@rackbops/plugin-tracker 0.30.0 → 0.31.2

package/README.md

@@ -39,10 +39,10 @@ as in a server (plan 5.5, item 39).
 
 | Command | Who | What |
 |---|---|---|
-| `/allow user` | a tracker admin | Admits a person: they can now `/register`. With the usr link on (0.21.0), run in a server, it also allows them in usr as `tracker:member` and keeps their usr user id. The admin must be linked in usr and hold `tracker:register` and `tracker:member` there. Run again, it asks usr again (usr only ever adds), so it links someone not yet linked and relinks someone whose usr link was made anew. The usr user id is final only once they have signed up on usr: one who finishes signing up while signed in to a usr account they already had is moved to it by usr, and the account `/allow` made is dropped, so their usr sign-in fails until a second `/allow` links the one they have. A usr refusal or outage leaves the admission standing and says what to do; in a DM it says to run it in the server. |
+| `/allow user` | a tracker admin | Admits a person: they can now `/register`. With the usr link on (0.21.0), run in a server, it also allows them in usr as `tracker:member` and keeps their usr user id. The admin must be linked in usr and hold `tracker:register` and `tracker:member` there. Run again, it asks usr again (usr only ever adds), so it links someone not yet linked and relinks someone whose usr link was made anew. The usr user id is final only once they have signed up on usr: one who finishes signing up while signed in to a usr account they already had is moved to it by usr, and the account `/allow` made is dropped, so their usr sign-in fails until a second `/allow`, or an admin's Refresh usr links, links the one they have. A usr refusal or outage leaves the admission standing and says what to do; in a DM it says to run it in the server. |
 | `/register [hour] [zone]` | an admitted person | Signs up, or changes the preferred hour (0-23, default 9) and time zone (default `America/New_York`). The reply says an admin can see every task. With the usr link on (0.21.0), run in a server, it also carries a linked person's one-time usr sign-up link, until usr says they have signed up; in a DM it says to run it in the server. If usr says they are not allowed yet (a usr admin removed their link), it forgets their link and says to ask for `/allow` again. See **First admin and usr** below. |
 | `/remind text [when] [repeat]` | a registered person | A reminder by DM. `when` is docket's `parseWhen` grammar (`in 20 minutes`, `tomorrow 9am`, `fri at 17:30`); `repeat` is once (the default), daily, weekly or monthly. A repeating one with no `when` starts today at the preferred hour. |
-| `/renewal name amount currency renews [unit] [every] [lead] [note]` | registered | A subscription, domain, warranty or membership (docket's `renewal`, a `period` schedule). `renews` is the next renewal or expiry date, `YYYY-MM-DD`, today or later; `unit` yearly (the default), monthly, weekly or daily, `every` how many of those; the ask comes `lead` days before (default 7) at the preferred hour, with Keep, Cancel, Renewed and Snooze. If that ask is already past but the date is not, the first ask comes within a minute (a zone or hour change before it fires drops it for the next period's). Keep and Renewed record what was paid; Cancel ends it. |
+| `/renewal name amount currency renews [unit] [every] [lead] [note]` | registered | A subscription, domain, warranty or membership (docket's `renewal`, a `period` schedule). `amount` is from 0 to 1,000,000 (`MAX_AMOUNT` in `src/limits.ts`; `/task decide`, the web editor and the task API take the same range); `renews` is the next renewal or expiry date, `YYYY-MM-DD`, today or later; `unit` yearly (the default), monthly, weekly or daily, `every` how many of those; the ask comes `lead` days before (default 7) at the preferred hour, with Keep, Cancel, Renewed and Snooze. If that ask is already past but the date is not, the first ask comes within a minute (a zone or hour change before it fires drops it for the next period's). Keep and Renewed record what was paid; Cancel ends it. |
 | `/price url [name] [hours] [drop] [baseline] [near]` | registered | A price (docket's `price`, a `poll` schedule every `hours`, default 12, at most 168). `url` may be any public web page (Page reads, under What it does), eBay's and BGG's included, or a link that redirects to one; only the want-list watcher refuses eBay. The page is read once at once, and nothing is created unless a price is found in it; then the first check, within a minute, DMs the starting price, and a drop of `drop` percent or more (default 10) from the `baseline` -- the last (default), first or highest price seen -- DMs the owner once per crossing. `near` is the words just before the price, for a page with no structured price. At most 20 per person. |
 | `/research question [context] [deadline] [at] [sources]` | registered | A one-off research request (docket's `research`, a `once` schedule at `at`, default now). A research run splits the question into its parts and looks each up on the web (read-and-web tools only, plan 5.6), naming each part's best source and trying it -- BoardGameGeek included, read honestly, a page that refuses it listed as one it could not open (with the web area; without it, named as a gap) -- and never opening eBay (eBay's User Agreement, section 3; since 0.30.0, docket-types 0.10.0), a reviewer run checks the draft against its sources, and only a passed answer is DMed to you (and accepted recipients); its claims are kept as findings on the task's page. `deadline` (docket's `parseWhen`) goes into the request; a run that would start past it makes no call and tells you. `question` must hold the question itself: fewer than 3 characters, or no letter at all (a stray `0`), is refused before anything is made. At most 5 waiting per person (a request waiting for pages for a fuller pass, below, not counted: its first answer is delivered); every run counts against the daily budget (below). `sources: browser` (0.28.0, docket-types 0.8.0's `sources: "sent"`; default `web`) answers from pages your own browser gathers instead -- ask Claude in Chrome to gather them and send them in through the task API (`POST /api/v1/tasks/<id>/sources`, then `/sources/ready`; Task API below), for pages a web run cannot or may not read, such as a BoardGameGeek page that refuses it or eBay, which the research never opens: it answers only from the pages sent in, and the request waits for them, its run queued 14 days out or 10 minutes before the deadline, whichever is sooner (a deadline less than 20 minutes away is refused; the margin makes a missed deadline unlikely, not impossible, since a run held by the budget or behind another Job can still start late), and moved to now by `ready`; a request whose `ready` never comes runs then on whatever pages are in, and with none makes no model call and DMs you so. `at` does not go with it, and it needs the web area. **A fuller pass** (0.29.0, docket-types 0.9.0; with the web area only): when the research run lists pages it needed and could not open (a best source that refused it, BoardGameGeek's included), the reviewed answer is DMed with a "Couldn't open:" list, and the request waits for pages for up to 14 days (or until 10 minutes before its deadline), sending, running and charging nothing; ask Claude in Chrome to gather them and send them in as for a browser request, and `ready` starts a second pass that DMs an "Update to ..." of what it adds or corrects. With no `ready` by then, the second pass runs on whatever pages are in, and with none the request ends and the first answer stands. Answers that research is not available while the city-hall Executor is not set up. |
 | `/scout new interests [lens] [for] [notes] [every]` | registered | An interest scout (docket-types' `scout` type, since 0.6.0; plan 1.2 row 1): every `every` days (default 1, at most 30) at your preferred hour, a model run looks on the web for 5 to 10 things published or available in the last 30 days that fit the `interests` (separated by commas, at most 20, each at most 80 characters) through the `lens` -- `general` (the default), `birthday` (fun or a little grandiose), `anniversary` (a romantic angle) or `christmas` (tied to their interests) -- for `for` (someone else, e.g. Anne; empty means you), weighing `notes`, and DMs them to you (and accepted recipients). A link it showed before is not shown again (it remembers the newest 300); fewer than five come with the run's reason. At most 3 scouts per person; each run counts against the daily budget (below), up to 1.50 USD. Answers that the scout is not available while the city-hall Executor is not set up. |
@@ -51,8 +51,8 @@ as in a server (plan 5.5, item 39).
 | `/tasks` | registered | Your active tasks and the ones you receive, each with its next run; then your paused ones, each naming up to three people it could not DM (then how many more). A list longer than one message (Discord's 2000 characters) is cut between whole lines and keeps your paused tasks in preference to the active ones that do not fit, since their ids are what `/task resume` needs (any paused ones that still do not fit are counted); it says how many active ones it left out and, when the web area is set up, points to `/web`, which lists them all. |
 | `/task done task` / `/task snooze task [until]` | the task's owner | Answers the task's latest reminder (snooze: an hour, or until `until`). |
 | `/task decide task choice [amount]` | the renewal's owner | Answers the renewal's latest ask -- keep, cancel or renewed -- with the amount actually paid when it changed (a button cannot carry one). Use it instead of the button, not after it: a run is answered once. |
-| `/task history task` | the owner, an accepted recipient, or an admin | The newest 10 runs -- due, status, how it was answered, text replies -- and the newest 5 of the task's changes, older ones counted; sent with Discord's suppress-embeds flag, so a link in a reply, a finding or an error does not unfurl into a preview; for a renewal, what each period cost and the total; for a price, the last check and the readings with the low and the high; for a want-list watch, how many listings it has kept, and once there are any, a second message with the newest of them, up to 20 and as many as fit in one message, then how many more there are (and, while the web area is set up, that the task's page there shows the newest 50). |
-| `/task share task user` | the task's owner | Invites an admitted, registered member who can be DMed: they get one consent DM with accept and decline. |
+| `/task history task` | the owner, an accepted recipient, or an admin | The newest 10 runs -- due, status, how it was answered, text replies -- and the newest 5 of the task's changes, older ones counted (only the shown rows are loaded; SQLite still counts the rest, and for the runs sorts them too); sent with Discord's suppress-embeds flag, so a link in a reply, a finding or an error does not unfurl into a preview; for a renewal, what each period cost and the total; for a price, the last check and the readings with the low and the high; for a want-list watch, how many listings it has kept, and once there are any, a second message with the newest of them, up to 20 and as many as fit in one message, then how many more there are (and, while the web area is set up, that the task's page there shows the newest 50). |
+| `/task share task user` | the task's owner | Invites an admitted, registered member who can be DMed: they get one consent DM with accept and decline. An invitation still open when the task is deleted or finishes is withdrawn, with a history event; a late Accept or Decline is refused with "That task was deleted." or "That task is done." and records nothing (one on a paused task still counts). |
 | `/task resume task` | the task's owner | Resumes a paused task: one paused because a recipient could not be DMed goes on without that recipient; one its owner paused on the web simply goes on. |
 | `/settings hour hour` | registered | The preferred hour; recurring reminders with no time of their own move to it. |
 | `/web` | registered | A one-time link to sign in to the web area (below), good for 10 minutes and one use. Says so when `TRACKER_WEB_URL` is unset. |
@@ -250,6 +250,7 @@ served at a hashed path, cached for a year).
 | `/admin/usage` | Admins only: model usage per budget day (below). |
 | `/admin/people/<id>` | Admins only: one person -- Discord id, registration, zone and hour, delivery, task counts, their tasks -- with Make admin or Revoke admin, Resume delivery (when paused), and Remove from the tracker; their daily ceiling, with the form to change it; and their API tokens, each with Revoke. |
 | `/admin/usr-link` | Admins only, POST only, with the usr link on: Link everyone to usr (below). |
+| `/admin/usr-refresh` | Admins only, POST only, with the usr link on: Refresh usr links (below). |
 | `/admin/allow`, `/admin/people/<id>/grant`, `/revoke`, `/resume-delivery`, `/ceiling`, `/forget`, `/admin/blocks/<id>/lift`, `/admin/tokens/<id>/revoke` | Admins only, POST only: the acts below. |
 | `/api/v1/...` | The JSON task API (below): bearer tokens only, never the cookie. |
 | `/signin` | Where a request that is not signed in is sent (a POST, or any request with the usr link off): says to run `/web`, and with the usr link on offers Sign in with usr. |
@@ -702,7 +703,7 @@ $ curl -s https://clerk.example.com/tracker/api/v1/tasks/t9 -H "Authorization: B
 |---|---|---|
 | Store | `src/store.ts`, `src/schema.ts` | docket's `Store` port on `bun:sqlite`, in `<dataDir>/tracker/tracker.sqlite` (WAL). A Discord id belongs to at most one user. Schema versioned by `PRAGMA user_version`; a shipped migration is never edited. Schema 5 (0.9.0) is docket 0.4.0's: a run's `record`, a series point's `key`, `deliveries` (from `delivery_claims`), `usage` and `notices`. Schema 6 (0.11.0) is docket 0.5.0's, all additive: `findings`, a charge's `usage.key`, and the Executor's `executor_jobs`. Forget-me erases a person's findings and their runs' Job records too. Schema 8 (0.19.0) adds `want_inbox`, the listings sent in for an inbox watch. Schema 9 (0.20.0) adds `users.usr_subject`, a person's usr user id, null until linked, unique when set. Schema 10 (0.25.0) adds `mail_addresses`. Schema 11 (0.28.0) adds `research_sources`, the pages a browser sent in for a research request (at most 10 per request, one per address, 99,800 characters of text in all), dropped once the request ends (by the execute tick's housekeeping, so only while the execute lane is configured) and always erased by forget-me. `store.test.ts` runs docket's `STORE_CONTRACT` against it. |
 | Notify lane | `src/notify-lane.ts` | docket's `Lanes.tickNotify` on two host ticks, every 60 s, one pass per task with work (a due run, a run in flight, a DM owed or claimed), each under that task's lock through a view of the store limited to that task: `notify` runs every type but the page readers, `poll` runs only them (`price`, `wantlist`) with the Fetch port, so a slow page never holds up a reminder. A task the execute tick holds is left for the next notify tick, never waited on. Registers `reminder`, `renewal`, `price`, `research`, `scout`, `wantlist` and `wantjudge`. |
-| Want-list watcher | `src/want.ts`, `src/inbox.ts`, `src/web/api-listings.ts`; the types and sources are `@rackbops/docket-types`' (0.7.0: `wantlist`, `wantjudge`, `pageSource`, `bggSource`, `inboxSource`) | `/want`'s rules; the `wantlist` type over a `Source` port; the `inbox` source over the `want_inbox` table (schema 8, 0.19.0: the listings sent in per watch, keyed `ebay-` or `bgg-` and 24 random hex digits, the newest 100 kept, as many as one look reads; forget-me erases them with the person's tasks), filled by the task API's listings route; the `page` source (JSON-LD listings through the fenced Fetch port, no HTML guessing) and the `bgg` source (BGG's XML API with the Bearer token, on `boardgamegeek.com`, never `www.`, at least 5 s between requests (a read due sooner is put back for the next tick, never waited on), read by a bounded `indexOf` parser, never a pattern over the whole body; a 401 or 403 is the token refused, a 202, 429 or 5xx a miss). The BGG fixture is hand-written to BGG's documented shape: BGG declined the application, so there is no token to capture a real response with. The judged watch (`wantjudge`) is an execute-lane type: its `prepare` reads the source in plain code (an uncharged `NoJob` when nothing is new), keeps new listings in the task's state as `pending` and asks for a follow-up, whose `prepare` makes the judge Job; `finish` maps the verdicts back by number, so a Job collected after a restart still has its listings. On this lane a BGG read due too soon waits out the spacing once. |
+| Want-list watcher | `src/want.ts`, `src/inbox.ts`, `src/web/api-listings.ts`; the types and sources are `@rackbops/docket-types`' (0.7.0: `wantlist`, `wantjudge`, `pageSource`, `bggSource`, `inboxSource`) | `/want`'s rules; the `wantlist` type over a `Source` port; the `inbox` source over the `want_inbox` table (schema 8, 0.19.0: the listings sent in per watch, keyed `ebay-` or `bgg-` and 24 random hex digits, the newest 100 kept, as many as one look reads; a watch's rows go when it is deleted or finishes (#208), and forget-me erases them with the person's tasks), filled by the task API's listings route; the `page` source (JSON-LD listings through the fenced Fetch port, no HTML guessing) and the `bgg` source (BGG's XML API with the Bearer token, on `boardgamegeek.com`, never `www.`, at least 5 s between requests (a read due sooner is put back for the next tick, never waited on), read by a bounded `indexOf` parser, never a pattern over the whole body; a 401 or 403 is the token refused, a 202, 429 or 5xx a miss). The BGG fixture is hand-written to BGG's documented shape: BGG declined the application, so there is no token to capture a real response with. The judged watch (`wantjudge`) is an execute-lane type: its `prepare` reads the source in plain code (an uncharged `NoJob` when nothing is new), keeps new listings in the task's state as `pending` and asks for a follow-up, whose `prepare` makes the judge Job; `finish` maps the verdicts back by number, so a Job collected after a restart still has its listings. On this lane a BGG read due too soon waits out the spacing once. |
 | Execute lane | `src/execute-lane.ts`, `src/executor.ts`, `src/research.ts`, `src/research-sources.ts`, `src/web/api-sources.ts`, `src/scout.ts` (the `scout` and `research` types are docket-types'; `research` over `researchType({ readSources })`, 0.8.0, reading a browser request's pages from `research_sources`, and since 0.29.0 a fuller pass's, given only with the web area) | Only when the city-hall Executor is configured: a third host tick, `execute`, that starts docket's `Lanes.tickExecute` in the background (one at a time, at most once per host tick, about a minute) over every task with a due execute-lane run, reserving those tasks and then holding their locks in id order, through one docket `Lanes` kept while the plugin is active (docket keeps its usage-limit pause on it). The Executor is city-hall#18's source pair (above), its I/O injected; `executor_jobs` keeps each Job key's city-hall id. `/research`'s and `/scout`'s rules, and the scout type. |
 | Budgets, usage | `src/ceilings.ts`, `src/usage.ts`; `src/web/ceiling-pages.ts`, `src/web/usage-pages.ts` | The execute lane's `BudgetPolicy` (docket's defaults plus each person's raise, or no ceiling at all while `TRACKER_BUDGET_UNLIMITED` is on), the ceiling changes, and the pure usage report `/admin/usage` renders from docket's `usage` table. |
 | Page reads | `src/fetch.ts` | docket's `Fetch` port for `price` and the want-list's `page` source: http or https on the default port, no credentials, every resolved address public (no loopback, private, link-local, CGNAT, multicast or reserved range, IPv4 or IPv6), redirects followed by hand and re-checked (at most 5; a redirect to something that is not a web address is refused), 15 s including the name lookup, at most 3 MB kept. The body is then rebuilt in linear time (`src/page.ts`) to just what extraction reads -- at most 200 JSON-LD blocks and 300 meta tags, the first ones in page order (room for a shop search page with one JSON-LD block per product beside its other blocks; the `page` source keeps at most 100 listings a page, docket-types' `MAX_LISTINGS`, and a look takes at most 20 new ones, the rest on the next look), and the page with every `<` blanked, so `near` still reads text, attributes and script data -- because docket's extraction patterns take quadratic time on a page of unclosed tags. Tag names are matched with only `A`-`Z` folded to lower case, so a letter that changes length when lower-cased (the Turkish `İ`) does not shift the tags after it out of reach. A read the tick's abort cuts short requeues its run instead of counting a miss. A DNS answer that changes between the check and the read is not caught here. A refusal says why -- the name did not resolve, or it is not on the public internet -- so anyone who may make a price tracker or page watch (a command, the web editor or the task API) can learn which names the bot host's resolver maps to private addresses; one read at a time per person and the API's rate limit slow that, they do not stop it. A want-list page read (docket-types' `page` source) carries `NEVER_EBAY` and is refused on any hop to eBay; a price read is not. |
@@ -729,9 +730,9 @@ $ curl -s https://clerk.example.com/tracker/api/v1/tasks/t9 -H "Authorization: B
 | `TRACKER_WEB_URL` | no | The https origin the bot's HTTP is reached at through its tunnel, e.g. `https://clerk.example.com` (no path). `/web` links and the allowed `Origin` come from it, never from a request's `Host`. Unset = no web area (`/web` says so, the pages answer 404); anything but a bare https origin refuses to load. |
 | `TRACKER_BUDGET_UNLIMITED` | no | Budgets off for the alpha (0.14.0): `true` or `1` means no daily ceiling -- a person's or the global one -- holds a model run, bot-wide. Each Job's own caps still apply, usage is still recorded (see `/admin/usage`), the bot logs one line at start saying so (or, with the execute lane off, that no model work runs), the People and Usage admin pages show a "Budgets off (alpha): unlimited" banner, and the person page's ceiling section shows a "not enforced" note. Unset, empty, `false` or `0` = the ceilings apply (the default); anything else refuses to load. |
 | `TRACKER_CITY_HALL_URL` | no | The https origin of the city-hall that queues the tracker's model Jobs (no path). |
-| `TRACKER_CITY_HALL_KEY` | yes | The source bearer key city-hall checks on `/api/execute/jobs` (its `CITY_HALL_API_KEY`, city-hall#18). Never logged. Kept in the instance's own env, never in a repo. |
+| `TRACKER_CITY_HALL_KEY` | yes | The source bearer key city-hall checks on `/api/execute/jobs` (its `CITY_HALL_API_KEY`, city-hall#18). Visible ASCII only: a value with whitespace inside it or any other character outside visible ASCII refuses to load (whitespace at either end is trimmed), naming the variable. Never logged. Kept in the instance's own env, never in a repo. |
 | `TRACKER_CITY_HALL_CAPABILITY` | no | The capability tag every Job names, one only docket-runner carries (plan item 71), e.g. `claude-cli:subscription`. No default: a guessed tag could send the tracker's Jobs to another agent. |
-| `TRACKER_CITY_HALL_ACCESS_CLIENT_ID`, `TRACKER_CITY_HALL_ACCESS_CLIENT_SECRET` | yes | A Cloudflare Access service token for city-hall's edge (`CF-Access-Client-Id` / `-Secret`), when one is in front. Both or neither. |
+| `TRACKER_CITY_HALL_ACCESS_CLIENT_ID`, `TRACKER_CITY_HALL_ACCESS_CLIENT_SECRET` | yes | A Cloudflare Access service token for city-hall's edge (`CF-Access-Client-Id` / `-Secret`), when one is in front. Both or neither, each visible ASCII only, as for the key. |
 | `TRACKER_BGG_TOKEN` | yes | BoardGameGeek's XML API Bearer token for the tracker's registered application. Set = `/want source: bgg` watches a game's BGG marketplace; unset or empty = `/want source: bgg` makes an inbox watch instead, whose listings are sent in (as for eBay). Never logged. BGG declined the tracker's application (applied 2026-09-29, non-commercial), so no token exists today; if BGG ever grants one, put it in the instance's `.env` and recreate the bot. BGG's terms ask for attribution: every BGG line in a DM says "via BoardGameGeek". |
 | `TRACKER_USR_URL` | no | The https origin of our usr (Rackbops/usr), e.g. `https://id.example.com` (no path). With `TRACKER_USR_KEY` it turns the usr link on (0.20.0): people stay in the tracker, and each is linked to a usr account by usr's user id (`users.usr_subject`). Unset = off, and the tracker behaves as before (migration 9 still adds the empty column). `/allow` and `/register` use it since 0.21.0, and the web sign-in since 0.22.0 (Signing in through usr, above). |
 | `TRACKER_USR_KEY` | yes | The tracker's usr API key, with the role `usr:discord` only (usr's `/api/discord/allow` and `/register-link`), never `tracker:admin` or `tracker:register`, and a usr Discord service (`PUT /api/discord/services/<keyId>`) set to the tracker's app. Required with `TRACKER_USR_URL`; set without it, or with whitespace in it, refuses to load. Never logged. |
@@ -765,7 +766,18 @@ instead. Only a 400 from usr whose reason starts with one of the person's own fi
 `display_name`) is theirs, listed by name while the rest go on; any other 400, refusal or failure (the admin not linked in usr or missing `tracker:register` or `tracker:member`,
 the key, usr unreachable) stops the run, since it would fail everyone the same way. It never starts
 on its own. It passes over everyone already linked, so it does not fix a link usr moved at sign-up
-(`/allow` above): run `/allow` for that person again.
+(`/allow` above); Refresh usr links does.
+
+**Refresh usr links** (#170, the admin page, with the usr link on). The same run, over everyone on the
+list already linked. usr answers each with the account it has for them now, and a link usr moved at
+sign-up is updated, so their usr sign-in works. It changes usr: it puts `tracker:member` back for
+everyone still linked and in the server, undoing a usr admin's removal of it, and someone whose usr
+link a usr admin removed gets a new usr account (an existing account's display name and who allowed
+it stay as they were). It ends with how many were refreshed, how many moved to another account, how
+many got a new usr account, how many failed and how many were skipped, naming each failure (not a
+member, a 400 about them, or the account usr names already linked to someone else here) while the
+rest go on; a failure that would fail everyone stops it, as above, with the counts so far. Someone
+forgotten is never sent, and one run of either kind goes at a time.
 
 **First admin and usr.** usr's `/api/discord/allow` needs the admin running `/allow` to be linked in
 usr already, so the first admin cannot be `/allow`ed by anyone. With the usr link on, a configured

package/dist/plugin.js

@@ -120,13 +120,6 @@ async function visibleOccurrences(store, actor, taskId) {
   const runs = await store.listOccurrences({ taskId });
   return seesAll(actor, task) ? runs : runs.map((o) => ({ ...o, record: null }));
 }
-async function visibleReplies(store, actor, taskId) {
-  const task = await visibleTask(store, actor, taskId);
-  if (!task)
-    return null;
-  const replies = await store.listReplies(taskId);
-  return seesAll(actor, task) ? replies : replies.filter((r) => r.userId === actor.userId);
-}
 var ABOUT_A_RECIPIENT = new Set([
   "recipient_invited",
   "recipient_accepted",
@@ -136,15 +129,6 @@ var ABOUT_A_RECIPIENT = new Set([
   "blocked",
   "block_lifted"
 ]);
-async function visibleHistory(store, actor, taskId) {
-  const task = await visibleTask(store, actor, taskId);
-  if (!task)
-    return null;
-  const events = await store.listTaskEvents(taskId);
-  if (seesAll(actor, task))
-    return events;
-  return events.filter((e) => !ABOUT_A_RECIPIENT.has(e.kind) || e.detail.split(" ")[0] === actor.userId);
-}
 async function visibleSeries(store, actor, taskId, filter) {
   if (!await visibleTask(store, actor, taskId))
     return null;
@@ -5014,6 +4998,17 @@ function toDelivery(r) {
     settledAt: str2(r.settled_at)
   };
 }
+var ABOUT_A_RECIPIENT2 = ["recipient_invited", "recipient_accepted", "recipient_declined", "recipient_opted_out", "recipient_removed", "blocked", "block_lifted"];
+var PREV_PAUSE_OR_RESUME = "(SELECT x.kind FROM task_events x WHERE x.task_id = e.task_id AND x.kind IN ('paused', 'resumed') AND x.seq < e.seq ORDER BY x.seq DESC LIMIT 1)";
+function recipientShown(taskId, viewerId) {
+  const about = ABOUT_A_RECIPIENT2.map((k) => `'${k}'`).join(", ");
+  const sql = `e.task_id = ? AND (
+      (e.kind NOT IN ('paused', 'resumed') AND (e.kind NOT IN (${about}) OR e.detail = ? OR instr(e.detail, ?) = 1))
+      OR (e.kind = 'resumed' AND ${PREV_PAUSE_OR_RESUME} = 'paused')
+      OR (e.kind = 'paused' AND NOT (${PREV_PAUSE_OR_RESUME} IS 'paused' AND instr(e.detail, 'delivery to ') = 1 AND instr(e.detail, ?) <> 1))
+    )`;
+  return [sql, [taskId, viewerId, `${viewerId} `, `delivery to {${viewerId}} paused:`]];
+}
 function deleteDeliveriesOf(db, userId) {
   return db.query("DELETE FROM deliveries WHERE user_id = ?").run(userId).changes;
 }
@@ -5111,6 +5106,21 @@ class SqliteStore {
     };
     this.run(`UPDATE tasks SET title = ?, config = ?, state = ?, schedule = ?, capabilities = ?, status = ?, updated_at = ?
        WHERE seq = ?`, next.title, json(next.config), json(next.state), json(next.schedule), json(next.capabilities), next.status, next.updatedAt, seqOf("t", id));
+    const ended = (status) => status === "done" || status === "archived";
+    if (ended(next.status) && !ended(cur.status)) {
+      this.run("DELETE FROM want_inbox WHERE task_id = ?", id);
+      const why = next.status === "archived" ? "deleted" : "finished";
+      for (const r of this.all("SELECT * FROM task_recipients WHERE task_id = ? AND state = 'invited' ORDER BY seq", id).map(toRecipient)) {
+        this.run("DELETE FROM task_recipients WHERE task_id = ? AND user_id = ?", id, r.userId);
+        this.insertTaskEvent({
+          taskId: id,
+          actorId: null,
+          kind: "recipient_removed",
+          detail: `${r.userId}: the task was ${why}, so the invitation is withdrawn`,
+          at: patch.at
+        });
+      }
+    }
     return toTask(this.mustGet("tasks", "t", id, "task"));
   }
   async listRecipients(taskId) {
@@ -5228,6 +5238,9 @@ class SqliteStore {
     return this.all("SELECT * FROM events WHERE occurrence_id = ? AND seq > ? ORDER BY seq", occurrenceId, cursor ? Number(cursor.seq) : 0).map(toEvent);
   }
   async addTaskEvent(e) {
+    return this.insertTaskEvent(e);
+  }
+  insertTaskEvent(e) {
     const { lastInsertRowid } = this.run("INSERT INTO task_events (task_id, actor_id, kind, detail, at) VALUES (?, ?, ?, ?, ?)", e.taskId, e.actorId, e.kind, e.detail, e.at);
     return toTaskEvent(this.mustGet("task_events", "h", idOf("h", lastInsertRowid), "task event"));
   }
@@ -5241,6 +5254,33 @@ class SqliteStore {
   async listReplies(taskId) {
     return this.all("SELECT * FROM replies WHERE task_id = ? ORDER BY seq", taskId).map(toReply);
   }
+  async runsTail(taskId, now, limit) {
+    const past = "task_id = ? AND NOT (status = 'queued' AND due_at > ?)";
+    const total = Number(this.one(`SELECT COUNT(*) AS n FROM occurrences WHERE ${past}`, taskId, now)?.n ?? 0);
+    const rows = this.all(`SELECT * FROM occurrences WHERE ${past} ORDER BY due_at DESC, created_at DESC, seq DESC LIMIT ?`, taskId, now, limit);
+    const next = this.one("SELECT * FROM occurrences WHERE task_id = ? AND status = 'queued' AND due_at > ? ORDER BY due_at, created_at, seq LIMIT 1", taskId, now);
+    return { rows: rows.reverse().map(toOccurrence), total, next: next ? toOccurrence(next) : null };
+  }
+  async repliesTo(taskId, occurrenceIds, userId) {
+    if (occurrenceIds.length === 0)
+      return [];
+    const ids = `occurrence_id IN (${occurrenceIds.map(() => "?").join(", ")})`;
+    const own = userId === null ? "" : " AND user_id = ?";
+    return this.all(`SELECT * FROM replies WHERE task_id = ? AND ${ids}${own} ORDER BY seq`, taskId, ...occurrenceIds, ...userId === null ? [] : [userId]).map(toReply);
+  }
+  async changesTail(taskId, viewerId, limit) {
+    if (viewerId === null) {
+      const total = Number(this.one("SELECT COUNT(*) AS n FROM task_events WHERE task_id = ?", taskId)?.n ?? 0);
+      const rows = this.all("SELECT * FROM task_events WHERE task_id = ? ORDER BY seq DESC LIMIT ?", taskId, limit).reverse();
+      return { rows: rows.map(toTaskEvent), total, before: null };
+    }
+    const [shown, params] = recipientShown(taskId, viewerId);
+    const total = Number(this.one(`SELECT COUNT(*) AS n FROM task_events e WHERE ${shown}`, ...params)?.n ?? 0);
+    const rows = this.all(`SELECT e.* FROM task_events e WHERE ${shown} ORDER BY e.seq DESC LIMIT ?`, ...params, limit).reverse();
+    const first = rows[0];
+    const before = first ? this.one(`SELECT e.* FROM task_events e WHERE ${shown} AND e.kind IN ('paused', 'resumed') AND e.seq < ? ORDER BY e.seq DESC LIMIT 1`, ...params, Number(first.seq)) : null;
+    return { rows: rows.map(toTaskEvent), total, before: before ? toTaskEvent(before) : null };
+  }
   async addSeriesPoint(p) {
     const key = p.key ?? null;
     const { changes, lastInsertRowid } = this.run("INSERT INTO series (task_id, key, at, value, unit, note) VALUES (?, ?, ?, ?, ?, ?) ON CONFLICT (key) WHERE key IS NOT NULL DO NOTHING", p.taskId, key, p.at, p.value, p.unit ?? null, p.note ?? null);
@@ -6811,8 +6851,14 @@ function parseCityHallConfig(env) {
   if (capability !== undefined && (capability.length > MAX_CAPABILITY || !CAPABILITY.test(capability))) {
     throw new Error(`${ENV.capability}: "${capability}" is not a capability tag (lowercase words joined by ":" or "-", e.g. claude-cli:subscription)`);
   }
-  if (key !== undefined && /\s/.test(key))
-    throw new Error(`${ENV.key} has whitespace in it`);
+  for (const [name, v] of [[ENV.key, key], [ENV.accessId, accessId], [ENV.accessSecret, accessSecret]]) {
+    if (v === undefined)
+      continue;
+    if (/\s/.test(v))
+      throw new Error(`${name} has whitespace in it`);
+    if (!/^[!-~]+$/.test(v))
+      throw new Error(`${name} has a character in it that is not visible ASCII (letters, digits and punctuation only)`);
+  }
   const missing = [
     ...origin === undefined ? [ENV.url] : [],
     ...key === undefined ? [ENV.key] : [],
@@ -7168,6 +7214,7 @@ var MAX_WHEN = 100;
 var MAX_NOTE = 300;
 var MAX_URL = 1000;
 var MAX_NEAR = 100;
+var MAX_AMOUNT = 1e6;
 var CURRENCY_LENGTH = 3;
 var DATE_LENGTH = 10;
 var MAX_ZONE = 64;
@@ -8316,6 +8363,12 @@ var MAX_EVERY = 100;
 function plural3(n, word) {
   return `${n} ${word}${n === 1 ? "" : "s"}`;
 }
+function amountProblem(amount) {
+  if (!Number.isFinite(amount) || amount < 0 || amount > MAX_AMOUNT) {
+    return `The amount has to be a number from 0 to ${MAX_AMOUNT.toLocaleString("en-US")}.`;
+  }
+  return null;
+}
 var PERIOD_UNITS = ["year", "month", "week", "day"];
 function renewalPlan(d, user, input) {
   const bad = (error) => ({ ok: false, error });
@@ -8324,8 +8377,9 @@ function renewalPlan(d, user, input) {
     return bad("Say what renews: a subscription, a domain, a warranty.");
   if (name.length > MAX_TITLE)
     return bad(`That name is longer than ${MAX_TITLE} characters.`);
-  if (!Number.isFinite(input.amount) || input.amount < 0)
-    return bad("The amount has to be zero or more.");
+  const amountBad = amountProblem(input.amount);
+  if (amountBad)
+    return bad(amountBad);
   const currency = input.currency.trim().toUpperCase();
   if (!new RegExp(`^[A-Z]{${CURRENCY_LENGTH}}$`).test(currency))
     return bad("The currency is a three-letter code, such as USD or EUR.");
@@ -8406,8 +8460,9 @@ async function decideRenewal(d, user, input) {
     return NO_SUCH_TASK;
   if (task.type !== "renewal")
     return `\`/task decide\` answers a renewal; \`${task.id}\` is a ${task.type}.`;
-  if (input.amount !== undefined && (!Number.isFinite(input.amount) || input.amount < 0))
-    return "The amount has to be zero or more.";
+  const amountBad = input.amount === undefined ? null : amountProblem(input.amount);
+  if (amountBad)
+    return amountBad;
   const payload = input.amount === undefined ? input.choice : { choice: input.choice, amount: input.amount };
   const refused = await d.locks.turn(task.id, async () => {
     const latest = await latestRun(d, task.id);
@@ -9135,7 +9190,22 @@ async function press(d, user, ref) {
   const taskId = await taskOfRef(d, ref);
   return taskId === null ? pressLocked(d, user, ref) : d.locks.turn(taskId, () => pressLocked(d, user, ref), () => ({ ok: false, error: TASK_BUSY }));
 }
+async function consentRefusal(d, ref) {
+  const decoded = decodeReplyRef(ref);
+  if (decoded?.kind !== "accept" && decoded?.kind !== "decline")
+    return null;
+  const taskId = await taskOfRef(d, ref);
+  const task = taskId === null ? null : await d.store.getTask(taskId);
+  if (!task || task.status === "archived")
+    return "That task was deleted.";
+  if (task.status === "done")
+    return "That task is done.";
+  return null;
+}
 async function pressLocked(d, user, ref) {
+  const refused = await consentRefusal(d, ref);
+  if (refused)
+    return { ok: false, error: refused };
   const verdict = await replyForRef(d.store, ref, user.id);
   if (!verdict.ok)
     return { ok: false, error: verdict.error };
@@ -9601,14 +9671,14 @@ async function loadHistory(d, user, taskId) {
   if (!task)
     return null;
   const now = d.clock.now();
-  const all = await visibleOccurrences(d.store, actor, task.id) ?? [];
-  const upcoming = (o) => o.status === "queued" && Date.parse(o.dueAt) > now.getTime();
-  const runs = all.filter((o) => !upcoming(o));
-  const next = all.find(upcoming);
-  const replies = await visibleReplies(d.store, actor, task.id) ?? [];
   const seesEveryone = user.admin || task.ownerId === user.id;
-  const visible = await visibleHistory(d.store, actor, task.id) ?? [];
-  const changes = seesEveryone ? visible : changesForRecipient(visible, user.id);
+  const tailed = await d.store.runsTail(task.id, now.toISOString(), HISTORY_RUNS);
+  const runs = seesEveryone ? tailed : { ...tailed, rows: tailed.rows.map((o) => ({ ...o, record: null })) };
+  const next = runs.next;
+  const replies = await d.store.repliesTo(task.id, runs.rows.map((o) => o.id), seesEveryone ? null : user.id);
+  const tail = await d.store.changesTail(task.id, seesEveryone ? null : user.id, HISTORY_CHANGES);
+  const lead = tail.before?.kind === "paused" ? [tail.before] : [];
+  const changes = seesEveryone ? tail.rows : changesForRecipient([...lead, ...tail.rows], user.id).slice(lead.length);
   const people = new Map;
   for (const r of replies) {
     if (!people.has(r.userId)) {
@@ -9633,10 +9703,10 @@ async function loadHistory(d, user, taskId) {
     task,
     cadence: task.schedule && owner ? describeSchedule(task.schedule, owner, user.timeZone, now) : "no schedule",
     next: next ? formatInstant(next.dueAt, user.timeZone, now) : null,
-    runs: runs.slice(-HISTORY_RUNS).map((o) => runView(o, replies, people, user, now, seesEveryone)),
-    earlierRuns: Math.max(0, runs.length - HISTORY_RUNS),
-    changes: changes.slice(-HISTORY_CHANGES).map((e) => changeView(e, user, now, names)),
-    earlierChanges: Math.max(0, changes.length - HISTORY_CHANGES),
+    runs: runs.rows.map((o) => runView(o, replies, people, user, now, seesEveryone)),
+    earlierRuns: Math.max(0, runs.total - HISTORY_RUNS),
+    changes: changes.map((e) => changeView(e, user, now, names)),
+    earlierChanges: Math.max(0, tail.total - HISTORY_CHANGES),
     findings: findings.map((f) => findingView(f, user, now))
   };
 }
@@ -9924,7 +9994,7 @@ function createSurface(w) {
     },
     {
       name: "renewal",
-      build: (b) => b.setDescription("Track a subscription, domain or warranty: I ask before each renewal").addStringOption((o) => o.setName("name").setDescription("What renews, e.g. Netflix").setRequired(true).setMaxLength(MAX_TITLE)).addNumberOption((o) => o.setName("amount").setDescription("What one period costs").setRequired(true).setMinValue(0)).addStringOption((o) => o.setName("currency").setDescription("Currency code, e.g. USD").setRequired(true).setMinLength(CURRENCY_LENGTH).setMaxLength(CURRENCY_LENGTH)).addStringOption((o) => o.setName("renews").setDescription("The next renewal or expiry date, YYYY-MM-DD").setRequired(true).setMaxLength(DATE_LENGTH)).addStringOption((o) => o.setName("unit").setDescription("How it renews (default: yearly)").addChoices({ name: "yearly", value: "year" }, { name: "monthly", value: "month" }, { name: "weekly", value: "week" }, { name: "daily", value: "day" })).addIntegerOption((o) => o.setName("every").setDescription("Every how many of those, e.g. 2 for every two years (default 1)").setMinValue(1).setMaxValue(MAX_EVERY)).addIntegerOption((o) => o.setName("lead").setDescription(`Days before the date to ask (default ${DEFAULT_LEAD_DAYS})`).setMinValue(0).setMaxValue(MAX_LEAD_DAYS)).addStringOption((o) => o.setName("note").setDescription("Carried on every ask: where to cancel, which account").setMaxLength(MAX_NOTE)),
+      build: (b) => b.setDescription("Track a subscription, domain or warranty: I ask before each renewal").addStringOption((o) => o.setName("name").setDescription("What renews, e.g. Netflix").setRequired(true).setMaxLength(MAX_TITLE)).addNumberOption((o) => o.setName("amount").setDescription("What one period costs").setRequired(true).setMinValue(0).setMaxValue(MAX_AMOUNT)).addStringOption((o) => o.setName("currency").setDescription("Currency code, e.g. USD").setRequired(true).setMinLength(CURRENCY_LENGTH).setMaxLength(CURRENCY_LENGTH)).addStringOption((o) => o.setName("renews").setDescription("The next renewal or expiry date, YYYY-MM-DD").setRequired(true).setMaxLength(DATE_LENGTH)).addStringOption((o) => o.setName("unit").setDescription("How it renews (default: yearly)").addChoices({ name: "yearly", value: "year" }, { name: "monthly", value: "month" }, { name: "weekly", value: "week" }, { name: "daily", value: "day" })).addIntegerOption((o) => o.setName("every").setDescription("Every how many of those, e.g. 2 for every two years (default 1)").setMinValue(1).setMaxValue(MAX_EVERY)).addIntegerOption((o) => o.setName("lead").setDescription(`Days before the date to ask (default ${DEFAULT_LEAD_DAYS})`).setMinValue(0).setMaxValue(MAX_LEAD_DAYS)).addStringOption((o) => o.setName("note").setDescription("Carried on every ask: where to cancel, which account").setMaxLength(MAX_NOTE)),
       handle: (interaction) => run(interaction, "registered", (d, user) => {
         const every = interaction.options.getInteger("every");
         const lead = interaction.options.getInteger("lead");
@@ -10026,7 +10096,7 @@ function createSurface(w) {
     },
     {
       name: "task",
-      build: (b) => b.setDescription("Answer, look back at, or share one of your tasks").addSubcommand((s) => s.setName("done").setDescription("Mark the task's latest reminder done").addStringOption((o) => o.setName("task").setDescription("The task id from /tasks, e.g. t3").setRequired(true).setMaxLength(MAX_TASK_ID))).addSubcommand((s) => s.setName("snooze").setDescription("Snooze the task's latest reminder (default: an hour)").addStringOption((o) => o.setName("task").setDescription("The task id from /tasks, e.g. t3").setRequired(true).setMaxLength(MAX_TASK_ID)).addStringOption((o) => o.setName("until").setDescription('Until when: "in 2h", "tomorrow 9am"').setMaxLength(MAX_WHEN))).addSubcommand((s) => s.setName("decide").setDescription("Answer a renewal's latest ask, with what you paid if it changed").addStringOption((o) => o.setName("task").setDescription("The task id from /tasks, e.g. t3").setRequired(true).setMaxLength(MAX_TASK_ID)).addStringOption((o) => o.setName("choice").setDescription("Keep it, cancel it, or it has renewed").setRequired(true).addChoices({ name: "keep", value: "keep" }, { name: "cancel", value: "cancel" }, { name: "renewed", value: "renewed" })).addNumberOption((o) => o.setName("amount").setDescription("What you paid this time, if not the usual").setMinValue(0))).addSubcommand((s) => s.setName("history").setDescription("Every run of the task, how it was answered, and its changes").addStringOption((o) => o.setName("task").setDescription("The task id from /tasks, e.g. t3").setRequired(true).setMaxLength(MAX_TASK_ID))).addSubcommand((s) => s.setName("resume").setDescription("Resume a paused task; one paused for failed DMs goes on without them").addStringOption((o) => o.setName("task").setDescription("The task id from /tasks, e.g. t3").setRequired(true).setMaxLength(MAX_TASK_ID))).addSubcommand((s) => s.setName("share").setDescription("Ask someone to receive this task's messages too").addStringOption((o) => o.setName("task").setDescription("The task id from /tasks, e.g. t3").setRequired(true).setMaxLength(MAX_TASK_ID)).addUserOption((o) => o.setName("user").setDescription("Who to invite").setRequired(true))),
+      build: (b) => b.setDescription("Answer, look back at, or share one of your tasks").addSubcommand((s) => s.setName("done").setDescription("Mark the task's latest reminder done").addStringOption((o) => o.setName("task").setDescription("The task id from /tasks, e.g. t3").setRequired(true).setMaxLength(MAX_TASK_ID))).addSubcommand((s) => s.setName("snooze").setDescription("Snooze the task's latest reminder (default: an hour)").addStringOption((o) => o.setName("task").setDescription("The task id from /tasks, e.g. t3").setRequired(true).setMaxLength(MAX_TASK_ID)).addStringOption((o) => o.setName("until").setDescription('Until when: "in 2h", "tomorrow 9am"').setMaxLength(MAX_WHEN))).addSubcommand((s) => s.setName("decide").setDescription("Answer a renewal's latest ask, with what you paid if it changed").addStringOption((o) => o.setName("task").setDescription("The task id from /tasks, e.g. t3").setRequired(true).setMaxLength(MAX_TASK_ID)).addStringOption((o) => o.setName("choice").setDescription("Keep it, cancel it, or it has renewed").setRequired(true).addChoices({ name: "keep", value: "keep" }, { name: "cancel", value: "cancel" }, { name: "renewed", value: "renewed" })).addNumberOption((o) => o.setName("amount").setDescription("What you paid this time, if not the usual").setMinValue(0).setMaxValue(MAX_AMOUNT))).addSubcommand((s) => s.setName("history").setDescription("Every run of the task, how it was answered, and its changes").addStringOption((o) => o.setName("task").setDescription("The task id from /tasks, e.g. t3").setRequired(true).setMaxLength(MAX_TASK_ID))).addSubcommand((s) => s.setName("resume").setDescription("Resume a paused task; one paused for failed DMs goes on without them").addStringOption((o) => o.setName("task").setDescription("The task id from /tasks, e.g. t3").setRequired(true).setMaxLength(MAX_TASK_ID))).addSubcommand((s) => s.setName("share").setDescription("Ask someone to receive this task's messages too").addStringOption((o) => o.setName("task").setDescription("The task id from /tasks, e.g. t3").setRequired(true).setMaxLength(MAX_TASK_ID)).addUserOption((o) => o.setName("user").setDescription("Who to invite").setRequired(true))),
       handle: (interaction) => {
         const sub = interaction.options.getSubcommand();
         const taskId = interaction.options.getString("task", true);
@@ -11801,7 +11871,7 @@ function fieldsFor(type, mode, surface = "web") {
     case "renewal":
       return [
         { name: "name", label: "What renews", kind: "text", required: true, maxlength: MAX_TITLE, help: "A subscription, a domain, a warranty." },
-        { name: "amount", label: "What one period costs", kind: "text", required: true, decimal: true },
+        { name: "amount", label: "What one period costs", kind: "text", required: true, decimal: true, min: 0, max: MAX_AMOUNT, help: `0 to ${MAX_AMOUNT.toLocaleString("en-US")}.` },
         { name: "currency", label: "Currency", kind: "text", required: true, maxlength: CURRENCY_LENGTH, help: "A three-letter code, such as USD or EUR." },
         { name: "renews", label: "Next renewal or expiry date", kind: "date", required: true },
         { name: "unit", label: "Renews", kind: "select", options: UNIT_OPTIONS },
@@ -12279,10 +12349,13 @@ ${hidden(v)}
 </form>
 </section>
 ${o.usrUnlinked === undefined || o.usrUnlinked === null ? null : html`<section>
-<h2>Link everyone to usr</h2>
-<p class="rb-muted">${o.usrUnlinked === 0 ? "Everyone on the list is linked to usr." : `${o.usrUnlinked} on the list ${o.usrUnlinked === 1 ? "is" : "are"} not linked to usr yet.`} Each one is checked as a member of the server and allowed in usr as a member, with you as the admin who allowed them, as <code>/allow</code> does in the server. Someone linked before they finished signing up on usr with a usr account they already had is linked to the account usr dropped, and cannot sign in through usr: run <code>/allow</code> for them again.</p>
-${o.usrRun?.running ? html`<p>Linking everyone to usr: ${String(o.usrRun.done)} of ${String(o.usrRun.total)} done. Reload this page to see how far it has got.</p>` : o.usrRun?.result ? html`<div class="rb-alert ${o.usrRun.result.ok ? "rb-alert--success" : "rb-alert--warning"}" role="status"><p>Last run: ${o.usrRun.result.text}</p></div>` : null}
+<h2>usr links</h2>
+<p class="rb-muted">${o.usrUnlinked === 0 ? "Everyone on the list is linked to usr." : `${o.usrUnlinked} on the list ${o.usrUnlinked === 1 ? "is" : "are"} not linked to usr yet.`}</p>
+${o.usrUnlinked === 0 || o.usrRun?.running ? null : html`<p class="rb-muted">Link everyone to usr checks each one as a member of the server and allows them in usr as a member, with you as the admin who allowed them, as <code>/allow</code> does in the server.</p>`}
+${!o.usrLinked || o.usrRun?.running ? null : html`<p class="rb-muted">Refresh usr links asks usr again, as <code>/allow</code> does, for the ${String(o.usrLinked)} on the list ${o.usrLinked === 1 ? "who is" : "who are"} linked, and keeps the account usr has for each now: someone linked before they finished signing up on usr with a usr account they already had is linked to the account usr dropped, and cannot sign in through usr until then. It changes usr: it puts the tracker's member role back for everyone still linked and in the server, undoing a usr admin's removal of it, and someone whose usr link a usr admin removed gets a new usr account.</p>`}
+${o.usrRun?.running ? html`<p>${o.usrRun.kind === "link" ? "Linking everyone to usr" : "Refreshing usr links"}: ${String(o.usrRun.done)} of ${String(o.usrRun.total)} done. Reload this page to see how far it has got.</p>` : o.usrRun?.result ? html`<div class="rb-alert ${o.usrRun.result.ok ? "rb-alert--success" : "rb-alert--warning"}" role="status"><p>Last run: ${o.usrRun.result.text}</p></div>` : null}
 ${o.usrUnlinked === 0 || o.usrRun?.running ? null : html`<form method="post" action="${v.base}/admin/usr-link">${hidden(v)}<button class="rb-btn rb-btn--primary" type="submit">Link everyone to usr</button></form>`}
+${!o.usrLinked || o.usrRun?.running ? null : html`<form method="post" action="${v.base}/admin/usr-refresh">${hidden(v)}<button class="rb-btn rb-btn--ghost" type="submit">Refresh usr links</button></form>`}
 </section>`}
 <section>
 <h2>Decline blocks</h2>
@@ -12471,8 +12544,16 @@ async function peoplePage(a, result, status, allow) {
   const data = { people, blocks: a.d.roster.activeBlocks(a.d.clock.now()), now: a.d.clock.now() };
   const usr = a.d.usr;
   const usrUnlinked = usr ? people.filter((p) => p.discordId !== null && usr.links.subjectOf(p.id) === null).length : null;
+  const usrLinked = usr ? people.filter((p) => p.discordId !== null && usr.links.subjectOf(p.id) !== null).length : null;
   const usrRun = usr ? usrLinkRuns.get(usr) : undefined;
-  return htmlResponse(adminPage(a.v, data, { result, unlimited: a.d.budgetUnlimited === true, usrUnlinked, ...usrRun ? { usrRun } : {}, ...allow !== undefined ? { allow } : {} }), status);
+  return htmlResponse(adminPage(a.v, data, {
+    result,
+    unlimited: a.d.budgetUnlimited === true,
+    usrUnlinked,
+    usrLinked,
+    ...usrRun ? { usrRun } : {},
+    ...allow !== undefined ? { allow } : {}
+  }), status);
 }
 async function onePerson(a, id, result = null) {
   const everyone = a.d.roster.people();
@@ -12533,11 +12614,12 @@ async function adminPost(a, r, form) {
     const ok = text.startsWith("Allowed") || text.includes("already on the list");
     return peoplePage(a, { ok, text }, ok ? 200 : 400);
   }
-  if (r.kind === "admin-usr-link") {
+  if (r.kind === "admin-usr-link" || r.kind === "admin-usr-refresh") {
     if (!a.d.usr)
       return unknownPage(base);
     const usr = a.d.usr;
-    const result = await fresh(a, true, async (me) => startLinkEveryone(a, usr, me));
+    const kind = r.kind === "admin-usr-link" ? "link" : "refresh";
+    const result = await fresh(a, true, async (me) => startUsrRun(a, usr, me, kind));
     if (result === null)
       return unknownPage(base);
     if (result === "started")
@@ -12606,9 +12688,18 @@ async function adminPost(a, r, form) {
     return redirect(`${base}/`);
   return onePerson({ ...a, v: { ...a.v, deliveryPaused: a.d.health.isPaused(a.v.user.id) } }, r.id, said2(done));
 }
+var RUN_WORDS = {
+  link: { doing: "linking everyone to usr", stopped: "Linking to usr stopped", soFar: "Linked", none: "Everyone on the list is already linked to usr." },
+  refresh: {
+    doing: "refreshing usr links",
+    stopped: "Refreshing usr links stopped",
+    soFar: "Refreshed",
+    none: "No one on the list is linked to usr yet, so there is nothing to refresh."
+  }
+};
 var usrLinkRuns = new WeakMap;
 var usrLinkPending = new Set;
-function startLinkEveryone(a, usr, me) {
+function startUsrRun(a, usr, me, kind) {
   if (a.usrGuildId === null) {
     return { ok: false, text: "usr needs a server for each link, and TRACKER_GUILD_ID is unset: run /allow on each person in the server instead." };
   }
@@ -12616,15 +12707,15 @@ function startLinkEveryone(a, usr, me) {
     return { ok: false, text: "You have no Discord id here, and usr asks who is allowing them by it." };
   const current = usrLinkRuns.get(usr);
   if (current?.running)
-    return { ok: false, text: `Already linking everyone to usr: ${current.done} of ${current.total} done.` };
-  const waiting = a.d.roster.people().filter((p) => p.discordId !== null && usr.links.subjectOf(p.id) === null);
+    return { ok: false, text: `Already ${RUN_WORDS[current.kind].doing}: ${current.done} of ${current.total} done.` };
+  const waiting = a.d.roster.people().filter((p) => p.discordId !== null && wanted(kind, usr.links.subjectOf(p.id)));
   if (waiting.length === 0)
-    return { ok: true, text: "Everyone on the list is already linked to usr." };
-  const run = { running: true, done: 0, total: waiting.length, result: null };
+    return { ok: true, text: RUN_WORDS[kind].none };
+  const run = { kind, running: true, done: 0, total: waiting.length, result: null };
   usrLinkRuns.set(usr, run);
-  const pending = linkEveryone(a, usr, me.discordId, nameOf(me), a.usrGuildId, waiting.map((p) => p.id), run).catch((err) => {
+  const pending = usrRun(a, usr, me.discordId, nameOf(me), a.usrGuildId, waiting.map((p) => p.id), run).catch((err) => {
     a.d.log.error("usr link run failed", err);
-    run.result = { ok: false, text: `Linking to usr stopped: something went wrong. Linked ${run.done} so far; press again to go on.` };
+    run.result = { ok: false, text: `${RUN_WORDS[kind].stopped}: something went wrong. ${RUN_WORDS[kind].soFar} ${run.done} so far; press again to go on.` };
   }).finally(() => {
     run.running = false;
     usrLinkPending.delete(pending);
@@ -12635,20 +12726,32 @@ function startLinkEveryone(a, usr, me) {
 function personsOwn400(err) {
   return err.status === 400 && /^(discord_user_id|display_name)\b/.test(err.reason);
 }
-async function linkEveryone(a, usr, invoker, by, guildId, ids, run) {
+function wanted(kind, subject) {
+  return kind === "link" ? subject === null : subject !== null;
+}
+async function usrRun(a, usr, invoker, by, guildId, ids, run) {
   const member = `${usr.app}:${MEMBER_ROLE}`;
+  const words = RUN_WORDS[run.kind];
   let linked = 0;
+  let changed = 0;
+  let created = 0;
+  let skipped = 0;
   const problems = [];
+  const counts = () => run.kind === "link" ? "" : ` (${changed} changed, ${created} new usr ${created === 1 ? "account" : "accounts"}, ${problems.length} failed, ${skipped} skipped)`;
+  const soFar = () => `${words.soFar} ${linked} so far${counts()}`;
   const end = (ok, stopped) => {
-    const parts = [stopped ?? `Linked ${linked} of ${ids.length} to usr.`];
+    const tally = run.kind === "link" ? `Linked ${linked} of ${ids.length} to usr.` : `Refreshed ${linked} of ${ids.length} usr links: ${changed} changed, ${created} new usr ${created === 1 ? "account" : "accounts"}, ${problems.length} failed, ${skipped} skipped.`;
+    const parts = [stopped ?? tally];
+    if (run.kind === "link" && skipped > 0)
+      parts.push(`Skipped ${skipped}: left the tracker or linked meanwhile.`);
     if (problems.length > 0)
-      parts.push(`Not linked: ${problems.join("; ")}.`);
+      parts.push(`${run.kind === "link" ? "Not linked" : "Not refreshed"}: ${problems.join("; ")}.`);
     run.result = { ok: ok && problems.length === 0, text: parts.join(" ") };
   };
-  const notAdmin = () => end(false, `Linking to usr stopped: ${by}, who started it, is no longer an admin here. Linked ${linked} so far.`);
+  const notAdmin = () => end(false, `${words.stopped}: ${by}, who started it, is no longer an admin here. ${soFar()}.`);
   const stillWaiting = (id) => fresh(a, true, async () => {
     const p = await a.d.store.getUser(id);
-    return p && p.discordId !== null && usr.links.subjectOf(id) === null ? p : "skip";
+    return p && p.discordId !== null && wanted(run.kind, usr.links.subjectOf(id)) ? p : "skip";
   });
   for (const id of ids) {
     const first = await stillWaiting(id);
@@ -12656,6 +12759,7 @@ async function linkEveryone(a, usr, invoker, by, guildId, ids, run) {
       return notAdmin();
     if (first === "skip") {
       run.done++;
+      skipped++;
       continue;
     }
     const membership = await a.memberOf(first.discordId);
@@ -12669,6 +12773,7 @@ async function linkEveryone(a, usr, invoker, by, guildId, ids, run) {
       return notAdmin();
     if (p === "skip") {
       run.done++;
+      skipped++;
       continue;
     }
     const answer = await usr.client.allow({ discordId: p.discordId, guildId, invokerDiscordId: invoker, roles: [member], ...p.displayName ? { displayName: p.displayName } : {} }).catch((err) => err);
@@ -12681,11 +12786,11 @@ async function linkEveryone(a, usr, invoker, by, guildId, ids, run) {
       if (!(answer instanceof UsrError))
         a.d.log.error("usr allow failed", answer);
       const why = answer instanceof UsrError ? answer.message : "something went wrong";
-      return end(false, `Linking to usr stopped, since it would fail for everyone: ${why}. Linked ${linked} so far; fix that, then press again.`);
+      return end(false, `${words.stopped}, since it would fail for everyone: ${why}. ${soFar()}; fix that, then press again.`);
     }
     const allowed = answer;
     if (!allowed.roles.includes(member)) {
-      return end(false, `Linking to usr stopped: usr did not give ${nameOf(p)} ${member}. Check that the tracker's usr key's Discord service is set to app ${usr.app} (TRACKER_USR_APP). Linked ${linked} so far.`);
+      return end(false, `${words.stopped}: usr did not give ${nameOf(p)} ${member}. Check that the tracker's usr key's Discord service is set to app ${usr.app} (TRACKER_USR_APP). ${soFar()}.`);
     }
     const outcome = await fresh(a, true, async () => {
       try {
@@ -12698,9 +12803,15 @@ async function linkEveryone(a, usr, invoker, by, guildId, ids, run) {
     if (outcome === null)
       return notAdmin();
     run.done++;
-    if (outcome === "linked" || outcome === "relinked" || outcome === "unchanged")
+    if (outcome === "linked" || outcome === "relinked" || outcome === "unchanged") {
       linked++;
-    else if (outcome === "taken")
+      if (outcome !== "unchanged") {
+        if (allowed.created)
+          created++;
+        else
+          changed++;
+      }
+    } else if (outcome === "taken")
       problems.push(`${nameOf(p)}: their usr account is already linked to someone else here`);
     else if (outcome === "gone")
       problems.push(`${nameOf(p)}: left the tracker meanwhile`);
@@ -13844,6 +13955,8 @@ function route2(path) {
     return { kind: "admin-allow" };
   if (path === "/admin/usr-link")
     return { kind: "admin-usr-link" };
+  if (path === "/admin/usr-refresh")
+    return { kind: "admin-usr-refresh" };
   const ceiling = PERSON_CEILING.exec(path);
   if (ceiling)
     return { kind: "admin-ceiling", id: segment2(ceiling[1]) };
@@ -13873,7 +13986,7 @@ function route2(path) {
   return { kind: "act", id, action };
 }
 function methodsOf(r) {
-  if (r.kind === "logout" || r.kind === "resume-dms" || r.kind === "act" || r.kind === "admin-allow" || r.kind === "admin-usr-link" || r.kind === "admin-act" || r.kind === "admin-ceiling" || r.kind === "admin-lift" || r.kind === "token-revoke" || r.kind === "admin-token-revoke") {
+  if (r.kind === "logout" || r.kind === "resume-dms" || r.kind === "act" || r.kind === "admin-allow" || r.kind === "admin-usr-link" || r.kind === "admin-usr-refresh" || r.kind === "admin-act" || r.kind === "admin-ceiling" || r.kind === "admin-lift" || r.kind === "token-revoke" || r.kind === "admin-token-revoke") {
     return "POST";
   }
   if (r.kind === "settings" || r.kind === "edit" || r.kind === "new" || r.kind === "forget" || r.kind === "tokens")
@@ -14034,7 +14147,7 @@ var LEFT_SERVER = `You are signed out. ${NOT_MEMBER}`;
 var USR_NO_COOKIE = "I could not confirm your usr sign-in. Try again in a minute, or run /web in Discord for a one-time link. If it keeps happening, tell an admin.";
 var USR_RECHECK_FAILED = "I could not check that you are a member of this tracker's server. Try again in a minute.";
 var USR_NOT_MEMBER = "Your usr account does not have this tracker's member role yet: ask an admin to run /allow for you in the server.";
-var USR_NOT_LINKED = "Your usr account is not linked to anyone on this tracker yet: ask an admin to run /allow for you in the server, then run /register if you have not. If you were allowed before you finished signing up on usr with a usr account you already had, usr moved you to that account, and a second /allow links it.";
+var USR_NOT_LINKED = "Your usr account is not linked to anyone on this tracker yet: ask an admin to run /allow for you in the server, then run /register if you have not. If you were allowed before you finished signing up on usr with a usr account you already had, usr moved you to that account, and a second /allow links it, as does an admin's Refresh usr links.";
 var USR_BACK = "usr";
 var USR_GO = "go";
 var USR_IN = "in";
@@ -14380,6 +14493,7 @@ function createWebHandler(w) {
           return tokenRevokePost(d, v, r.id);
         case "admin-allow":
         case "admin-usr-link":
+        case "admin-usr-refresh":
         case "admin-act":
         case "admin-ceiling":
         case "admin-lift":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rackbops/plugin-tracker",
-  "version": "0.30.0",
+  "version": "0.31.2",
   "description": "The task tracker for Rackbops Clerk: reminders, renewals, price drops, one-off research (on the web, or on pages your own browser gathers and sends in through the task API, with a fuller pass on pages the research could not open) and an interest scout (through city-hall, with their findings), a want-list watcher (listing pages you paste, BoardGameGeek through its API once its token is set, and eBay and BoardGameGeek listings you send in through the task API or that eBay's saved-search alert emails forwarded to your alert address carry, which the watcher never opens; with the model checking each new listing and its seller first, through city-hall) by slash command, delivered by DM with buttons, and a daily DM at each person's hour of what is due today and overdue, on docket's SQLite store (/allow, /register, /remind, /renewal, /price, /research, /scout, /want, /tasks, /task, /settings, /web), with a web area for your tasks, history and settings, a web editor to make, change, pause and delete your own tasks (research requests too, made but not changed, and scouts, made and changed), an admin view (with the DMs that did not arrive, raising a person's daily model ceiling, and daily model usage per person), an operator switch that turns the daily budgets off for the alpha, forget-me, and a JSON task API with personal API tokens",
   "type": "module",
   "main": "dist/plugin.js",