toolroll 0.9.83 → 0.9.85

package/dist/models-ui.js

@@ -1,10 +1,10 @@
 /** Settings → Models: the CLIs on this computer, the default agent for each
  * role picked from live lists, and the models that just arrived. */
-import { html, postForm } from "./html.js";
+import { html, postForm, reauth } from "./html.js";
 import { priceWords } from "./model-catalog.js";
 import { whenUtc } from "./when-html.js";
 const when = (iso) => iso === null ? "never" : whenUtc(iso);
-export const MODELS_CSS = `.models{max-width:780px;min-width:0;overflow-wrap:anywhere}.models .card{padding:16px 20px;margin:12px 0;min-width:0}.models h2{margin:24px 0 8px}.models form{margin:0}.models label{display:grid;gap:6px}.models select,.models input[type=search]{box-sizing:border-box;width:100%;max-width:100%;min-width:0}.models button,.models summary,.models .button-link{min-height:44px}.models button{white-space:nowrap}.models summary{padding:12px 0;cursor:pointer}.models .tool{display:flex;gap:12px;align-items:center;justify-content:space-between;flex-wrap:wrap}.models .role{display:grid;grid-template-columns:minmax(0,1fr);gap:8px}.models .role-row{display:flex;gap:12px;align-items:end;flex-wrap:wrap}.models .role-row select{flex:1 1 240px;width:auto;min-width:0}.models .role-name{font-weight:600}.models .new{font-weight:600}.models ul{padding-left:20px}.models .meta{font-size:.86rem}@media(max-width:600px){.models .card{padding:14px}}`;
+export const MODELS_CSS = `.models{max-width:780px;min-width:0;overflow-wrap:anywhere}.models .card{padding:16px 20px;margin:12px 0;min-width:0}.models h2{margin:24px 0 8px}.models form{margin:0}.models label{display:grid;gap:6px}.models select,.models input[type=search]{box-sizing:border-box;width:100%;max-width:100%;min-width:0}.models button,.models summary,.models .button-link{min-height:44px}.models button{white-space:nowrap}.models summary{padding:12px 0;cursor:pointer}.models .tool{display:flex;gap:12px;align-items:center;justify-content:space-between;flex-wrap:wrap}.models .role{display:grid;grid-template-columns:minmax(0,1fr);gap:8px}.models .role-row{display:flex;gap:12px;align-items:end;flex-wrap:wrap}.models .role-row select{flex:1 1 240px;width:auto;min-width:0}.models .role-name{font-weight:600}.models .new{font-weight:600}.models ul{padding-left:20px}.models .meta{font-size:.86rem}.models .role-read{display:grid;gap:2px;padding:8px 0}.models .editor{display:grid;gap:14px}.models .editor .role select{width:100%}.models .tiers{border-top:1px solid var(--so-line)}.models .tiers .role{margin:0 0 14px}.models .mono{font-family:var(--font-mono,ui-monospace,monospace);font-size:.84rem}.models .preset{display:flex;gap:12px;align-items:center;justify-content:space-between;flex-wrap:wrap}.models .preset p{margin:4px 0 0}.models .preset>div{flex:1 1 280px;min-width:0}.models .button-link{display:inline-flex;align-items:center;padding:0 14px;border:1px solid var(--so-input-line);border-radius:8px;text-decoration:none;color:var(--so-ink);font-weight:600}.models table{width:100%;border-collapse:collapse}.models th,.models td{text-align:left;vertical-align:top;padding:8px 6px;border-bottom:1px solid var(--so-line)}.models .diff th{width:38%;font-weight:600}.models .diff ul{margin:4px 0 0}.models .preview{border-color:var(--so-input-line)}.models .preview form{display:grid;gap:10px;margin-top:12px}.models .preview .cancel{justify-self:start;display:inline-flex;align-items:center;min-height:44px}.models .sizing dt{font-weight:600;margin-top:8px}.models .sizing dd{margin:2px 0 0}.models .editor label:has(input[type=password]){margin-top:4px}@media(max-width:600px){.models .card{padding:14px}.models .diff th,.models .diff td{display:block;width:auto;border:0;padding:4px 0}.models .diff tr{display:block;border-bottom:1px solid var(--so-line);padding:6px 0}.models .recent td{display:block;border:0;padding:2px 0}.models .recent tr{display:block;border-bottom:1px solid var(--so-line);padding:6px 0}.models .recent thead{display:none}}`;
 function toolRow(one, manage) {
     const state = one.installed === null ? "Version unknown"
         : one.behind ? html `${one.installed} · <strong>${one.latest} available</strong>`
@@ -16,18 +16,17 @@ function toolRow(one, manage) {
 }
 function roleForm(role, manage) {
     if (!manage)
-        return html `<div class="card role"><strong>${role.label}</strong><span>${role.words}</span></div>`;
+        return html `<div class="role-read"><span class="role-name">${role.label}</span><span>${role.words}</span></div>`;
     const known = role.groups.some(group => group.options.some(option => `${group.provider}|${option.value}` === role.current));
-    const saved = !known && role.current !== "inherit" && role.current !== "" ? html `<option value="${role.current}" selected>${role.words} · current</option>` : "";
+    const saved = !known && role.current !== "" ? html `<option value="${role.current}" selected>${role.words} · current</option>` : "";
     const groups = role.groups.map(group => html `<optgroup label="${group.label}">${group.options.map(option => {
         const value = `${group.provider}|${option.value}`;
         return html `<option value="${value}"${value === role.current ? html ` selected` : ""}>${option.label}</option>`;
     })}</optgroup>`);
-    const inherit = role.inherit ? html `<option value="inherit"${role.current === "inherit" ? html ` selected` : ""}>Same as the builder</option>` : "";
-    const long = role.groups.reduce((sum, group) => sum + group.options.length, 0) > 40;
+    const unset = html `<option value="clear"${role.current === "" ? html ` selected` : ""}>${role.unset}</option>`;
     const count = role.groups.reduce((sum, group) => sum + group.options.length, 0);
-    const id = `role-${role.phase}`;
-    return postForm("/settings/models/agent", html `<label class="role-name" for="${id}">${role.label}</label>${long ? html `<input type="search" data-model-filter hidden aria-label="Search ${role.label.toLowerCase()} models" placeholder="Search ${count} models" autocomplete="off">` : ""}<div class="role-row"><select id="${id}" name="agent">${inherit}${saved}${groups}</select><button type="submit" class="secondary">Save</button></div>`, { attrs: { class: "card role" }, hidden: { phase: role.phase } });
+    const id = `role-${role.key}`;
+    return html `<div class="role"><label class="role-name" for="${id}">${role.label}</label>${count > 40 ? html `<input type="search" data-model-filter hidden aria-label="Search ${role.label.toLowerCase()} models" placeholder="Search ${count} models" autocomplete="off">` : ""}<select id="${id}" name="${role.key}">${unset}${saved}${groups}</select>${role.current === "" ? html `<span class="meta">${role.words}</span>` : ""}</div>`;
 }
 export function modelsHtml(view) {
     const manage = view.canManage && view.csrf !== "";
@@ -44,11 +43,11 @@ export function modelsHtml(view) {
     const watch = manage
         ? html `<details><summary>Automatic checks · ${view.watch.enabled ? "On" : "Off"}</summary>${postForm("/settings/models/watch", html `<p>Check every 6 hours and send a message when a new model or CLI update appears. It uses public lists and sends nothing about you or your projects.</p><button type="submit" class="secondary">${view.watch.enabled ? "Turn off" : "Turn on"}</button>`, { hidden: { enabled: view.watch.enabled ? "0" : "1" } })}</details>`
         : "";
-    return html `<section class="models">${status}${problem}<h2>AI tools</h2>${tools}<p class="meta">Checked ${when(view.watch.checkedAt)} ${check}</p>${fresh}<h2>Default agents</h2><p class="meta">New tasks use these. Approved tasks keep the agents they were approved with.</p>${view.roles.map(role => roleForm(role, manage))}${view.chat === null ? "" : html `<h2>Chat</h2><p>${view.chat.words} · <a href="/settings/lead">Change</a></p>`}${watch}</section>`;
+    return html `<section class="models">${status}${problem}${previewCard(view, manage)}${editorSection(view, manage)}${presetsSection(view, manage)}${sizingSection(view)}${recentSection(view)}<h2>AI tools</h2>${tools}<p class="meta">Checked ${when(view.watch.checkedAt)} ${check}</p>${fresh}${view.chat === null ? "" : html `<h2>Chat</h2><p>${view.chat.words} · <a href="/settings/lead">Change</a></p>`}${watch}</section>`;
 }
 /** Filters one long picker as you type; the saved choice always stays listed. */
 export function modelsScript() {
-    return `(function(){document.querySelectorAll('.models form.role').forEach(function(form){
+    return `(function(){document.querySelectorAll('.models .role').forEach(function(form){
     var search=form.querySelector('[data-model-filter]'),select=form.querySelector('select');
     if(!search||!select)return;search.hidden=false;
     var groups=Array.from(select.querySelectorAll('optgroup')).map(function(g){return{g:g,options:Array.from(g.children)}});
@@ -57,3 +56,47 @@ export function modelsScript() {
       select.value=chosen;});
   })})();`;
 }
+const scopeQuery = (view) => view.scope.value === "installation" ? "" : `&scope=${encodeURIComponent(view.scope.value)}`;
+const password = () => reauth(html `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password"></label>`);
+/** The roles at the scope being edited: one form, one save, one password. Sizes and tiers sit behind a disclosure. */
+function editorSection(view, manage) {
+    const scopes = view.scope.options.length < 2 ? "" : html `<form method="get" action="/settings/models" class="models-scope"><label for="models-scope">Settings for</label><div class="role-row"><select id="models-scope" name="scope">${view.scope.options.map(one => html `<option value="${one.value}"${one.value === view.scope.value ? html ` selected` : ""}>${one.label}</option>`)}</select><button type="submit" class="secondary">Show</button></div></form>`;
+    const main = view.roles.filter(role => !role.tier), tiers = view.roles.filter(role => role.tier);
+    const inUse = html `<p class="meta">In use: ${view.inUse === null ? "a custom set" : view.inUse}${view.scope.value === "installation" ? "" : html ` · ${view.scope.label}`}</p>`;
+    const unresolved = view.unresolved === null ? "" : html `<p class="problem" role="alert">New tasks can't be filed here yet: ${view.unresolved}</p>`;
+    const rows = html `${main.map(role => roleForm(role, manage))}<details class="tiers"${manage ? "" : html ` open`}><summary>By task size</summary>${tiers.map(role => roleForm(role, manage))}</details>`;
+    const body = manage
+        ? postForm("/settings/models/agent", html `${rows}${password()}<button type="submit">Save</button>`, { attrs: { class: "card editor" }, hidden: { scope: view.scope.value, digest: view.scope.digest } })
+        : html `<div class="card editor">${rows}</div>`;
+    return html `<h2>Models for new tasks</h2>${scopes}${inUse}${unresolved}${body}<p class="meta">Changes apply to tasks filed from now on. Approved and waiting tasks keep the models they were filed with.</p>`;
+}
+/** A preset or a switch shows exactly what it changes, and applies only with a second, password-checked submit. */
+function previewCard(view, manage) {
+    const preview = view.preview;
+    if (preview === null || !manage)
+        return html ``;
+    const back = `/settings/models${view.scope.value === "installation" ? "" : `?scope=${encodeURIComponent(view.scope.value)}`}`;
+    if (preview.rows.length === 0)
+        return html `<div class="card preview" role="status"><h2>${preview.title}</h2><p>Already in use. Nothing would change.</p><a class="button-link" href="${back}">Back</a></div>`;
+    const rows = preview.rows.map(row => html `<tr><th scope="row">${row.role}</th><td><span class="mono">${row.before}</span> → <span class="mono">${row.after}</span>${row.notes.length === 0 ? "" : html `<ul class="meta">${row.notes.map(note => html `<li>${note}</li>`)}</ul>`}</td></tr>`);
+    return html `<div class="card preview"><h2>${preview.title}</h2><p>Review what changes for tasks filed from now on.</p><table class="diff"><tbody>${rows}</tbody></table>${postForm("/settings/models/apply", html `${password()}<button type="submit" class="primary">Apply ${preview.rows.length} change${preview.rows.length === 1 ? "" : "s"}</button><a class="cancel" href="${back}">Cancel</a>`, { hidden: preview.hidden })}</div>`;
+}
+function presetsSection(view, manage) {
+    const presets = view.presets.map(one => html `<div class="card preset"><div><strong>${one.label}</strong>${one.recommended ? html ` <span class="meta">Default</span>` : ""}<p>${one.words}</p></div>${one.inUse ? html `<span class="meta">In use</span>` : manage ? html `<a class="button-link" href="/settings/models?preset=${one.name}${scopeQuery(view)}">Review changes</a>` : ""}</div>`);
+    const newer = view.newer.length === 0 ? "" : html `<h2>Newer models</h2>${view.newer.map(one => html `<div class="card preset"><div><strong>${one.name}</strong><p>Newer than <span class="mono">${one.from}</span>, used by ${one.roles}.</p></div>${manage ? html `<a class="button-link" href="/settings/models?switch=${encodeURIComponent(one.from)}&to=${encodeURIComponent(one.to)}${scopeQuery(view)}">Switch to it</a>` : ""}</div>`)}`;
+    return html `<h2>Presets</h2>${presets}${newer}`;
+}
+/** How a task's size is decided, in plain words, and what routing does at filing. */
+function sizingSection(view) {
+    return html `<h2>How tasks are sized</h2><div class="card sizing"><p>Each task is sized once, when it is filed. ${view.sizing.classifier} If it doesn't answer within 5 seconds, the size comes from the description.</p><dl>
+<dt>Small</dt><dd>${view.sizing.small}. Built by the builder for small tasks, with no plan.</dd>
+<dt>Routine</dt><dd>${view.sizing.routine}. Planned and built by the planner and builder for routine tasks.</dd>
+<dt>Large or risky</dt><dd>Large: ${view.sizing.large}. Risky: ${view.sizing.risky} Planned and built by the large or risky models.</dd></dl>
+<details><summary>More about routing</summary><p>${view.routing}</p><p>Changing a model never re-sizes or re-routes a task that was already filed. One exception: an older build review saved without its own route uses the reviewer set here now.</p></details></div>${view.waiting.length === 0 ? "" : html `<details class="waiting"><summary>${view.waiting.length} plan${view.waiting.length === 1 ? "" : "s"} waiting for approval</summary><p class="meta">They keep the models they were filed with.</p><ul>${view.waiting.map(one => html `<li><a href="/t/${encodeURIComponent(one.taskId)}">${one.title}</a></li>`)}</ul></details>`}`;
+}
+/** The model each recent run was set to, next to the model its provider reported. */
+function recentSection(view) {
+    if (view.recent.length === 0)
+        return html ``;
+    return html `<h2>Recent work</h2><table class="recent"><thead><tr><th scope="col">Task</th><th scope="col">Chosen → ran on</th></tr></thead><tbody>${view.recent.map(one => html `<tr><td><a href="/t/${encodeURIComponent(one.taskId)}">${one.taskId}</a> <span class="meta">${one.role}</span></td><td><span class="mono">${one.chosen}</span> → <span class="mono">${one.ranOn}</span></td></tr>`)}</tbody></table>`;
+}

package/dist/needs-you.d.ts

@@ -15,6 +15,14 @@ export type NeedAction = {
     code: NeedActionCode;
     label: string;
 };
+/** Where "Connect a builder" and "Start the builder" lead (code `start-worker`): the Start a builder page, which shows
+ * the one command to run and the open project's builder state. Every signed-in person can open it, a project-limited
+ * one included (System is instance-only). Never the task's own page, which only repeats that nothing is connected. */
+export declare const START_BUILDER_HREF = "/start-builder";
+/** Start a builder for one task: the page reports that task's own project, whatever project is open. */
+export declare const startBuilderHref: (taskId: string | null) => string;
+/** What starts a builder: run on the machine where the project lives, in the project's folder. */
+export declare const START_BUILDER_COMMAND = "toolroll up";
 /** `build`: the run a sentence names; `provider`: the agent that signed out. */
 export type NeedContext = {
     build?: number | null;

package/dist/needs-you.js

@@ -5,6 +5,14 @@
  *
  * The words never name the machine's internals; `plainSentence` keeps a
  * recorded reason only when it is free of them. */
+/** Where "Connect a builder" and "Start the builder" lead (code `start-worker`): the Start a builder page, which shows
+ * the one command to run and the open project's builder state. Every signed-in person can open it, a project-limited
+ * one included (System is instance-only). Never the task's own page, which only repeats that nothing is connected. */
+export const START_BUILDER_HREF = "/start-builder";
+/** Start a builder for one task: the page reports that task's own project, whatever project is open. */
+export const startBuilderHref = (taskId) => taskId === null ? START_BUILDER_HREF : `${START_BUILDER_HREF}?task=${encodeURIComponent(taskId)}`;
+/** What starts a builder: run on the machine where the project lives, in the project's folder. */
+export const START_BUILDER_COMMAND = "toolroll up";
 const always = () => true;
 const build = (context) => context.build == null ? "the last build" : `build #${context.build}`;
 const Build = (context) => context.build == null ? "The last build" : `Build #${context.build}`;

package/dist/operate.d.ts

@@ -9,10 +9,12 @@ import { type Store } from "./store.js";
 import { type DispatchAdapter } from "./sync.js";
 import { type RolePort, type UpRoleStart } from "./up-processes.js";
 import { type TelegramTransport } from "./telegram.js";
+import { type ProjectIdentities } from "./project-identity.js";
 import { type FolderLookOptions } from "./folder-look.js";
 import { type LeadCliSeams } from "./lead-cli.js";
 import { type Principal, type RemoteRun, type RemoteSource } from "./operate-remote.js";
 import { type PublishExec } from "./publish.js";
+import { type ApplyResult, type ExtraWrite, type ModelChange, type Slot } from "./model-choices.js";
 import { type Runner as CommandRunner } from "./builder.js";
 import { type ReleaseIo } from "./releases.js";
 export type Write = (line: string) => void;
@@ -94,8 +96,10 @@ export type OperateOptions = {
     filingSizer?: Sizer;
     /** Set only by up-role-child.ts: this process is one role of a `toolroll up` (the console or the worker). */
     upRole?: UpRoleHost;
+    /** Injected by tests: how the console looks at project folders off its thread (folder-look.ts). */
+    folderLook?: FolderLookOptions;
 };
-export type OnboardSeams = Partial<Pick<OnboardIo, "home" | "env" | "cwd" | "interactive" | "confirm" | "findRepo" | "checkConnection" | "pullRequests">>;
+export type OnboardSeams = Partial<Pick<OnboardIo, "home" | "env" | "cwd" | "interactive" | "confirm" | "findRepo" | "checkConnection" | "pullRequests" | "youiyoux">>;
 export declare const OPERATE_HELP: string;
 /** Parsed flags, with the positionals left over. */
 type Args = {
@@ -153,6 +157,8 @@ export declare function runOperateAs(argv: string[], opts: {
     options?: OperateOptions;
 }): Promise<number>;
 type Context = {
+    /** Injected by tests: how the console looks at project folders off its thread. */
+    folderLook?: FolderLookOptions;
     /** A remote run's person (runOperateAs): every credential check resolves to them. Absent for every local command. */
     principal?: RemoteRun;
     /** The lead token this command runs under: it signs in as its owner. */
@@ -231,7 +237,6 @@ type Context = {
 export declare function writeLoginFileDurably(path: string, name: string, password: string): void;
 /** The platform browser opener — detached, silent, never load-bearing. */
 export declare function openBrowser(url: string): void;
-export declare function readUpConsoleUrl(dir: string): string | null;
 /**
  * The people allowed to agree to a scope.
  *
@@ -303,3 +308,18 @@ export declare function upProveSaved(gitRun: (file: string, args: readonly strin
 /** What `up` hands its next worker after the worker reports which saved projects it still holds start authority for:
  * only what both still hold. A worker's report can give up an authority, never add or give back one. */
 export declare function upNarrowDeferred(held: readonly string[], reported: readonly string[]): string[];
+/** Resolve the console's project identities after it is listening, never before: the deploy's health check and every
+ * page answer at once, and each project shows up as its folder answers (project-identity.ts `refresh`, its looks a
+ * few at a time under their deadline). Nothing waits on it; a pass that fails leaves those paths unresolved, which
+ * fails closed, for the background pass to try again. */
+export declare function consoleIdentitiesInBackground(identities: ProjectIdentities, paths: readonly string[]): void;
+/** `config set` and `config clear` on the command line, through Settings → Models' one write path (model-choices.ts,
+ * docs/plans/spend-dashboard.md slice 3), under the same target and resulting-configuration checks as the editor: the
+ * person proved themselves with their own password or login at `proved.generation`; a machine credential (a remote
+ * token, the lead's token) never changes which models run. The write re-proves them inside its transaction: still an
+ * unrestricted instance operator, at that very generation, by a proof that still stands. */
+export declare function writeModelRow(store: Store, proved: {
+    actor: string;
+    generation: number;
+    method: string;
+}, scope: string, knownProject: (repo: string) => boolean, slot: Slot | null, to: ModelChange["to"], now: Date, extra?: readonly ExtraWrite[]): ApplyResult;

package/dist/operate.js

@@ -54,6 +54,7 @@ import { packageVersion, startMonitoring, targetOf } from "./monitoring.js";
 import { origin, readMonitoring } from "./monitoring-settings.js";
 import { logEvent } from "./log.js";
 import { FLOW_EVERY_MS, flowHousekeeping, moveCards, moveCardsAfter } from "./flow-cadence.js";
+import { NO_YOUIYOUX_PASS, youiyouxOnboardLine } from "./youiyoux-intake.js";
 import { readHooksBase, scheduleFromWords } from "./flow-triggers.js";
 import { sendSubagentSummaries } from "./subagent-admin.js";
 import { runRequestedUndos, sendSubagentWeeklies } from "./subagent-week.js";
@@ -222,11 +223,12 @@ import { fileTaskProposal, validateTaskText } from "./proposal.js";
 import { TEMPLATES, templateByName } from "./templates.js";
 import { isDirectChatProvider, isSubscriptionChatProvider, priceOf, PRICED_MODELS } from "./converse.js";
 import { resolvePhaseAgent, resolveScopeProfile, resolveRouteCandidates, routeOfTask, INSTALLATION_SCOPE } from "./agentconfig.js";
+import { applyModelChoices, stateDigest } from "./model-choices.js";
 import { isTaskSize, legOf, projectRoute, routeDigestOf, routeWords, TASK_SIZES, PHASES as ROUTE_PHASES } from "./phase-routing.js";
 import { observeProviderReadiness, reportProviderReadinessAuthed } from "./runner.js";
 import { parseDemoUrl, projectDemoUrl, saveProjectDemo } from "./project-demo.js";
 import { effectiveConcurrency, maySlotTake, parseProjectConcurrency, PROJECT_CONCURRENCY_DEFAULT, ProjectPasses, projectConcurrency, saveProjectConcurrency, savedProjectConcurrency } from "./project-concurrency.js";
-import { activeWebhookTargets, webhookPass, LEGACY_WEBHOOK_WARNING, loadWebhookTargets, effectivePrimary, isMessagingChannel, loadConsoleUrl, phoneOrigin, saveConsoleUrl, savePrimary } from "./webhooks.js";
+import { activeWebhookTargets, webhookPass, LEGACY_WEBHOOK_WARNING, loadWebhookTargets, effectivePrimary, isMessagingChannel, loadConsoleUrl, phoneOrigin, readUpConsoleUrl, saveConsoleUrl, savePrimary, UP_CONSOLE_FILE } from "./webhooks.js";
 import { auditOf, inspectionOf, isProviderId, MONEY_CAPABILITIES, PROVIDER_IDS, validModelId, validateSpec, ALL_CREDENTIAL_ENV } from "./provider.js";
 import { attestProvider, attestationOf, versionInRange } from "./attest.js";
 import { build, proveApprovedProfile, } from "./builder.js";
@@ -277,6 +279,7 @@ export const OPERATE_HELP = `toolroll — operating the queue
                                         wait for this attempt to finish or need a person
   toolroll project use <path>        remember a saved project (optional --token-file)
   toolroll project show              show the current project and credential reference
+  toolroll project activity --json   read the current project supervision report
   toolroll project rules --repo <p>  a project's approval rules; an instance operator changes them with
                                         --not-requester on|off, --protect none|project, --protect-paths "a/**,b/**"
   toolroll project network --repo <p> [--allow h,…] [--remove h,…] [--open|--allowlist] [--local any|none]
@@ -967,6 +970,7 @@ async function dispatchOn(command, positional, flags, repoList, base, options, e
             ...(options.onboardSeams === undefined ? {} : { onboardSeams: options.onboardSeams }),
             ...(options.upSeams === undefined ? {} : { upSeams: options.upSeams }),
             ...(options.upRole === undefined ? {} : { upRole: options.upRole }),
+            ...(options.folderLook === undefined ? {} : { folderLook: options.folderLook }),
             ...(upNeedsOneProcess(options) ? { upOneProcess: true } : {}),
             ...(activeRemote() === null ? {} : { principal: activeRemote() }),
         });
@@ -2257,6 +2261,7 @@ function flowIoOf(context, pool, git, base) {
             dir: context.flowStepIo?.dir ?? dir, scratch: context.flowStepIo?.scratch ?? join(pool, "flow-checks"), base,
             ...(context.evidenceRoot === undefined ? {} : { evidenceRoot: context.evidenceRoot }) },
         ...(context.evidenceRoot === undefined ? {} : { evidenceRoot: context.evidenceRoot }),
+        youiyouxGit: gitOf(context.gitRunner),
     };
 }
 /**
@@ -3382,8 +3387,10 @@ async function tickCommand(flags, context) {
         syncAssignmentHandoffs(store, clock(), auth.runner.repos, context.evidenceRoot);
     settleFinished();
     const replied = replyPass.taken > 0 || replyPass.problem !== null;
-    const flows = flowPass.moved + flowPass.filed.length + flowPass.problems.length + triggerPass.added + triggerPass.problems.length + stepPass.ran + stepPass.problems.length === 0 && !replied ? {} : { flows: { ...flowPass,
-            ...(triggerPass.added + triggerPass.problems.length === 0 ? {} : { triggers: triggerPass }), ...(stepPass.ran + stepPass.problems.length === 0 ? {} : { steps: stepPass }), ...(replied ? { replies: replyPass } : {}) } };
+    const requestPass = housekeeping?.youiyoux ?? NO_YOUIYOUX_PASS;
+    const requested = requestPass.filed + requestPass.copied + requestPass.decided + requestPass.problems.length > 0;
+    const flows = flowPass.moved + flowPass.filed.length + flowPass.problems.length + triggerPass.added + triggerPass.problems.length + stepPass.ran + stepPass.problems.length === 0 && !replied && !requested ? {} : { flows: { ...flowPass,
+            ...(triggerPass.added + triggerPass.problems.length === 0 ? {} : { triggers: triggerPass }), ...(requested ? { youiyoux: requestPass } : {}), ...(stepPass.ran + stepPass.problems.length === 0 ? {} : { steps: stepPass }), ...(replied ? { replies: replyPass } : {}) } };
     const summary = () => {
         const lines = [`Considered ${considered}, built ${built}, parked ${parked}, broke ${broke}.`];
         for (const entry of dispatched) {
@@ -3941,11 +3948,11 @@ async function startConsole(options) {
     const { context } = options;
     // A git incident (teardown-git.ts) raises an attention notification in this console's outbox.
     noticeGitIncidents(context.store, context.clock);
-    // Every project folder this console starts with is resolved off its thread, under a deadline: one that doesn't
-    // answer (a drive away, an iCloud folder macOS is holding) stays unresolved, kept restrictive, and is looked at again
-    // by the background pass; the console starts and answers either way (project-identity.ts).
-    const identities = projectIdentities();
-    await identities.refresh([...options.repos ?? [], ...options.projectRoots ?? [], ...context.store.listProjects().map(one => one.path), ...context.store.knownRepos()]);
+    // Every project folder this console starts with is resolved off its thread, under a deadline, after it is listening
+    // (consoleIdentitiesInBackground): the console answers at once, and a project shows up once its folder answers. Until
+    // then it is unresolved and kept restrictive; one that doesn't answer (a drive away, an iCloud folder macOS is
+    // holding) is looked at again by the background pass (project-identity.ts).
+    const identities = projectIdentities(context.folderLook);
     const server = createDecisionServer({
         identities,
         store: context.store,
@@ -3982,6 +3989,7 @@ async function startConsole(options) {
     }).catch(error => {
         throw new Error(`could not listen on ${options.host}:${options.port} — ${describe(error)}`);
     });
+    consoleIdentitiesInBackground(identities, [...options.repos ?? [], ...options.projectRoots ?? [], ...context.store.listProjects().map(one => one.path), ...context.store.knownRepos()]);
     // v104: monitoring runs beside the console (every setup has one): one loop sends the audit stream and traces where
     // Settings → Monitoring says, and stops when the console does. A lease keeps a second process from sending too.
     const stopMonitoring = startMonitoring({
@@ -5042,6 +5050,9 @@ async function configCommand(positional, flags, context) {
     if (phase === undefined || !["plan", "build", "repair", "review"].includes(phase))
         return fail(write, json, `config ${action}`, "usage", "which phase? plan, build, repair, review — or chat", EXIT.usage);
     const acting = await askCredentials(flags, context);
+    // The credential generation the proof below is checked against, read BEFORE it: a rotation after this read makes
+    // the write refuse (model-choices.ts re-checks it inside the transaction), never borrow the new generation.
+    const provedGeneration = acting === null ? -1 : store.accountOf(acting.name)?.generation ?? -1;
     const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
     if (acting === null || !verified?.ok)
         return refuseApprover(context, `config ${action}`, verified, "changing spend routing takes `--as <you> --token <t>`", phase);
@@ -5057,6 +5068,18 @@ async function configCommand(positional, flags, context) {
     // Clearing one left from before stays possible.
     if (tierGiven === "light" && phase !== "build" && !(action === "clear" && phase === "plan" && !flag(flags, "also")))
         return fail(write, json, `config ${action}`, "usage", "--tier light is for build only — a small change makes no plan, and repairs resume the builder's session", EXIT.usage);
+    // Every row below — plain, tier, `--also`, and a leftover light planner's removal — is written through the one write
+    // path (model-choices.ts): one transaction, the actor re-proved as an instance operator at the credential generation
+    // proved above by a proof that still stands, the target and the resulting configuration checked, every row ledgered.
+    // A project named with --repo must be one Toolroll knows (the editor's own rule).
+    const projectKnown = repoGiven === undefined || (await knownProject(context, repoGiven, { listed: true, canonical: true })) !== undefined;
+    const proof = { actor: acting.name, generation: provedGeneration, method: verified.method };
+    const written = (slot, to, extra = []) => writeModelRow(store, proof, scope, () => projectKnown, slot, to, clock(), extra);
+    // A configuration still missing a role's model is saved, and said (JSON: `incomplete`).
+    const said = (command, result, payload, lines) => {
+        const incomplete = result.ok ? result.unresolved : null;
+        return succeed(write, json, command, { ...payload, ...(incomplete === null ? {} : { incomplete }) }, () => [...lines(), ...(incomplete === null ? [] : [`  ! new tasks can't be filed here yet: ${incomplete}`])]);
+    };
     // Another provider's candidate on the same tier (`--also`): one per provider, and at filing the one whose plan
     // has more room runs.
     if (flag(flags, "also")) {
@@ -5067,8 +5090,11 @@ async function configCommand(positional, flags, context) {
         if (alsoProvider !== undefined && !isProviderId(alsoProvider))
             return fail(write, json, `config ${action}`, "usage", `--provider is one of ${PROVIDER_IDS.join(", ")}`, EXIT.usage);
         if (action === "clear") {
-            const removed = store.clearPhaseTierAlternates(scope, phase, tier, alsoProvider ?? null);
-            return succeed(write, json, "config clear", { scope, phase, tier, also: true, provider: alsoProvider ?? null, cleared: removed }, () => [
+            const alsoClear = written(null, null, [{ kind: "also-clear", phase, tier, provider: alsoProvider ?? null }]);
+            if (!alsoClear.ok)
+                return fail(write, json, "config clear", alsoClear.reason, alsoClear.problem, EXIT.refused);
+            const removed = alsoClear.extra;
+            return said("config clear", alsoClear, { scope, phase, tier, also: true, provider: alsoProvider ?? null, cleared: removed }, () => [
                 removed > 0 ? `Removed ${removed} other-provider ${tier} ${phase} agent${removed === 1 ? "" : "s"} at ${scope}; sealed routes are untouched.` : `No other-provider ${tier} ${phase} agent${alsoProvider === undefined ? "" : ` on ${alsoProvider}`} was configured at ${scope}.`,
             ]);
         }
@@ -5078,10 +5104,12 @@ async function configCommand(positional, flags, context) {
         const alsoValid = validateSpec({ provider: alsoProvider, model: alsoModel });
         if (!alsoValid.ok)
             return fail(write, json, "config set", "invalid", alsoValid.problem, EXIT.usage);
-        store.setPhaseTierAlternate(scope, phase, tier, alsoProvider, alsoModel, acting.name, clock());
+        const alsoSet = written(null, null, [{ kind: "also-set", phase, tier, provider: alsoProvider, model: alsoModel }]);
+        if (!alsoSet.ok)
+            return fail(write, json, "config set", alsoSet.reason, alsoSet.problem, EXIT.refused);
         const resolvedNow = resolveRouteCandidates(store, scope === INSTALLATION_SCOPE ? null : scope);
         const own = !resolvedNow.ok ? null : tier === "routine" ? resolvedNow.candidates[phase].routine : tier === "light" ? resolvedNow.candidates[phase].light ?? null : resolvedNow.candidates[phase].strong;
-        return succeed(write, json, "config set", { scope, phase, tier, also: true, provider: alsoProvider, model: alsoModel }, () => [
+        return said("config set", alsoSet, { scope, phase, tier, also: true, provider: alsoProvider, model: alsoModel }, () => [
             `${tier} ${phase} at ${scope === INSTALLATION_SCOPE ? "the installation" : scope} can also run ${alsoProvider} · ${alsoModel}, set by ${acting.name}.`,
             own !== null && own.provider === alsoProvider && !own.source.includes("also")
                 ? `  ! the ${tier} ${phase} agent already runs ${alsoProvider} (${own.model}) — this one is not used while it does.`
@@ -5089,20 +5117,39 @@ async function configCommand(positional, flags, context) {
         ]);
     }
     if (action === "clear") {
+        if (tierGiven === "light" && phase === "build") {
+            const lightWrite = written({ phase, tier: "light" }, null);
+            if (!lightWrite.ok)
+                return fail(write, json, "config clear", lightWrite.reason, lightWrite.problem, EXIT.refused);
+            const clearedLight = lightWrite.diff.length > 0;
+            return said("config clear", lightWrite, { scope, phase, tier: "light", cleared: clearedLight }, () => [
+                clearedLight ? `Cleared the light ${phase} agent at ${scope} — small changes keep the default and say so; sealed routes are untouched.` : `No light ${phase} agent was configured at ${scope}.`,
+            ]);
+        }
         if (tierGiven === "light") {
-            const clearedLight = store.clearPhaseTierConfig(scope, phase, "light");
-            return succeed(write, json, "config clear", { scope, phase, tier: "light", cleared: clearedLight }, () => [
+            // A light planner from before light became build-only: removed here, never written.
+            const legacyClear = written(null, null, [{ kind: "legacy-light-clear", phase: phase }]);
+            if (!legacyClear.ok)
+                return fail(write, json, "config clear", legacyClear.reason, legacyClear.problem, EXIT.refused);
+            const clearedLight = legacyClear.extra > 0;
+            return said("config clear", legacyClear, { scope, phase, tier: "light", cleared: clearedLight }, () => [
                 clearedLight ? `Cleared the light ${phase} agent at ${scope} — small changes keep the default and say so; sealed routes are untouched.` : `No light ${phase} agent was configured at ${scope}.`,
             ]);
         }
         if (tierGiven === "strong") {
-            const clearedStrong = store.clearPhaseTierConfig(scope, phase, "strong");
-            return succeed(write, json, "config clear", { scope, phase, tier: "strong", cleared: clearedStrong }, () => [
+            const strongWrite = written({ phase: phase, tier: "strong" }, null);
+            if (!strongWrite.ok)
+                return fail(write, json, "config clear", strongWrite.reason, strongWrite.problem, EXIT.refused);
+            const clearedStrong = strongWrite.diff.length > 0;
+            return said("config clear", strongWrite, { scope, phase, tier: "strong", cleared: clearedStrong }, () => [
                 clearedStrong ? `Cleared the strong ${phase} agent at ${scope} — demanding routes keep the default and say so; sealed routes are untouched.` : `No strong ${phase} agent was configured at ${scope}.`,
             ]);
         }
-        const cleared = store.clearPhaseConfig(scope, phase);
-        return succeed(write, json, "config clear", { scope, phase, cleared }, () => [
+        const routineWrite = written({ phase: phase, tier: "routine" }, null);
+        if (!routineWrite.ok)
+            return fail(write, json, "config clear", routineWrite.reason, routineWrite.problem, EXIT.refused);
+        const cleared = routineWrite.diff.length > 0;
+        return said("config clear", routineWrite, { scope, phase, cleared }, () => [
             cleared ? `Cleared ${phase} at ${scope} — it resolves one layer down now.` : `Nothing was configured for ${phase} at ${scope}.`,
         ]);
     }
@@ -5116,8 +5163,10 @@ async function configCommand(positional, flags, context) {
     if (tierGiven === "light") {
         if (modelGiven === null)
             return fail(write, json, "config set", "usage", `a light ${phase} agent names an exact --model — approvals bind exact routing`, EXIT.usage);
-        store.setPhaseTierConfig(scope, phase, "light", providerGiven, modelGiven, acting.name, clock());
-        return succeed(write, json, "config set", { scope, phase, tier: "light", provider: providerGiven, model: modelGiven }, () => [
+        const lightSet = written({ phase: phase, tier: "light" }, { provider: providerGiven, model: modelGiven });
+        if (!lightSet.ok)
+            return fail(write, json, "config set", lightSet.reason, lightSet.problem, EXIT.refused);
+        return said("config set", lightSet, { scope, phase, tier: "light", provider: providerGiven, model: modelGiven }, () => [
             `light ${phase} at ${scope === INSTALLATION_SCOPE ? "the installation" : scope} is ${providerGiven} · ${modelGiven}, set by ${acting.name}.`,
             "  small changes filed from now on build on it with no plan; sealed routes are untouched.",
         ]);
@@ -5127,14 +5176,19 @@ async function configCommand(positional, flags, context) {
             return fail(write, json, "config set", "invalid", "gemini has no isolation posture for the review phase yet — name claude or codex as the strong reviewer", EXIT.usage);
         if (modelGiven === null)
             return fail(write, json, "config set", "usage", `a strong ${phase} agent names an exact --model — approvals bind exact routing`, EXIT.usage);
-        store.setPhaseTierConfig(scope, phase, "strong", providerGiven, modelGiven, acting.name, clock());
-        return succeed(write, json, "config set", { scope, phase, tier: "strong", provider: providerGiven, model: modelGiven }, () => [
+        const strongSet = written({ phase: phase, tier: "strong" }, { provider: providerGiven, model: modelGiven });
+        if (!strongSet.ok)
+            return fail(write, json, "config set", strongSet.reason, strongSet.problem, EXIT.refused);
+        return said("config set", strongSet, { scope, phase, tier: "strong", provider: providerGiven, model: modelGiven }, () => [
             `strong ${phase} at ${scope === INSTALLATION_SCOPE ? "the installation" : scope} is ${providerGiven}${modelGiven === null ? "" : ` · ${modelGiven}`}, set by ${acting.name}.`,
             "  large or risky, strict, screenshot-proof, and automerge routes filed from now on reach for it; sealed routes are untouched.",
             ...(phase === "repair" ? ["  a strong repair agent applies only when its provider is the build's — cross-provider repair does not exist."] : []),
         ]);
     }
-    store.setPhaseConfig(scope, phase, providerGiven, modelGiven, acting.name, clock());
+    // A routine row may still name no model on the command line (said below); the editor never writes one.
+    const routineSet = written({ phase: phase, tier: "routine" }, { provider: providerGiven, model: modelGiven });
+    if (!routineSet.ok)
+        return fail(write, json, "config set", routineSet.reason, routineSet.problem, EXIT.refused);
     const warnings = [];
     if (modelGiven === null) {
         warnings.push(`no --model named: approvals bind exact routing, so scopes cannot file until ${phase} has an exact model — \`config set ${phase} --provider ${providerGiven} --model <model>\``);
@@ -5145,7 +5199,7 @@ async function configCommand(positional, flags, context) {
     if (providerGiven !== "claude") {
         warnings.push(`${providerGiven} does not report dollar cost: its runs land as UNMEASURED, and any schedule with a weekly limit fails closed on them by design.`);
     }
-    return succeed(write, json, "config set", { scope, phase, provider: providerGiven, model: modelGiven, warnings }, () => [
+    return said("config set", routineSet, { scope, phase, provider: providerGiven, model: modelGiven, warnings }, () => [
         `${phase} at ${scope === INSTALLATION_SCOPE ? "the installation" : scope} now runs ${providerGiven}${modelGiven === null ? "" : ` · ${modelGiven}`}, set by ${acting.name}.`,
         ...warnings.map(one => `  ! ${one}`),
     ]);
@@ -6347,7 +6401,7 @@ async function runWatchLoop(args) {
                 base = head.stdout.trim();
             }
             const pass = await flowHousekeeping(store, repo, context.clock, flowIoOf(context, flowPool, flowGit, base), admissionStopped);
-            flowsDid(pass.flows.moved + pass.triggers.added + pass.steps.ran + pass.replies.taken, pass.flows.filed.length, `flow pass — ${pass.triggers.added} card(s) added, ${pass.replies.taken} reply(ies) taken, ${pass.steps.ran} step(s) run, ${pass.flows.moved} moved`);
+            flowsDid(pass.flows.moved + pass.triggers.added + pass.steps.ran + pass.replies.taken, pass.flows.filed.length + pass.youiyoux.filed, `flow pass — ${pass.triggers.added} card(s) added, ${pass.youiyoux.filed} youiyoux request(s) filed, ${pass.replies.taken} reply(ies) taken, ${pass.steps.ran} step(s) run, ${pass.flows.moved} moved`);
         },
     });
     const modelWatch = startMaintenance({
@@ -6887,8 +6941,6 @@ export function openBrowser(url) {
         // A browser that will not open is a URL the greeting already printed.
     }
 }
-/** Where `up` last served its console, kept beside the database so `onboard` names the same address. */
-const UP_CONSOLE_FILE = "up-console.json";
 function recordUpConsoleUrl(dir, url, now) {
     try {
         const file = join(dir, UP_CONSOLE_FILE), temporary = `${file}.${process.pid}.tmp`;
@@ -6899,15 +6951,6 @@ function recordUpConsoleUrl(dir, url, now) {
         // A display fact: a failed write only leaves onboard on the default port.
     }
 }
-export function readUpConsoleUrl(dir) {
-    try {
-        const parsed = JSON.parse(readFileSync(join(dir, UP_CONSOLE_FILE), "utf8"));
-        return typeof parsed.url === "string" && /^https?:\/\/[^\s]+$/.test(parsed.url) ? parsed.url.replace(/\/+$/, "") : null;
-    }
-    catch {
-        return null;
-    }
-}
 /** How onboard says to sign in: the saved login file only while it still works (as `up` advertises it), else the
  * account and its password; null only when there is no account yet. Never the password itself. */
 function onboardLogin(store, loginFile) {
@@ -6992,6 +7035,8 @@ async function onboardCommand(flags, context) {
                 return `off: ${checked.message}`;
             return `off: turn on with toolroll publish setup --repo ${repo} --yes (asks your password), or in Settings → Projects`;
         }),
+        // A project that uses youiyoux has its change requests filed as tasks with no step of its own (youiyoux-intake.ts).
+        youiyoux: seams.youiyoux ?? (async (repo) => youiyouxOnboardLine(store, repo)),
         starterFlag: text(flags, "starter"),
         // Starter flows belong to a person: the flow's decisions ask them. With no account yet, none can be switched on.
         starters: {
@@ -7493,11 +7538,14 @@ async function upCommand(flags, context) {
                 pendingLinks.set(id, value => { clearTimeout(timer); resolveLink(value); });
                 consoleRole?.send({ type: "sign-in-link", id, account });
             });
-            const home = homedir();
-            const file = approverPlan2.passwordFile === null ? null : approverPlan2.passwordFile.startsWith(`${home}/`) ? `~${approverPlan2.passwordFile.slice(home.length)}` : approverPlan2.passwordFile;
+            // Every start says where the saved password is and the exact command that shows it, browser or not (Settings
+            // revamp S4, D2). Only the path is printed, never what the file holds: absolute (a relative --db names this
+            // directory), single-quoted (no ~ or $ expands), after `--` (a leading dash is never an option).
+            const saved = approverPlan2.passwordFile === null ? null : resolve(approverPlan2.passwordFile);
+            const showCommand = saved === null ? null : `cat -- '${saved.replaceAll("'", "'\\''")}'`;
             const signInWords = account === null
                 ? `sign in as one of ${approverPlan2.approvers.join(", ")}`
-                : file === null ? `sign in as ${account} with your password` : `sign in as ${account}: the password is in ${file}`;
+                : showCommand === null ? `sign in as ${account} with your password` : `sign in as ${account}`;
             write("");
             write(`Toolroll is on ${url}`);
             if (link !== null) {
@@ -7507,8 +7555,11 @@ async function upCommand(flags, context) {
             }
             else {
                 write(`${signInWords.charAt(0).toUpperCase()}${signInWords.slice(1)}.`);
-                write("Ctrl-C stops it.");
             }
+            if (showCommand !== null)
+                write(`Your password: run \`${showCommand}\``);
+            if (link === null)
+                write("Ctrl-C stops it.");
         }
     }
     // A bounded run (--for) counts from readiness, so a slow start never eats the window it asked for.
@@ -11744,7 +11795,7 @@ function upNeedsOneProcess(options) {
         options.flowEveryMs !== undefined || options.platform !== undefined || options.fenceAvailable !== undefined || options.flowFetch !== undefined ||
         options.integrationIo !== undefined || options.shouldStop !== undefined || options.leadSeams !== undefined || options.waitSleep !== undefined ||
         options.releaseIo !== undefined || options.installBin !== undefined || options.tempRoots !== undefined || options.filingSizer !== undefined ||
-        options.now !== undefined;
+        options.now !== undefined || options.folderLook !== undefined;
 }
 /** The entry a role child runs: the built sibling when installed, the TypeScript source through tsx in a checkout. */
 /**
@@ -12688,3 +12739,18 @@ export function upNarrowDeferred(held, reported) {
     const kept = new Set(reported);
     return held.filter(one => kept.has(one));
 }
+/** Resolve the console's project identities after it is listening, never before: the deploy's health check and every
+ * page answer at once, and each project shows up as its folder answers (project-identity.ts `refresh`, its looks a
+ * few at a time under their deadline). Nothing waits on it; a pass that fails leaves those paths unresolved, which
+ * fails closed, for the background pass to try again. */
+export function consoleIdentitiesInBackground(identities, paths) {
+    void identities.refresh(paths).catch(() => false);
+}
+/** `config set` and `config clear` on the command line, through Settings → Models' one write path (model-choices.ts,
+ * docs/plans/spend-dashboard.md slice 3), under the same target and resulting-configuration checks as the editor: the
+ * person proved themselves with their own password or login at `proved.generation`; a machine credential (a remote
+ * token, the lead's token) never changes which models run. The write re-proves them inside its transaction: still an
+ * unrestricted instance operator, at that very generation, by a proof that still stands. */
+export function writeModelRow(store, proved, scope, knownProject, slot, to, now, extra = []) {
+    return applyModelChoices(store, { scope, change: slot === null ? [] : [{ slot, to }], expected: null, strict: false, knownProject, extra }, { ...proved, live: () => true }, now);
+}

package/dist/project-activity.d.ts

@@ -0,0 +1,20 @@
+/** Shared presentation for browser and no-script Activity; facts come only
+ * from projectOutcomes. No alternate counting or status interpretation. */
+import type { ActivityFamily, ProjectOutcomes } from './project-outcomes.js';
+export declare const activityAge: (ms: number | null) => string;
+export declare const activityMoney: (usd: number | null) => string;
+export declare const ACTIVITY_ACTORS: {
+    human: string;
+    lead: string;
+    landed: string;
+    'machine-or-unknown': string;
+};
+export type ActivityMetric = {
+    label: string;
+    value: string;
+    detail: string;
+    rows: ActivityFamily[];
+};
+export declare const activityScope: (report: ProjectOutcomes) => string;
+export declare const activityLimit: (report: ProjectOutcomes) => string;
+export declare function activityMetrics(report: ProjectOutcomes): ActivityMetric[];

package/dist/project-activity.js

@@ -0,0 +1,23 @@
+export const activityAge = (ms) => ms === null ? 'Unknown' : ms < 3600000 ? `${Math.floor(ms / 60000)}m` : ms < 86400000 ? `${(ms / 3600000).toFixed(1)}h` : `${(ms / 86400000).toFixed(1)}d`;
+export const activityMoney = (usd) => usd === null ? 'Unknown' : `$${usd.toFixed(2)}`;
+export const ACTIVITY_ACTORS = { human: 'Human', lead: 'Lead', landed: 'Automatically landed', 'machine-or-unknown': 'Machine or unknown' };
+export const activityScope = (report) => `Current Ready backlog; completions in the last ${report.days} days. Completion does not mean checks passed or work deployed.`;
+export const activityLimit = (report) => `Partial report: only the ${report.limit} most recently updated eligible families are included. Counts and coverage below describe this sample.`;
+export function activityMetrics(report) {
+    const ready = report.families.filter(one => one.state === 'ready');
+    const complete = report.families.filter(one => one.state === 'completed');
+    const metrics = [
+        { label: 'Ready', value: report.ready.count === 0 ? '0' : `${report.ready.count} · Oldest ${activityAge(report.ready.oldestFinishedAgeMs)}`,
+            detail: `Age is measured from the latest result finishing, a proxy for Ready entry. ${report.ready.dated}/${report.ready.count} have usable timestamps.`, rows: ready },
+        { label: 'Finished to decision', value: report.completed.count === 0 ? 'No completed families' : `${activityAge(report.finishedToDecision.meanMs)} average`,
+            detail: `${report.finishedToDecision.samples}/${report.completed.count} completed families have usable timestamps. Elapsed time to the saved completion decision, not human work time.`, rows: complete },
+        { label: 'Explicit revisions', value: report.revisions.perCompletedFamily === null ? 'No completed families' : `${report.revisions.perCompletedFamily.toFixed(1)} per completed family`,
+            detail: `${report.revisions.count} revisions across ${report.revisions.samples} completed families. Retries are attempts, not revisions.`, rows: complete },
+        { label: 'Recorded spend', value: report.completed.count === 0 ? 'No completed families' : `${activityMoney(report.cost.recordedPerCompletedFamilyUsd)} per completed family · ${report.cost.knownRuns}/${report.cost.runs} costs known`,
+            detail: `${activityMoney(report.cost.recordedUsd)} in API charges across ${report.cost.families} completed families; ${report.cost.fullyCostedFamilies}/${report.cost.families} fully costed.${report.cost.subscriptionRuns > 0 ? ` ${report.cost.subscriptionRuns} subscription runs are plan usage, not charges${report.cost.subscriptionReportedUsd === null ? '' : ` (${activityMoney(report.cost.subscriptionReportedUsd)} reported)`}.` : ''} Missing or unreported costs are unknown. All family attempts count once, including planning and retries.`, rows: complete },
+        { label: 'Completed families', value: String(report.completed.count),
+            detail: `${Object.entries(report.completed.actors).map(([key, count]) => `${ACTIVITY_ACTORS[key]}: ${count}`).join(' · ')}. Scouts: ${report.completed.scouts}. Failed checks: ${report.completed.failedChecks}.`, rows: complete },
+        ...(report.incompleteHistory > 0 ? [{ label: 'Incomplete history', value: String(report.incompleteHistory), detail: 'Excluded from completion averages; their family relationships cannot be established.', rows: report.families.filter(one => one.state === 'history-unavailable') }] : []),
+    ];
+    return report.completed.count === 0 ? metrics.filter(one => one.label === 'Ready' || one.label === 'Completed families' || one.label === 'Incomplete history') : metrics;
+}