toolroll 0.9.7 → 0.9.8

package/dist/retention.js

@@ -1,9 +1,10 @@
 /**
  * Retention (v105): how long Toolroll keeps run evidence and logs,
- * finished checkouts' records, chat messages and notifications. Each kind
- * keeps everything ("forever") until an instance operator chooses a period;
- * a daily sweep then deletes what is older than it and writes one action
- * ledger entry saying what went and about how much space it freed.
+ * finished checkouts' records, chat messages and notifications. Until an
+ * instance operator chooses a period, evidence is kept 28 days and every
+ * other kind forever; a daily sweep deletes what is older than its period
+ * and writes one action ledger entry saying what went and about how much
+ * space it freed.
  *
  * Never deleted, whatever the settings: the action ledger (it is append-only),
  * and anything a task still needs. A task still needs its things until it is
@@ -21,24 +22,47 @@ import { join } from "node:path";
 import { RETENTION_NOTE } from "./evidence.js";
 import { COMPLETION_ACTION } from "./result-completion.js";
 import { bytesWords, treeBytes } from "./storage.js";
-export const RETENTION_SCHEMA = `
-CREATE TABLE IF NOT EXISTS retention_setting (
+const RETENTION_TABLE = (name) => `
+CREATE TABLE IF NOT EXISTS ${name} (
   kind       TEXT PRIMARY KEY CHECK (kind IN ('evidence', 'checkouts', 'chat', 'notifications')),
   -- NULL is forever; a row only exists once someone chose.
-  days       INTEGER CHECK (days IS NULL OR (days >= 7 AND days <= 3650)),
+  days       INTEGER CHECK (days IS NULL OR (days >= 1 AND days <= 3650)),
   updated_by TEXT NOT NULL,
   updated_at TEXT NOT NULL
 );
 `;
+export const RETENTION_SCHEMA = RETENTION_TABLE("retention_setting");
+/** A file from before 1-day evidence keeps `days >= 7` in its CHECK: rebuild the table with the wider one, keeping
+ * every row, in one transaction. A file already widened is untouched. */
+export function widenRetentionSchema(db) {
+    const row = db.prepare("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'retention_setting'").get();
+    if (row === undefined || !/days\s*>=\s*7\b/.test(String(row["sql"])))
+        return;
+    db.exec("BEGIN IMMEDIATE");
+    try {
+        db.exec(RETENTION_TABLE("retention_setting_next"));
+        db.exec("INSERT INTO retention_setting_next (kind, days, updated_by, updated_at) SELECT kind, days, updated_by, updated_at FROM retention_setting");
+        db.exec("DROP TABLE retention_setting");
+        db.exec("ALTER TABLE retention_setting_next RENAME TO retention_setting");
+        db.exec("COMMIT");
+    }
+    catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+    }
+}
 export const RETENTION_KINDS = [
     { kind: "evidence", label: "Run evidence and logs", detail: "Diffs, check logs, screenshots and reports saved for each run" },
     { kind: "checkouts", label: "Finished checkout records", detail: "Records of build checkouts that were let go and are no longer on disk" },
     { kind: "chat", label: "Chat messages", detail: "Messages in lead and team chats" },
     { kind: "notifications", label: "Notifications", detail: "Delivered or dismissed notifications" },
 ];
-/** The periods the page offers; the command line takes any number of days from 7 to 3650. */
-export const PERIOD_CHOICES = [30, 90, 180, 365, 730, null];
-export const MIN_DAYS = 7;
+/** The periods the page offers for each kind; the command line takes any number of days from 1 to 3650. */
+const LONG_CHOICES = [30, 90, 180, 365, 730, null];
+export const PERIOD_CHOICES = {
+    evidence: [1, 7, 14, 28, null], checkouts: LONG_CHOICES, chat: LONG_CHOICES, notifications: LONG_CHOICES,
+};
+export const MIN_DAYS = 1;
 export const MAX_DAYS = 3650;
 const DAY_MS = 86_400_000;
 /** A sweep is due once a day. */
@@ -46,7 +70,8 @@ export const SWEEP_EVERY_MS = DAY_MS;
 /** At most this many runs, messages, notifications or records go per kind per sweep; the next sweep takes the rest. */
 export const SWEEP_BATCH = 2000;
 const SWEEP_CURSOR = "retention:last-sweep";
-export const FOREVER = { evidence: null, checkouts: null, chat: null, notifications: null };
+/** What each kind keeps until someone chooses: evidence 28 days, everything else forever. */
+export const DEFAULT_PERIODS = { evidence: 28, checkouts: null, chat: null, notifications: null };
 export function isRetentionKind(value) {
     return RETENTION_KINDS.some(one => one.kind === value);
 }
@@ -67,7 +92,20 @@ export function periodWords(days) {
         return "forever";
     if (days % 365 === 0)
         return days === 365 ? "1 year" : `${days / 365} years`;
-    return `${days} days`;
+    return days === 1 ? "1 day" : `${days} days`;
+}
+/** What the page offers for `kind`, with `current` among them (in order) when it was set some other way. */
+export function periodChoices(kind, current) {
+    const offered = PERIOD_CHOICES[kind];
+    return offered.includes(current) ? offered : [...offered, current].sort((a, b) => (a ?? Infinity) - (b ?? Infinity));
+}
+/** A period as the page and `retention show` say it: "28 days (default)" when nobody chose, "30 days (custom)" when it's not one the page offers. */
+export function periodLabel(kind, days, chosen) {
+    const words = periodWords(days);
+    const label = `${words[0].toUpperCase()}${words.slice(1)}`;
+    if (!chosen)
+        return `${label} (default)`;
+    return PERIOD_CHOICES[kind].includes(days) ? label : `${label} (custom)`;
 }
 /** Tasks that no longer need anything kept: cancelled, or done with their result marked complete; not on hold, not
  * running, not a release candidate, and no revision below it (at any depth) still unfinished — cancelled or completed,

package/dist/review-switch.d.ts

@@ -0,0 +1,41 @@
+/** The per-project automatic review switch and the one review each finished
+ * build gets (build-review.ts runs it): tables, and the read-only views every
+ * surface shows. No schema version bump. Kept free of heavy imports so the
+ * status readers can use it without an import cycle. */
+import type { Store } from "./store.js";
+export type FindingSeverity = "HIGH" | "MEDIUM" | "LOW";
+/** One automatic-review finding: how bad, where, and how it fails. */
+export type BuildFinding = {
+    severity: FindingSeverity;
+    file: string;
+    line: number;
+    scenario: string;
+};
+export declare const REVIEW_SCHEMA = "\n-- A project's explicit review switch. No row: on while the project is under a hands-off mode, off otherwise.\nCREATE TABLE IF NOT EXISTS review_switch (\n  repo        TEXT PRIMARY KEY,\n  enabled     INTEGER NOT NULL CHECK (enabled IN (0, 1)),\n  changed_by  TEXT NOT NULL,\n  changed_at  TEXT NOT NULL\n);\n-- One row per reviewed build run: pending until its one reviewer run settles it.\nCREATE TABLE IF NOT EXISTS build_review (\n  run           INTEGER PRIMARY KEY,\n  task_id       TEXT NOT NULL,\n  repo          TEXT NOT NULL,\n  state         TEXT NOT NULL CHECK (state IN ('pending', 'reviewed', 'not-reviewed')),\n  request       INTEGER,\n  reviewer_run  INTEGER,\n  findings_json TEXT,\n  reason        TEXT,\n  sent_back_as  TEXT,\n  queued_at     TEXT NOT NULL,\n  finished_at   TEXT\n);\nCREATE INDEX IF NOT EXISTS build_review_pending ON build_review (repo) WHERE state = 'pending';\nCREATE INDEX IF NOT EXISTS build_review_sent_back ON build_review (sent_back_as) WHERE sent_back_as IS NOT NULL;\n";
+export type ReviewSwitch = {
+    on: boolean;
+    source: "project" | "hands-off" | "default";
+    changedBy: string | null;
+    changedAt: string | null;
+};
+/** How the policy log words a switch state. */
+export declare function reviewSwitchWords(state: ReviewSwitch): string;
+export type BuildReviewView = {
+    run: number;
+    state: "pending" | "reviewed" | "not-reviewed";
+    reviewerRun: number | null;
+    /** Why it was not reviewed, in words. */
+    reason: string | null;
+    /** HIGH findings; they sent the task back when `sentBackAs` is set. */
+    high: BuildFinding[];
+    /** MEDIUM and LOW findings: suggested follow-ups, never blocking. */
+    followUps: BuildFinding[];
+    sentBackAs: string | null;
+    finishedAt: string | null;
+};
+export declare function buildReviewOf(store: Pick<Store, "handle">, runId: number): BuildReviewView | null;
+export declare const findingWords: (finding: BuildFinding) => string;
+/** The review's standing in one line, or null while nothing was asked. */
+export declare function buildReviewHeadline(view: BuildReviewView | null): string | null;
+/** Plain lines for `task show` and `assignment show`. */
+export declare function buildReviewLines(view: BuildReviewView | null): string[];

package/dist/review-switch.js

@@ -0,0 +1,88 @@
+export const REVIEW_SCHEMA = `
+-- A project's explicit review switch. No row: on while the project is under a hands-off mode, off otherwise.
+CREATE TABLE IF NOT EXISTS review_switch (
+  repo        TEXT PRIMARY KEY,
+  enabled     INTEGER NOT NULL CHECK (enabled IN (0, 1)),
+  changed_by  TEXT NOT NULL,
+  changed_at  TEXT NOT NULL
+);
+-- One row per reviewed build run: pending until its one reviewer run settles it.
+CREATE TABLE IF NOT EXISTS build_review (
+  run           INTEGER PRIMARY KEY,
+  task_id       TEXT NOT NULL,
+  repo          TEXT NOT NULL,
+  state         TEXT NOT NULL CHECK (state IN ('pending', 'reviewed', 'not-reviewed')),
+  request       INTEGER,
+  reviewer_run  INTEGER,
+  findings_json TEXT,
+  reason        TEXT,
+  sent_back_as  TEXT,
+  queued_at     TEXT NOT NULL,
+  finished_at   TEXT
+);
+CREATE INDEX IF NOT EXISTS build_review_pending ON build_review (repo) WHERE state = 'pending';
+CREATE INDEX IF NOT EXISTS build_review_sent_back ON build_review (sent_back_as) WHERE sent_back_as IS NOT NULL;
+`;
+/** How the policy log words a switch state. */
+export function reviewSwitchWords(state) {
+    return state.source === "project" ? (state.on ? "on" : "off") : state.on ? "on (hands-off default)" : "off (default)";
+}
+export function buildReviewOf(store, runId) {
+    let row;
+    // A deploy reads this with the candidate's code over the INSTALLED runtime's file, before this version's migration
+    // made the table: no table reads as no review.
+    try {
+        row = store.handle.prepare("SELECT * FROM build_review WHERE run = ?").get(runId);
+    }
+    catch (error) {
+        if (/no such table: build_review/.test(String(error)))
+            return null;
+        throw error;
+    }
+    if (row === undefined)
+        return null;
+    // The row was validated when it was written (parseBuildFindings).
+    let findings = [];
+    try {
+        const saved = row["findings_json"] === null ? null : JSON.parse(String(row["findings_json"]));
+        if (Array.isArray(saved?.findings))
+            findings = saved.findings;
+    }
+    catch { /* An unreadable saved row shows no findings; its state stays. */ }
+    return {
+        run: runId,
+        state: String(row["state"]),
+        reviewerRun: row["reviewer_run"] === null ? null : Number(row["reviewer_run"]),
+        reason: row["reason"] === null ? null : String(row["reason"]),
+        high: findings.filter(one => one.severity === "HIGH"),
+        followUps: findings.filter(one => one.severity !== "HIGH"),
+        sentBackAs: row["sent_back_as"] === null ? null : String(row["sent_back_as"]),
+        finishedAt: row["finished_at"] === null ? null : String(row["finished_at"]),
+    };
+}
+export const findingWords = (finding) => `${finding.severity} ${finding.file}:${finding.line} — ${finding.scenario}`;
+/** The review's standing in one line, or null while nothing was asked. */
+export function buildReviewHeadline(view) {
+    if (view === null)
+        return null;
+    if (view.state === "pending")
+        return "Reviewing — an automatic review is reading this result.";
+    if (view.state === "not-reviewed")
+        return `Not reviewed${view.reason === null ? "." : `: ${view.reason}`}`;
+    if (view.sentBackAs !== null)
+        return `Sent back as ${view.sentBackAs}: ${view.high.length} high finding${view.high.length === 1 ? "" : "s"}.`;
+    if (view.high.length > 0)
+        return `Reviewed: ${view.high.length} high finding${view.high.length === 1 ? "" : "s"} for you to decide.`;
+    return `Reviewed: no high findings${view.followUps.length === 0 ? "." : `; ${view.followUps.length} suggested follow-up${view.followUps.length === 1 ? "" : "s"}.`}`;
+}
+/** Plain lines for `task show` and `assignment show`. */
+export function buildReviewLines(view) {
+    const headline = buildReviewHeadline(view);
+    if (view === null || headline === null)
+        return [];
+    return [
+        `  review: ${headline}`,
+        ...view.high.map(one => `    ${findingWords(one)}`),
+        ...view.followUps.map(one => `    suggested follow-up: ${findingWords(one)}`),
+    ];
+}

package/dist/reviewer.d.ts

@@ -1,6 +1,8 @@
-/** Pure parser for retained historical review payloads. Model-review execution
- * is retired; this module cannot launch providers, create runs or retry work. */
+/** Pure parsers for review payloads: retained historical reviews, and the one
+ * automatic build review's findings (build-review.ts runs it). This module
+ * cannot launch providers, create runs or retry work. */
 import type { CriterionJudgementWord } from "./proof.js";
+import type { BuildFinding } from "./review-switch.js";
 /** The files the pass writes INTO the scratch directory for the agent —
  * the patch always; the rubric, re-serialized proof, check log, and
  * screenshots only when this run actually has one (v40) — a grandfathered
@@ -95,3 +97,23 @@ export declare function parseReview(raw: string, patchPaths: ReadonlySet<string>
     ok: false;
     problems: ReviewProblem[];
 };
+export type { BuildFinding, FindingSeverity } from "./review-switch.js";
+export declare const FINDING_LIMITS: {
+    readonly findings: 40;
+    readonly file: 300;
+    readonly scenario: 500;
+};
+/**
+ * The automatic build review's reply, strict and wholesale like parseReview:
+ * `{"version":1,"findings":[{"severity","file","line","scenario"}]}`. Any
+ * invalid finding refuses the whole reply — a review that did not answer
+ * what it was asked is "not reviewed", never a partial pass. Text is kept
+ * to one line so it can travel in a revision note and a terminal.
+ */
+export declare function parseBuildFindings(raw: string): {
+    ok: true;
+    findings: BuildFinding[];
+} | {
+    ok: false;
+    problem: string;
+};

package/dist/reviewer.js

@@ -1,5 +1,5 @@
 import { citesSuppliedProvenance } from "./review-context.js";
-import { REVIEW_OUTPUT_LIMITS } from "./structured-output.js";
+import { normalizeStructuredJson, REVIEW_OUTPUT_LIMITS } from "./structured-output.js";
 /** The files the pass writes INTO the scratch directory for the agent —
  * the patch always; the rubric, re-serialized proof, check log, and
  * screenshots only when this run actually has one (v40) — a grandfathered
@@ -200,3 +200,51 @@ export function parseReview(raw, patchPaths, approvedCriteriaIds = new Set(), pr
         return { ok: false, problems };
     return { ok: true, comments, criteria, ...(payload["learning"] === undefined ? {} : { learning: payload["learning"] }), ...(payload["learningAssessment"] === undefined ? {} : { learningAssessment: payload["learningAssessment"] }) };
 }
+export const FINDING_LIMITS = { findings: 40, file: REVIEW_OUTPUT_LIMITS.path, scenario: REVIEW_OUTPUT_LIMITS.note };
+/**
+ * The automatic build review's reply, strict and wholesale like parseReview:
+ * `{"version":1,"findings":[{"severity","file","line","scenario"}]}`. Any
+ * invalid finding refuses the whole reply — a review that did not answer
+ * what it was asked is "not reviewed", never a partial pass. Text is kept
+ * to one line so it can travel in a revision note and a terminal.
+ */
+export function parseBuildFindings(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(normalizeStructuredJson(raw).text);
+    }
+    catch {
+        return { ok: false, problem: "the reply is not JSON" };
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+        return { ok: false, problem: "the reply is not an object" };
+    const payload = parsed;
+    if (payload["version"] !== 1)
+        return { ok: false, problem: "version must be 1" };
+    const list = payload["findings"];
+    if (!Array.isArray(list))
+        return { ok: false, problem: "findings must be an array" };
+    if (list.length > FINDING_LIMITS.findings)
+        return { ok: false, problem: `at most ${FINDING_LIMITS.findings} findings` };
+    const findings = [];
+    const oneLine = (text) => text.replace(/[\u0000-\u001f\u007f-\u009f\u061c\u200e\u200f\u2028\u2029\u202a-\u202e\u2066-\u2069]+/g, " ").replace(/\s+/g, " ").trim();
+    for (const [index, one] of list.entries()) {
+        if (one === null || typeof one !== "object" || Array.isArray(one))
+            return { ok: false, problem: `finding ${index}: not an object` };
+        const finding = one;
+        const severity = finding["severity"];
+        if (severity !== "HIGH" && severity !== "MEDIUM" && severity !== "LOW")
+            return { ok: false, problem: `finding ${index}: severity must be HIGH, MEDIUM or LOW` };
+        const file = typeof finding["file"] === "string" ? oneLine(finding["file"]) : "";
+        if (file.length === 0 || file.length > FINDING_LIMITS.file)
+            return { ok: false, problem: `finding ${index}: file must be a path of 1..${FINDING_LIMITS.file} characters` };
+        const line = finding["line"];
+        if (typeof line !== "number" || !Number.isInteger(line) || line < 1)
+            return { ok: false, problem: `finding ${index}: line must be a positive whole number` };
+        const scenario = typeof finding["scenario"] === "string" ? oneLine(finding["scenario"]) : "";
+        if (scenario.length === 0 || scenario.length > FINDING_LIMITS.scenario)
+            return { ok: false, problem: `finding ${index}: scenario must be one sentence of 1..${FINDING_LIMITS.scenario} characters` };
+        findings.push({ severity, file, line, scenario });
+    }
+    return { ok: true, findings };
+}

package/dist/serve.js

@@ -229,11 +229,12 @@ import { checkoutPlan, cleanCheckouts, discardCheckout, previewDigest } from "./
 import { UPDATES_CSS, newerThan, updateStepsHtml, updatesHtml, updatesScript } from "./toolroll-update-ui.js";
 import { abandonRuntimeUpdate, launchRuntimeUpdate, markWhatsNewSeen, prepareRuntimeUpdate, requestRuntimeUpdateCancel, runningWorkWords, runtimeUpdateStatus, runtimeUpdateTerminal, currentRuntime } from "./toolroll-update.js";
 import { latestVersionNow } from "./releases.js";
-import { RETENTION_KINDS, lastSweepAt, parsePeriod, retentionPlan } from "./retention.js";
+import { RETENTION_KINDS, lastSweepAt, parsePeriod, periodChoices, retentionPlan } from "./retention.js";
 import { EXPORT_CSS, dataExportHtml } from "./export-ui.js";
 import { buildExport, exportZip } from "./export.js";
 import { PROJECT_DELETE_CSS, projectDeleteConfirmHtml, projectSettingsHtml } from "./project-delete-ui.js";
 import { parseProjectConcurrency, PROJECT_CONCURRENCY_DEFAULT, projectConcurrency, saveProjectConcurrency } from "./project-concurrency.js";
+import { buildReviewOf, findingWords } from "./review-switch.js";
 import { deleteProject, holdingsWords, projectHoldings, projectRunning } from "./project-delete.js";
 import { POLICY_CSS, policyHtml } from "./policy-ui.js";
 import { checkPolicy, parseList, policyParts } from "./policy.js";
@@ -3898,7 +3899,7 @@ export function createDecisionServer(options) {
         if (url.pathname === "/settings/retention") {
             if (who.via !== "cookie" || !store.isInstanceOperator(who.name))
                 return refuse(response, who, 403, "An instance operator sets retention.", "/settings");
-            const view = { periods: store.retentionPeriods(), next: retentionPlan(store, evidenceRoot, now).counts, lastSweep: lastSweepAt(store), csrf: who.session.csrf };
+            const view = { periods: store.retentionPeriods(), chosen: Object.keys(store.retentionChosen()), next: retentionPlan(store, evidenceRoot, now).counts, lastSweep: lastSweepAt(store), csrf: who.session.csrf };
             return sendScreen(response, 200, screen("Retention", `<p><a href="/settings">Settings</a></p><h1>Retention</h1>${retentionHtml(view, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") })}`, { chrome: chromeFor(project, "settings") }));
         }
         // Settings → Storage: what task checkouts use, cleaning up now (the preview behind the password), and when a
@@ -3933,6 +3934,7 @@ export function createDecisionServer(options) {
             const quick = liveQuickCommand(store, repo);
             const html = checkSettingsHtml({ repo, name: projectName(repo), csrf: who.session.csrf, canChange: who.role === "approver" && !store.isDemo(),
                 level: projectCheckLevel(store, repo).level, full: store.liveVerifyCommand(repo), quick, suggestion: quick === null ? suggestQuickCommand(repo) : null,
+                review: (({ on, source }) => ({ on, source }))(store.reviewSwitch(repo, clock())),
                 said: url.searchParams.get("said"), problem: url.searchParams.get("problem") });
             return sendScreen(response, 200, screen("Checks", `<p><a href="/projects">Projects</a></p><h1>Checks</h1>${html}`, { chrome: chromeFor(project, "projects") }));
         }
@@ -5187,7 +5189,7 @@ export function createDecisionServer(options) {
     const reviewFactsFor = (runId) => reviewFactsOf(store.reviewRetryStateOf(runId), runner => {
         const one = store.getRunner(runner)?.runner;
         return one !== undefined && runnerAlive(one, clock());
-    });
+    }, buildReviewOf(store, runId)?.state === "pending");
     /** Keep detailed receipt diagnostics; shared assignment reads own readiness. */
     function freshAssignment(assignment, receipt) {
         if (assignment === null)
@@ -7264,7 +7266,9 @@ export function createDecisionServer(options) {
             if (!authenticateApprover(store, who.name, body.get("password") ?? "").ok)
                 return back("problem", "Enter your Toolroll password to change retention.");
             const before = store.retentionPeriods();
-            const chosen = RETENTION_KINDS.map(({ kind }) => ({ kind, days: body.has(kind) ? parsePeriod(body.get(kind) ?? "") : before[kind] }));
+            // Only what the page offers (or the period already set): a hand-made value doesn't save.
+            const offered = (kind, days) => days !== undefined && periodChoices(kind, before[kind]).includes(days) ? days : undefined;
+            const chosen = RETENTION_KINDS.map(({ kind }) => ({ kind, days: body.has(kind) ? offered(kind, parsePeriod(body.get(kind) ?? "")) : before[kind] }));
             if (chosen.some(one => one.days === undefined))
                 return back("problem", "Choose a period for each kind of data.");
             const changed = chosen.filter(one => one.days !== before[one.kind]);
@@ -7354,6 +7358,12 @@ export function createDecisionServer(options) {
             if (!authenticateApprover(store, who.name, body.get("password") ?? "", repo).ok)
                 return back("problem", "Enter your Toolroll password to change checks.");
             const act = body.get("act");
+            // The automatic review switch: the policy log keeps before → after.
+            if (act === "review") {
+                const on = body.get("on") === "1";
+                store.setReviewSwitch(repo, on, who.name, now);
+                return back("said", on ? "Automatic review is on." : "Automatic review is off.");
+            }
             if (act === "level") {
                 const level = body.get("level");
                 if (!isCheckLevel(level))
@@ -11423,6 +11433,7 @@ export function createDecisionServer(options) {
             comments: store.liveDiffComments(run.id).filter(isRevisionFeedback),
             pastComments: store.allDiffComments(run.id).filter(one => one.reviewerRun === null && (one.consumedBy !== null || one.supersededBy !== null)),
             reviewerFindings: store.allDiffComments(run.id).filter(one => one.reviewerRun !== null),
+            automaticReview: buildReviewOf(store, run.id),
             revisions: store.revisionsFromRun(run.id).flatMap(one => {
                 const child = store.getTask(one.id);
                 if (child === null || !visible(store.lookupRef(one.id)?.repo ?? null))
@@ -22115,6 +22126,16 @@ function resultPanelParts(detail, o) {
     if (current == null)
         attention.push(...receipt.caveats.filter(caveat => !historicalAssessmentReason(caveat) && !attention.some(problem => problem.includes(caveat))));
     attention.push(...(handoff?.followUps ?? []).map(one => `Follow-up: ${one}`));
+    // The automatic review: a HIGH that did not send the work back, or a review
+    // that could not finish, is the person's to see. (Said once when the
+    // current assignment already carries it.)
+    const automatic = detail.automaticReview ?? null;
+    if (automatic !== null && automatic.sentBackAs === null) {
+        const reviewed = [...(automatic.state === "not-reviewed" ? [`Not reviewed: ${automatic.reason ?? "the automatic review did not finish"}.`] : []), ...automatic.high.map(one => `Review: ${findingWords(one)}`)];
+        for (const line of reviewed)
+            if (!attention.includes(line))
+                attention.push(line);
+    }
     // Publication risks stay in the open (repair 2026-09-14); the routine
     // publication fact lives with the build details below.
     // With the shared status, the pull request is its own quiet row (its reason under Details).
@@ -22189,6 +22210,10 @@ function resultPanelParts(detail, o) {
     ];
     if (agentAccount.length > 0)
         summaryParts.push(`<details class="result-notes" data-result-notes-agent><summary>What the agent reported</summary>${agentAccount.join("")}</details>`);
+    // MEDIUM and LOW never block: suggested follow-ups, on request.
+    if (automatic !== null && automatic.followUps.length > 0) {
+        summaryParts.push(`<details class="result-notes" data-review-followups="${automatic.followUps.length}"><summary>Suggested follow-ups · ${automatic.followUps.length}</summary><ul class="result-changes">${automatic.followUps.map(one => `<li><span class="badge">${one.severity === "MEDIUM" ? "Medium" : "Low"}</span> <span class="mono">${escape(`${one.file}:${one.line}`)}</span> ${escape(one.scenario)}</li>`).join("")}</ul></details>`);
+    }
     const evidenceSources = [
         ...(report !== null ? [report.ok ? `verified report${report.truncated ? " (shortened)" : ""}` : "report (unverifiable)"] : []),
         ...(patch !== null ? [patchOk ? `sealed diff${patch.truncated ? " (shortened)" : ""}` : "diff (unverifiable)"] : []),

package/dist/store.d.ts

@@ -15,6 +15,7 @@ import { type ProjectAccess } from "./project-access.js";
 import { type LedgerEntry } from "./action-ledger.js";
 import type { LimitReading, LimitWindow } from "./provider-limits.js";
 import { underCeiling, type OrgPolicy, type SavedPolicy } from "./policy.js";
+import { type ReviewSwitch } from "./review-switch.js";
 import { type Billing, type Budget, type BudgetAgent, type BudgetHold, type BudgetScope, type BudgetState, type SpendItem } from "./spend.js";
 import { type RetentionKind, type RetentionPeriods } from "./retention.js";
 import { type CheckoutCleanup } from "./storage.js";
@@ -2419,6 +2420,14 @@ export declare class Store {
     };
     /** v99: a policy change, as the ledger keeps it: what changed and from what to what. Nothing is kept when nothing changed. */
     private recordPolicy;
+    /** The project's automatic review switch: its explicit setting, else on
+     * while a hands-off mode is active on it, else off. */
+    reviewSwitch(repo: string, now: Date): ReviewSwitch;
+    /** Turn a project's automatic review on or off; the policy log keeps before → after. */
+    setReviewSwitch(repo: string, on: boolean, by: string, now: Date): {
+        before: ReviewSwitch;
+        after: ReviewSwitch;
+    };
     /** A project deleted (project-delete.ts): who, and what it held → how it went. Returns the entry's id. */
     recordProjectDeleted(by: string, repo: string, held: string, how: string, now: Date): number;
     recordAction(entry: Omit<LedgerEntry, "id" | "detail"> & {
@@ -5101,8 +5110,10 @@ export declare class Store {
         hardStop: boolean;
     }, by: string, now: Date): Budget;
     removeBudget(id: number, by: string, now: Date): boolean;
-    /** How long each kind of data is kept; null is forever (every kind, until someone chooses). */
+    /** How long each kind of data is kept; null is forever. A kind nobody chose keeps its default (evidence 28 days, the rest forever). */
     retentionPeriods(): RetentionPeriods;
+    /** The periods someone chose: only kinds with a saved row. */
+    retentionChosen(): Partial<RetentionPeriods>;
     /** Set how long one kind is kept (null: forever); the ledger keeps before → after. */
     setRetentionPeriod(kind: RetentionKind, days: number | null, by: string, now: Date): RetentionPeriods;
     /** Settings → Storage: when a finished task's clean checkout is removed (the default until someone chooses). */
@@ -7078,6 +7089,30 @@ export declare class Store {
         group: boolean;
     }): number;
     finishUnspawnedProcess(witness: number, now: Date): void;
+    /** The reconcile road for a pid-less witness a crash or a thrown spawn
+     * left behind: once its run has finished, no live child is tracked for it
+     * here, every other witness of the run has exited and none of the run's
+     * process groups is alive, it settles as never started, with a ledger
+     * entry. A sole pid-less witness has no group to prove gone and stays for
+     * `run settle`. Native witnesses keep their OS-only road. */
+    settleUnspawnedWitnesses(now: Date): number;
+    /** `run settle` (an approver's last resort): every witness of a finished
+     * run that cannot be proven either way is recorded settled under the
+     * approver's reason, in the ledger. Refuses while anything of the run is
+     * alive or could be checked only from another host. Never signals. */
+    settleRunWitnessesByApprover(args: {
+        runId: number;
+        by: string;
+        why: string;
+    }, now: Date): {
+        ok: true;
+        witnesses: number[];
+        repeated: boolean;
+    } | {
+        ok: false;
+        reason: "unknown-run" | "still-running" | "alive";
+        detail: string;
+    };
     recordRunProcess(runId: number, pid: number, now: Date, group?: boolean, witness?: number): void;
     /** The native OS object a witnessed spawn ran inside (v53) — recorded
      * with the spawn, before the target can execute. */