toolroll 0.9.103 → 0.9.105

package/dist/server/render-people.js

@@ -1,12 +1,8 @@
-/** Sign-in, sign-up, join and wrong-host pages: pages outside the shell, built from the kit (server/kit.ts outPage).
- * They carry no script and no session; every refusal names the field it is about. */
 import { BRAND_HTML, shell } from "./chrome.js";
 import { html, joinHtml, postForm, replaceMarkup } from "../html.js";
 import { btn, disclose, facts, notice, outField, outPage } from "./kit.js";
 import { projectName } from "../project.js";
 const ACCESS_WORDS = { approver: ["Can manage and approve", "Create, manage and approve work."], viewer: ["Can view", "Read work and results."] };
-/** The invite's front door: cookie-free, script-free, sensitive by shape. Rendered only for a LIVE token — everything
- * dead gets joinDeadPage. A live token's holder reads what it grants before choosing a name and a password. */
 export function joinFormPage(token, problem, name, terms = null) {
     const [access, accessLine] = terms === null ? [null, null] : ACCESS_WORDS[terms.role];
     const grants = terms === null ? "" : facts([
@@ -28,7 +24,6 @@ export function joinFormPage(token, problem, name, terms = null) {
         foot: "This link works once, for you. Joining creates your own account; whoever runs this Toolroll can change what it can do later.",
     }), { nav: false });
 }
-/** Unknown, expired, revoked, consumed, attempts spent: ONE page (D6). */
 export function joinDeadPage() {
     return shell("Join Toolroll", outPage({
         brand: BRAND_HTML, brandHref: "/login", title: "This invite link can't be used",
@@ -36,13 +31,6 @@ export function joinDeadPage() {
         body: html `<div class="k-acts">${btn("Sign in instead", { href: "/login" })}</div>`,
     }), { nav: false });
 }
-/**
- * v100: for someone signed in with the identity provider, every step-up
- * password field (autocomplete="current-password"; a secret like a bot token
- * is never one) becomes that sign-in: confirmed, when an explicit re-check
- * made on request awaits its one step-up (cockpit B2), or a link to be
- * checked again, then back here. An ordinary sign-in never confirms.
- */
 export function ssoStepUps(page, sso, returnTo) {
     const stepUp = (attributes) => /\btype="password"/.test(attributes) && /\bautocomplete="current-password"/.test(attributes);
     const swap = (attributes) => {
@@ -54,12 +42,6 @@ export function ssoStepUps(page, sso, returnTo) {
     const labelled = replaceMarkup(page, /<label>[^<]*<input\b([^>]*)>\s*<\/label>/g, (_whole, attributes) => stepUp(attributes) ? swap(attributes) : null);
     return replaceMarkup(labelled, /<input\b([^>]*)>/g, (_whole, attributes) => stepUp(attributes) ? swap(attributes) : null);
 }
-/**
- * Easy start: for a local owner who has no password yet, every step-up password field (type=password with
- * autocomplete="current-password", typed-only ones included) becomes "Set a password to do this." and the Set a
- * password link, carrying this page on: there is no password to type. A new password, a secret or a key field is
- * never one. The field's own label and hint go with it.
- */
 export function localOwnerStepUps(page, setHref) {
     const stepUp = (attributes) => /\btype="password"/.test(attributes) && /\bautocomplete="current-password"/.test(attributes);
     const instead = () => html `<p class="k-note" data-local-step-up>Set a password to do this. <a class="k-link" href="${setHref}">Set a password</a></p>`;
@@ -67,7 +49,6 @@ export function localOwnerStepUps(page, setHref) {
     const labelled = replaceMarkup(fields, /<label\b[^>]*>[^<]*(?:<span\b[^>]*>[^<]*<\/span>)?[^<]*<input\b([^>]*)>\s*<\/label>/g, (_whole, attributes) => stepUp(attributes) ? instead() : null);
     return replaceMarkup(labelled, /<input\b([^>]*)>/g, (_whole, attributes) => stepUp(attributes) ? instead() : null);
 }
-/** An expiry as a person reads it: "Thu 5 Nov, 10:42". */
 function expiryWords(iso) {
     const at = new Date(iso);
     if (Number.isNaN(at.getTime()))
@@ -80,7 +61,6 @@ export function loginPage(problem, returnTo = "/", sso = null) {
         outField({ id: "login-password", label: "Password", name: "token", type: "password", attrs: { autocomplete: "current-password" } }),
         btn("Sign in", { variant: sso === null ? "primary" : "outline", type: "submit", className: "k-wide" }),
     ]), { signedOut: true, returnTo: returnTo === "/" ? null : returnTo, attrs: { class: "k-form" } });
-    // v100: with an identity provider, its button comes first and passwords wait behind "Use a password".
     const body = sso === null
         ? joinHtml([problem === null ? "" : html `<div class="k-refusal">${notice(problem)}</div>`, form])
         : joinHtml([
@@ -90,17 +70,13 @@ export function loginPage(problem, returnTo = "/", sso = null) {
         ]);
     return shell("Sign in · Toolroll", outPage({
         brand: BRAND_HTML, brandHref: "/login", title: "Sign in", body,
-        foot: html `${sso === null ? html `Forgot it? Your first login was shown when Toolroll started, and saved beside its database in <code>.toolroll-secrets/up-login.txt</code> on the computer running it.<br>` : ""}No account? Ask whoever runs this Toolroll for an invite link.`,
+        foot: html `${sso === null ? html `Forgot it? Your first login was shown when Toolroll started, and saved beside its database in <code class="k-nowrap">.toolroll-secrets/up-login.txt</code> on the computer running it.<br>` : ""}No account? Ask whoever runs this Toolroll for an invite link.`,
     }), { nav: false });
 }
-/**
- * Easy-start C2: reconnect this tab after a restart (or when it lost its key): the password again for a full session, an
- * identity-provider sign-in for one that signs in there, or the terminal for a local owner (no password exists).
- */
 export function reconnectPage(problem, returnTo, how) {
     const back = returnTo === "/" ? null : returnTo;
     const body = how.kind === "command"
-        ? html `<p>Run <code>toolroll open</code> on this computer to reconnect.</p>`
+        ? html `<p>Run <code>toolroll --web</code> on this computer to reconnect.</p>`
         : how.kind === "sso"
             ? btn(`Sign in with ${how.label}`, { variant: "primary", href: `/login/sso${back === null ? "" : `?return=${encodeURIComponent(back)}`}`, className: "k-wide" })
             : postForm("/login/rekey", joinHtml([
@@ -113,11 +89,6 @@ export function reconnectPage(problem, returnTo, how) {
         foot: html `Toolroll restarted, so this tab needs a fresh connection before it can make changes.`,
     }), { nav: false });
 }
-/**
- * Easy-start C4: the local owner's first password. Two fields and one button; the form carries the session's CSRF token
- * (render it inside withFormToken) and, through the page's key fill, the browser key and the act that was refused, to continue there. Neither typed
- * password ever comes back on a refusal.
- */
 export function passwordSetPage(view) {
     const problem = view.problem;
     const error = (field) => problem !== null && problem.field === field ? problem.text : null;
@@ -136,7 +107,6 @@ export function passwordSetPage(view) {
             html `<div class="k-acts">${btn("Not now", { variant: "ghost", href: view.returnTo, className: "k-wide" })}</div>`]),
     }), { nav: false });
 }
-/** /password/set once a password exists (set earlier, or just now in another tab): sign in with it, and come back. */
 export function passwordAlreadySetPage(title, returnTo, signedIn = false) {
     return shell(`${title} · Toolroll`, outPage({
         brand: BRAND_HTML, brandHref: "/", title, sub: signedIn ? "You're signed in with it." : "Sign in with it to continue.",
@@ -144,11 +114,6 @@ export function passwordAlreadySetPage(title, returnTo, signedIn = false) {
             : btn("Sign in", { variant: "primary", href: returnTo === "/" ? "/login" : `/login?return=${encodeURIComponent(returnTo)}`, className: "k-wide" })}</div>`,
     }), { nav: false });
 }
-/**
- * The page for an address the console doesn't answer to (onboarding): what was opened, where it answers, and the exact
- * command that admits this address. It stands alone (styles inline, no script, no font), because every other asset
- * would be refused at this address too; and it holds nothing a stranger's page doesn't already know.
- */
 export function wrongHostPage(facts) {
     const code = (text) => html `<code>${text}</code>`;
     return html `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
@@ -173,18 +138,11 @@ ${facts.command === null ? "" : html `<p>To use this address, stop Toolroll (Ctr
 <p class="meta">On that computer, ${code(`http://${facts.served}/`)} always works. Other addresses need your say-so, so no other website can reach it.</p>
 </main></body></html>`;
 }
-/** The username rule, said once for the server's check, the input's `pattern` (anchored by the browser; `\-` so the
- * v-flag parse accepts it) and the hint. */
 export const SIGNUP_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
 const SIGNUP_NAME_PATTERN = "[A-Za-z0-9][A-Za-z0-9._\\-]{0,63}";
 export const SIGNUP_PASSWORD_MIN = 8;
-/** The first-account page (setup review): shown only while no approver exists. Rules are stated up front and match
- * the inputs' own constraints. On a refusal the typed username comes back; the setup code and the password never do.
- * The message sits under the field it is about, announced (role="alert"), with that field aria-invalid, described by
- * it and focused, so it works without script (this page has none). */
 export function signupPage(problem, attemptsLeft, typedName = "") {
     const open = attemptsLeft > 0;
-    // Out of tries, the page always says why and what to do, also when it is simply opened again.
     const said = typeof problem === "string" ? { field: null, text: problem }
         : problem ?? (open ? null : { field: null, text: "Too many wrong setup codes. Restart Toolroll to get a new code." });
     const field = open ? said?.field ?? null : null;
@@ -207,8 +165,6 @@ export function signupPage(problem, attemptsLeft, typedName = "") {
         foot: "Lost the code? Restart Toolroll and it prints a new one.",
     }), { nav: false });
 }
-/** The page a browser sees when answering broke (Wave E): what happened, whether anything changed, a reference for the
- * log, and two ways on. `read`: the request only read, so nothing can have changed. Holds no error text. */
 export function serverErrorPage(options) {
     if (options.updating) {
         return shell("Toolroll is updating", outPage({

package/dist/server/render-projects.js

@@ -1,8 +1,4 @@
-/**
- * Projects on the kit (src/design/KIT.md): the list's server parts (the add ways, the clone review), the project's
- * reading page, folder browse and the GitHub listing. Names, descriptions and paths are gh or filesystem data,
- * escaped at the sink like everything else (html.ts).
- */
+import { advancedShownNow } from "../advanced-view.js";
 import { ACTIVITY_ACTORS, activityAge, activityLimit, activityMetrics, activityScope } from "../project-activity.js";
 import {} from "../browser-workspace.js";
 import { html, htmlString, joinHtml, postForm } from "../html.js";
@@ -13,32 +9,25 @@ import { homedir } from "node:os";
 import { relativeAge, screen } from "./chrome.js";
 import { acts, approvalFactsNow, approvalTerms, approveForm, btn, chip, count, disclose, doc, docHeader, dock, empty, facts, field, group, infoLine, input, linkTabs, note, notice, pageHeader, phoneHeader, row, slots, status, } from "./kit.js";
 import {} from "./render-pages.js";
-/** A path as a person reads it: the home folder as ~. */
 export function shortPathOf(path) {
     const home = homedir();
     return path.startsWith(`${home}/`) ? `~${path.slice(home.length)}` : path;
 }
-/** A project's page address. Names are folder names, so two projects can share one: then the path picks. */
 export function projectHref(name, path, ambiguous, page = "") {
     return `/projects/${encodeURIComponent(name)}${page === "" ? "" : `/${page}`}${ambiguous ? `?path=${encodeURIComponent(path)}` : ""}`;
 }
-/** What a project's counts say on one line ("2 need you · 1 running"); null when it wasn't scanned. */
 export function peekWords(peek) {
     if (peek === null)
         return null;
     const words = [
-        peek.waiting > 0 ? `${peek.waiting} need${peek.waiting === 1 ? "s" : ""} you` : "",
         peek.running > 0 ? `${peek.running} running` : "",
         peek.queued > 0 ? `${peek.queued} queued` : "",
     ].filter(Boolean);
-    return words.length === 0 ? "Nothing waiting" : words.join(" · ");
+    return words.length === 0 ? peek.waiting > 0 ? "" : "Nothing waiting" : words.join(" · ");
 }
 const mono = (text) => html `<span class="k-mono">${text}</span>`;
 const sentence = (text) => text === "" ? text : `${text.charAt(0).toUpperCase()}${text.slice(1)}`;
-/** A refusal says what didn't change. */
 const refused = (text) => /nothing (changed|was)/i.test(text) ? sentence(text) : `${sentence(text).replace(/[.\s]+$/, "")}. Nothing changed.`;
-// ---- the list's server parts -------------------------------------------------------------------------------------
-/** The add ways, as the drawer (and the no-script page) shows them: GitHub, then this computer. */
 export function addWaysHtml(data) {
     const onboard = data.onboard;
     const github = onboard === null
@@ -58,22 +47,20 @@ export function addWaysHtml(data) {
                 ]), { attrs: { class: "k-sec" } }),
             ])}</section>`;
     const local = html `<section class="k-sec" aria-labelledby="add-local"><h3 id="add-local">From this computer</h3>${joinHtml([
-        data.browsable ? acts(btn("Choose a folder", { sm: true, href: "/projects/browse" })) : note(html `Choose a projects folder once with ${mono("toolroll up --project-root <dir>")}. Toolroll remembers it after that.`),
+        data.browsable ? acts(btn("Choose a folder", { sm: true, href: "/projects/browse" })) : note(html `Choose a projects folder once with <span class="k-mono k-nowrap">${"toolroll up --project-root <dir>"}</span>. Toolroll remembers it after that.`),
         postForm("/projects/open", joinHtml([
             field({ id: "add-path", label: "Or enter an exact path", hint: "It must be a git repository.",
                 control: input({ id: "add-path", name: "path", hint: true, attrs: { placeholder: "/Users/you/code/your-repo", autocomplete: "off", spellcheck: "false" } }) }),
-            acts(btn("Add and open", { sm: true, type: "submit" })),
+            acts(btn("Add and open", { sm: true, type: "submit", variant: "primary" })),
         ]), { attrs: { class: "k-sec" }, returnTo: data.returnTo }),
     ])}</section>`;
     return html `<div class="k-sec">${github ?? ""}${local}</div>`;
 }
-/** The clone review a preview minted (single use, ten minutes): what lands where, then the step-up. */
 export function cloneReviewHtml(onboard, problem) {
     if (onboard === null || !onboard.enabled || onboard.record === null)
         return null;
     const [nonce, record] = onboard.record;
     const kind = "step-up";
-    // The local owner has no password to type: the clone is its own act (add-project), proved by the session at confirm.
     const local = onboard.localOwner === true;
     const factsNow = local ? { ...approvalFactsNow(), passwordless: true } : approvalFactsNow();
     const size = record.diskUsageKib === null ? "Unknown" : `${Math.max(1, Math.round(record.diskUsageKib / 1024))} MiB`;
@@ -89,8 +76,6 @@ export function cloneReviewHtml(onboard, problem) {
         attrs: { "aria-label": `Clone ${record.nameWithOwner}` },
     })}${facts([["Repository", mono(`github.com/${record.nameWithOwner}`)], ["Size", size], ["Into", mono(shortPathOf(record.target))]])}`;
 }
-/** The projects list: the React view draws it from `workspace.view`; the body is the same page for a browser
- * without the workspace script (and what the sensitivity check reads). */
 export function projectsPage(chrome, data) {
     const choosing = data.returnTo.startsWith("/tasks/new");
     const names = new Map();
@@ -102,6 +87,7 @@ export function projectsPage(chrome, data) {
             name, path, shortPath: shortPathOf(path), href: projectHref(name, path, (names.get(name) ?? 0) > 1),
             open: data.open !== null && data.open === path, openedAt,
             status: peek === null ? null : peek.waiting > 0 ? "needs" : peek.running > 0 ? "running" : null,
+            waiting: peek?.waiting ?? 0,
             summary: peekWords(peek),
         };
     };
@@ -113,9 +99,8 @@ export function projectsPage(chrome, data) {
     const said = data.problemAt === "said" && data.problem !== null ? sentence(data.problem) : null;
     const topProblem = data.problem === null || said !== null || linkProblem !== null || reviewHasProblem ? null : data.problemAt === "clone" ? sentence(data.problem) : refused(data.problem);
     const addHtml = addWaysHtml({ browsable: data.browsable, onboard: data.onboard, returnTo: data.returnTo, linkProblem });
-    // Without the workspace script: the same rows, the add ways as a section.
     const rowHtml = (one) => row({
-        href: one.href, chip: one.status === null ? html `` : status(one.status), title: one.name, wait: one.status === "needs",
+        href: one.href, chip: one.status === null ? html `` : one.status === "needs" ? chip(waitingWords(one.waiting), "ask") : status(one.status), title: one.name, wait: one.status === "needs",
         desc: mono(one.shortPath), meta: html `<span>${one.summary ?? "Not scanned"}</span>${one.open ? html `<span>Open now</span>` : ""}`,
         action: one.open && !choosing ? btn("New task", { sm: true, href: "/tasks/new" })
             : postForm("/projects/open", btn(choosing ? "Choose" : "Open", { sm: true, type: "submit" }), { returnTo: data.returnTo, hidden: { path: one.path } }),
@@ -126,8 +111,8 @@ export function projectsPage(chrome, data) {
         topProblem === null ? null : notice(topProblem),
         said === null ? null : infoLine(said),
         review,
-        recent.length > 0 ? html `${group("Projects", count(recent.length))}${recent.map(rowHtml)}` : null,
-        available.length > 0 ? html `${group("Available", count(available.length))}${available.map(rowHtml)}` : null,
+        recent.length > 0 ? html `<section aria-label="Projects" data-project-list>${group("Projects", count(recent.length))}${recent.map(rowHtml)}</section>` : null,
+        available.length > 0 ? html `<section aria-label="Available" data-project-list>${group("Available", count(available.length))}${available.map(rowHtml)}</section>` : null,
         recent.length === 0 && available.length === 0 ? empty({ title: "No projects yet.", text: "A project is a git repository your agents work in." }) : null,
         html `<section class="k-doc" id="add-project" aria-label="Add a project">${addHtml}</section>`,
     ], "\n");
@@ -146,10 +131,8 @@ function activityHtml(report) {
     });
     return html `${note(activityScope(report))}${report.truncated ? note(activityLimit(report)) : ""}${activityMetrics(report).map(metric => disclose(`${metric.label} · ${metric.value}`, html `${note(metric.detail)}${metric.rows.length === 0 ? note("No tasks in this group.") : metric.rows.map(familyLine)}`))}`;
 }
-/** One project's reading page. Reads only: Open project posts to /projects/select, which switches this session. */
 export function projectPage(chrome, data) {
     const opened = data.open ? "Open now" : data.openedAt === null ? "Not opened here yet" : `Opened ${relativeAge(data.openedAt, data.now)}`;
-    // The one primary: in the header at a desk, in the dock on a phone (the dock's button submits the header's form).
     const primary = data.open
         ? btn("New task", { variant: "primary", lead: "plus", href: "/tasks/new", className: "k-desk-only" })
         : postForm("/projects/select", btn("Open project", { variant: "primary", type: "submit", className: "k-desk-only" }), { returnTo: data.selfHref, hidden: { path: data.path }, attrs: { id: "project-open" } });
@@ -177,8 +160,10 @@ export function projectPage(chrome, data) {
         ...(data.checks === null ? [] : [["Checks", html `<a class="k-link" href="${data.checks.href}">${data.checks.level}</a>`]]),
         ...(data.pullRequests === null ? [] : [["Pull requests", html `<a class="k-link" href="${data.pullRequests.href}">${data.pullRequests.on ? "On" : "Off"}</a>`]]),
         ["Knowledge", html `<a class="k-link" href="${data.knowledgeHref}">Open knowledge</a>`],
-        ["Code map", html `<a class="k-link" href="${`/projects/${encodeURIComponent(data.name)}/map${data.selfHref.includes("?") ? data.selfHref.slice(data.selfHref.indexOf("?")) : ""}`}">Open code map</a>`],
-        ["Flaky tests", html `<a class="k-link" href="${data.flakyHref}">Open flaky tests</a>`],
+        ...(advancedShownNow() ? [
+            ["Code map", html `<a class="k-link" href="${`/projects/${encodeURIComponent(data.name)}/map${data.selfHref.includes("?") ? data.selfHref.slice(data.selfHref.indexOf("?")) : ""}`}">Open code map</a>`],
+            ["Flaky tests", html `<a class="k-link" href="${data.flakyHref}">Open flaky tests</a>`],
+        ] : []),
     ]);
     const body = joinHtml([
         phoneHeader(data.name, { back: "/projects" }),
@@ -187,7 +172,6 @@ export function projectPage(chrome, data) {
     ], "\n");
     return screen(data.name, body, { chrome });
 }
-// ---- folder browse -----------------------------------------------------------------------------------------------
 export function browsePage(chrome, data) {
     const browseHref = (path) => `/projects/browse?at=${encodeURIComponent(path)}`;
     const here = data.at === data.root ? shortPathOf(data.root) : `${shortPathOf(data.root)}${data.at.slice(data.root.length)}`;
@@ -206,9 +190,6 @@ export function browsePage(chrome, data) {
     ], "\n");
     return screen("Choose a folder", body, { chrome });
 }
-// ---- the GitHub listing --------------------------------------------------------------------------------------------
-/** The account's repositories with ONE honest action each: open (already a project here), add and open (a clone
- * under a projects folder), or the existing preview-and-password clone ceremony. */
 export function githubReposPage(chrome, data) {
     const openForm = (path, label) => postForm("/projects/open", btn(label, { sm: true, type: "submit" }), { hidden: { path } });
     const cloneForm = (nameWithOwner) => postForm("/projects/onboard-preview", btn("Clone here", { sm: true, type: "submit" }), { hidden: { repo: nameWithOwner, root: "0" } });
@@ -247,5 +228,7 @@ export function githubReposPage(chrome, data) {
     ], "\n");
     return screen("Add from GitHub", body, { chrome });
 }
-/** A project name nobody can see answers the same as one that doesn't exist. */
 export const unknownProject = (name) => ({ title: `There is no project called ${name} here.`, text: "It may have been removed, or the link is for another Toolroll." });
+export function waitingWords(count) {
+    return `${count} waiting on you`;
+}

package/dist/server/render-release.js

@@ -1,9 +1,3 @@
-/**
- * The release approval sheet (docs/plans/trusted-release-reports.md, slice A, A7): one screen with what the person is
- * approving, GitHub CI now, what approving does, what changed and every term, then one Approve release button. The
- * page only shows: the approval POST (`/t/<id>/approve`, `sheet=release`) proves the person, the card and the scope
- * again (release-approval.ts approveReleaseCard).
- */
 import { html, joinHtml, postForm } from "../html.js";
 import { ciWords, releaseConsequence } from "../release-approval.js";
 import { checkAccessWords } from "../check-access.js";
@@ -11,7 +5,6 @@ import { projectName } from "../project.js";
 import { screen } from "./chrome.js";
 import { approvalTerms, approveForm, chip, disclose, doc, docHeader, facts, field, infoLine, input, note, notice, slots, btn } from "./kit.js";
 import { taskHref } from "./http.js";
-/** The change list, folded: every commit when it is whole, or why it isn't. */
 function changesHtml(card) {
     const changes = card.card.changes;
     const id = card.seal.identity;
@@ -24,7 +17,6 @@ function changesHtml(card) {
         : html `<ul class="k-list">${changes.commits.map(one => html `<li><code class="k-mono">${one.sha.slice(0, 7)}</code> ${one.subject}</li>`)}</ul>`;
     return disclose(`What changed: ${changes.commits.length} commit${changes.commits.length === 1 ? "" : "s"}`, html `<p class="k-note">${head}</p>${list}`);
 }
-/** Every signed term, before the button. */
 function termsHtml(card) {
     return disclose("Every term", facts(card.terms.map(line => [line.label, html `<span class="k-mono">${line.value}</span>`])), true);
 }
@@ -73,12 +65,7 @@ export function releaseSheetPage(chrome, data) {
         });
         terms = approvalTerms("standard", data.facts);
     }
-    // What, then what changed, then the one decision: its status, CI now, what approving does, every term, the button.
     const formShown = acts !== "" && data.nonce !== "" && card.approved === null && card.refusal === null && data.local === null;
-    const body = doc(docHeader({ title, back: [taskHref(card.taskId), "Task"], meta: `${projectName(id.repo)} · pull request #${id.pr}` }), 
-    // A refused approval says why first, above the card it now shows.
-    data.problem === null ? "" : notice(data.problem), summary, changesHtml(card), slots({ wait, attrs: { "data-release-sheet": card.taskId }, status, text, acts, terms }), notRunning, data.held == null ? "" : html `<section class="k-sec" data-release-held><h3>Held after its merge</h3><p class="k-note">${data.held}.</p>${postForm(`${taskHref(card.taskId)}/release/go-on`, html `${field({ id: "go-on-password", label: "Your password", control: input({ id: "go-on-password", name: "password", type: "password", attrs: { required: true, autocomplete: "current-password" } }) })}${btn("Let it go on", { variant: "primary", type: "submit" })}`, { attrs: { class: "k-form" } })}</section>`, 
-    // When the form isn't shown, the consequence and the terms are still on the page.
-    formShown ? "" : html `<section class="k-sec"><h3>What approving does</h3>${joinHtml(consequence.map(line => html `<p class="k-note">${line}</p>`))}</section>${termsHtml(card)}`);
+    const body = doc(docHeader({ title, back: [taskHref(card.taskId), "Task"], meta: `${projectName(id.repo)} · pull request #${id.pr}` }), data.problem === null ? "" : notice(data.problem), summary, changesHtml(card), slots({ wait, attrs: { "data-release-sheet": card.taskId }, status, text, acts, terms }), notRunning, data.held == null ? "" : html `<section class="k-sec" data-release-held><h3>Held after its merge</h3><p class="k-note">${data.held}.</p>${postForm(`${taskHref(card.taskId)}/release/go-on`, html `${field({ id: "go-on-password", label: "Your password", control: input({ id: "go-on-password", name: "password", type: "password", attrs: { required: true, autocomplete: "current-password" } }) })}${btn("Let it go on", { variant: "primary", type: "submit" })}`, { attrs: { class: "k-form" } })}</section>`, formShown ? "" : html `<section class="k-sec"><h3>What approving does</h3>${joinHtml(consequence.map(line => html `<p class="k-note">${line}</p>`))}</section>${termsHtml(card)}`);
     return screen(title, body, { chrome });
 }