@things-factory/worklist 10.1.36 → 10.1.38

package/tests/open-doors.test.ts

@@ -0,0 +1,274 @@
+import { existsSync } from 'fs'
+import { join } from 'path'
+
+import { buildSchema } from 'type-graphql'
+import { GraphQLSchema } from 'graphql'
+
+/**
+ * Which of worklist's doors are open, and why each one is allowed to be.
+ *
+ * ── The thing this catches ──────────────────────────────────────────────────
+ * `@privilege` is opt-in. A root field that declares nothing is recorded as open, and that is
+ * indistinguishable from a field somebody decided to open. `deleteActivities` went in that way: its
+ * neighbours `deleteActivity` and `createActivity` ask for the activity privilege, it does not.
+ *
+ * Every open field must be on a list below, with its reason. A new open field fails. A field that
+ * gets closed fails too, until it is moved to CLOSED - so closing is visible as well.
+ *
+ * ── Why measured and not read off the source ────────────────────────────────
+ * The schema is built from `service/index.ts`'s own `resolverClasses`, the list the server boots
+ * from, and the directive fills the privilege table while it walks it. A pattern over the files
+ * answered 45 where the schema has 47 - it missed fields declared with `@Args(type => ListParam)`.
+ *
+ * ── Why the compiled output ──────────────────────────────────────────────────
+ * The entities use type-graphql decorators with no explicit type, which need
+ * `emitDecoratorMetadata`; jest's babel transform does not emit it (auth-base `tests/compiled.ts`).
+ */
+
+const DIST = join(__dirname, '..', 'dist-server')
+const AUTH_BASE_DIST = join(__dirname, '..', '..', 'auth-base', 'dist-server')
+
+function loadCompiled<T = any>(file: string): T {
+  if (!existsSync(file)) {
+    throw new Error(
+      `compiled output missing: ${file}\n` +
+        `this test reads the tsc output (see the header). build first:\n` +
+        `  yarn workspace @things-factory/worklist build:server`
+    )
+  }
+
+  return require(file)
+}
+
+const { schema: declared } = loadCompiled(join(DIST, 'service', 'index.js'))
+const { privilegeDirectiveResolver, privilegeOfField } = loadCompiled(
+  join(AUTH_BASE_DIST, 'service', 'privilege', 'privilege-directive.js')
+)
+
+type Root = 'Query' | 'Mutation' | 'Subscription'
+
+/**
+ * Open on purpose. Each one answers about the caller, is a catalogue of this domain, or checks
+ * who may act inside its own body.
+ */
+const OPEN_BY_DECISION: Record<Root, Record<string, string>> = {
+  Query: {
+    /* The caller's own. */
+    todoList: "the caller's open threads - myOpenThreadsWhere(user, roles)",
+    doneList: "threads the caller ended - at.assignee = the caller",
+    draftList: 'instances the caller made - ai.creator = the caller',
+    pickableActivityList: "instances waiting for a role the caller holds, or for nobody's role",
+    approvalPendingList: "approvals waiting for the caller or the caller's roles - myPendingApprovalsWhere",
+    approvalDoneList: 'approvals the caller judged - ap.approver = the caller',
+    approvalReferenceList: 'approvals the caller is a reference on - ap.approver = the caller',
+    approvalCompletedList: 'approvals the caller took part in - ap.approver = the caller',
+    activitySummary: "counts of the caller's own threads and approvals",
+    activityEvents: "the caller's own threads and approvals, for the calendar",
+
+    /* A catalogue of this domain - what can be started, not anybody's case. */
+    activities: 'activity definitions of this domain',
+    activity: 'one activity definition of this domain',
+    activityByName: 'one activity definition of this domain, by name',
+    startableActivities: 'definitions the caller may start here',
+    supervisableActivities: 'definitions the caller supervises here',
+    installableActivities: 'what the installed modules declare - the same for every domain',
+    installableActivity: 'one declaration of an installed module',
+    activityTemplates: 'activity templates of this domain',
+    activityTemplate: 'one activity template of this domain'
+  },
+  Mutation: {
+    /* Checked in the body: checkAuthority refuses anyone who does not hold the seat. */
+    startActivityThread: 'checkAuthority - only the assignee',
+    restartActivityThread: 'checkAuthority - only the assignee',
+    saveActivityThread: 'checkAuthority - only the assignee',
+    submitActivityThread: 'checkAuthority - only the assignee',
+    endActivityThread: 'checkAuthority - only the assignee',
+    abortActivityThread: 'checkAuthority - only the assignee',
+    delegateActivityThread: 'checkAuthority - only the assignee',
+    approveActivityApproval: 'checkAuthority - only the approver, never the issuer (self-approval)',
+    rejectActivityApproval: 'checkAuthority - only the approver',
+    saveActivityApproval: 'checkAuthority - only the approver',
+    delegateActivityApproval: 'checkAuthority - only the approver',
+
+    /* Checked in the body: entitlement.ts, with the reason in its header. */
+    draftActivityInstance: 'entitlement - the caller may start this activity',
+    issueActivityInstance: 'entitlement - the caller may start this activity; refuses an ungated issue',
+    pickActivityInstance: "entitlement - the instance waits for a role the caller holds",
+    deleteDraftActivityInstance:
+      'entitlement - the writer or a manager, drafts only, the state checked in the delete itself (ruling 2026-09-24)'
+  },
+  Subscription: {
+    /* Each filter compares the event's domain first, then the person - test/subscription-filters.test.ts. */
+    activityThread: 'events of threads assigned to the caller, in this domain',
+    activityApproval: 'events of approvals waiting for the caller, in this domain',
+    activityInstance: "events of instances the caller made or whose role the caller holds, in this domain"
+  }
+}
+
+/**
+ * Open and read in the body: one case by id. The thread screen and the approval screen open a case for
+ * the people working on it, who mostly hold no management privilege, so the body decides - the domain
+ * first, then the case's participants, else a named refusal (controllers/activity-read). Ruled
+ * 2026-09-24.
+ */
+const READ_IN_THE_BODY: Record<Root, Record<string, string>> = {
+  Query: {
+    activityInstance:
+      'assert-may-read - participants of the instance, or the activity-instance query privilege. Asked the privilege until 2026-09-24, which kept OPERATOR from reopening a draft of their own',
+    activityThread: 'assert-may-read - participants of the thread, or the activity-instance query privilege',
+    activityApproval: 'assert-may-read - read through its thread, the same people'
+  },
+  Mutation: {},
+  Subscription: {}
+}
+
+/**
+ * Closed doors, by name, so that reopening one is a visible act. All were open until 2026-09-24,
+ * reachable by anyone signed in to the domain.
+ *
+ *   deleteActivities       deleteActivity beside it already asked the activity privilege
+ *   the six template writes definition writes asked a privilege; the templates they come from did not
+ *   activityThreads        every thread of the domain, while activityInstances asked a privilege
+ *   activityApprovals      every approval of the domain, likewise
+ */
+const CLOSED: Record<Root, string[]> = {
+  Query: ['activityThreads', 'activityApprovals'],
+  Mutation: [
+    'deleteActivities',
+    'createActivityTemplate',
+    'updateActivityTemplate',
+    'updateMultipleActivityTemplate',
+    'deleteActivityTemplate',
+    'deleteActivityTemplates',
+    'importActivityTemplates'
+  ],
+  Subscription: []
+}
+
+/**
+ * Taken out of the schema on 2026-09-24 because nothing called them. A door that comes back under the
+ * same name comes back open, so it is listed here to fail loudly instead.
+ *
+ *   updateActivityThreadOutput   overwrote any thread's output in the domain
+ *   activityInstanceHistory(-ies) every instance history of the domain
+ */
+const REMOVED: Record<Root, string[]> = {
+  Query: ['activityInstanceHistory', 'activityInstanceHistories'],
+  Mutation: ['updateActivityThreadOutput'],
+  Subscription: []
+}
+
+/*
+ * worklist-client declares deleteActivities, createActivity and the rest under the same names. Those are
+ * empty bodies that write nothing (a remote call that was never written), not this door, and they are
+ * not in this package's schema.
+ */
+
+let schema: GraphQLSchema
+
+beforeAll(async () => {
+  schema = await buildSchema({
+    resolvers: declared.resolverClasses,
+    validate: false,
+    /* The subscriptions name their own subscribe; the walk only needs a pubSub to accept them. */
+    pubSub: { publish() {}, subscribe() {} } as any
+  })
+
+  privilegeDirectiveResolver(schema)
+})
+
+function rootType(typeName: Root) {
+  return typeName === 'Query'
+    ? schema.getQueryType()
+    : typeName === 'Mutation'
+      ? schema.getMutationType()
+      : schema.getSubscriptionType()
+}
+
+function openFields(typeName: Root): string[] {
+  return Object.keys(rootType(typeName)?.getFields() || {}).filter(field => {
+    const declaredGate = privilegeOfField(typeName, field)
+
+    return declaredGate.known && declaredGate['gate'] === null
+  })
+}
+
+describe('every open door has a written reason', () => {
+  it.each(['Query', 'Mutation', 'Subscription'] as const)('%s', typeName => {
+    const listed = [...Object.keys(OPEN_BY_DECISION[typeName]), ...Object.keys(READ_IN_THE_BODY[typeName])]
+
+    expect(openFields(typeName).sort()).toEqual(listed.sort())
+  })
+
+  it('no door is on both lists', () => {
+    for (const typeName of ['Query', 'Mutation', 'Subscription'] as const) {
+      const both = Object.keys(OPEN_BY_DECISION[typeName]).filter(name => name in READ_IN_THE_BODY[typeName])
+
+      expect(both).toEqual([])
+    }
+  })
+})
+
+describe('the doors that were closed', () => {
+  const closed = Object.entries(CLOSED).flatMap(([typeName, fields]) => fields.map(field => [typeName, field]))
+
+  it.each(closed)('%s.%s', (typeName, field) => {
+    const declaredGate = privilegeOfField(typeName, field)
+
+    expect(declaredGate.known).toBe(true)
+    expect(declaredGate['gate']).not.toBeNull()
+  })
+})
+
+describe('the doors that were taken out', () => {
+  const removed = Object.entries(REMOVED).flatMap(([typeName, fields]) => fields.map(field => [typeName, field]))
+
+  it.each(removed)('%s.%s is not in the schema', (typeName, field) => {
+    expect(Object.keys(rootType(typeName as Root)?.getFields() || {})).not.toContain(field)
+  })
+})
+
+describe('a case read under its parent still rides on the parent', () => {
+  /*
+   * dataset's four screens (data-ooc, data-sample) read activityInstance { activityThreads {
+   * activityApprovals } } under their own records. Closing the root lists must not close this path:
+   * these are field resolvers, reached only through a parent the caller could already read.
+   */
+  it.each([
+    ['ActivityInstance', 'activityThreads'],
+    ['ActivityThread', 'activityApprovals']
+  ])('%s.%s is still a field', (typeName, field) => {
+    const type = schema.getType(typeName) as any
+
+    /*
+     * Only that the field is there. A @privilege on a field resolver does not reach the schema at all
+     * (measured 2026-09-24: no AST node, not in the privilege table), so a gate cannot close this path -
+     * only its body can. tests/may-read-case.test.ts calls the two bodies as a stranger and expects rows.
+     */
+    expect(type?.getFields?.()[field]).toBeDefined()
+  })
+})
+
+describe('what the walk itself has to be true for', () => {
+  it('reaches the whole schema, not a handful of fields', () => {
+    /* If the resolver list shrank to nothing, the lists above would pass by having nothing to look at. */
+    expect(Object.keys(schema.getQueryType()?.getFields() || {}).length).toBeGreaterThan(25)
+    expect(Object.keys(schema.getMutationType()?.getFields() || {}).length).toBeGreaterThan(35)
+    expect(Object.keys(schema.getSubscriptionType()?.getFields() || {}).length).toBe(3)
+  })
+
+  it('tells an undeclared field from one the schema does not have', () => {
+    expect(privilegeOfField('Query', 'noSuchField')).toEqual({ known: false })
+  })
+
+  it('the census, in plain numbers', () => {
+    /* 2026-09-24 after the rulings: 34 open by reason, 3 read in the body, 9 closed, 3 removed. */
+    const count = (lists: Record<Root, Record<string, string>>) =>
+      Object.keys(lists.Query).length + Object.keys(lists.Mutation).length
+
+    expect(count(OPEN_BY_DECISION)).toBe(34)
+    expect(count(READ_IN_THE_BODY)).toBe(3)
+    expect(CLOSED.Query.length + CLOSED.Mutation.length).toBe(9)
+    expect(REMOVED.Query.length + REMOVED.Mutation.length).toBe(3)
+  })
+})

package/tests/published-shape.test.ts

@@ -0,0 +1,85 @@
+import { join } from 'path'
+
+import { EventSubscriber } from 'typeorm'
+
+/**
+ * What the three subscriptions filter on is really on the entity they are handed.
+ *
+ * Each subscriber publishes `event.entity`, and the filters (subscription-filters.ts) read its
+ * @RelationId fields - domainId first, then the person. If TypeORM left those empty on a new row,
+ * every new thread, approval and instance would be dropped without a sound, and the filter tests
+ * would still be green. Measured here with the real entities on sqlite, on insert and on update.
+ *
+ * Saved the way the controllers save: with the relation objects, not the ids.
+ */
+
+const { createSqliteTestDataSource } = require(join(__dirname, '..', '..', 'ops-master', 'test', 'support', 'database.cjs'))
+const DIST = join(__dirname, '..', 'dist-server', 'service')
+const { ActivityApproval } = require(join(DIST, 'activity-approval', 'activity-approval.js'))
+const { ActivityThread } = require(join(DIST, 'activity-thread', 'activity-thread.js'))
+const { ActivityInstance } = require(join(DIST, 'activity-instance', 'activity-instance.js'))
+const { Domain } = require('@things-factory/shell')
+const { Role, User } = require('@things-factory/auth-base')
+
+const seen: { on: string; name: string; entity: any }[] = []
+
+class HandedToSubscribers {
+  afterInsert(event: any) {
+    event.entity && seen.push({ on: 'insert', name: event.metadata.name, entity: { ...event.entity } })
+  }
+  afterUpdate(event: any) {
+    event.entity && seen.push({ on: 'update', name: event.metadata.name, entity: { ...event.entity } })
+  }
+}
+EventSubscriber()(HandedToSubscribers)
+
+let db: any
+let domain: any
+let user: any
+let role: any
+
+beforeAll(async () => {
+  db = createSqliteTestDataSource([ActivityApproval, ActivityThread, ActivityInstance], { subscribers: [HandedToSubscribers] })
+  await db.initialize()
+
+  domain = await db.getRepository(Domain).save({ name: 'd', subdomain: 'd' })
+  user = await db.getRepository(User).save({ name: 'u', email: 'u@example.com', password: 'x', domains: [domain] })
+  role = await db.getRepository(Role).save({ name: 'r', domain })
+})
+
+afterAll(async () => db?.destroy())
+
+beforeEach(() => (seen.length = 0))
+
+const handed = (name: string, on: string) => seen.find(one => one.name === name && one.on === on)?.entity
+
+it('a new instance carries its domain, its maker and the role it waits for', async () => {
+  await db.getRepository(ActivityInstance).save({ domain, name: 'i', creator: user, assigneeRole: role, state: 'issued' })
+
+  expect(handed('ActivityInstance', 'insert')).toMatchObject({ domainId: domain.id, creatorId: user.id, assigneeRoleId: role.id })
+})
+
+it('a new thread carries its domain and its assignee', async () => {
+  await db.getRepository(ActivityThread).save({ domain, name: 't', round: 1, assignee: user, state: 'assigned' })
+
+  expect(handed('ActivityThread', 'insert')).toMatchObject({ domainId: domain.id, assigneeId: user.id })
+})
+
+it('a new approval carries its domain and its approver; so does an update of a loaded one', async () => {
+  const thread = await db.getRepository(ActivityThread).save({ domain, name: 't2', round: 1, state: 'started' })
+  const saved = await db.getRepository(ActivityApproval).save({
+    domain,
+    activityThread: thread,
+    approver: user,
+    order: 1,
+    round: 1,
+    judgment: 'pending'
+  })
+
+  expect(handed('ActivityApproval', 'insert')).toMatchObject({ domainId: domain.id, approverId: user.id })
+
+  const loaded = await db.getRepository(ActivityApproval).findOne({ where: { id: saved.id } })
+  await db.getRepository(ActivityApproval).save({ ...loaded, judgment: 'approved' })
+
+  expect(handed('ActivityApproval', 'update')).toMatchObject({ domainId: domain.id, approverId: user.id })
+})

package/tests/work-door-not-used-refuse.test.ts

@@ -0,0 +1,110 @@
+import { readFileSync } from 'fs'
+import { join } from 'path'
+
+/**
+ * A door that refuses on an empty approval line cannot be declared unused (ADR-0077 decision 3).
+ *
+ * "We do not use this door" means the work runs with no approval step. `whenNoLine: 'refuse'` means the
+ * work cannot stand without one. Accepted together, the door screen shows the door as off while the
+ * product still demands approval - and a product that honoured it would scrap, release a hold or lower
+ * a control unapproved.
+ *
+ * Both sides of the axis are walked through the real resolver on sqlite, inside a real transaction:
+ * the refusing doors are refused and write nothing, the `run` / `as-established` / assignment doors are
+ * accepted as before.
+ */
+
+const { createSqliteTestDataSource } = require(join(__dirname, '..', '..', 'ops-master', 'test', 'support', 'database.cjs'))
+const DIST = join(__dirname, '..', 'dist-server', 'service', 'work-door')
+const { WorkDoorResolver } = require(join(DIST, 'work-door-resolver.js'))
+const { WorkDoorNotUsed } = require(join(DIST, 'work-door-not-used.js'))
+const { WorkDoorJournal } = require(join(DIST, 'work-door-journal.js'))
+const { registerWorkDoors, whyNotUsedCannotBeDeclared } = require(join(DIST, 'work-door-declaration.js'))
+const { Activity } = require(join(__dirname, '..', 'dist-server', 'service', 'activity', 'activity.js'))
+const { Domain, addDataSource, removeDataSource } = require('@things-factory/shell')
+const { User } = require('@things-factory/auth-base')
+
+const REFUSING = [
+  { name: 'Scrap', labelKey: 'x', kind: 'approval', whenNoLine: 'refuse', because: 'irreversible' },
+  { name: 'Release', labelKey: 'x', kind: 'approval', whenNoLine: 'refuse', because: 'approval-is-the-act' },
+  { name: 'Defer', labelKey: 'x', kind: 'approval', whenNoLine: 'refuse', because: 'lowers-a-control' }
+]
+const ACCEPTED = [
+  { name: 'Priority', labelKey: 'x', kind: 'approval', whenNoLine: 'run' },
+  { name: 'Withdraw', labelKey: 'x', kind: 'approval', whenNoLine: 'as-established', because: 'approval-is-the-act' },
+  { name: 'Dispatch', labelKey: 'x', kind: 'assignment' }
+]
+
+let db: any
+let domain: any
+let user: any
+
+beforeAll(async () => {
+  registerWorkDoors({ module: 'not-used-test', doors: [...REFUSING, ...ACCEPTED] as any })
+
+  db = createSqliteTestDataSource([Activity, WorkDoorNotUsed, WorkDoorJournal])
+  await db.initialize()
+  /* After saving, the resolver answers the whole door list, and that read goes through the default source. */
+  addDataSource('default', db)
+
+  domain = await db.getRepository(Domain).save({ name: 'd', subdomain: 'd' })
+  user = await db.getRepository(User).save({ name: 'u', email: 'u@example.com', password: 'x', domains: [domain] })
+})
+
+afterAll(async () => {
+  removeDataSource('default')
+  await db?.destroy()
+})
+
+const declare = (doorName: string) =>
+  db.transaction((tx: any) =>
+    new WorkDoorResolver().declareWorkDoorNotUsed(doorName, 'we do not do this here', {
+      state: { domain, user, tx },
+      t: (key: string) => key
+    } as any)
+  )
+
+const declared = (doorName: string) => db.getRepository(WorkDoorNotUsed).count({ where: { doorName } })
+
+describe('the judgement', () => {
+  it('★ a refusing door answers its reason; the others answer nothing', () => {
+    expect(REFUSING.map(door => whyNotUsedCannotBeDeclared(door as any))).toEqual([
+      'irreversible',
+      'approval-is-the-act',
+      'lowers-a-control'
+    ])
+    expect(ACCEPTED.map(door => whyNotUsedCannotBeDeclared(door as any))).toEqual([undefined, undefined, undefined])
+  })
+})
+
+describe('declaring a door unused, through the resolver', () => {
+  it.each(REFUSING.map(door => [door.name, door.because]))(
+    '★ %s refuses on an empty line, so it cannot be turned off — the refusal names the reason (%s)',
+    async (name, because) => {
+      await expect(declare(name as string)).rejects.toMatchObject({ code: `work-door-not-used-refused-${because}` })
+      expect(await declared(name as string)).toBe(0)
+    }
+  )
+
+  it.each(ACCEPTED.map(door => [door.name, door.whenNoLine ?? 'assignment']))(
+    '%s (%s) is accepted as before',
+    async name => {
+      await declare(name as string)
+      expect(await declared(name as string)).toBe(1)
+    }
+  )
+})
+
+describe('every language says it', () => {
+  const languages = ['en', 'ko', 'ja', 'zh', 'ms']
+
+  it.each(languages)('★ %s has a sentence for each reason — a missing key prints the key', language => {
+    const words = JSON.parse(readFileSync(join(__dirname, '..', 'translations', `${language}.json`), 'utf-8'))
+
+    for (const door of REFUSING) {
+      const sentence = words[`error.work-door-not-used-refused-${door.because}`]
+
+      expect(sentence).toEqual(expect.stringContaining('{name}'))
+    }
+  })
+})

package/things-factory.config.js

@@ -9,6 +9,7 @@ export default {
     { tagname: 'todo-list-page', page: 'todo-list' },
     { tagname: 'done-list-calendar-page', page: 'done-list-calendar' },
     { tagname: 'activity-catalog-page', page: 'activity-catalog' },
+    { tagname: 'activity-detail-page', page: 'activity-detail' },
     { tagname: 'done-list-page', page: 'done-list' },
     { tagname: 'approval-pending-list-page', page: 'approval-pending-list' },
     { tagname: 'approval-done-list-page', page: 'approval-done-list' },

package/translations/en.json

@@ -1,7 +1,13 @@
 {
+  "button.try-again": "try again",
+  "button.discard-draft": "discard draft",
   "button.abort": "abort",
+  "button.activity-install": "use it here",
+  "button.activity-set-approval-line": "set the approval line",
+  "button.activity-uninstall": "stop using it",
   "button.approve": "approve",
   "button.assign": "assign",
+  "button.back-to-activity-catalog": "activity catalog",
   "button.buy": "buy",
   "button.copy": "copy",
   "button.delegate": "delegate",
@@ -24,13 +30,19 @@
   "error.activity-approval is already terminated": "this approval task ({activityApproval}) has already been terminated ({actual}).",
   "error.activity-approval is reference only": "you are a reference on this item, so you cannot approve or reject it. you can leave a comment.",
   "error.activity-approval not found": "this approval task ({activityApproval}) cannot be found.",
+  "error.activity-approval delegate to self": "the task is already yours; choose someone else to hand it to.",
+  "error.activity-approval delegate outside domain": "that person is not in this site, so the task cannot be handed to them.",
+  "error.activity-approval delegate to issuer": "the person who raised this cannot approve it, so it cannot be handed to them.",
   "error.activity-approval taken by someone else": "someone else handled this approval first. reload the list to see where it stands.",
   "error.activity-instance belongs to someone else": "{id} is someone else's draft. Only the person who wrote it, or someone who manages activity instances, may edit or issue it.",
   "error.activity-instance is addressed to another role": "{id} is assigned to another role. only someone with that role can pick it.",
   "error.activity-instance is already issued": "this task ({id}) has already been issued with the {state} status.",
   "error.activity-instance is already terminated": "this task ({id}) has already been terminated with the {state} status.",
   "error.activity-instance not found": "this task ({activityInstance}) cannot be found.",
+  "error.activity-instance not a draft any more": "this draft has already gone out, so it cannot be thrown away.",
   "error.activity-instance should not be assigned": "this task ({id}) is already in {actual} status and cannot be assigned.",
+  "error.activity-case not a participant": "you do not take part in this case, so it cannot be opened here.",
+  "error.activity-instance unknown state": "{state} is not a state a task can be in. available: {known}",
   "error.activity-thread is already terminated": "this task thread ({id}) has already been terminated with the {state} status.",
   "error.activity-thread not found": "this task thread ({activityThread}) cannot be found.",
   "error.activity-thread rejection is final": "this case cannot be reopened — a rejection closes it for good. raise a new one instead.",
@@ -42,6 +54,9 @@
   "error.approval line names a role that nobody holds": "{seats}: nobody holds the role named for that step. add someone to that role.",
   "error.not authorized to handle this task": "you are not authorized to perform this task.",
   "error.work-door-not-used-reason-missing": "enter why this task is not used.",
+  "error.work-door-not-used-refused-irreversible": "\"{name}\" cannot be turned off. what it does cannot be undone, so it only runs through approval. set its approval line instead.",
+  "error.work-door-not-used-refused-approval-is-the-act": "\"{name}\" cannot be turned off. its approval is the work itself. set its approval line instead.",
+  "error.work-door-not-used-refused-lowers-a-control": "\"{name}\" cannot be turned off. it lowers a control that stands, so it only runs through approval. set its approval line instead.",
   "error.work-door-unknown": "unknown task \"{name}\". use a task name from the status screen.",
   "field.activity-type": "activity type",
   "field.approval-changed-at": "last change",
@@ -126,9 +141,11 @@
   "field.wl-submitted-at": "submitted",
   "field.wl-terminated-at": "finished",
   "field.wl-view-source": "view source",
+  "label.activity-approval-line": "approval line",
   "label.activity-build-info": "build info",
   "label.activity-input": "task content",
   "label.activity-instance": "activity instance",
+  "label.activity-panels": "more settings",
   "label.activity-starting-type-issue": "issue",
   "label.activity-starting-type-post": "post",
   "label.activity-state-aborted": "aborted",
@@ -164,6 +181,8 @@
   "label.activity-transaction-save": "save",
   "label.activity-transaction-start": "start",
   "label.activity-transaction-submit": "submit",
+  "label.activity-use-here": "use here",
+  "label.activity-what-is-it": "what this is",
   "label.approval-info": "approval info",
   "label.approval-noted": "noted",
   "label.approval-round-n": "resubmitted, round {n}",
@@ -205,14 +224,23 @@
   "label.what-it-was-judged-from": "what it was judged from",
   "label.yes": "yes",
   "menu.work-doors": "approval and assignment forms",
+  "text.discard-draft-confirm": "discard this draft?",
+  "text.discard-draft-for-good": "a discarded draft cannot be brought back.",
+  "text.draft-discarded": "the draft was discarded.",
   "text.activity-activated": "{name} is now on for this domain.",
   "text.activity-change-failed": "{name} was not changed: {why}",
   "text.activity-change-not-allowed": "you are not allowed to change {name}. ask an administrator for the activity privilege.",
   "text.activity-deactivated": "{name} is off. this work will no longer be raised.",
   "text.activity-draft-how": "enter a title and description, then choose save draft to open the editor.",
-  "text.activity-draft-where": "drafts are in the drafts list and can be edited until you {action}.",
+  "text.activity-draft-where": "drafts are in the “raised by me” list and can be edited until you {action}.",
   "text.activity-guide-unwritten": "an explanation of this work has not been written yet.",
   "text.activity-in-use-here": "in use",
+  "text.activity-line-none": "no approval line",
+  "text.activity-line-not-built": "this activity is not built yet, so it cannot have an approval line",
+  "text.activity-line-not-installed": "use it here first, then the approval line can be set",
+  "text.activity-line-steps": "{steps} approval steps",
+  "text.activity-no-panels": "this app has no more settings for an activity",
+  "text.activity-not-found": "that activity cannot be found ({name})",
   "text.activity-not-in-use-here": "not in use",
   "text.activity_instance_aborted_successfully": "activity instance aborted successfully",
   "text.and-n-more": "{n} more",
@@ -323,12 +351,13 @@
   "title.activity template model item list": "activity template model item list",
   "title.activity thread": "activity thread",
   "title.activity thread list": "tasks",
+  "title.activity-detail": "activity",
   "title.activity-stats list": "task statistics",
   "title.approval done list": "approval done list",
   "title.approval pending list": "my approval inbox",
   "title.assigned list": "assigned list",
   "title.done list": "done",
-  "title.draft list": "drafts",
+  "title.draft list": "raised by me",
   "title.edit duration": "edit duration",
   "title.import activity-approval": "import approvals",
   "title.import activity-stats": "import task statistics",
@@ -342,4 +371,4 @@
   "title.work-doors": "approval and assignment forms in this plant",
   "title.work-doors-next": "What to do next",
   "title.worklist dashboard": "worklist dashboard"
-}
+}