@giamme/forge 0.11.0 → 0.11.1

package/CHANGELOG.md

@@ -5,6 +5,19 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and versions follow the format `{major}.{minor}[.{patch}]` ([...] parts appear only when non-zero).
 
+## [0.11.1] - 2026-10-26
+
+A bug-fix release for forge-ui and forge issues: the Settings and Open findings views keep your edits and selections honest, forge ui open handles a read-only server with another configuration, and refused labels and warnings say what's wrong.
+
+### Fixed
+
+- forge-ui's Open findings view files exactly what its preview showed, even if you change the scope or the plausible toggle while the drafts load, and shows forge's notes when nothing was filed. Findings hidden by a filter are no longer counted or acted on, and "Select shown open" counts only shown findings toward its limit of 25.
+- forge-ui's Settings page no longer drops a repository-switch confirm when the run list changes. It warns before saving over a file that changed on disk while a confirm was open, and a failed read keeps your unsaved edits on screen with a note instead of replacing the page with an error.
+- `forge ui open` resolves a `FORGE_REGISTRY` that starts with `~` the same way forge's commands do, and replaces a read-only forge-ui running with another configuration instead of refusing to open.
+- The docs now match the code on who creates `control.lock`, `forge config set` and `unset` needing `--repo`, when `forge runs rm` keeps a run directory, and a Fractal plan's hidden pin control.
+- `forge issues` prints its warnings as `warning: …` in the listing too, as it already did for dismissals.
+- When forge-ui refuses an issue label, its message now names the rule the label broke (blank, over 50 characters, starting with `-`, or holding control characters).
+
 ## [0.11] - 2026-10-26
 
 Reviews now remember the last round: a retry's review starts from the previous findings, and a repeated whole-run review from the last report. forge dataset can forecast a plan before it runs and grade how often each reviewer's PASS held, and forge-ui shows a superseded final review as OUTDATED instead of FAIL.

package/VERSION

@@ -1 +1 @@
-0.11
+0.11.1

package/docs/artifacts.md

@@ -67,7 +67,8 @@ A decomposed run adds:
   reviewer_session                     holds on; present while plan --reviewer-session is on
   <final-review-dir>/review.meta       final-review-<epoch>-<pid>/ or integrate-*/final-review/; base=, tip=, source=, spec=, threshold=, integration=, previous=, since=; session= and session_reason= while reviewer_session is set
   control.log                          one JSON line per human change made with forge control
-  scheduler.live, control.lock         only while a scheduler runs: {"pid", "started"}; the lock serialises forge control
+  scheduler.live                       only while a scheduler runs: {"pid", "started"}
+  control.lock                         the lock that serialises changes to the plan's control files, created by whichever takes it first (forge control, the scheduler or an escalation record) and left in place
   retry_budget, infra_budget           only while a scheduler runs: its live budgets (a number each)
   integration.base                     commit the integration branch started from
   verification.{status,exit,log,command,fingerprint}   the combined verification

package/docs/commands.md

@@ -17,7 +17,7 @@ harness (`/forge`); this command installs forge and drives its optional tools.
 | `forge fractal …` | opt-in Fractal execution; see [the command group](fractal.md#forge-fractal-command-group) |
 | `forge runs [--repo DIR \| --all] [--limit N] [--json]` | this repo's recent runs, newest first: run id, kind, age, task states, verification and final review, goal, and the run dir. Read-only; the same summaries forge-ui shows |
 | `forge control show\|set\|pin\|unpin PLAN_DIR …` | change a live plan: `set` takes `qa-threshold`, `timeout`, `escalate-after`, `verify-retries`, `retry-budget` or `infra-retries` (the last two only while a scheduler runs; `--task ID` for `qa-threshold` and `retry-budget`, value `inherit` drops the override); `pin PLAN_DIR TASK SPEC` sets the model the task's next full retry uses once, `unpin` drops it; `--json`. Every change is logged in `control.log`. See [live controls](decomposed-runs.md#changing-a-run-while-it-works) |
-| `forge config show\|set\|unset [--repo DIR] [--json]` | one view of every config source (registry, Jev, the repo's `.forge/verify`, `setup` and `verify-subset`, dataset, `FORGE_*` variables with secrets hidden); `set KEY VALUE` / `unset KEY` edit `repo.verify`, `repo.setup`, `repo.verify-subset` (must contain `{files}`) and, for `set`, `jev.enabled true\|false`. `-` as a value reads stdin. Exit 2 on invalid input |
+| `forge config show [--repo DIR] [--json]` / `forge config set <key> <value> --repo DIR [--json]` / `forge config unset <key> --repo DIR [--json]` | one view of every config source (registry, Jev, the repo's `.forge/verify`, `setup` and `verify-subset`, dataset, `FORGE_*` variables with secrets hidden); `set KEY VALUE` / `unset KEY` edit `repo.verify`, `repo.setup`, `repo.verify-subset` (must contain `{files}`) and, for `set`, `jev.enabled true\|false` (that one does not need `--repo`). `-` as a value reads stdin. Exit 2 on invalid input |
 | `forge runs rm RUN_DIR [--dry-run] [--yes] [--no-archive] [--worktrees] [--branches] [--json]` | delete a run directory but keep what it taught the dataset; see [below](#forge-runs-rm) |
 | `forge issues RUN [--apply] …` | file the review findings a run left open as GitHub issues; see [below](#forge-issues) |
 | `forge ui open\|status\|stop` | forge-ui, the run viewer; see [the command group](forge-ui.md#forge-ui-command-group) |
@@ -41,7 +41,8 @@ solo run), so a run started meanwhile fails to start instead of racing the delet
 What counts as the run's is decided from the run id, not read from the run directory: a worktree
 under `<repo>/../.forge-worktrees/<run id>/` on `forge/<run id>/<task>` or
 `forge/<run id>-integration`. Any other worktree there is `foreign`, one with uncommitted changes
-is `dirty`; neither is touched, and a dirty one keeps the run directory too. Branches are reported
+is `dirty`; neither is touched, and a dirty one keeps the run directory only when `--worktrees`
+was asked. Branches are reported
 `merged` or `UNMERGED`, so you see what deleting them would lose. `--dry-run` changes nothing and
 reports; `--yes` skips the prompt for the run id (needed without a terminal); `--json` prints one
 object, on failure too. Exit 0 ok, 2 refused input, 3 busy or the run is active, 4 failed during

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@giamme/forge",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "description": "Multi-model coding with a reviewer that reads the code: plan, build in parallel worktrees, review every real diff, merge only what passes.",
   "keywords": ["claude-code", "codex", "opencode", "agent-skill", "code-review", "multi-model"],
   "license": "MIT",

package/scripts/forge-issues.py

@@ -1107,7 +1107,7 @@ def print_human(out, applied):
           f"{s['drafts']} draft(s) ({s['tolerated']} tolerated, {s['accepted']} accepted, "
           f"{s['review']} review, {s['plausible']} plausible)")
     for warning in out["warnings"]:
-        print(f"  warning {warning}")
+        print(f"  warning: {warning}")
     for note in out["notes"]:
         print(f"  skipped {note}")
     for a in out["already_filed"]:

package/scripts/forge-ui.py

@@ -355,12 +355,16 @@ def cmd_open(args):
                 # the record and the live answer must both name this code and the mode asked for
                 if (server.get('build') == build and answer.get('build') == build and server.get('registry') == registry
                         and bool(server.get('read_only')) == read_only and is_read_only(answer) == read_only):
-                    # Reused, it would run this shell's writes with another registry and dataset, and a
-                    # restart could cut off a write in flight: say so instead, and how to restart it.
+                    # Reused, its CLIs would run with another registry and dataset. A server that takes
+                    # writes may be in the middle of one, which a restart could cut off: say so instead,
+                    # and how to restart it. A read-only one has none to cut off: replace it.
                     change = config_change(server.get('cli_env'), cli_env)
-                    if change:
+                    if change and read_only:
+                        terminate(server['pid'])
+                        server = None
+                    elif change:
                         _say(f'error: the running forge-ui (pid {server["pid"]}) has another forge configuration '
-                             f'for its writes: {change}. Run `forge ui stop`, then open again.')
+                             f'for its CLIs: {change}. Run `forge ui stop`, then open again.')
                         return 5
                 else:
                     terminate(server['pid'])

package/ui/README.md

@@ -266,7 +266,7 @@ takes effect. The routes are in [docs/api.md](docs/api.md).
   infra-retry budgets. A task has a threshold override (`Inherit`, P0–P3 or `None`, which
   exempts it from the run's threshold), its own retry budget and a **model pin**: the model
   its next full retry uses, once. A control that cannot apply (no live scheduler, a merged
-  task, a Fractal plan's pin) is disabled and says why.
+  task) is disabled and says why. A Fractal plan's pin control is hidden.
 - **Open findings (`forge issues`):** the findings a run, or every run of its repository,
   left open. The list opens from a quick offline listing and then fills in what is already
   filed; select findings to file as GitHub issues, or dismiss them (and undo that).

package/ui/docs/api.md

@@ -1012,9 +1012,12 @@ of the other mode: it replaces it as it does one running other code. `forge ui s
 mode (`read_only` in its JSON).
 
 **The CLIs' configuration.** The server `forge ui open` starts runs without any `FORGE_*` variable
-of the shell it was started from. The CLIs its writes call still need the forge configuration, so
+of the shell it was started from. The CLIs it calls, for reads and writes alike, still need the forge configuration, so
 `open` hands them these, as that shell has them (an empty value counts as unset; a relative
-`FORGE_REGISTRY` or `FORGE_DATA_HOME` is made absolute against the shell's directory):
+`FORGE_REGISTRY` or `FORGE_DATA_HOME` is made absolute against the shell's directory, except that a
+`FORGE_DATA_HOME` starting with `~` is kept as given, because its reader expands the `~`; a
+`FORGE_REGISTRY` starting with `~` is not expanded by anything, so it is made absolute like any other
+relative path):
 `FORGE_REGISTRY`, `FORGE_DATA_HOME`, `FORGE_DATASET`, `XDG_CONFIG_HOME`, `XDG_DATA_HOME` and
 `XDG_STATE_HOME` (`control.CLI_ENV_NAMES`). It writes them to `cli-env.json` (mode `0600`) in its
 state dir, the server loads that file once when it starts (`_serve --cli-env FILE`) and every CLI
@@ -1022,12 +1025,14 @@ call gets them on top of the server's own environment; the server's environment
 changed. No other variable is passed, and none of these is a secret. `server.json` records them as
 `cli_env`. A server started by hand (`python3 -m forge_ui`) passes its own environment unchanged.
 
-`open` never reuses a server whose recorded `cli_env` differs from the current shell's. It names
-each variable that differs and both values, says to run `forge ui stop` and then open again, exits
-`5`, prints no link and leaves the server running (it may be in the middle of another shell's
-write). A server
-running other code, in the other mode or reading another registry directory is still replaced, and
-the new one gets the current shell's configuration.
+`open` never reuses a server whose recorded `cli_env` differs from the current shell's. For a
+server that takes writes it names each variable that differs and both values, says to run
+`forge ui stop` and then open again, exits `5`, prints no link and leaves the server running (it may
+be in the middle of another shell's write). A read-only server (`FORGE_UI_READONLY=1`, asked for
+again in the same mode) has no write to cut off, so it is replaced, as is one running other code, in
+the other mode or reading another registry directory: the new one gets the current shell's
+configuration, `open` prints the link and exits `0`. Read-only servers still run CLIs for their GET
+routes, so their configuration matters too.
 
 **Serialization.** One write per run key at a time. A second write to a run whose write is still
 running is `409 {"error": "busy"}`, without reaching the CLI; other runs are not held up.

package/ui/forge_ui/control.py

@@ -43,6 +43,7 @@ _EXITS = {2: (400, 'invalid'), 3: (409, 'refused'), 4: (500, 'failed')}
 # of them is a secret (forge-config.py's SECRET_WORDS), and no other FORGE_* variable is ever passed.
 CLI_ENV_NAMES = ('FORGE_REGISTRY', 'FORGE_DATA_HOME', 'FORGE_DATASET', 'XDG_CONFIG_HOME', 'XDG_DATA_HOME', 'XDG_STATE_HOME')
 _CLI_ENV_PATHS = ('FORGE_REGISTRY', 'FORGE_DATA_HOME')  # read relative to the shell's directory, not the server's
+_CLI_ENV_EXPANDS_HOME = ('FORGE_DATA_HOME',)  # the paths whose reader expands a leading ~ itself
 cli_env = {}  # set once, before the server starts; empty when it was started by hand
 
 
@@ -50,14 +51,15 @@ def cli_env_from(environ):
     """The CLI_ENV_NAMES set in `environ` (an empty value counts as unset, as it does for the CLIs).
 
     A relative FORGE_REGISTRY or FORGE_DATA_HOME is made absolute here: the server and its CLIs run in
-    another directory than the shell that named it.
+    another directory than the shell that named it. A leading ~ is kept only where the reader expands it
+    (FORGE_DATA_HOME); a FORGE_REGISTRY of '~/x.tsv' is the relative path ./~/x.tsv to every CLI.
     """
     out = {}
     for name in CLI_ENV_NAMES:
         value = environ.get(name, '')
         if not value:
             continue
-        if name in _CLI_ENV_PATHS and not value.startswith('~'):
+        if name in _CLI_ENV_PATHS and not (name in _CLI_ENV_EXPANDS_HOME and value.startswith('~')):
             value = os.path.abspath(value)
         out[name] = value
     return out
@@ -358,9 +360,16 @@ def _issues_file(ctx):
         if not isinstance(labels, list) or len(labels) > MAX_LABELS:
             raise BadBody(f'labels must be a list of at most {MAX_LABELS} strings')
         for label in labels:
-            if (not isinstance(label, str) or not label.strip() or len(label) > MAX_LABEL
-                    or label.startswith('-') or not _no_control_chars(label)):
-                raise BadBody(f'a label must be a text of 1 to {MAX_LABEL} characters, without control characters')
+            if not isinstance(label, str):
+                raise BadBody('a label must be a text')
+            if not label.strip():
+                raise BadBody('a label cannot be blank')
+            if len(label) > MAX_LABEL:
+                raise BadBody(f'a label is at most {MAX_LABEL} characters')
+            if label.startswith('-'):
+                raise BadBody('a label cannot start with "-"')
+            if not _no_control_chars(label):
+                raise BadBody('a label cannot hold control characters')
     except BadBody as exc:
         return _invalid(str(exc))
     path = ctx.locate()

package/ui/forge_ui/static/findingsview.js

@@ -64,6 +64,20 @@
     const note = n > MAX_FPS ? `${n} selected: at most ${MAX_FPS} per action` : '';
     return { fps, count: n, enabled: n >= 1 && n <= MAX_FPS, note };
   }
+  // Fingerprints "Select shown open" adds. `rows` are the rows the filters leave shown. The cap is how many of
+  // those are already selected and open — the same rows File and Dismiss take — so a selection a filter hides stays
+  // selected and does not count. A shown row that is not open is not added.
+  function selectShownOpen(rows, selected) {
+    const chosen = new Set(selected instanceof Set || Array.isArray(selected) ? selected : []);
+    const add = [];
+    for (const r of list(rows)) {
+      if (!selectable('file', r) || chosen.has(r.fp)) continue;
+      if (selection('file', rows, chosen).count >= MAX_FPS) break;
+      chosen.add(r.fp);
+      add.push(r.fp);
+    }
+    return add;
+  }
   const bit = v => v ? '1' : '0';
   // The GET path: `o` = { scope, offline, plausible, dismissed, only (fingerprints) }.
   function issuesUrl(key, o) {
@@ -104,6 +118,11 @@
       return { kind: 'note', text: c && c.note ? c.note : 'no detail' };
     });
   }
+  // The CLI's `notes` as lines for the dialog, only when the POST created nothing: a bare "0 created" says no reason, the
+  // notes ("--only fp: no such open finding") do. When something was created the notes are not about the dialog.
+  function emptyNotes(created, notes) {
+    return list(created).some(c => c && c.url) ? [] : list(notes).map(n => String(n)).filter(Boolean);
+  }
   // An untrusted URL becomes a link only when it is a plain https address.
   const safeUrl = u => typeof u === 'string' && /^https:\/\/[^\s"'<>]+$/.test(u) ? u : null;
   // The marker for a finding whose whole-run review is outdated, or null. The lamp is the hollow unlit
@@ -176,7 +195,7 @@
     const dismissKey = key_('Dismiss', undefined, () => openDismiss());
     const undismissKey = key_('Undismiss', undefined, () => doDismiss(true, ''));
     const allKey = key_('Select shown open', undefined, () => {
-      for (const r of shown()) if (selectable('file', r) && s.selected.size < MAX_FPS) s.selected.add(r.fp);
+      for (const fp of selectShownOpen(shown(), s.selected)) s.selected.add(fp);
       drawTable(); syncActions();
     });
     const noneKey = key_('Clear selection', undefined, () => { s.selected.clear(); drawTable(); syncActions(); });
@@ -193,6 +212,9 @@
     host.append(dlg);
 
     const shown = () => filterRows(s.rows, { ...s.filter, dismissed: s.dismissed });
+    // What an action takes: the selected rows the filters leave visible. Rows hidden by a filter stay in s.selected, so
+    // they come back with the filter, but no button counts them and no action reaches them.
+    const picked = action => selection(action, shown(), s.selected);
     function syncScope() {
       for (const [v, b] of Object.entries(scopeKeys)) b.setAttribute('aria-pressed', String(s.scope === v));
       lede.textContent = s.scope === 'run' ? `Findings this run left unfixed${ctx.run && ctx.run.goal ? ': ' + String(ctx.run.goal).split('\n')[0] : ''}.`
@@ -201,11 +223,11 @@
     function syncActions() {
       actions.hidden = !s.writes;
       if (!s.writes) return;
-      const f = selection('file', s.rows, s.selected), d = selection('dismiss', s.rows, s.selected), u = selection('undismiss', s.rows, s.selected);
+      const f = picked('file'), d = picked('dismiss'), u = picked('undismiss');
       fileKey.textContent = f.count ? `File ${f.count} issue${f.count === 1 ? '' : 's'}` : 'File issues';
       fileKey.disabled = !f.enabled || s.busy; dismissKey.disabled = !d.enabled || s.busy;
       undismissKey.textContent = u.count ? `Undismiss ${u.count}` : 'Undismiss'; undismissKey.disabled = !u.enabled || s.busy;
-      actionNote.textContent = f.note || d.note || u.note || (s.selected.size ? `${f.count} open, ${u.count} dismissed selected` : '');
+      actionNote.textContent = f.note || d.note || u.note || (f.count + u.count ? `${f.count} open, ${u.count} dismissed selected` : '');
     }
     function setLamp(cls, text) {
       lamp.replaceChildren(el('i', undefined, 'lamp ' + cls), el('span', text));
@@ -330,7 +352,7 @@
     // dismiss: an optional reason, then the call
     async function openDismiss() {
       reasonHost.replaceChildren();
-      const sel = selection('dismiss', s.rows, s.selected);
+      const sel = picked('dismiss');
       if (!sel.enabled) return;
       const l = el('label', undefined, 'fnd-field fnd-reason-field'), input = el('input');
       input.type = 'text'; input.maxLength = MAX_REASON; input.placeholder = 'why (optional)';
@@ -345,7 +367,7 @@
       input.focus();
     }
     async function doDismiss(undo, reason) {
-      const sel = selection(undo ? 'undismiss' : 'dismiss', s.rows, s.selected);
+      const sel = picked(undo ? 'undismiss' : 'dismiss');
       if (!sel.enabled || s.busy) return;
       s.busy = true; syncActions(); outcomeHost.replaceChildren();
       const res = await UI.post(dismissPath(key), dismissBody(sel.fps, reason, undo));
@@ -356,17 +378,19 @@
 
     // filing: drafts for exactly the selection, a preview, then the POST
     async function openFile() {
-      const sel = selection('file', s.rows, s.selected);
+      const sel = picked('file');
       if (!sel.enabled || s.busy) return;
       s.busy = true; syncActions(); outcomeHost.replaceChildren();
       setLamp('st-running', 'preparing the issue drafts…');
-      const res = await UI.get(issuesUrl(key, { scope: s.scope, offline: false, plausible: s.plausible, only: sel.fps }));
+      // The scope and the toggle stay usable while the drafts are made: the preview files what these drafts were made for.
+      const scope = s.scope, plausible = s.plausible;
+      const res = await UI.get(issuesUrl(key, { scope, offline: false, plausible, only: sel.fps }));
       s.busy = false; syncActions();
       if (!res.ok) { setLamp('st-fail', 'could not prepare the drafts'); UI.outcome(outcomeHost, res); return; }
       setLamp('st-pass', 'drafts ready');
-      preview(sel.fps, list(res.data.drafts));
+      preview(sel.fps, list(res.data.drafts), { scope, plausible });
     }
-    function preview(fps, drafts) {
+    function preview(fps, drafts, made) {
       dlg.replaceChildren();
       dlg.append(el('h2', 'File issues on GitHub'));
       const warn = el('p', undefined, 'fnd-warn');
@@ -399,7 +423,7 @@
         labelNote.hidden = !parsed.error; labelNote.textContent = parsed.error || '';
         if (parsed.error) return;
         go.disabled = true; cancel.disabled = true; labels.disabled = true; results.replaceChildren(); posting = true;
-        const res = await UI.post(issuesPath(key), fileBody(s.scope, fps, s.plausible, parsed.labels));
+        const res = await UI.post(issuesPath(key), fileBody(made.scope, fps, made.plausible, parsed.labels));
         posting = false;
         if (!res.ok) { go.disabled = false; cancel.disabled = false; labels.disabled = false; UI.outcome(results, res); return; }
         const lines = resultLines(res.data.created), ul = el('ul', undefined, 'fnd-created');
@@ -410,6 +434,7 @@
           ul.append(li);
         }
         results.replaceChildren(el('p', `${lines.filter(l => l.kind === 'created').length} created`, 'fnd-done'), ul);
+        for (const n of emptyNotes(res.data.created, res.data.notes)) results.append(el('p', n, 'muted fnd-result-note'));
         go.remove(); cancel.textContent = 'Close'; cancel.disabled = false;
         for (const fp of fps) s.selected.delete(fp);
         load();
@@ -433,6 +458,6 @@
     return { reload: load };
   }
 
-  return { render, statusOf, filterRows, mergeFiled, selectable, selection, issuesUrl, issuesPath, dismissPath, fileBody, dismissBody,
-    parseLabels, resultLines, safeUrl, reviewMarker, ORIGINS, MAX_FPS };
+  return { render, statusOf, filterRows, mergeFiled, selectable, selection, selectShownOpen, issuesUrl, issuesPath, dismissPath, fileBody, dismissBody,
+    parseLabels, resultLines, emptyNotes, safeUrl, reviewMarker, ORIGINS, MAX_FPS };
 });

package/ui/forge_ui/static/settings.js

@@ -85,13 +85,25 @@
     return { editor: { base: fresh, draft: e.draft }, dirty: true, moved: norm(fresh) !== norm(e.base) };
   }
   const edited = (editor, draft) => ({ base: editor.base, draft: text(draft) });
+  // The editor after typing in a textarea drawn from the file text `from`. When a read moved `base` on since the textarea
+  // was drawn (a held body is not redrawn), the typing sits on the old text, so the save would overwrite the new file.
+  function typed(editor, draft, from) {
+    const e = edited(editor, draft), dirty = isDirty(e);
+    return { editor: e, dirty, moved: dirty && norm(from) !== norm(e.base) };
+  }
   const shown = editor => editor.draft !== null ? editor.draft : editor.base;
+  // What a failed GET /api/config does: with a good read of this run on the page, it stays and a note names the
+  // failure; with none yet, the message replaces the page. Status 0 is no answer at all.
+  function readFailure(res, hasData) {
+    const message = (res && res.status !== 0 && (res.detail || res.error)) || 'could not reach forge-ui';
+    return { keep: !!hasData, message };
+  }
 
   /* ---------- DOM ---------- */
   function render(host, ctx) {
     const UI = root.ForgeUI, c = ctx || {};
     const el = (tag, t, cls) => UI.el(tag, t, cls);
-    const s = { run: null, data: null, dataText: null, error: null, writes: false, loading: true, editors: {}, moved: {}, hold: 0, redraw: false, seq: 0, gen: 0, runsSig: null, ready: false, loadedAt: 0, repo: null, gone: false };
+    const s = { run: null, data: null, dataText: null, error: null, writes: false, loading: true, editors: {}, moved: {}, hold: 0, redraw: false, seq: 0, gen: 0, runsSig: null, ready: false, loadedAt: 0, repo: null, gone: false, asking: 0, asks: 0, pickerLate: false };
     const key_ = (label, cls, onclick) => { const b = el('button', label, cls); b.type = 'button'; if (onclick) b.addEventListener('click', onclick); return b; };
 
     const head = el('header', undefined, 'set-head');
@@ -101,10 +113,17 @@
     const body = el('div', undefined, 'set-body');
     const note = el('p', 'This page is read-only: this server has no write token, or has controls off.', 'muted set-readonly');
     note.hidden = true;
-    host.replaceChildren(head, picker, note, body);
+    // A failed read over a good one: the page stays, and this says the shown values may be old. Outside the body, so a
+    // held body (an open confirm) still gets it.
+    const stale = el('p', undefined, 'warn set-problem set-stale'); stale.setAttribute('role', 'status');
+    stale.hidden = true;
+    host.replaceChildren(head, picker, note, stale, body);
+    const staleNote = msg => { stale.hidden = !msg; stale.textContent = msg ? `The last read of the configuration failed: ${msg}. This shows the read before it; the next refresh tries again.` : ''; };
 
     /* the repository picker */
     function drawPicker() {
+      // The switch confirm lives in the picker: while it is open the rebuild waits, and runs when it is answered.
+      if (s.asking) { s.pickerLate = true; return; }
       const runs = c.runs ? c.runs() : [];
       const groups = groupRuns(runs);
       const before = s.run, usable = withRepo(runs);
@@ -138,7 +157,14 @@
       }
       sel.addEventListener('change', async () => {
         const unsaved = FILES.filter(n => s.editors[n] && isDirty(s.editors[n]));
-        if (unsaved.length && !(await UI.confirmInline(picker, `Switch repository and discard the unsaved edits to ${unsaved.map(n => '.forge/' + n).join(', ')}?`, { danger: true }))) { sel.value = s.gone ? '' : s.run; return; }
+        if (unsaved.length) {
+          const ask = s.asking = ++s.asks;
+          const yes = await UI.confirmInline(picker, `Switch repository and discard the unsaved edits to ${unsaved.map(n => '.forge/' + n).join(', ')}?`, { danger: true });
+          if (s.asking !== ask) return;                           // a later change asked again, and that confirm decides
+          const late = s.pickerLate;
+          s.asking = 0; s.pickerLate = false;
+          if (!yes) { sel.value = s.gone ? '' : s.run; if (late) drawPicker(); return; }
+        }
         pick(sel.value);
       });
       const lab = el('label', undefined, 'set-field'); lab.htmlFor = 'set-run';
@@ -151,11 +177,13 @@
     }
     // A new run: nothing of the old one stays, and confirms of the old body (now detached) no longer hold a redraw.
     function resetRun() {
+      staleNote(null);
       s.data = null; s.dataText = null; s.error = null; s.editors = {}; s.moved = {}; s.loading = s.run != null;
       s.gen++; s.hold = 0; s.redraw = false;
     }
     function pick(key) {
       s.run = key; resetRun();
+      s.asking = 0; s.pickerLate = false;                         // a switch confirm still open goes with the old picker
       s.runsSig = null; drawPicker(); drawBody();
       if (c.onPick) c.onPick(key);
       load();
@@ -171,12 +199,12 @@
       if (seq !== s.seq || run !== s.run) return;                 // a later pick or load answered
       s.loading = false;
       if (!res.ok) {
-        const msg = res.status === 0 ? null : res.detail || res.error;
-        if (msg === null && s.data) return;                       // a poll that did not reach the server keeps the last good page
+        const failed = readFailure(res, s.data);
+        if (failed.keep) { staleNote(failed.message); return; }   // the last good page, its editors and their unsaved text stay
         if (s.hold > 0) return;                                   // a confirm or a write is open: its strip must not be torn down
-        s.error = msg || 'could not reach forge-ui'; s.data = null; s.dataText = null; drawBody(); return;
+        s.error = failed.message; s.data = null; s.dataText = null; drawBody(); return;
       }
-      s.error = null;
+      s.error = null; staleNote(null);
       const files = object(object(res.data.repo).files);
       for (const name of FILES) {
         const next = dirtyState(s.editors[name], object(files[name]).content);
@@ -305,7 +333,9 @@
       const top = el('div', undefined, 'set-file-head'); top.append(h, status);
       art.append(top, el('p', blurb, 'muted set-file-blurb'));
       if (file.note) art.append(el('p', text(file.note), 'warn set-file-note'));
-      if (isDirty(ed) && s.moved[name]) art.append(el('p', 'The file changed on disk after you began editing; saving replaces it with your text.', 'warn set-file-note'));
+      const movedNote = el('p', 'The file changed on disk after you began editing; saving replaces it with your text.', 'warn set-file-note');
+      movedNote.hidden = !(isDirty(ed) && s.moved[name]);              // sync() keeps it current as the text is typed
+      art.append(movedNote);
       if (!s.writes) {
         status.replaceChildren(el('i', undefined, 'lamp ' + (file.exists ? 'st-pass' : '')), el('span', file.exists ? (unreadable ? 'present, not shown' : 'present') : 'absent'));
         art.append(unreadable ? el('p', file.exists ? 'The content is not shown.' : 'Not set.', 'muted') : el('pre', text(file.content), 'set-pre'));
@@ -316,6 +346,7 @@
       ta.dataset.editor = name; ta.rows = Math.max(3, Math.min(14, shown(ed).split('\n').length + 1));
       ta.spellcheck = false; ta.setAttribute('autocapitalize', 'off'); ta.setAttribute('autocomplete', 'off');
       ta.value = shown(ed);
+      let from = ed.base;                                         // the file text this textarea was drawn from
       if (unreadable && file.exists) { ta.disabled = true; ta.placeholder = 'The content is not shown, so it cannot be edited here.'; }
       const problem = el('p', undefined, 'warn set-problem'); problem.hidden = true; problem.id = id + '-problem';
       const result = el('div', undefined, 'set-result');
@@ -328,10 +359,15 @@
         if (bad) { ta.setAttribute('aria-invalid', 'true'); ta.setAttribute('aria-describedby', problem.id); }
         else { ta.removeAttribute('aria-invalid'); ta.removeAttribute('aria-describedby'); }
         save.disabled = !dirtyNow || !!bad;
+        movedNote.hidden = !(dirtyNow && s.moved[name]);
         status.replaceChildren(el('i', undefined, 'lamp ' + (dirtyNow ? 'set-amber' : file.exists ? 'st-pass' : '')),
           el('span', dirtyNow ? 'unsaved edits' : file.exists ? (unreadable ? 'present, not shown' : 'present') : 'absent'));
       };
-      ta.addEventListener('input', () => { s.editors[name] = edited(s.editors[name], ta.value); sync(); });
+      ta.addEventListener('input', () => {
+        const next = typed(s.editors[name], ta.value, from);
+        s.editors[name] = next.editor; s.moved[name] = next.moved || (next.dirty && !!s.moved[name]);
+        sync();
+      });
       remove.disabled = !file.exists;
       save.addEventListener('click', async () => {
         const cur = s.editors[name], bad = valueProblem(name, cur.draft);
@@ -342,7 +378,7 @@
         if (!yes) { ta.readOnly = false; remove.disabled = !file.exists; release(); sync(); save.focus({ preventScroll: true }); return; }
         const res = await UI.post('/api/config', configBody(s.run, repoKey(name), cur.draft));
         UI.outcome(result, res, `Saved ${target}.`);
-        if (res.ok && gen === s.gen) s.editors[name] = editorOf(cur.draft.endsWith('\n') ? cur.draft : cur.draft + '\n');
+        if (res.ok && gen === s.gen) { s.editors[name] = editorOf(cur.draft.endsWith('\n') ? cur.draft : cur.draft + '\n'); s.moved[name] = false; from = s.editors[name].base; }
         ta.readOnly = false; remove.disabled = !file.exists; release(); sync();
         if (res.ok && gen === s.gen) await reload();
       });
@@ -353,7 +389,7 @@
         if (!yes) { ta.readOnly = false; release(); sync(); remove.disabled = !file.exists; remove.focus({ preventScroll: true }); return; }
         const res = await UI.post('/api/config', configBody(s.run, repoKey(name), null, true));
         UI.outcome(result, res, `Removed ${target}.`);
-        if (res.ok && gen === s.gen) s.editors[name] = editorOf('');
+        if (res.ok && gen === s.gen) { s.editors[name] = editorOf(''); s.moved[name] = false; from = ''; }
         ta.readOnly = false; release();
         if (res.ok && gen === s.gen) await reload(); else if (!res.ok) { remove.disabled = !file.exists; sync(); }
       });
@@ -395,5 +431,5 @@
   }
 
   return { render, configBody, repoKey, targetPath, subsetOk, valueProblem, pickDefault, groupRuns, optionLabel,
-    editorOf, isDirty, dirtyState, edited, shown, FILES, VALUE_MAX };
+    editorOf, isDirty, dirtyState, edited, typed, shown, readFailure, FILES, VALUE_MAX };
 });