@giamme/forge 0.10.0 → 0.11.1

package/scripts/forge_registry.py

@@ -49,15 +49,19 @@ def registry_dir() -> Path:
     """The ``runs`` directory under forge's config home.
 
     Resolved the same way ``forge_jev.config_path()`` resolves ``jev.json``:
-    ``XDG_CONFIG_HOME`` when set and not empty, otherwise ``~/.config``, then
-    ``expanduser()``. An empty value counts as unset, as the XDG spec says and as
-    forge-ui's run list reads it; taken literally it named a directory below the
-    current one, usually the user's repo. ``config_path()`` is
-    ``<that>/forge/jev.json``; the registry is the sibling ``runs`` directory.
+    ``XDG_CONFIG_HOME`` (``~`` expanded) when it is an absolute path, otherwise
+    ``~/.config``. An empty or relative value counts as unset, as the XDG spec says
+    ("If an implementation encounters a relative path in any of these variables it
+    should consider the path invalid and ignore it") and as forge-ui's run list reads
+    it; taken literally it named a directory below the current one, usually the
+    user's repo. ``config_path()`` is ``<that>/forge/jev.json``; the registry is the
+    sibling ``runs`` directory.
     """
-    config = (Path(os.environ.get('XDG_CONFIG_HOME') or str(Path.home() / '.config')).expanduser()
-              / 'forge/jev.json')
-    return config.parent / 'runs'
+    value = os.environ.get('XDG_CONFIG_HOME') or ''
+    base = Path(value).expanduser() if value else None
+    if base is None or not base.is_absolute():
+        base = Path.home() / '.config'
+    return base / 'forge' / 'runs'
 
 
 def repo_key(repo) -> str:
@@ -118,8 +122,9 @@ def register_run_dir(repo: Path, run_dir: Path) -> None:
     it went to.
     """
     try:
-        # A relative XDG_CONFIG_HOME resolves below the current directory -- for a runner or
-        # `forge ui open`, usually the user's repo. Forge does not write into the user's tree.
+        # A relative HOME (registry_dir already ignores a relative XDG_CONFIG_HOME) would resolve
+        # below the current directory -- for a runner, usually the user's repo. Forge does not
+        # write into the user's tree.
         if not registry_dir().is_absolute():
             return
         registry = runs_registry(repo)

package/ui/README.md

@@ -96,7 +96,7 @@ Sources are checked in this order:
 2. `--root DIR` itself, its children and grandchildren. Scanning stops when a plan
    directory is found; hidden children and symlinked child directories are skipped.
 3. Forge's registry: `*.txt` files in `$XDG_CONFIG_HOME/forge/runs/`, defaulting
-   to `~/.config/forge/runs/` when XDG_CONFIG_HOME is unset or empty. Each file
+   to `~/.config/forge/runs/` when XDG_CONFIG_HOME is unset, empty or relative. Each file
    supplies absolute paths, one per line; blank lines and `#` comments are ignored.
    `--registry-dir` replaces this location; `--no-registry` disables it.
 
@@ -189,8 +189,9 @@ keep one meaning everywhere (amber running, green merged or passed, red failed,
 - **Models (`#/models`):** a leaderboard of the models forge used. Implementers: tasks, first-attempt
   pass rate with its 95% Wilson interval, censored attempts, retries, escalations away from the
   model, timeouts, gate and human accepts, median model time and tokens. Reviewers: primary,
-  shadow and final reviews, the PASS/FAIL split, findings per review by severity, and how often a
-  shadow review agreed with the primary. Filter by project, difficulty, kind and period, or keep
+  shadow and final reviews, the PASS/FAIL split, findings per review by severity, how often a
+  shadow review agreed with the primary, and how often work it PASSed did not hold (later
+  reverted or rewritten, from `forge dataset reviewers`; "not enough data" below 10 outcomes). Filter by project, difficulty, kind and period, or keep
   only exploratory picks; open a difficulty for its own table. Routing is not random, so the
   numbers compare what happened, not what would have: the page says so. A model's name opens the
   run cloud filtered to its runs.
@@ -265,7 +266,7 @@ takes effect. The routes are in [docs/api.md](docs/api.md).
   infra-retry budgets. A task has a threshold override (`Inherit`, P0–P3 or `None`, which
   exempts it from the run's threshold), its own retry budget and a **model pin**: the model
   its next full retry uses, once. A control that cannot apply (no live scheduler, a merged
-  task, a Fractal plan's pin) is disabled and says why.
+  task) is disabled and says why. A Fractal plan's pin control is hidden.
 - **Open findings (`forge issues`):** the findings a run, or every run of its repository,
   left open. The list opens from a quick offline listing and then fills in what is already
   filed; select findings to file as GitHub issues, or dismiss them (and undo that).

package/ui/docs/api.md

@@ -50,7 +50,7 @@ written), and the reader must never raise because of one.
 | `deferrals.txt` | one line per task the wave planner deferred |
 | `integration.base`, `accepted.integration` | one commit each: where the integration branch started, the revision the run accepted |
 | `attempts/<role>-<uuid>/` | one *execution* (below) of the run itself: `parallel` (a `run`) or `verification` |
-| `final-review-<epoch>-<pid>/` | one whole-run review: `qa.input`, `qa.last`, `verdict` (`PASS FAIL UNKNOWN INVALIDATED ACCEPTED`; absent while it runs or when nothing was judged), `qa.infra`, `qa.gate`, `known_issues.md`, `review.meta` (`key=value`: `base tip source spec threshold`, `threshold=none` when unset), `tasks.summary`, `attempts/qa-<uuid>/` |
+| `final-review-<epoch>-<pid>/` | one whole-run review: `qa.input`, `qa.last`, `verdict` (`PASS FAIL UNKNOWN INVALIDATED ACCEPTED`; absent while it runs or when nothing was judged), `qa.infra`, `qa.gate`, `known_issues.md`, `review.meta` (`key=value`: `base tip source spec threshold integration`, `threshold=none` when unset; `integration` is the integration-branch commit the reviewed result contains and is absent on older runs), `tasks.summary`, `attempts/qa-<uuid>/` |
 | `final-review` | a symlink to the newest *published* review dir; `final-review.verdict` a copy of its verdict |
 | `integrate-<epoch>-<pid>/` | one `integrate`: `setup.log`, `merge.log`, `verification.*`, `attempts/verification-<uuid>/`, and `final-review/` (a review dir as above) when it ran one |
 | `tasks/<id>/merged` | exists when the task was merged; its mtime is when |
@@ -60,7 +60,7 @@ written), and the reader must never raise because of one.
 | `tasks/<id>/escalations.tsv` | `epoch<TAB>attempt<TAB>from_spec<TAB>to_spec[<TAB>source]` per line; `source` (who decided: `policy`, a human's `retry --dwarf` as `retry`, or a `pin`) is missing on older rows, which read as `policy` |
 | `tasks/<id>/qa.last` | the reviewer's final message; its last line matching `FORGE_VERDICT: PASS` or `FORGE_VERDICT: FAIL` is the verdict |
 | `tasks/<id>/prompt.md`, `approach.md`, `retry_findings.md` | free text |
-| `tasks/<id>/accepted.by` | who accepted a task over a reviewer's FAIL, and why (`key=value` lines in current forge; returned as text) |
+| `tasks/<id>/accepted.by` | who accepted a task over a reviewer's FAIL, and why (`key=value`: `task`, `status`, `reason`, `by`, `at`, `epoch`, `attempt`, `reviewed_commit`; older runs are free text; returned as text) |
 | `tasks/<id>/qa.gate` | `threshold<TAB>decision<TAB>worst<TAB>n_confirmed<TAB>n_unlabelled<TAB>n_below` (`decision` is `accept` or `keep`, `-` for none) |
 | `tasks/<id>/known_issues.md` | the confirmed findings a threshold tolerated |
 | `tasks/<id>/dwarf.input`, `qa.input` | the prompts forge assembled; `<role>.delivered`, `<role>.resolved` the live dispatch files |
@@ -233,6 +233,7 @@ its last 20,000 behind a leading `…`. Their `truncated` lists the field names
 | `POST /api/runs/<key>/issues` | file GitHub issues for chosen findings; authenticated, 300 s timeout |
 | `POST /api/runs/<key>/issues/dismiss` | dismiss or (`undo`) restore findings; authenticated |
 | `POST /api/runs/<key>/delete` | dry-run or delete a run with `forge runs rm`; authenticated, 900 s timeout; later requests for the key answer `404` |
+| `GET /api/models/reviewers` | `200` the `forge dataset reviewers --json` report (how each reviewer's PASSed work held up); no parameters |
 | `GET /api/config?run=<key>` | `200` the `forge config show --json` of that run's repo |
 | `POST /api/config` | set or unset one allowed key (`repo.verify`, `repo.setup`, `repo.verify-subset`, `jev.enabled`); authenticated |
 | `GET /api/runs/<key>/export?texts=0\|1&paths=0\|1` | `200` the run as one HTML file (see Export), `Content-Disposition: attachment`, `Content-Security-Policy: default-src 'none'; sandbox`; `404` for an unknown run |
@@ -286,18 +287,20 @@ nothing when there is none. Every other response keeps
   "counts": {"MERGED": 3, "RUNNING": 1, "PENDING": 1},
   "verification_status": "PASS",
   "created": 1760619000.0,
-  "task_statuses": [{"id": "reader", "status": "MERGED", "difficulty": "high", "title": "Read plan dirs"},
-                    {"id": "page", "status": "RUNNING", "difficulty": "medium", "title": "Draw the page"}],
+  "task_statuses": [{"id": "reader", "status": "MERGED", "difficulty": "high", "title": "Read plan dirs", "accepted": true},
+                    {"id": "page", "status": "RUNNING", "difficulty": "medium", "title": "Draw the page", "accepted": false}],
   "models": ["opus", "sol:xhigh"],
   "dwarf_models": ["sol:xhigh"],
   "qa_models": ["opus"],
-  "final_review": "FAIL"
+  "final_review": "FAIL",
+  "final_review_outdated": false
 }
 ```
 
-- `task_statuses`: every task in `tasks.tsv` order, with its `difficulty` (`null` when empty) and
-  `title` (its first 160 characters, then `…`). A solo run: `[{"id": "solo", "status": <solo status>,
-  "difficulty": null, "title": <goal or "Solo run">}]`.
+- `task_statuses`: every task in `tasks.tsv` order, with its `difficulty` (`null` when empty),
+  `title` (its first 160 characters, then `…`) and `accepted` (`true` when `tasks/<id>/accepted.by`
+  is a non-empty file). A solo run: `[{"id": "solo", "status": <solo status>, "difficulty": null,
+  "title": <goal or "Solo run">, "accepted": false}]`. `accepted` does not change `status` or `counts`.
 - `created`: when the run began: the earliest birth time (else mtime) of the files a run writes
   once at its start (plan: `run_id`, `repo`, `request.md`, `goal.txt`, `tasks.tsv`; solo: `prompt.md`,
   `repo`, `request.md`, `goal.txt`), else `null`. These are stat'ed only, and never move `updated`.
@@ -306,6 +309,11 @@ nothing when there is none. Every other response keeps
   and `qa` specs as its task has them), nulls left out.
 - `final_review`: the first word of `final-review.verdict`, else `null`; always `null` for a
   solo run. (RunDetail replaces it with an object, below.)
+- `final_review_outdated`: `true`, `false` or `null`, for the published review only (the dir the
+  `final-review` link points to, when that link stays inside the plan). The same rule as
+  FinalReviewSummary `outdated`, below. `null` when there is no such review, it has no verdict, or
+  `accepted.integration` is missing; always `null` for a solo run. RunDetail keeps this field
+  (it is not replaced by the newest review's `outdated`).
 
 `kind` is `"plan"` or `"solo"`. `updated` is the newest mtime (epoch seconds, float) among
 the run dir and the files the reader read. Any field it cannot determine is `null`
@@ -316,7 +324,11 @@ are `null`, `task_count` is 1, and `counts` is `{<status>: 1}` using the solo st
 The summary reads only `repo`, `goal.txt`, `status`, `verdict`, `dwarf.spec`, `qa.spec` and,
 when a spec file is missing, `*.resolved`. It also stats `dwarf.log` and `qa.log` without
 reading them, so `updated` moves while a model is writing a log. A plan summary reads
-`final-review.verdict` besides the files it always read.
+`final-review.verdict` besides the files it always read. For `final_review_outdated` it also
+reads `accepted.integration` and, through the `final-review` link, that dir's `verdict` and
+`review.meta`, and stats each task's `merged` marker. Those reads count toward `updated`, the
+same way as every other file the summary reads, so a newer `accepted.integration` moves the
+run's activity time. It does not open a review's attempts or scan the other review dirs.
 
 ## RunDetail
 
@@ -370,7 +382,9 @@ Every RunSummary field, plus:
   path of its review dir or `null`, `ended` the latest end of its verification and review
   executions (`null` while one is unfinished or there is none).
 - `final_review` is the newest FinalReviewSummary (review and integrate dirs together, by the
-  epoch in the name), or `null`; `final_reviews` lists the newest 20, newest first.
+  epoch in the name), or `null`; `final_reviews` lists the newest 20, newest first. That newest
+  review's `outdated` is its own. `final_review_outdated` stays the published review's flag, so
+  the two differ when a newer review exists than the one `final-review` links to.
 - `deferrals`: the non-empty lines of `deferrals.txt`, `[]` when it is missing.
 - `findings_available`: whether `scripts/forge-contract.py` could be loaded.
 - `fractal`: `null` without `fractal-selection.json`, else `{"enabled", "run", "available", "reason"}`
@@ -403,6 +417,9 @@ Every RunSummary field, plus:
   "escalations": [{"at": 1760620500.0, "attempt": 2, "from": "luna", "to": "sol", "source": "policy"}],
   "verdict": "PASS",
   "accepted_by": null,
+  "accepted": false,
+  "accepted_attempt": null,
+  "accepted_over": null,
   "explored": true,
   "route": [{"at": 1760619000.0, "task": "reader", "tier": "high", "epsilon": 0.5,
              "candidates": ["astra", "opus"], "default": "opus", "chosen": "astra",
@@ -437,6 +454,14 @@ Every RunSummary field, plus:
 - `infra` in an attempt: `null` for empty, `-` or missing.
 - `source` in an escalation: the 5th column of `escalations.tsv` (`policy`, `retry` or `pin`, as forge wrote it); `policy` when the row has only 4 columns or the cell is empty.
 - `verdict`: `"PASS"`, `"FAIL"` or `null`, from `qa.last` as described above.
+- `accepted`: `true` when `accepted.by` is a non-empty file, on `task_statuses` and on the task.
+  `status` stays what the merged marker or `status` file says (`MERGED` when the marker is there)
+  and `counts` do not change.
+- `accepted_attempt`: the integer `attempt=` of `accepted.by`, or `null` when the key is missing
+  or not an integer (not an integer is warned). On the task, not on `task_statuses`.
+- `accepted_over`: `"FAIL"` or `"UNKNOWN"` when `status=` in `accepted.by` says so; `null` for any
+  other or missing value, including `PASS` (the panel then says plain "accepted"). On the task,
+  not on `task_statuses`. A free-text `accepted.by` from an older forge has both null.
 - `dwarf_tail`: the last 4,000 characters of `dwarf.last` (`tasks/<id>/dwarf.last` for a
   plan task, the run dir's `dwarf.last` for a solo run), or `null` when the file is missing.
   Capped like `qa_tail`.
@@ -468,8 +493,9 @@ it is missing or `<harness default>`). `wave` is 1, `branch` is `null`, and `att
 from the run dir's `attempts.tsv`. `status` is the solo status; `attempt` is the highest `n`
 in `attempts.tsv`, or `null`. `escalations`, `route` and `shadow` are empty. `verdict` and
 `qa_tail` come from `qa.last`, and `prompt` comes from `prompt.md`. `deps` and `files` are
-`[]`; `difficulty`, `accepted_by`, `approach` and `retry_findings` are `null`; `explored` is
-false; `clef` is `{first_pass: null, retry_pass: {}}`. `request` on the detail is `request.md`.
+`[]`; `difficulty`, `accepted_by`, `approach` and `retry_findings` are `null`; `accepted` is
+false; `accepted_attempt` and `accepted_over` are `null`; `explored` is false; `clef` is
+`{first_pass: null, retry_pass: {}}`. `request` on the detail is `request.md`.
 
 ## Execution
 
@@ -538,6 +564,7 @@ block's 1-based line in the reply. Lists of Findings keep the first 200.
 ```json
 {"name": "final-review-1760622000-4242", "source": "review", "at": 1760622000.0, "published": true,
  "verdict": "FAIL", "state": "done", "spec": "opus", "threshold": "P2", "base": "1a2b...", "tip": "3c4d...",
+ "integration": "3c4d...", "outdated": false, "merged_since": [],
  "gate": {...}, "findings": FindingsSummary, "execution": "qa-...",
  "started": 1760622010.0, "ended": 1760622400.0, "duration_s": 390.0}
 ```
@@ -548,7 +575,29 @@ block's 1-based line in the reply. Lists of Findings keep the first 200.
   publishes nothing).
 - `state`: `done` with a verdict, `infra` with `qa.infra`, `running` when it is the newest
   review and has `qa.input`, else `orphaned`.
-- `spec`, `threshold`, `base`, `tip` come from `review.meta` (`threshold=none` is `null`).
+- `spec`, `threshold`, `base`, `tip`, `integration` come from `review.meta` (`threshold=none` is
+  `null`). `integration` is the integration-branch commit the reviewed result contains, or `null`
+  when missing, empty, or not a commit. A commit is the object name `git rev-parse` writes: 40
+  or 64 lowercase hex digits. Any other `integration=` value is warned on that
+  `review.meta` (`integration is not a commit`; the summary's read of the published dir
+  warns `final-review/review.meta`) and is not a known commit, so freshness uses the next rule.
+  `source` on this object is the dir kind, `review` or `integrate`, not `review.meta`'s
+  `source=` (a worktree path).
+- `outdated`: whether the plan's integration branch has moved since this review. `null` when the
+  review has no verdict, or when `accepted.integration` is missing. Otherwise the first rule that
+  applies:
+  1. `integration` is a commit: `true` when it differs from `accepted.integration`.
+  2. Else, for `source` `review`: `true` when `tip` differs from `accepted.integration`.
+  3. Else (an integrate review from an older forge, which has no `integration=` commit): `true`
+     when any task merged after the review started.
+- `merged_since`: the ids of tasks merged after the review started, oldest merge first. `[]` when
+  the review is not outdated. It may also be `[]` for an outdated review whose only later merge
+  fell inside the review's starting second.
+- A task merged after the review when the mtime of its `merged` marker is `>= at + 1`, where `at`
+  is the whole-second epoch in the review dir's name. A merge inside that starting second is
+  ambiguous and is not counted. The execution's `started` is not used.
+- `outdated` means tasks merged into the plan's integration branch since the review. Changes on
+  the user's own branch after an integrate are not tracked.
 - `execution` is its newest `attempts/qa-*`; `started`, `ended`, `duration_s` are that
   execution's.
 
@@ -662,13 +711,15 @@ lists, for all tasks and final reviews at once, without `text` or `line`.
             "verdict": "FAIL", "findings": [{"id": "qa-…:0", "severity": "P1", "status": "CONFIRMED",
                                              "location": "ui/reader.py:42", "summary": "…"}]}]}],
  "final_reviews": [{"name": "final-review-…", "execution": "qa-…", "spec": "sol", "verdict": "FAIL",
+                    "outdated": true, "merged_since": ["reader"],
                     "findings": [{"id": "qa-…:0", "severity": "P2", "status": "CONFIRMED", "location": null, "summary": "…"}]}],
  "truncated": [], "warnings": []}
 ```
 
 A task's `reviews` are every primary and shadow review of every attempt that listed a Finding
-(a solo run has one task, `solo`); `final_reviews` the newest 20 final reviews that did. A
-Finding's `id` is `<execution>:<n>`, `n` its 0-based place in the reply (`primary:<n>` or
+(a solo run has one task, `solo`); `final_reviews` the newest 20 final reviews that did. Each
+of those carries `outdated` and `merged_since`, the same values as that review's
+FinalReviewSummary. A Finding's `id` is `<execution>:<n>`, `n` its 0-based place in the reply (`primary:<n>` or
 `final:<n>` for a reply without an execution); the DiffDetail that pins it gives it the same
 `id`, so a mark on the stage opens that Finding in the diff. `available` is `false` without the
 contract module, and the lists are then empty.
@@ -961,9 +1012,12 @@ of the other mode: it replaces it as it does one running other code. `forge ui s
 mode (`read_only` in its JSON).
 
 **The CLIs' configuration.** The server `forge ui open` starts runs without any `FORGE_*` variable
-of the shell it was started from. The CLIs its writes call still need the forge configuration, so
+of the shell it was started from. The CLIs it calls, for reads and writes alike, still need the forge configuration, so
 `open` hands them these, as that shell has them (an empty value counts as unset; a relative
-`FORGE_REGISTRY` or `FORGE_DATA_HOME` is made absolute against the shell's directory):
+`FORGE_REGISTRY` or `FORGE_DATA_HOME` is made absolute against the shell's directory, except that a
+`FORGE_DATA_HOME` starting with `~` is kept as given, because its reader expands the `~`; a
+`FORGE_REGISTRY` starting with `~` is not expanded by anything, so it is made absolute like any other
+relative path):
 `FORGE_REGISTRY`, `FORGE_DATA_HOME`, `FORGE_DATASET`, `XDG_CONFIG_HOME`, `XDG_DATA_HOME` and
 `XDG_STATE_HOME` (`control.CLI_ENV_NAMES`). It writes them to `cli-env.json` (mode `0600`) in its
 state dir, the server loads that file once when it starts (`_serve --cli-env FILE`) and every CLI
@@ -971,12 +1025,14 @@ call gets them on top of the server's own environment; the server's environment
 changed. No other variable is passed, and none of these is a secret. `server.json` records them as
 `cli_env`. A server started by hand (`python3 -m forge_ui`) passes its own environment unchanged.
 
-`open` never reuses a server whose recorded `cli_env` differs from the current shell's. It names
-each variable that differs and both values, says to run `forge ui stop` and then open again, exits
-`5`, prints no link and leaves the server running (it may be in the middle of another shell's
-write). A server
-running other code, in the other mode or reading another registry directory is still replaced, and
-the new one gets the current shell's configuration.
+`open` never reuses a server whose recorded `cli_env` differs from the current shell's. For a
+server that takes writes it names each variable that differs and both values, says to run
+`forge ui stop` and then open again, exits `5`, prints no link and leaves the server running (it may
+be in the middle of another shell's write). A read-only server (`FORGE_UI_READONLY=1`, asked for
+again in the same mode) has no write to cut off, so it is replaced, as is one running other code, in
+the other mode or reading another registry directory: the new one gets the current shell's
+configuration, `open` prints the link and exits `0`. Read-only servers still run CLIs for their GET
+routes, so their configuration matters too.
 
 **Serialization.** One write per run key at a time. A second write to a run whose write is still
 running is `409 {"error": "busy"}`, without reaching the CLI; other runs are not held up.
@@ -1061,6 +1117,15 @@ deletion) `500`. Deletion holds the run's write lock and a server-wide lock on t
 directory (`409 busy` when either is held). The run key is looked up again under the lock, and
 once the directory is gone every later request for that key is `404`. Timeout 900 s.
 
+### `GET /api/models/reviewers`
+
+Runs `dataset reviewers --json` and answers with its object: `horizon_days`, `min_landed`,
+`survives_at`, `reviewers` (per reviewer alias: `landed`, `reverted`, `rewritten`,
+`did_not_hold`, `enough`, and `rate` and `ci` only when `enough`, else `null` with a `note`),
+`unattributed`, `skipped` and `other_horizons`. Any query parameter is a `400`. Not cached: every
+request runs the CLI, and the page asks once per change of `/api/models`. Advisory: it feeds the
+Reviewers table's Did not hold column and nothing else. Timeout 60 s.
+
 ### `GET /api/config?run=<key>` and `POST /api/config`
 
 The repository is the run's own `repo` file (first line, an existing absolute directory; else

package/ui/forge_ui/control.py

@@ -43,6 +43,7 @@ _EXITS = {2: (400, 'invalid'), 3: (409, 'refused'), 4: (500, 'failed')}
 # of them is a secret (forge-config.py's SECRET_WORDS), and no other FORGE_* variable is ever passed.
 CLI_ENV_NAMES = ('FORGE_REGISTRY', 'FORGE_DATA_HOME', 'FORGE_DATASET', 'XDG_CONFIG_HOME', 'XDG_DATA_HOME', 'XDG_STATE_HOME')
 _CLI_ENV_PATHS = ('FORGE_REGISTRY', 'FORGE_DATA_HOME')  # read relative to the shell's directory, not the server's
+_CLI_ENV_EXPANDS_HOME = ('FORGE_DATA_HOME',)  # the paths whose reader expands a leading ~ itself
 cli_env = {}  # set once, before the server starts; empty when it was started by hand
 
 
@@ -50,14 +51,15 @@ def cli_env_from(environ):
     """The CLI_ENV_NAMES set in `environ` (an empty value counts as unset, as it does for the CLIs).
 
     A relative FORGE_REGISTRY or FORGE_DATA_HOME is made absolute here: the server and its CLIs run in
-    another directory than the shell that named it.
+    another directory than the shell that named it. A leading ~ is kept only where the reader expands it
+    (FORGE_DATA_HOME); a FORGE_REGISTRY of '~/x.tsv' is the relative path ./~/x.tsv to every CLI.
     """
     out = {}
     for name in CLI_ENV_NAMES:
         value = environ.get(name, '')
         if not value:
             continue
-        if name in _CLI_ENV_PATHS and not value.startswith('~'):
+        if name in _CLI_ENV_PATHS and not (name in _CLI_ENV_EXPANDS_HOME and value.startswith('~')):
             value = os.path.abspath(value)
         out[name] = value
     return out
@@ -358,9 +360,16 @@ def _issues_file(ctx):
         if not isinstance(labels, list) or len(labels) > MAX_LABELS:
             raise BadBody(f'labels must be a list of at most {MAX_LABELS} strings')
         for label in labels:
-            if (not isinstance(label, str) or not label.strip() or len(label) > MAX_LABEL
-                    or label.startswith('-') or not _no_control_chars(label)):
-                raise BadBody(f'a label must be a text of 1 to {MAX_LABEL} characters, without control characters')
+            if not isinstance(label, str):
+                raise BadBody('a label must be a text')
+            if not label.strip():
+                raise BadBody('a label cannot be blank')
+            if len(label) > MAX_LABEL:
+                raise BadBody(f'a label is at most {MAX_LABEL} characters')
+            if label.startswith('-'):
+                raise BadBody('a label cannot start with "-"')
+            if not _no_control_chars(label):
+                raise BadBody('a label cannot hold control characters')
     except BadBody as exc:
         return _invalid(str(exc))
     path = ctx.locate()
@@ -538,6 +547,17 @@ def _config_set(ctx):
 
 # (method, path pattern, handler(ctx) -> (status, body)); group 1 of the pattern is the run key
 # (the config routes name it in the query or body instead). New routes are added here.
+def _reviewer_outcomes(ctx):
+    # How the work each reviewer PASSed held up afterwards (`forge dataset reviewers`): advisory,
+    # read from the run dataset through the CLI, so forge_ui never opens the store itself.
+    ctx.route = 'reviewers'
+    try:
+        _query_params(ctx.query, ())
+    except BadBody as exc:
+        return _invalid(str(exc))
+    return ctx.call('dataset', 'reviewers', '--json')
+
+
 ROUTES = [
     ('GET', re.compile(r'/api/runs/([0-9a-f]{12})/controls'), _show),
     ('POST', re.compile(r'/api/runs/([0-9a-f]{12})/controls'), _change),
@@ -547,6 +567,7 @@ ROUTES = [
     ('POST', re.compile(r'/api/runs/([0-9a-f]{12})/delete'), _delete),
     ('GET', re.compile(r'/api/config()'), _config_get),
     ('POST', re.compile(r'/api/config()'), _config_set),
+    ('GET', re.compile(r'/api/models/reviewers()'), _reviewer_outcomes),
 ]