, current, [
460    env.DB.prepare(
461      `UPDATE jobs SET status = 'superseded', result_summary = ?2, summary_sig = NULL, updated_at = ?3
462       WHERE id = ?1 AND (status = 'queued' OR (status = 'claimed' AND claimed_by = ?4 AND blocked_count = 0
463         AND resumed_count = 0 AND corrections_count = 0 AND result_ref IS NULL)) RETURNING id`
464    ).bind(id, summary, now.toISOString(), current.claimed_by),
465    ...(await mirrorStatements(env, job, "job-superseded", agent.actor)),
466    jobAudit(env.DB, agent.actor, "job-superseded", job, {
467      reason,
468      replaced_by: replacedBy,
469      from: current.status,
470      held_by: current.claimed_by,
471    }),
472    touchStatement(env.DB, {
473      job_id: id,
474      namespace: job.namespace,
475      kind: "supersede",
476      actor: agent.actor,
477      actor_kind: actorKind(agent.actor, { seat: callerIsSeat(agent) }),
478      detail: { reason, replaced_by: replacedBy, from: current.status, held_by: current.claimed_by },
479      sinceGate: false, // only a queued or claimed job is superseded, so no gate is open
480      at: now.toISOString(),
481    }),
482    ...extra,
483  ]);
484  if (!won) {
485    const moved = await readJob(env.DB, id);
486    const work = moved ? workRecorded(moved) : null;
487    return refuse(
488      "supersede",
489      `${id} changed between reading it and superseding it: it is now ${moved?.status ?? "gone"}${moved?.claimed_by ? `, held by ${moved.claimed_by}` : ""}${work ? `, and ${work}` : ""}. Nothing was written.`
490    );
491  }
492  return { ok: true, action: "supersede", job };
493}
494
495// Resume. A gate is a pause, not an ending. If `blocked` were terminal, a job the
496// driver stopped at a gate could never be picked back up: the human would run the
497// command, the work would land, and the row would still describe the state before the
498// gate, because `claim` refuses anything that is not queued.
499//
500// The signature is checked again. `claim` verifies the body before handing a job to a
501// driver, but a blocked job then sits in the table for as long as a human takes, which
502// is the window in which a row could be edited. Resume hands that body back to a
503// session holding local shell and repo credentials, so it re-verifies on the same
504// terms and marks a tampered job failed rather than returning it.
505//
506// A plain resume is the seat's act (callerIsSeat: the admin or a can_merge caller). It is
507// not restricted to the original claimer, because the point is that a human approved
508// something, and the seat that approves is routinely not the session that blocked. The
509// reason is required and lands in the audit row, so what was approved is recorded
510// rather than implied.
511//
512// A driver, the claimant or a sibling in the namespace, may not plain-resume. A driver
513// that blocked a job on a deploy, a secret or a force push could otherwise resume it
514// with any reason, or have another driver with the namespace's write grant do it, and
515// the audit row would read "approved: <reason>" as though a human had said yes (Grok
516// audit 2026-10, S1). The claimant may still resume its own job through
517// approved_by_policy for a branch push or a pull request.
518//
519// The claim goes back to the driver that blocked it, not to the caller that resumed
520// it: a blocked row keeps claimed_by. A seat that took the claim would hold a job it
521// has no shell to finish. `take` is the explicit way for a resumer to acquire the job
522// instead, and it runs every check a claim runs.
523//
524// Unless that credential cannot take it back. A credential that is not a minted agent
525// (the admin identity every chat tab connects as, or a legacy operator key) names no
526// particular session, so a claim given to it is worked by nobody. The same holds for a
527// runner whose session ended and a revoked agent. The job then goes back to the queue
528// with its approval, and whichever session claims it next gets the resume note. The job's flags
529// and record bar are asked at that claim, as for any queued job.
530export interface ResumeOptions {
531  // The pre-approved gate. When set, this resume is approved on the signed gate policy
532  // rather than on a human having said yes, and the value is the policy version the
533  // caller read. The blocked command is matched against the policy classes and the
534  // resume is refused when it matches none, so this narrows what the caller may do on
535  // its own rather than widening it.
536  approvedByPolicy?: string;
537  // The resumer acquires the job rather than returning it to the driver that blocked.
538  take?: boolean;
539  // This resume sends the work back to be corrected, so it spends from the retry
540  // cap's budget. A plain resume does not, because an ordinary push through a gate
541  // corrects nothing.
542  correction?: boolean;
543  // The seat's full note, beside the one-line reason. Recorded in the audit row as
544  // `note` and handed on whole in resume_note and the mirror document.
545  note?: string;
546}
547
548// What a driver may approve for itself: pushing its own branch and opening its own
549// pull request. Not a migration, which stays a human gate, so `additive_migration`
550// stays the seat's to approve. The classes and the never list are the policy's own;
551// this only narrows which of them a driver may use.
552const DRIVER_SELF_APPROVED: readonly GateClass[] = ["push_branch", "open_pr"];
553
554// A minted agent's actor is `agent:<name>`: one credential, one driver. The admin
555// identity (`access:<email>`, or `github:<login>` from the old console) and a legacy
556// operator key (`opkey:<fingerprint>`) are shared by whatever sessions connect with them.
557const isMintedActor = (actor: string): boolean => actor.startsWith("agent:");
558
559/** Where a resume sends a blocked job: back to `holder` (toQueue null), or to the queue
560 *  with the reason, when the holder cannot act on it. With take the resumer acquires the
561 *  job, so it never goes to the queue. resumeJob acts on it and the Portal's preview
562 *  (src/controls.ts) states it, so the two agree. */
563export async function resumeDestination(env: Env, holder: string, job: JobRow, take: boolean): Promise<{ toQueue: string | null }> {
564  const id = job.id;
565  const db = env.DB;
566  const toQueue: string | null = take
567    ? null
568    : !isMintedActor(holder)
569      ? `${holder} is a shared identity rather than one driver's session, so ${id} went back to the queue for the next free session.`
570      : (await isRevokedActor(db, holder))
571        ? `${holder} is revoked and can no longer claim, so ${id} went back to the queue for the next session.`
572        : null;
573  return { toQueue };
574}
575
576/** A minted agent whose key was revoked: it can never act on a job handed back to it. */
577async function isRevokedActor(db: D1Database, actor: string): Promise<boolean> {
578  if (!actor.startsWith("agent:")) return false;
579  // An archived agent is a revoked one (src/agents-archive.ts).
580  const row = await db
581    .prepare("SELECT revoked_at FROM agents WHERE name = ?1 UNION ALL SELECT revoked_at FROM agents_archive WHERE name = ?1")
582    .bind(actor.slice("agent:".length))
583    .first<{ revoked_at: string | null }>();
584  return row?.revoked_at != null;
585}
586
587/** The head commit of the job's own pull request, and the mapped repo it is on.
588 *  The pull request is the one the job records: its result_ref, or its job_outcome_prs
589 *  rows. Throws with the reason when there is none, more than one, one outside the
590 *  namespace's mapping, or one GitHub cannot read. */
591async function jobBranchHead(env: Env, job: JobRow): Promise<{ repo: string; sha: string }> {
592  const recorded = await env.DB.prepare("SELECT pr_url FROM job_outcome_prs WHERE job_id = ?1")
593    .bind(job.id)
594    .all<{ pr_url: string }>();
595  const byKey = new Map<string, PrUrl>();
596  for (const ref of [job.result_ref, ...(recorded.results ?? []).map((r) => r.pr_url)]) {
597    const pr = parsePrUrl(ref);
598    if (pr) byKey.set(`${pr.owner}/${pr.repo}#${pr.number}`.toLowerCase(), pr);
599  }
600  if (byKey.size === 0) {
601    throw new Error(`${job.id} records no pull request, so there is no branch head to read the migration at`);
602  }
603  if (byKey.size > 1) {
604    throw new Error(`${job.id} records more than one pull request (${[...byKey.keys()].join(", ")}), so which head runs the migration is not known`);
605  }
606  const [pr] = [...byKey.values()];
607  // resolveRepo refuses a repo the namespace does not map, before GitHub is asked.
608  const { owner, repo, full } = await resolveRepo(env, job.namespace, `${pr.owner}/${pr.repo}`);
609  const resp = await ghFetch(env, owner, repo, `/repos/${owner}/${repo}/pulls/${pr.number}`);
610  if (!resp.ok) throw new Error(`reading pull request #${pr.number} failed (${resp.status})`);
611  const sha = ((await resp.json()) as { head?: { sha?: string } }).head?.sha ?? "";
612  if (!/^[0-9a-f]{40}$/i.test(sha)) throw new Error(`pull request #${pr.number} reported no head commit`);
613  return { repo: full, sha };
614}
615
616export async function resumeJob(
617  env: Env,
618  agent: Agent,
619  now: Date,
620  id: string,
621  reason: string,
622  opts: ResumeOptions = {}
623): Promise<JobResult> {
624  const { approvedByPolicy, take = false, correction = false } = opts;
625  // A blank note is no note, so resume_note does not carry an empty block.
626  const fullNote = opts.note?.trim() ? opts.note : undefined;
627  const actor = agent.actor;
628  const badActor = actorShapeRefusal("resume", actor);
629  if (badActor) return badActor;
630  if (!reason?.trim()) {
631    return refuse("resume", "resume needs a reason: what the human approved. A job that came back off a gate with no record of who cleared it is a gate that did not happen.");
632  }
633
634  const current = await readJob(env.DB, id);
635  if (!current) return refuse("resume", `no job ${id}.`);
636  if (current.status !== "blocked") {
637    return refuse(
638      "resume",
639      `${id} is ${current.status}, not blocked. Resume is how a job comes back off a gate; a queued job is claimed and a done or failed one is finished.`
640    );
641  }
642
643  // A plain resume is a record that the seat approved the gate, and a driver approving
644  // a gate, its own or a sibling's, is no approval. `take` does not change that, so a
645  // driver passing take is refused the same way.
646  const isSeat = callerIsSeat(agent);
647  if (approvedByPolicy === undefined && !isSeat) {
648    const own = current.claimed_by === actor;
649    return refuse(
650      "resume",
651      `${actor} ${own ? `blocked ${id} and cannot approve its own gate` : `cannot approve ${id}'s gate`} with a plain resume: that is the seat's act. ` +
652        `The seat (admin or can_merge) resumes it once the command is approved, ` +
653        `or, for a branch push or a pull request only, the driver that blocked it resumes with approved_by_policy. It stays blocked.`
654    );
655  }
656
657  // The claimant the claim goes to. A blocked row with no claimant (none should
658  // exist, since block keys on claimed_by) goes to the caller.
659  const holder = take || !current.claimed_by ? actor : current.claimed_by;
660
661  const { toQueue } = await resumeDestination(env, holder, current, take);
662  const acquiring = !toQueue && holder === actor;
663
664  // A resume is a claim when the caller acquires the job, so it asks the same scope
665  // question a claim asks: a driver that could not have claimed this job must not
666  // acquire it by resuming it. When the job goes back to its own claimant, that
667  // claimant passed these checks at its claim, and the resumer is not taking anything.
668  const corrupt = corruptRequirement(current);
669  if (corrupt) {
670    return refuse("resume", `${id} has a corrupt requirement: ${corrupt}. It stays blocked; a requirement that cannot be read is not the same as none.`);
671  }
672  // The namespace is asked either way. A resume that returns the job to its own
673  // claimant still moves a job, so a caller that cannot write the job's namespace may
674  // not do it; only the job's flags are left to the claimant it goes back to.
675  const outside = outsideJobNamespace(agent, current.namespace);
676  if (outside) {
677    return refuse("resume", `${actor} cannot resume ${id} ('${current.title}'): ${outside} It stays blocked.`);
678  }
679  if (acquiring) {
680    const missing = missingForJob(agent, current.namespace, current.required_scopes);
681    if (missing) {
682      return refuse("resume", `${actor} cannot resume ${id} ('${current.title}'): ${missing} It stays blocked for a driver that can finish it.`);
683    }
684    // And the record question, on the same reasoning.
685    const resumeShortfall = await recordShortfall(env.DB, actor, current);
686    if (resumeShortfall) {
687      return refuse("resume", `${actor} cannot resume ${id} ('${current.title}'): ${resumeShortfall} It stays blocked for a driver that can finish it.`);
688    }
689  }
690
691  // The retry cap, checked before anything is spent. A job sent back twice already is
692  // one where each further correction has stopped being progress, and what to do next
693  // belongs to a person. An admin is that person arriving, so an admin resume passes
694  // and does not spend the budget.
695  const spentOnWork = await correctionsForWork(env.DB, current.namespace, current.title);
696  if (!agent.admin && atCorrectionCap(spentOnWork)) {
697    return refuse(
698      "resume",
699      `the work titled '${current.title}' has been corrected ${spentOnWork} times across every job posted for it, which is the cap of ${CORRECTION_CAP}: ${RETRY_CAP_REASON}. ` +
700        `The count is per (namespace, title) rather than per row, so failing this job and posting it again does not reset it. ` +
701        `Every resume so far was defensible on its own, which is why the ceiling is counted rather than argued. ` +
702        `An admin caller may resume it; a driver or the seat may not.`
703    );
704  }
705
706  const verdict = await verifySignedBody(env.IMPROVE_SCORE_SECRET, current.body, "job body");
707  if (!verdict.ok) {
708    const marked = await markJobFailed(env, current, "blocked", verdict.reason, "job-signature-refused", actor, { reason: verdict.reason, at: "resume" }, now);
709    if (!marked.failed) return movedBeforeFailing("resume", id, marked.current, "failed its signature check");
710    return refuse("resume", `${id} failed its signature check and has been marked failed: ${verdict.reason}`);
711  }
712
713  // The policy check runs before the claim is given, so a refusal leaves the job
714  // blocked as it was rather than claimed by a caller whose approval did not hold.
715  let policyMatch: { klass: string; detail: string; version: string } | null = null;
716  if (approvedByPolicy !== undefined) {
717    // Approving on policy is the seat's act. `resume` takes the write grant every
718    // driver holds, so without this check any driver could pass the policy version and
719    // approve its own blocked command. The policy's shape is "what the seat may approve
720    // alone", and a check nobody performs would make that meaningless.
721    //
722    // A driver may approve its own branch push and pull request, and nothing wider:
723    // only on a job it blocked itself and still holds, and only when every class the
724    // command matched is in DRIVER_SELF_APPROVED. The classification is still the
725    // Worker's, through the same approveByPolicy call the seat's approval makes, so the
726    // never list still runs first and a force push still waits.
727    if (!isSeat && (current.claimed_by !== actor || take)) {
728      return refuse(
729        "resume",
730        `${id} cannot be approved by ${agent.actor} on the gate policy alone. A driver may approve only a job it blocked itself, ` +
731          `and ${id} was blocked by ${current.claimed_by ?? "nobody on record"}. Approving somebody else's blocked command is the seat's act, ` +
732          `and this caller holds neither the admin identity nor can_merge.`
733      );
734    }
735    const command = commandFromSummary(current.result_summary);
736    // The driver's narrower list is checked before the policy, over the same
737    // classifier, so a driver's migration is refused without a repo read on its behalf.
738    // A command that classifies as nothing falls through to approveByPolicy, which
739    // refuses it for its own reason.
740    if (!isSeat && command) {
741      const match = classifyCommand(command);
742      const beyond = "klasses" in match ? match.klasses.filter((k) => !DRIVER_SELF_APPROVED.includes(k)) : [];
743      if (beyond.length > 0) {
744        return refuse(
745          "resume",
746          `${id} is not pre-approved for a driver: it matched ${beyond.join(", ")}, which a driver may not approve for itself. ` +
747            `A driver approves only ${DRIVER_SELF_APPROVED.join(" and ")}. It stays blocked for the human.`
748        );
749      }
750    }
751    // A migration is read at the job's branch head, not on the default branch. The
752    // approved command runs the file in the driver's checkout, so reading the default
753    // branch would refuse a new migration and could approve a same-named file whose
754    // content is not what runs. Read once, and only when the command names a
755    // migration. A read that fails throws its reason, which approveByPolicy puts in the
756    // refusal.
757    let head: Promise<{ repo: string; sha: string }> | null = null;
758    const verdict = await approveByPolicy(env, approvedByPolicy, command, async (path) => {
759      head ??= jobBranchHead(env, current);
760      const at = await head;
761      const file = await readRepoFile(env, current.namespace, path, at.sha, at.repo);
762      return (file as { content?: string }).content ?? null;
763    });
764    if (!verdict.approved) {
765      return refuse("resume", id + " is not pre-approved: " + verdict.reason);
766    }
767    // The approved verdict is the one that counts, so the driver's list is asserted on
768    // it too. Unreachable unless the two classifications disagree, which is the case
769    // this line exists for.
770    if (!isSeat && verdict.klasses.some((k) => !DRIVER_SELF_APPROVED.includes(k))) {
771      return refuse("resume", `${id} is not pre-approved for a driver: it matched ${verdict.klass}. It stays blocked for the human.`);
772    }
773    policyMatch = { klass: verdict.klass, detail: verdict.detail, version: verdict.policyVersion };
774  }
775
776  // Only a correction spends the budget, and never an admin's. The 0 or 1 is bound
777  // rather than interpolated for the same reason bumpBlocked is: the statement stays
778  // one static string that the source guards can read and the query-plan test can
779  // EXPLAIN.
780  //
781  // claimed_at is not touched. It is the first claim, and duration_minutes measures
782  // from it, so a job that waited at a gate is measured over its whole working life
783  // rather than over the stretch after its last resume.
784  const spend = correction && !agent.admin ? 1 : 0;
785  const job: JobRow = {
786    ...current,
787    status: toQueue ? "queued" : "claimed",
788    claimed_by: toQueue ? null : holder,
789    resumed_count: current.resumed_count + 1,
790    corrections_count: current.corrections_count + spend,
791    updated_at: now.toISOString(),
792  };
793  // Signed with the job body's key, over the approval, the full note and who gave it,
794  // bound to this job (src/job-signing.ts); latestResumeNote checks it on every read.
795  const noteSig = await signJobText(env.IMPROVE_SCORE_SECRET, "resume-note", id, resumeNoteFields(reason, fullNote ?? null, actor));
796  const resumeNote: ResumeNote = {
797    reason,
798    ...(fullNote ? { note: fullNote } : {}),
799    by: actor,
800    at: now.toISOString(),
801    ...(policyMatch ? { approved_by_policy: policyMatch.version, policy_class: policyMatch.klass } : {}),
802    ...(spend ? { correction: true as const } : {}),
803    signature: noteSig ? "verified" : "unconfigured",
804  };
805  // The touch this resume records. A correction sends the work back; an approval clears
806  // the gate, on the signed policy or by the seat (admin or can_merge). "resume" was a
807  // plain resume by another write-grant caller, which is now refused above; older rows
808  // still carry it. A driver approving its own branch push
809  // or pull request on the policy is the policy's approval, not a person's. The note, when
810  // there is one, is a row of its own, so a count of approvals is not a count of notes.
811  const touchKind = correction ? "correction" : policyMatch || isSeat ? "approval" : "resume";
812  const touchActorKind = actorKind(actor, { policy: policyMatch !== null && !isSeat, seat: isSeat });
813  const touches = [
814    touchStatement(env.DB, {
815      job_id: id,
816      namespace: current.namespace,
817      kind: touchKind,
818      actor,
819      actor_kind: touchActorKind,
820      detail: {
821        reason,
822        command: commandFromSummary(current.result_summary),
823        ...(policyMatch ? { approved_by_policy: policyMatch.version, policy_class: policyMatch.klass } : {}),
824        ...(take ? { taken: true } : {}),
825        ...(toQueue ? { returned_to: "queued" } : {}),
826      },
827      sinceGate: true,
828      at: now.toISOString(),
829    }),
830    ...(fullNote
831      ? [
832          touchStatement(env.DB, {
833            job_id: id,
834            namespace: current.namespace,
835            kind: "note",
836            actor,
837            actor_kind: touchActorKind,
838            detail: { note: fullNote },
839            sinceGate: false,
840            at: now.toISOString(),
841          }),
842        ]
843      : []),
844  ];
845  // One static statement for both returns, so the source guards and the query-plan
846  // test read one shape: ?5 is 'claimed' or 'queued', and ?2 is NULL for the
847  // queue.
848  const won = await guardedTransition(env, current, [
849    env.DB.prepare(
850      `UPDATE jobs SET status = ?5, claimed_by = ?2,
851         resumed_count = resumed_count + 1, corrections_count = corrections_count + ?4, updated_at = ?3
852       WHERE id = ?1 AND status = 'blocked' RETURNING id`
853    ).bind(id, job.claimed_by, now.toISOString(), spend, job.status),
854    ...(await mirrorStatements(env, job, "job-resumed", actor, resumeNote)),
855    jobAudit(env.DB, actor, "job-resumed", job, {
856      approved: reason,
857      ...(fullNote ? { note: fullNote } : {}),
858      ...(noteSig ? { sig: noteSig } : {}),
859      held_by: job.claimed_by,
860      ...(toQueue ? { returned_to: "queued", previous_holder: holder } : {}),
861      ...(take ? { taken: true } : {}),
862      ...(spend ? { correction: true } : {}),
863      resumed_count: job.resumed_count,
864      corrections_count: job.corrections_count,
865      ...(agent.admin ? { cap_lifted_by_admin: true } : {}),
866      // Which class matched, not merely that one did. A row saying "approved by policy"
867      // cannot be checked against the policy afterwards; one naming the class and what
868      // it matched can.
869      ...(policyMatch
870        ? { approved_by_policy: policyMatch.version, policy_class: policyMatch.klass, policy_detail: policyMatch.detail }
871        : {}),
872    }),
873    ...touches,
874  ]);
875  if (!won) {
876    return refuse("resume", `${id} left blocked between reading it and resuming it. Nothing was written; ask again.`);
877  }
878  return { ok: true, action: "resume", job, resume_note: resumeNote, ...(toQueue ? { note: toQueue } : {}) };
879}
880
881/** The actor that returns a blocked job whose pull requests have all merged
882 *  (src/merge-resume.ts). A system actor, not a caller: it holds no grant, passes no
883 *  checkScope, and can do exactly what autoResumeJob does. */
884export const MERGE_RESUME_ACTOR = "system:merge-resume";
885
886/** Resume a BLOCKED job to its holder, or to the queue when the holder cannot act, on
887 *  the strength of one fact the caller has read: every pull request the job names has
888 *  merged. Never completes, never takes the claim, never approves a gate command; the
889 *  holder's own claim still finishes the job. Returns false when the job moved between
890 *  the caller's read and this write, in which case nothing was written. */
891export async function autoResumeJob(env: Env, now: Date, job: JobRow, note: string): Promise<{ resumed: boolean; to: "holder" | "queue" }> {
892  const holder = job.claimed_by;
893  if (job.status !== "blocked" || !holder) return { resumed: false, to: "holder" };
894  // Without take, a holder that cannot take the job back already yields toQueue.
895  const { toQueue } = await resumeDestination(env, holder, job, false);
896  const queued = toQueue !== null;
897  const reason = "every pull request this job names has merged";
898  const next: JobRow = {
899    ...job,
900    status: queued ? "queued" : "claimed",
901    claimed_by: queued ? null : holder,
902    resumed_count: job.resumed_count + 1,
903    updated_at: now.toISOString(),
904  };
905  const noteSig = await signJobText(env.IMPROVE_SCORE_SECRET, "resume-note", job.id, resumeNoteFields(reason, note, MERGE_RESUME_ACTOR));
906  const resumeNote: ResumeNote = {
907    reason,
908    note,
909    by: MERGE_RESUME_ACTOR,
910    at: now.toISOString(),
911    signature: noteSig ? "verified" : "unconfigured",
912  };
913  const kind = actorKind(MERGE_RESUME_ACTOR);
914  const won = await guardedTransition(env, job, [
915    env.DB.prepare(
916      `UPDATE jobs SET status = ?5, claimed_by = ?2,
917         resumed_count = resumed_count + 1, corrections_count = corrections_count + ?4, updated_at = ?3
918       WHERE id = ?1 AND status = 'blocked' RETURNING id`
919    ).bind(job.id, next.claimed_by, now.toISOString(), 0, next.status),
920    ...(await mirrorStatements(env, next, "job-resumed", MERGE_RESUME_ACTOR, resumeNote)),
921    jobAudit(env.DB, MERGE_RESUME_ACTOR, "job-resumed", next, {
922      approved: reason,
923      note,
924      ...(noteSig ? { sig: noteSig } : {}),
925      held_by: next.claimed_by,
926      ...(queued ? { returned_to: "queued", previous_holder: holder } : {}),
927      resumed_count: next.resumed_count,
928    }),
929    touchStatement(env.DB, {
930      job_id: job.id,
931      namespace: job.namespace,
932      kind: "resume",
933      actor: MERGE_RESUME_ACTOR,
934      actor_kind: kind,
935      detail: { reason, ...(queued ? { returned_to: "queued" } : {}) },
936      sinceGate: true,
937      at: now.toISOString(),
938    }),
939    touchStatement(env.DB, {
940      job_id: job.id,
941      namespace: job.namespace,
942      kind: "note",
943      actor: MERGE_RESUME_ACTOR,
944      actor_kind: kind,
945      detail: { note },
946      sinceGate: false,
947      at: now.toISOString(),
948    }),
949  ]);
950  return { resumed: won, to: queued ? "queue" : "holder" };
951}