toolroll 0.9.84 → 0.9.86

package/dist/operate.js

@@ -28,6 +28,8 @@ import { idleStorageSweep, sweepSchedule, sweepScheduleWords } from "./storage-s
 import { lastSweep, saveSweep, sweepDetails, sweepWords as storageSweepWords } from "./storage-sweep.js";
 import { removeShared, sharedDepsRoot, sharedUse, unusedShared } from "./shared-deps.js";
 import { cleanLandedBacklog, gitOf, landedBacklog, reconcileLanded, BACKLOG_DAYS } from "./landed-cleanup.js";
+import { accessOf, applyTidy, approverStandsNow, withinLens, familyRepoOf, releaseFactsFor, runTidy, tidyDays, tidyDigest, tidyGroups, tidyPreview, TIDY_DEFAULT_DAYS, TIDY_PASS_LIMIT } from "./tidy.js";
+import { personProof } from "./person-proof.js";
 import { RemoteMains } from "./remote-main.js";
 import { checkoutPlan, cleanCheckouts, discardCheckout, finishedCheckouts, slimKeptCheckouts, whyWords } from "./checkout-cleanup.js";
 import { closeOutCheckouts, closeOutRuns, stoppedWords } from "./run-closeout.js";
@@ -54,6 +56,7 @@ import { packageVersion, startMonitoring, targetOf } from "./monitoring.js";
 import { origin, readMonitoring } from "./monitoring-settings.js";
 import { logEvent } from "./log.js";
 import { FLOW_EVERY_MS, flowHousekeeping, moveCards, moveCardsAfter } from "./flow-cadence.js";
+import { NO_YOUIYOUX_PASS, youiyouxOnboardLine } from "./youiyoux-intake.js";
 import { readHooksBase, scheduleFromWords } from "./flow-triggers.js";
 import { sendSubagentSummaries } from "./subagent-admin.js";
 import { runRequestedUndos, sendSubagentWeeklies } from "./subagent-week.js";
@@ -104,7 +107,7 @@ import { taskReviewBrief, renderReviewBrief } from "./task-review-brief.js";
 import { homedir, hostname } from "node:os";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { releaseStalledUpdate, waitingUpdate } from "./toolroll-update.js";
-import { openStore, openStoreNoMigrate, CONCURRENT_WRITER_WAIT_MS, isDatabaseBusy, databasePath, BUILT_IN, parseCapabilityKey, verifiedAuthor, isDigestTime, predecessorWatches, RESULT_SCREENSHOTS, lifecycleOf, reportLifecycle, beatLifecycle, } from "./store.js";
+import { openStore, openStoreNoMigrate, archiveTaskFamily, restoreTaskFamily, CONCURRENT_WRITER_WAIT_MS, isDatabaseBusy, databasePath, BUILT_IN, parseCapabilityKey, verifiedAuthor, isDigestTime, predecessorWatches, RESULT_SCREENSHOTS, lifecycleOf, reportLifecycle, beatLifecycle, } from "./store.js";
 import { createHash, randomBytes, randomInt, randomUUID } from "node:crypto";
 import { claimInstance, clearInstance, openInstanceSocket } from "./console-instance.js";
 import { authorizePlanUnderMode } from "./plan-auto.js";
@@ -227,7 +230,7 @@ import { isTaskSize, legOf, projectRoute, routeDigestOf, routeWords, TASK_SIZES,
 import { observeProviderReadiness, reportProviderReadinessAuthed } from "./runner.js";
 import { parseDemoUrl, projectDemoUrl, saveProjectDemo } from "./project-demo.js";
 import { effectiveConcurrency, maySlotTake, parseProjectConcurrency, PROJECT_CONCURRENCY_DEFAULT, ProjectPasses, projectConcurrency, saveProjectConcurrency, savedProjectConcurrency } from "./project-concurrency.js";
-import { activeWebhookTargets, webhookPass, LEGACY_WEBHOOK_WARNING, loadWebhookTargets, effectivePrimary, isMessagingChannel, loadConsoleUrl, phoneOrigin, saveConsoleUrl, savePrimary } from "./webhooks.js";
+import { activeWebhookTargets, webhookPass, LEGACY_WEBHOOK_WARNING, loadWebhookTargets, effectivePrimary, isMessagingChannel, loadConsoleUrl, phoneOrigin, readUpConsoleUrl, saveConsoleUrl, savePrimary, UP_CONSOLE_FILE } from "./webhooks.js";
 import { auditOf, inspectionOf, isProviderId, MONEY_CAPABILITIES, PROVIDER_IDS, validModelId, validateSpec, ALL_CREDENTIAL_ENV } from "./provider.js";
 import { attestProvider, attestationOf, versionInRange } from "./attest.js";
 import { build, proveApprovedProfile, } from "./builder.js";
@@ -272,12 +275,17 @@ export const OPERATE_HELP = `toolroll — operating the queue
                                         the lead passes it as --token, or TOOLROLL_LEAD_TOKEN, and its work pings nobody
   toolroll task ask <id> --person <name> --why "<text>"
                                         hand a task to a person: it pings them, and it is theirs
-  toolroll task list [--view <v>] [--limit <n>] [--cursor <c>]   paginated saved task status
+  toolroll task list [--view <v>] [--limit <n>] [--cursor <c>]   paginated saved task status (--view archived: put away)
+  toolroll task archive <id...> [--reason <why>]   put tasks away: out of every list, history kept (a person's act)
+  toolroll task restore <id...>      bring put-away tasks back exactly as they were
+  toolroll task tidy --preview [--days N]   what Put away old tasks would put away, and why (read-only)
+  toolroll task tidy --apply --digest <d> [--except <id,...>]   put away exactly that list
   toolroll task show <id>
   toolroll task wait <id> [--timeout <seconds>]
                                         wait for this attempt to finish or need a person
   toolroll project use <path>        remember a saved project (optional --token-file)
   toolroll project show              show the current project and credential reference
+  toolroll project activity --json   read the current project supervision report
   toolroll project rules --repo <p>  a project's approval rules; an instance operator changes them with
                                         --not-requester on|off, --protect none|project, --protect-paths "a/**,b/**"
   toolroll project network --repo <p> [--allow h,…] [--remove h,…] [--open|--allowlist] [--local any|none]
@@ -661,7 +669,7 @@ export const TASK_ACTIONS = [
     "add", "list", "show", "wait", "state", "block", "unblock", "next", "steer", "pause", "continue", "assign",
     "reopen", "scope", "approve", "hold", "unhold", "require", "requeue", "regate", "plan",
     "review", "accept", "repair", "route", "stop", "resume", "complete", "revise", "merge", "ask",
-    "checks", "add-tests",
+    "checks", "add-tests", "archive", "restore", "tidy",
 ];
 export const PUBLISH_ACTIONS = ["setup", "grant", "revoke", "status", "unblock", "rearm", "merge", "refire"];
 export const CONFIG_ACTIONS = ["show", "set", "clear"];
@@ -705,6 +713,8 @@ export const OPERATE_VALUE_FLAGS = new Set([
     "starter",
     // flows: templates, steps, scripts and cards.
     "template", "steps", "about", "language", "timeout-minutes", "body", "description", "zone", "option",
+    // task tidy --apply: the previewed tasks to leave out.
+    "except",
     "token-env", "after", "repair-max-attempts", "consumer", "batch", "feedback", "source", "view", "cursor", "why", "supersedes", "decision", "sessions", "timeout",
     // pings follow responsibility: replacements.
     "replaced-by", "replaces",
@@ -755,6 +765,8 @@ export const OPERATE_BOOLEAN_FLAGS = new Set([
     "password-stdin",
     // task steer: pause the running Claude build, then send the note.
     "now",
+    // task tidy: look first (--preview), then put away exactly what was shown (--apply --digest).
+    "preview", "apply",
 ]);
 /** `project network` reads --remove <hosts> and --local any|none as values, where every other verb's --remove and
  * --local are switches. */
@@ -1562,6 +1574,8 @@ function claimCommand(positional, flags, context) {
             return fail(write, json, "claim", "sweep-limit", `its sweep already has ${result.limit} running at once — it starts when one finishes`, EXIT.refused, { sweep: result.sweep, limit: result.limit });
         if (result.reason === "watch-custody")
             return fail(write, json, "claim", "watch-custody", "This worker no longer holds the project; restart the watch", EXIT.refused);
+        if (result.reason === "archived")
+            return fail(write, json, "claim", "archived", `${id} is put away — restore it with \`toolroll task restore ${id}\` first`, EXIT.refused);
         if (result.reason === "draining")
             return fail(write, json, "claim", "draining", `Toolroll is restarting (draining): ${runner} takes no new work until it is back (by ${result.until})`, EXIT.refused, { until: result.until });
         return fail(write, json, "claim", result.reason, `held by ${result.by} until ${result.until}`, EXIT.refused, { holder: result.by, until: result.until });
@@ -2259,6 +2273,7 @@ function flowIoOf(context, pool, git, base) {
             dir: context.flowStepIo?.dir ?? dir, scratch: context.flowStepIo?.scratch ?? join(pool, "flow-checks"), base,
             ...(context.evidenceRoot === undefined ? {} : { evidenceRoot: context.evidenceRoot }) },
         ...(context.evidenceRoot === undefined ? {} : { evidenceRoot: context.evidenceRoot }),
+        youiyouxGit: gitOf(context.gitRunner),
     };
 }
 /**
@@ -3384,8 +3399,10 @@ async function tickCommand(flags, context) {
         syncAssignmentHandoffs(store, clock(), auth.runner.repos, context.evidenceRoot);
     settleFinished();
     const replied = replyPass.taken > 0 || replyPass.problem !== null;
-    const flows = flowPass.moved + flowPass.filed.length + flowPass.problems.length + triggerPass.added + triggerPass.problems.length + stepPass.ran + stepPass.problems.length === 0 && !replied ? {} : { flows: { ...flowPass,
-            ...(triggerPass.added + triggerPass.problems.length === 0 ? {} : { triggers: triggerPass }), ...(stepPass.ran + stepPass.problems.length === 0 ? {} : { steps: stepPass }), ...(replied ? { replies: replyPass } : {}) } };
+    const requestPass = housekeeping?.youiyoux ?? NO_YOUIYOUX_PASS;
+    const requested = requestPass.filed + requestPass.copied + requestPass.decided + requestPass.problems.length > 0;
+    const flows = flowPass.moved + flowPass.filed.length + flowPass.problems.length + triggerPass.added + triggerPass.problems.length + stepPass.ran + stepPass.problems.length === 0 && !replied && !requested ? {} : { flows: { ...flowPass,
+            ...(triggerPass.added + triggerPass.problems.length === 0 ? {} : { triggers: triggerPass }), ...(requested ? { youiyoux: requestPass } : {}), ...(stepPass.ran + stepPass.problems.length === 0 ? {} : { steps: stepPass }), ...(replied ? { replies: replyPass } : {}) } };
     const summary = () => {
         const lines = [`Considered ${considered}, built ${built}, parked ${parked}, broke ${broke}.`];
         for (const entry of dispatched) {
@@ -3557,6 +3574,13 @@ async function reconcileCommand(flags, context) {
         remotes.close();
     }
     const landedGone = landed.steps.filter(one => one.outcome === "removed");
+    // Tidy (task-tidy.md): old routine runs a newer run replaces, release tasks already published or replaced, and CI
+    // notices main has fixed are put away, at most a bounded number a pass, each with its reason in the ledger.
+    let tidied = [];
+    try {
+        tidied = runTidy(store, clock(), releaseFactsFor(context.databaseFile), TIDY_PASS_LIMIT, { principal: "operator", repos: [repo], includeUnplaced: false });
+    }
+    catch { /* the next pass tries again */ }
     // Checkout cleanup (Settings → Storage): finished work's clean checkouts go as the setting says (by default when
     // the task is complete or cancelled); their branches stay. Each removal is in the ledger.
     // Completing or cancelling a task stops anything still running from its checkout first.
@@ -3600,6 +3624,7 @@ async function reconcileCommand(flags, context) {
         slimmed.slimmed.length === 0 &&
         landed.completed.length === 0 &&
         landedGone.length === 0 &&
+        tidied.length === 0 &&
         liveSwept.removed.length === 0;
     return succeed(write, json, "reconcile", {
         recovered,
@@ -3611,6 +3636,7 @@ async function reconcileCommand(flags, context) {
         processesStopped: [...closedRuns.map(one => ({ run: one.runId, pids: one.done.stopped.map(row => row.pid) })), ...closedCheckouts.map(one => ({ checkout: one.path, pids: one.done.stopped.map(row => row.pid) }))],
         checkoutsSlimmed: slimmed.slimmed.map(one => one.path),
         landed: { completed: landed.completed, steps: landed.steps },
+        tidied: tidied.map(one => ({ id: one.taskId, rule: one.rule, reason: one.reason })),
         liveViewsSwept: liveSwept.removed.length,
         retention: retention === null ? null : { counts: retention.counts, freedBytes: retention.freed },
         storageSweep: storageSwept,
@@ -3625,6 +3651,7 @@ async function reconcileCommand(flags, context) {
             ...closedRuns.map(one => `Run #${one.runId} ended; stopped ${stoppedWords(one.done)}.`),
             ...closedCheckouts.map(one => `${one.path}: its task finished; stopped ${stoppedWords(one.done)}.`),
             ...(landed.completed.length === 0 ? [] : [`Marked ${landed.completed.length} landed result(s) complete: ${landed.completed.join(", ")}.`]),
+            ...(tidied.length === 0 ? [] : [`Put away ${tidied.length} old task(s): ${tidied.map(one => one.taskId).join(", ")}.`]),
             ...(landedGone.length === 0 ? [] : [`Removed landed work: ${landedGone.filter(one => one.kind === "checkout").length} checkout(s), ${landedGone.filter(one => one.kind === "branch").length} local branch(es).`]),
             ...(slimmed.slimmed.length === 0 ? [] : [`Dropped dependencies and build output from ${slimmed.slimmed.length} kept checkout(s), about ${bytesWords(slimmed.slimmed.reduce((sum, one) => sum + one.bytes, 0))}.`]),
             ...(liveSwept.removed.length === 0 ? [] : [`Cleared ${liveSwept.removed.length} finished live view(s).`]),
@@ -4107,6 +4134,7 @@ async function requeueTask(positional, flags, context) {
             published: `${id}'s last result is published; revise it through its pull request`,
             // Only an Approve & build again asks for an exact build; the CLI never does.
             moved: `${id} changed since its page was read; read it again`,
+            archived: `${id} is put away — restore it with \`toolroll task restore ${id}\` first`,
         };
         return fail(write, json, "task requeue", result.reason, why[result.reason], EXIT.refused);
     }
@@ -6396,7 +6424,7 @@ async function runWatchLoop(args) {
                 base = head.stdout.trim();
             }
             const pass = await flowHousekeeping(store, repo, context.clock, flowIoOf(context, flowPool, flowGit, base), admissionStopped);
-            flowsDid(pass.flows.moved + pass.triggers.added + pass.steps.ran + pass.replies.taken, pass.flows.filed.length, `flow pass — ${pass.triggers.added} card(s) added, ${pass.replies.taken} reply(ies) taken, ${pass.steps.ran} step(s) run, ${pass.flows.moved} moved`);
+            flowsDid(pass.flows.moved + pass.triggers.added + pass.steps.ran + pass.replies.taken, pass.flows.filed.length + pass.youiyoux.filed, `flow pass — ${pass.triggers.added} card(s) added, ${pass.youiyoux.filed} youiyoux request(s) filed, ${pass.replies.taken} reply(ies) taken, ${pass.steps.ran} step(s) run, ${pass.flows.moved} moved`);
         },
     });
     const modelWatch = startMaintenance({
@@ -6936,8 +6964,6 @@ export function openBrowser(url) {
         // A browser that will not open is a URL the greeting already printed.
     }
 }
-/** Where `up` last served its console, kept beside the database so `onboard` names the same address. */
-const UP_CONSOLE_FILE = "up-console.json";
 function recordUpConsoleUrl(dir, url, now) {
     try {
         const file = join(dir, UP_CONSOLE_FILE), temporary = `${file}.${process.pid}.tmp`;
@@ -6948,15 +6974,6 @@ function recordUpConsoleUrl(dir, url, now) {
         // A display fact: a failed write only leaves onboard on the default port.
     }
 }
-export function readUpConsoleUrl(dir) {
-    try {
-        const parsed = JSON.parse(readFileSync(join(dir, UP_CONSOLE_FILE), "utf8"));
-        return typeof parsed.url === "string" && /^https?:\/\/[^\s]+$/.test(parsed.url) ? parsed.url.replace(/\/+$/, "") : null;
-    }
-    catch {
-        return null;
-    }
-}
 /** How onboard says to sign in: the saved login file only while it still works (as `up` advertises it), else the
  * account and its password; null only when there is no account yet. Never the password itself. */
 function onboardLogin(store, loginFile) {
@@ -7041,6 +7058,8 @@ async function onboardCommand(flags, context) {
                 return `off: ${checked.message}`;
             return `off: turn on with toolroll publish setup --repo ${repo} --yes (asks your password), or in Settings → Projects`;
         }),
+        // A project that uses youiyoux has its change requests filed as tasks with no step of its own (youiyoux-intake.ts).
+        youiyoux: seams.youiyoux ?? (async (repo) => youiyouxOnboardLine(store, repo)),
         starterFlag: text(flags, "starter"),
         // Starter flows belong to a person: the flow's decisions ask them. With no account yet, none can be switched on.
         starters: {
@@ -8571,6 +8590,12 @@ function taskAction(action, rest, flags, context) {
             return addTestsTask(rest, flags, context);
         case "list":
             return listTasks(flags, context);
+        case "archive":
+            return archiveTasksCommand(rest, flags, context);
+        case "restore":
+            return restoreTasksCommand(rest, flags, context);
+        case "tidy":
+            return tidyTasksCommand(rest, flags, context);
         case "show":
             return showTask(rest, context);
         case "wait":
@@ -8992,9 +9017,9 @@ function listTasks(flags, context) {
     const limit = rawLimit === undefined ? 40 : Number(rawLimit);
     if (wanted !== undefined && !STATES.includes(wanted))
         return fail(write, json, 'task list', 'usage', `--state takes one of ${STATES.join(', ')}`, EXIT.usage);
-    if (rawView !== undefined && !['all', 'needs-you', 'running', 'completed'].includes(rawView) ||
+    if (rawView !== undefined && !['all', 'needs-you', 'running', 'completed', 'archived'].includes(rawView) ||
         !Number.isSafeInteger(limit) || limit < 1 || limit > 100) {
-        return fail(write, json, 'task list', 'usage', '--view takes all, needs-you, running or completed; --limit takes 1–100', EXIT.usage);
+        return fail(write, json, 'task list', 'usage', '--view takes all, needs-you, running, completed or archived; --limit takes 1–100', EXIT.usage);
     }
     // A remote person limited to some projects (remoteLensOf) pages and counts only theirs.
     const lens = context.principal?.lens ?? null;
@@ -9021,7 +9046,8 @@ function listTasks(flags, context) {
             write(wanted === undefined ? 'The task list is empty.' : `Nothing is ${wanted}.`);
         const width = Math.max(0, ...tasks.map(task => task.id.length));
         for (const task of tasks)
-            write(`  ${task.id.padEnd(width)}  ${task.status.label.padEnd(16)}  ${task.title}`);
+            write(task.archived === undefined ? `  ${task.id.padEnd(width)}  ${task.status.label.padEnd(16)}  ${task.title}`
+                : `  ${task.id.padEnd(width)}  ${'Archived'.padEnd(16)}  ${task.title} — by ${task.archived.byKind === 'tidy' ? 'tidy' : task.archived.by}: ${task.archived.reason}`);
         if (page.nextCursor !== null)
             write(`Next page: --cursor ${page.nextCursor}`);
         return EXIT.ok;
@@ -10153,6 +10179,8 @@ function describeApproveFailure(reason, id) {
     // Approval policy, phase 1: the lead's token (or a remote API token) proves a credential, not a person.
     if (reason === "machine-proof")
         return "only a person can approve this — approve it on the task page or from your paired chat";
+    if (reason === "archived")
+        return `${id} is put away — restore it with \`toolroll task restore ${id}\` first`;
     if (reason === "second-approver")
         return `your approval of ${id} is recorded; it is protected work, so a second person needs to approve it (toolroll task approve ${id} as them)`;
     if (reason === "no-approvers") {
@@ -12758,3 +12786,180 @@ export function consoleIdentitiesInBackground(identities, paths) {
 export function writeModelRow(store, proved, scope, knownProject, slot, to, now, extra = []) {
     return applyModelChoices(store, { scope, change: slot === null ? [] : [{ slot, to }], expected: null, strict: false, knownProject, extra }, { ...proved, live: () => true }, now);
 }
+/** Putting away and restoring are a person's acts (docs/plans/task-tidy.md): never the lead's token, never a remote
+ * API token, never a machine proof. Null when a person is acting. */
+function refuseMachineTidy(context, command, method) {
+    if (machineActing() || process.env["TOOLROLL_LEAD_TOKEN"] !== undefined || (method !== undefined && !personProof(method))) {
+        return fail(context.write, context.json, command, "person-only", "Only a person puts tasks away or restores them. Use the console or your own login.", EXIT.refused);
+    }
+    return null;
+}
+/** `toolroll task archive <id...> [--reason <text>]`: put tasks away by hand (v145). Each keeps its history, results and
+ * approvals; nothing can run, claim or approve it until it is restored. Credentialed, a person's act. */
+async function archiveTasksCommand(positional, flags, context) {
+    const { store, write, json, clock } = context;
+    const command = "task archive";
+    const ids = [...new Set(positional)];
+    if (ids.length === 0 || ids.length > 100)
+        return fail(write, json, command, "usage", "`toolroll task archive <id...> [--reason <why>] --as <you> --token <t>` — 1 to 100 tasks", EXIT.usage);
+    const machine = refuseMachineTidy(context, command);
+    if (machine !== null)
+        return machine;
+    const demo = refuseDemo(context, command);
+    if (demo !== null)
+        return demo;
+    const acting = await askCredentials(flags, context);
+    // The password is proved against a project the person can see (the first task's); each task's own project is
+    // re-proved inside its put-away transaction.
+    const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token, firstVisibleRepo(store, acting.name, ids));
+    if (acting === null || !verified?.ok)
+        return refuseApprover(context, command, verified, "putting a task away takes `--as <you> --token <t>` — it is recorded against your name", ids[0]);
+    const personal = refuseMachineTidy(context, command, verified.method);
+    if (personal !== null)
+        return personal;
+    const reason = text(flags, "reason") ?? "Put away by hand";
+    const archived = [], refused = [];
+    for (const id of ids) {
+        const ref = store.lookupRef(id);
+        if (ref === null || store.getTask(id) === null || !store.accountCanAccess(acting.name, ref.repo)) {
+            refused.push({ id, reason: "unknown-task", message: `No task ${id}.` });
+            continue;
+        }
+        const done = archiveTaskFamily(store, id, { by: acting.name, byKind: "person", rule: null, reason }, clock(), { guard: refs => approverStandsNow(store, acting.name, familyRepoOf(store, refs)) });
+        if (done.ok)
+            archived.push({ id, versions: done.refs.length });
+        else
+            refused.push({ id, reason: done.reason, message: done.message });
+    }
+    const lines = () => [
+        ...archived.map(one => `Put away ${one.id}${one.versions > 1 ? ` (${one.versions} versions)` : ""}.`),
+        ...refused.map(one => `Not put away: ${one.message}`),
+        ...(archived.length === 0 ? [] : [`Restore with \`toolroll task restore ${archived.map(one => one.id).join(" ")}\`.`]),
+    ];
+    if (refused.length === 0)
+        return succeed(write, json, command, { archived, refused }, lines);
+    if (json)
+        return fail(write, json, command, refused[0].reason, refused[0].message, EXIT.refused, { archived, refused });
+    write(lines().join("\n"));
+    return EXIT.refused;
+}
+/** `toolroll task restore <id...>`: bring put-away tasks back exactly as they were (v145). Credentialed, a person's act. */
+async function restoreTasksCommand(positional, flags, context) {
+    const { store, write, json, clock } = context;
+    const command = "task restore";
+    const ids = [...new Set(positional)];
+    if (ids.length === 0 || ids.length > 100)
+        return fail(write, json, command, "usage", "`toolroll task restore <id...> --as <you> --token <t>` — 1 to 100 tasks", EXIT.usage);
+    const machine = refuseMachineTidy(context, command);
+    if (machine !== null)
+        return machine;
+    const demo = refuseDemo(context, command);
+    if (demo !== null)
+        return demo;
+    const acting = await askCredentials(flags, context);
+    const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token, firstVisibleRepo(store, acting.name, ids));
+    if (acting === null || !verified?.ok)
+        return refuseApprover(context, command, verified, "restoring takes `--as <you> --token <t>` — it is recorded against your name", ids[0]);
+    const personal = refuseMachineTidy(context, command, verified.method);
+    if (personal !== null)
+        return personal;
+    const restored = [], refused = [];
+    for (const id of ids) {
+        const ref = store.lookupRef(id);
+        if (ref === null || store.getTask(id) === null || !store.accountCanAccess(acting.name, ref.repo)) {
+            refused.push({ id, reason: "unknown-task", message: `No task ${id}.` });
+            continue;
+        }
+        const done = restoreTaskFamily(store, id, acting.name, clock(), refs => approverStandsNow(store, acting.name, familyRepoOf(store, refs)));
+        if (done.ok)
+            restored.push(id);
+        else
+            refused.push({ id, reason: done.reason, message: done.message });
+    }
+    const lines = () => [...restored.map(id => `Restored ${id}.`), ...refused.map(one => `Not restored: ${one.message}`)];
+    if (refused.length === 0)
+        return succeed(write, json, command, { restored, refused }, lines);
+    if (json)
+        return fail(write, json, command, refused[0].reason, refused[0].message, EXIT.refused, { restored, refused });
+    write(lines().join("\n"));
+    return EXIT.refused;
+}
+/** `toolroll task tidy --preview [--days N]` (read-only, no credential) and `toolroll task tidy --apply --digest <d>
+ * [--days N] [--except <id,...>]` (credentialed, a person's act): the console's Put away old tasks, word for word,
+ * with the same preview and digest. Apply puts away exactly what the preview with that digest showed. */
+async function tidyTasksCommand(positional, flags, context) {
+    const { store, write, json, clock } = context;
+    const command = "task tidy";
+    const preview = flag(flags, "preview"), apply = flag(flags, "apply");
+    const days = tidyDays(text(flags, "days"));
+    const digest = text(flags, "digest");
+    const except = (text(flags, "except") ?? "").split(",").map(one => one.trim()).filter(one => one !== "");
+    const usage = "`toolroll task tidy --preview [--days N]`, then `toolroll task tidy --apply --digest <d> [--days N] [--except <id,...>]`";
+    if (positional.length > 0 || preview === apply || days === null || (preview && (digest !== undefined || except.length > 0)) || (apply && digest === undefined))
+        return fail(write, json, command, "usage", usage, EXIT.usage);
+    const releases = releaseFactsFor(context.databaseFile);
+    // One scope for the preview and the apply: `--as <you>` previews exactly your projects (no password: it reads), and
+    // the apply reads the same person's projects, so an unchanged list keeps its digest.
+    // Whose lists: `--as <you>`, else this machine's saved login (`toolroll up`), else everything (an unrestricted
+    // person's list; a person limited to some projects previews with --as).
+    const previewAs = text(flags, "as") ?? readLoginFile(join(dirname(context.databaseFile), UP_LOGIN_FILE))?.name;
+    const daysArg = `${days === TIDY_DEFAULT_DAYS ? "" : ` --days ${days}`}${previewAs === undefined ? "" : ` --as ${previewAs}`}`;
+    // `--as` only ever narrows: the named person's projects within the caller's own lens, never beyond it.
+    const lens = context.principal?.lens ?? null;
+    const own = { principal: "operator", repos: lens, includeUnplaced: lens === null };
+    const access = previewAs !== undefined ? withinLens(accessOf(store, previewAs), lens) : own;
+    if (preview) {
+        const items = tidyPreview(store, clock(), { releases, days, access });
+        const shown = tidyDigest(items, days);
+        const groups = tidyGroups(items, days);
+        const next = `toolroll task tidy --apply --digest ${shown}${daysArg}`;
+        return succeed(write, json, command, { preview: true, days, digest: shown, count: items.length, groups, next: items.length === 0 ? null : next,
+            ...(releases.problem === null ? {} : { releasesSkipped: releases.problem }) }, () => items.length === 0
+            ? ["Nothing to put away."]
+            : [`Put away old tasks: ${items.length} task${items.length === 1 ? "" : "s"}.`,
+                ...groups.flatMap(group => ["", `${group.label} (${group.items.length})`, ...group.items.map(one => `  ${one.taskId}  ${one.reason}${one.members.length > 1 ? ` (${one.members.length} versions)` : ""}`)]),
+                ...(releases.problem === null ? [] : ["", `Release tasks were left out: ${releases.problem}.`]),
+                "", `To put these away, run: ${next}`, "Leave some out with --except <id,...>.",
+                ...(previewAs === undefined ? ["Limited to some projects? Preview with --as <you> so the list is yours."] : [])]);
+    }
+    const machine = refuseMachineTidy(context, command);
+    if (machine !== null)
+        return machine;
+    const demo = refuseDemo(context, command);
+    if (demo !== null)
+        return demo;
+    const acting = await askCredentials(flags, context);
+    const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token, firstVisibleRepo(store, acting.name, []));
+    if (acting === null || !verified?.ok)
+        return refuseApprover(context, command, verified, "putting tasks away takes `--as <you> --token <t>` — it is recorded against your name", undefined);
+    const personal = refuseMachineTidy(context, command, verified.method);
+    if (personal !== null)
+        return personal;
+    // The person's own view of the lists, from the verified credential (never a flag), within the caller's lens: the
+    // same scope `--preview --as <them>` read.
+    const mine = withinLens(accessOf(store, acting.name), lens);
+    const shownItems = tidyPreview(store, clock(), { releases, days, access: mine });
+    const only = except.length === 0 ? null : shownItems.map(one => one.taskId).filter(id => !except.includes(id));
+    if (except.some(id => !shownItems.some(one => one.taskId === id)))
+        return fail(write, json, command, "outside", "--except names a task that isn't in the list. Check it again with --preview.", EXIT.refused);
+    const done = applyTidy(store, clock(), { by: acting.name, days, digest: digest, only, releases, access: mine });
+    if (!done.ok) {
+        const again = `toolroll task tidy --apply --digest ${done.digest}${daysArg}`;
+        return fail(write, json, command, done.reason, done.reason === "changed" ? `${done.message} Look again with \`toolroll task tidy --preview${daysArg}\`.` : done.message, EXIT.refused, { digest: done.digest, count: done.items.length, ...(done.reason === "changed" ? { next: done.items.length === 0 ? null : again } : {}) });
+    }
+    return succeed(write, json, command, { archived: done.archived.map(one => ({ id: one.taskId, rule: one.rule, reason: one.reason })), skipped: done.skipped }, () => [
+        `Put away ${done.archived.length} task${done.archived.length === 1 ? "" : "s"}.`,
+        ...done.skipped.map(one => `Not put away: ${one.message}`),
+        "Find them with `toolroll task list --view archived`; bring one back with `toolroll task restore <id>`.",
+    ]);
+}
+/** The project a put-away or restore proves the person's password against: the first named task's, when they can see
+ * it; otherwise the first project they can see at all (null when none: an unrestricted person, or none to prove). */
+function firstVisibleRepo(store, name, ids) {
+    for (const id of ids) {
+        const repo = store.lookupRef(id)?.repo ?? null;
+        if (repo !== null && store.accountCanAccess(name, repo))
+            return repo;
+    }
+    return store.accountCanAccess(name, null) ? null : store.knownRepos().find(repo => store.accountCanAccess(name, repo)) ?? null;
+}

package/dist/project-activity.d.ts

@@ -0,0 +1,20 @@
+/** Shared presentation for browser and no-script Activity; facts come only
+ * from projectOutcomes. No alternate counting or status interpretation. */
+import type { ActivityFamily, ProjectOutcomes } from './project-outcomes.js';
+export declare const activityAge: (ms: number | null) => string;
+export declare const activityMoney: (usd: number | null) => string;
+export declare const ACTIVITY_ACTORS: {
+    human: string;
+    lead: string;
+    landed: string;
+    'machine-or-unknown': string;
+};
+export type ActivityMetric = {
+    label: string;
+    value: string;
+    detail: string;
+    rows: ActivityFamily[];
+};
+export declare const activityScope: (report: ProjectOutcomes) => string;
+export declare const activityLimit: (report: ProjectOutcomes) => string;
+export declare function activityMetrics(report: ProjectOutcomes): ActivityMetric[];

package/dist/project-activity.js

@@ -0,0 +1,23 @@
+export const activityAge = (ms) => ms === null ? 'Unknown' : ms < 3600000 ? `${Math.floor(ms / 60000)}m` : ms < 86400000 ? `${(ms / 3600000).toFixed(1)}h` : `${(ms / 86400000).toFixed(1)}d`;
+export const activityMoney = (usd) => usd === null ? 'Unknown' : `$${usd.toFixed(2)}`;
+export const ACTIVITY_ACTORS = { human: 'Human', lead: 'Lead', landed: 'Automatically landed', 'machine-or-unknown': 'Machine or unknown' };
+export const activityScope = (report) => `Current Ready backlog; completions in the last ${report.days} days. Completion does not mean checks passed or work deployed.`;
+export const activityLimit = (report) => `Partial report: only the ${report.limit} most recently updated eligible families are included. Counts and coverage below describe this sample.`;
+export function activityMetrics(report) {
+    const ready = report.families.filter(one => one.state === 'ready');
+    const complete = report.families.filter(one => one.state === 'completed');
+    const metrics = [
+        { label: 'Ready', value: report.ready.count === 0 ? '0' : `${report.ready.count} · Oldest ${activityAge(report.ready.oldestFinishedAgeMs)}`,
+            detail: `Age is measured from the latest result finishing, a proxy for Ready entry. ${report.ready.dated}/${report.ready.count} have usable timestamps.`, rows: ready },
+        { label: 'Finished to decision', value: report.completed.count === 0 ? 'No completed families' : `${activityAge(report.finishedToDecision.meanMs)} average`,
+            detail: `${report.finishedToDecision.samples}/${report.completed.count} completed families have usable timestamps. Elapsed time to the saved completion decision, not human work time.`, rows: complete },
+        { label: 'Explicit revisions', value: report.revisions.perCompletedFamily === null ? 'No completed families' : `${report.revisions.perCompletedFamily.toFixed(1)} per completed family`,
+            detail: `${report.revisions.count} revisions across ${report.revisions.samples} completed families. Retries are attempts, not revisions.`, rows: complete },
+        { label: 'Recorded spend', value: report.completed.count === 0 ? 'No completed families' : `${activityMoney(report.cost.recordedPerCompletedFamilyUsd)} per completed family · ${report.cost.knownRuns}/${report.cost.runs} costs known`,
+            detail: `${activityMoney(report.cost.recordedUsd)} in API charges across ${report.cost.families} completed families; ${report.cost.fullyCostedFamilies}/${report.cost.families} fully costed.${report.cost.subscriptionRuns > 0 ? ` ${report.cost.subscriptionRuns} subscription runs are plan usage, not charges${report.cost.subscriptionReportedUsd === null ? '' : ` (${activityMoney(report.cost.subscriptionReportedUsd)} reported)`}.` : ''} Missing or unreported costs are unknown. All family attempts count once, including planning and retries.`, rows: complete },
+        { label: 'Completed families', value: String(report.completed.count),
+            detail: `${Object.entries(report.completed.actors).map(([key, count]) => `${ACTIVITY_ACTORS[key]}: ${count}`).join(' · ')}. Scouts: ${report.completed.scouts}. Failed checks: ${report.completed.failedChecks}.`, rows: complete },
+        ...(report.incompleteHistory > 0 ? [{ label: 'Incomplete history', value: String(report.incompleteHistory), detail: 'Excluded from completion averages; their family relationships cannot be established.', rows: report.families.filter(one => one.state === 'history-unavailable') }] : []),
+    ];
+    return report.completed.count === 0 ? metrics.filter(one => one.label === 'Ready' || one.label === 'Completed families' || one.label === 'Incomplete history') : metrics;
+}

package/dist/project-cli.d.ts

@@ -12,6 +12,7 @@ export declare function runProjectCommand(positional: readonly string[], flags:
     write: (line: string) => void;
     json: boolean;
     registryFile?: string;
+    now?: Date;
 }): Promise<number>;
 /** Only known credential-aware adapters consume the remembered reference.
  * Explicit credentials always win; no legacy action gains implicit authority. */

package/dist/project-cli.js

@@ -8,6 +8,7 @@ import { configPath, loadRepos } from './repos.js';
 import { authenticateCoordinator } from './coordinator.js';
 import { canonicalProject } from './project.js';
 import { envelopeJson } from './envelope.js';
+import { projectOutcomes } from './project-outcomes.js';
 export const projectProfilePath = (databaseFile) => join(dirname(databaseFile), 'cli-project.json');
 export function readProjectProfile(databaseFile) {
     const file = projectProfilePath(databaseFile);
@@ -25,11 +26,29 @@ export function readProjectProfile(databaseFile) {
         throw new Error('The saved CLI project is invalid. Select it again with project use.');
     return { version: 1, repo: p['repo'], tokenFile: p['tokenFile'] };
 }
+function scopedCredentialRefusal(store, tokenFile, repo) {
+    let token;
+    try {
+        const info = statSync(tokenFile);
+        if (!info.isFile() || info.size > 16_384)
+            return { reason: 'unauthenticated', message: 'The scoped credential file is unavailable.' };
+        token = readFileSync(tokenFile, 'utf8').trim();
+    }
+    catch {
+        return { reason: 'unauthenticated', message: 'The scoped credential file is unavailable.' };
+    }
+    const auth = authenticateCoordinator(store, token);
+    if (!auth.ok)
+        return { reason: 'unauthenticated', message: 'The scoped credential is invalid or revoked.' };
+    if (!auth.who.repos.includes(repo))
+        return { reason: 'not-found', message: 'That project is unavailable to this credential.' };
+    return null;
+}
 export async function runProjectCommand(positional, flags, context) {
     const action = positional[0] ?? 'show', command = `project ${action}`;
     const fail = (reason, message) => { context.write(context.json ? envelopeJson({ ok: false, command, reason, message }) : message); return reason === 'usage' ? 2 : 3; };
-    if (!['use', 'show'].includes(action) || positional.length > (action === 'use' ? 2 : 1))
-        return fail('usage', 'Use project use <saved checkout path> [--token-file PATH], or project show.');
+    if (!['use', 'show', 'activity'].includes(action) || positional.length > (action === 'use' ? 2 : 1))
+        return fail('usage', 'Use project use <saved checkout path> [--token-file PATH], project show, or project activity [--json].');
     const allowed = new Set(['db', 'json', ...(action === 'use' ? ['token-file'] : [])]);
     for (const name of flags.keys())
         if (!allowed.has(name))
@@ -57,23 +76,9 @@ export async function runProjectCommand(positional, flags, context) {
         if (credential !== undefined && (typeof credential !== 'string' || !credential || /[\x00-\x1f]/.test(credential)))
             return fail('usage', '--token-file requires a path.');
         const tokenFile = typeof credential === 'string' ? resolve(credential) : null;
-        if (tokenFile !== null) {
-            let token;
-            try {
-                const info = statSync(tokenFile);
-                if (!info.isFile() || info.size > 16_384)
-                    return fail('unauthenticated', 'The scoped credential file is unavailable.');
-                token = readFileSync(tokenFile, 'utf8').trim();
-            }
-            catch {
-                return fail('unauthenticated', 'The scoped credential file is unavailable.');
-            }
-            const auth = authenticateCoordinator(context.store, token);
-            if (!auth.ok)
-                return fail('unauthenticated', 'The scoped credential is invalid or revoked.');
-            if (!auth.who.repos.includes(repo))
-                return fail('not-found', 'That project is unavailable to this credential.');
-        }
+        const refused = tokenFile === null ? null : scopedCredentialRefusal(context.store, tokenFile, repo);
+        if (refused)
+            return fail(refused.reason, refused.message);
         profile = { version: 1, repo, tokenFile };
         const file = projectProfilePath(context.databaseFile), temp = `${file}.${randomBytes(6).toString('hex')}.tmp`;
         mkdirSync(dirname(file), { recursive: true });
@@ -82,6 +87,18 @@ export async function runProjectCommand(positional, flags, context) {
     }
     else
         profile = readProjectProfile(context.databaseFile);
+    if (action === 'activity') {
+        if (profile === null || !repos.includes(profile.repo))
+            return fail('not-found', 'Select a saved project with project use first.');
+        const refused = profile.tokenFile === null ? null : scopedCredentialRefusal(context.store, profile.tokenFile, profile.repo);
+        if (refused)
+            return fail(refused.reason, refused.message);
+        // Like assignment brief, an uncredentialed local database read has the
+        // local operator's access. A saved scoped credential is always re-proved.
+        const result = projectOutcomes(context.store, profile.repo, context.now ?? new Date(), { principal: 'operator', repos: [profile.repo] });
+        context.write(context.json ? envelopeJson({ ok: true, command, result }) : JSON.stringify(result, null, 2));
+        return 0;
+    }
     const result = { profile, saved: profile !== null && repos.includes(profile.repo) };
     context.write(context.json ? envelopeJson({ ok: true, command, result }) : profile === null ? 'No project selected. Use project use <saved checkout path>.' : `${profile.repo}${result.saved ? '' : ' (no longer saved)'}\n${profile.tokenFile === null ? 'Uses your existing local sign-in for operator actions.' : `Scoped credential reference: ${profile.tokenFile}`}`);
     return 0;

package/dist/project-delete.js

@@ -86,7 +86,9 @@ export function projectRunning(store, repo, now) {
     const chats = count("SELECT COUNT(*) AS n FROM mate_turn WHERE state IN ('queued','running') AND id IN (SELECT value FROM json_each(?))", json(d.turns));
     const steps = count("SELECT COUNT(*) AS n FROM flow_step_run WHERE state = 'running' AND card IN (SELECT value FROM json_each(?))", json(d.cards));
     const calls = count("SELECT COUNT(*) AS n FROM subagent_call WHERE state = 'running' AND subagent IN (SELECT value FROM json_each(?))", json(d.subagents));
-    const merges = count(`SELECT COUNT(*) AS n FROM merge_intent WHERE state IN ('claimed','firing') AND publication IN (SELECT id FROM publication WHERE task_ref IN (SELECT value FROM json_each(?)))`, json(d.refs));
+    const merges = count(`SELECT COUNT(*) AS n FROM merge_intent WHERE state IN ('claimed','firing') AND publication IN (SELECT id FROM publication WHERE task_ref IN (SELECT value FROM json_each(?)))`, json(d.refs))
+        // A person's merge between its last check and GitHub's answer (v145); a row older than 15 minutes is a crash.
+        + count("SELECT COUNT(*) AS n FROM merge_in_flight WHERE at > ? AND task_ref IN (SELECT value FROM json_each(?))", new Date(now.getTime() - 15 * 60_000).toISOString(), json(d.refs));
     const checkouts = count("SELECT COUNT(*) AS n FROM worktree WHERE repo = ? AND runner IS NOT NULL AND released_at IS NULL", repo);
     return [
         ...(building > 0 ? [`${plural(building, "task")} ${building === 1 ? "is" : "are"} being built`] : []),
@@ -267,6 +269,8 @@ function deleteRows(store, repo, d, now) {
     del("skill_test", `${IN("task_ref")} OR ${IN("source_run")}`, T, R);
     del("merge_blocker", `${IN("publication")} OR ${IN("task_id")}`, publications, K);
     del("merge_intent", IN("publication"), publications);
+    del("merge_in_flight", IN("publication"), publications);
+    del("deploy_in_flight", IN("task_ref"), T);
     del("publication", IN("id"), publications);
     del("artifact", IN("id"), A);
     // Tasks and their versions.
@@ -282,7 +286,7 @@ function deleteRows(store, repo, d, now) {
     del("workflow_preview", "repo = ?", repo);
     del("coding_handoff_scope", `id IN (SELECT id FROM coding_handoff WHERE json_extract(payload, '$.repo') = ?)`, repo);
     del("coding_handoff", "json_extract(payload, '$.repo') = ?", repo);
-    for (const table of ["task_act", "task_replacement"])
+    for (const table of ["task_act", "task_replacement", "task_archive"])
         del(table, IN("task_ref"), T);
     del("task_ref", IN("id"), T);
     del("task_scope", IN("task_id"), K);
@@ -293,7 +297,7 @@ function deleteRows(store, repo, d, now) {
     del("flow_trigger", IN("flow"), F);
     del("flow_unattended_run", `grant_id IN (SELECT id FROM flow_unattended_grant WHERE ${IN("flow")})`, F);
     del("flow_unattended_grant", IN("flow"), F);
-    for (const table of ["flow_card_watcher", "flow_comment", "flow_event", "flow_mail", "flow_step_run"])
+    for (const table of ["flow_card_watcher", "flow_comment", "flow_event", "flow_mail", "flow_step_run", "flow_step_task"])
         del(table, IN("card"), C);
     del("subagent_question", IN("id"), questions);
     del("subagent_call", `${IN("subagent")} OR ${IN("card")}`, M, C);