toolroll 0.9.84 → 0.9.86

package/dist/project-knowledge.d.ts

@@ -23,17 +23,18 @@ export declare function knowledgeVersion(store: Store, repo: string, actor: stri
 /** Chat reads only an admitted project. Keep the full source in the project UI. */
 export declare function conversationKnowledge(store: Store, repo: string, actor: string, reference?: string, decision?: number): {
     title?: never;
+    content?: never;
     revision: number;
     stale: boolean;
     notice: string;
     decision?: never;
-    content?: never;
     history?: never;
     instructions?: never;
     references?: never;
     decisions?: never;
 } | {
     title?: never;
+    content?: never;
     stale?: never;
     decision: {
         repo: string;
@@ -50,7 +51,6 @@ export declare function conversationKnowledge(store: Store, repo: string, actor:
         id: number;
     };
     notice: string;
-    content?: never;
     revision?: never;
     history?: never;
     instructions?: never;
@@ -69,9 +69,9 @@ export declare function conversationKnowledge(store: Store, repo: string, actor:
     decisions?: never;
 } | {
     title?: never;
+    content?: never;
     stale?: never;
     decision?: never;
-    content?: never;
     revision: number;
     history: {
         revision: number;

package/dist/project-outcomes.d.ts

@@ -0,0 +1,119 @@
+import type { Store } from './store.js';
+import type { WorkSummaryAccess } from './work-summary.js';
+export declare const ACTIVITY_DAYS = 60;
+export declare const ACTIVITY_LIMIT = 500;
+export type CompletionActor = 'human' | 'lead' | 'landed' | 'machine-or-unknown';
+export type ActivityFamily = {
+    root: string;
+    task: string;
+    title: string;
+    run: number | null;
+    href: string;
+    state: 'ready' | 'completed' | 'history-unavailable';
+    kind: string;
+    finishedAt: string | null;
+    completedAt: string | null;
+    actor: CompletionActor | null;
+    checks: string;
+    revisions: number | null;
+    elapsedMs: number | null;
+    runs: number;
+    /** Runs whose amount is known (reported-usage.ts runAmountOf): API dollars or subscription usage. */
+    knownCostRuns: number;
+    subscriptionRuns: number;
+    /** API dollars only; subscription usage is never added to them. */
+    recordedUsd: number | null;
+    subscriptionReportedUsd: number | null;
+    /** Every attempt billed in known API dollars; otherwise the family's dollar total is unknown. */
+    totalUsd: number | null;
+};
+export type ProjectOutcomes = {
+    asOf: string;
+    since: string;
+    days: number;
+    limit: number;
+    truncated: boolean;
+    ready: {
+        count: number;
+        oldestFinishedAgeMs: number | null;
+        dated: number;
+    };
+    completed: {
+        count: number;
+        actors: Record<CompletionActor, number>;
+        scouts: number;
+        failedChecks: number;
+    };
+    finishedToDecision: {
+        meanMs: number | null;
+        samples: number;
+    };
+    revisions: {
+        count: number;
+        perCompletedFamily: number | null;
+        samples: number;
+    };
+    cost: {
+        recordedUsd: number | null;
+        recordedPerCompletedFamilyUsd: number | null;
+        runs: number;
+        knownRuns: number;
+        subscriptionRuns: number;
+        subscriptionReportedUsd: number | null;
+        fullyCostedFamilies: number;
+        families: number;
+    };
+    incompleteHistory: number;
+    families: ActivityFamily[];
+};
+/** Callers supply their current authenticated ceiling. A path alone grants no access. */
+export declare function projectOutcomes(store: Store, project: string, now: Date, access: WorkSummaryAccess): ProjectOutcomes;
+/** The lead's page of one report: every aggregate unchanged, family rows in pages bounded by count AND by their
+ * serialized size, so the reply always fits the tool-result cap (lead.ts, converse.ts LEAD_TOOL_RESULT_CAP_BYTES) and
+ * the lead reads further with nextOffset. Long ids and titles are shortened; an over-long link is left out. */
+export declare const ACTIVITY_LEAD_PAGE = 10;
+export declare const ACTIVITY_LEAD_PAGE_BYTES = 12000;
+export declare function projectOutcomesPage(report: ProjectOutcomes, offset?: number): {
+    asOf: string;
+    since: string;
+    days: number;
+    limit: number;
+    truncated: boolean;
+    ready: {
+        count: number;
+        oldestFinishedAgeMs: number | null;
+        dated: number;
+    };
+    completed: {
+        count: number;
+        actors: Record<CompletionActor, number>;
+        scouts: number;
+        failedChecks: number;
+    };
+    finishedToDecision: {
+        meanMs: number | null;
+        samples: number;
+    };
+    revisions: {
+        count: number;
+        perCompletedFamily: number | null;
+        samples: number;
+    };
+    cost: {
+        recordedUsd: number | null;
+        recordedPerCompletedFamilyUsd: number | null;
+        runs: number;
+        knownRuns: number;
+        subscriptionRuns: number;
+        subscriptionReportedUsd: number | null;
+        fullyCostedFamilies: number;
+        families: number;
+    };
+    incompleteHistory: number;
+    families: (Omit<ActivityFamily, "href"> & {
+        href: string | null;
+    })[];
+    familiesTotal: number;
+    familiesOffset: number;
+    nextOffset: number | null;
+};

package/dist/project-outcomes.js

@@ -0,0 +1,79 @@
+/** Read-only Activity. A completion is a saved decision, never a claim of
+ * passing checks, deployment, review labor, or improved productivity. */
+import { chatResultHref } from './chat-controls.js';
+import { workOutcomeRows } from './work-index.js';
+import { COMPLETION_BY_PERSON, LANDED_ACTOR } from './result-completion.js';
+export const ACTIVITY_DAYS = 60;
+export const ACTIVITY_LIMIT = 500;
+const text = (value) => value == null ? null : String(value);
+const duration = (from, to) => {
+    const delta = from === null ? NaN : Date.parse(to) - Date.parse(from);
+    return Number.isFinite(delta) && delta >= 0 ? delta : null;
+};
+const actorOf = (actor, detail, byLead) => actor === LANDED_ACTOR ? 'landed'
+    : byLead || actor?.startsWith('lead:') ? 'lead'
+        : actor?.startsWith('operator:') && detail === COMPLETION_BY_PERSON ? 'human' : 'machine-or-unknown';
+/** Callers supply their current authenticated ceiling. A path alone grants no access. */
+export function projectOutcomes(store, project, now, access) {
+    if (access.repos !== null && !access.repos.includes(project))
+        throw new Error('Project activity is outside your access.');
+    const asOf = now.toISOString(), since = new Date(now.getTime() - ACTIVITY_DAYS * 86400000).toISOString();
+    const rows = workOutcomeRows(store, now, access, project, since, ACTIVITY_LIMIT);
+    const families = rows.slice(0, ACTIVITY_LIMIT).map(row => {
+        const state = row['code'] === 'complete' ? 'completed' : row['code'] === 'ready-to-check' ? 'ready' : 'history-unavailable';
+        const finishedAt = text(row['finished_at']), completedAt = text(row['checked_at']);
+        const runs = Number(row['runs']), apiRuns = Number(row['api_runs']), subscriptionRuns = Number(row['subscription_runs']);
+        const recordedUsd = apiRuns > 0 && Number.isFinite(Number(row['api_microusd'])) ? Number(row['api_microusd']) / 1_000_000 : null;
+        const subscriptionReportedUsd = row['subscription_usd'] != null && Number.isFinite(Number(row['subscription_usd'])) ? Number(row['subscription_usd']) : null;
+        const knownCostRuns = apiRuns + subscriptionRuns;
+        const task = String(row['task_id']);
+        return { root: String(row['root_id']), task, title: String(row['title']), run: row['result_id'] == null ? null : Number(row['result_id']),
+            href: row['result_id'] == null ? `/t/${encodeURIComponent(task)}` : chatResultHref(task, Number(row['result_id'])), state, kind: text(row['result_role']) ?? 'unknown',
+            finishedAt, completedAt, actor: state === 'completed' ? actorOf(text(row['checked_actor']), text(row['checked_detail']), Number(row['completed_by_lead']) === 1) : null,
+            checks: text(row['check_status']) ?? 'not-recorded', revisions: state === 'history-unavailable' ? null : Number(row['version_count']) - 1,
+            elapsedMs: duration(finishedAt, completedAt ?? asOf), runs, knownCostRuns, subscriptionRuns, recordedUsd, subscriptionReportedUsd,
+            totalUsd: runs > 0 && runs === apiRuns ? recordedUsd : null };
+    });
+    const ready = families.filter(one => one.state === 'ready'), completed = families.filter(one => one.state === 'completed');
+    const times = completed.flatMap(one => one.elapsedMs === null ? [] : [one.elapsedMs]);
+    const ages = ready.flatMap(one => one.elapsedMs === null ? [] : [one.elapsedMs]);
+    const actors = { human: 0, lead: 0, landed: 0, 'machine-or-unknown': 0 };
+    for (const one of completed)
+        actors[one.actor]++;
+    const knownRuns = completed.reduce((sum, one) => sum + one.knownCostRuns, 0);
+    const recordedUsd = completed.some(one => one.recordedUsd !== null) ? completed.reduce((sum, one) => sum + (one.recordedUsd ?? 0), 0) : null;
+    const subscriptionRuns = completed.reduce((sum, one) => sum + one.subscriptionRuns, 0);
+    const subscriptionReportedUsd = completed.some(one => one.subscriptionReportedUsd !== null) ? completed.reduce((sum, one) => sum + (one.subscriptionReportedUsd ?? 0), 0) : null;
+    const revisions = completed.reduce((sum, one) => sum + (one.revisions ?? 0), 0);
+    return { asOf, since, days: ACTIVITY_DAYS, limit: ACTIVITY_LIMIT, truncated: rows.length > ACTIVITY_LIMIT,
+        ready: { count: ready.length, oldestFinishedAgeMs: ages.length ? Math.max(...ages) : null, dated: ages.length },
+        completed: { count: completed.length, actors, scouts: completed.filter(one => one.kind === 'scout').length, failedChecks: completed.filter(one => one.checks === 'failed').length },
+        finishedToDecision: { meanMs: times.length ? times.reduce((a, b) => a + b, 0) / times.length : null, samples: times.length },
+        revisions: { count: revisions, perCompletedFamily: completed.length ? revisions / completed.length : null, samples: completed.length },
+        cost: { recordedUsd, recordedPerCompletedFamilyUsd: completed.length && recordedUsd !== null ? recordedUsd / completed.length : null,
+            runs: completed.reduce((sum, one) => sum + one.runs, 0), knownRuns, subscriptionRuns, subscriptionReportedUsd, fullyCostedFamilies: completed.filter(one => one.totalUsd !== null).length, families: completed.length },
+        incompleteHistory: families.filter(one => one.state === 'history-unavailable').length, families };
+}
+/** The lead's page of one report: every aggregate unchanged, family rows in pages bounded by count AND by their
+ * serialized size, so the reply always fits the tool-result cap (lead.ts, converse.ts LEAD_TOOL_RESULT_CAP_BYTES) and
+ * the lead reads further with nextOffset. Long ids and titles are shortened; an over-long link is left out. */
+export const ACTIVITY_LEAD_PAGE = 10;
+export const ACTIVITY_LEAD_PAGE_BYTES = 12_000;
+const shorten = (value, max) => [...value].length > max ? `${[...value].slice(0, max - 1).join('')}…` : value;
+const embeddedBytes = (value) => Buffer.byteLength(JSON.stringify(JSON.stringify(value)), 'utf8');
+export function projectOutcomesPage(report, offset = 0) {
+    const start = Math.max(0, Math.min(Number.isSafeInteger(offset) ? offset : 0, report.families.length));
+    const page = [];
+    const base = { ...report, families: page, familiesTotal: report.families.length, familiesOffset: start, nextOffset: null };
+    for (const one of report.families.slice(start, start + ACTIVITY_LEAD_PAGE)) {
+        const row = { ...one, root: shorten(one.root, 200), task: shorten(one.task, 200), title: shorten(one.title, 80), href: Buffer.byteLength(one.href) > 512 ? null : one.href };
+        page.push(row);
+        if (page.length > 1 && embeddedBytes(base) > ACTIVITY_LEAD_PAGE_BYTES) {
+            page.pop();
+            break;
+        }
+    }
+    const next = start + page.length;
+    base.nextOffset = next < report.families.length ? next : null;
+    return base;
+}

package/dist/pull-request-flow.js

@@ -14,7 +14,7 @@
  * read must show the PR open, on the accepted commit, with checks passing; GitHub's head-commit match guards
  * the race; the branch is deleted; the merge commit and who merged are recorded in the ledger.
  */
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { run as execRun } from "./exec.js";
 import { bodyHashOf, publicationBody, publicationGrantOf } from "./publish.js";
 import { failingChecks, summarizeChecks } from "./pulls.js";
@@ -23,7 +23,7 @@ import { requestResultChanges } from "./result-actions.js";
 import { revisionSourceOf } from "./result-review.js";
 import { authenticateApprover, personProof } from "./scope.js";
 import { BRANCH_PREFIX, headWithin } from "./names.js";
-import { NIGHTLY_CHECK_ONLY, RELEASE_MERGES_ONLY, nightlyTaskRef, releaseTaskRef } from "./store.js";
+import { NIGHTLY_CHECK_ONLY, RELEASE_MERGES_ONLY, nightlyTaskRef, refArchived, releaseTaskRef } from "./store.js";
 import { belongsToRelease } from "./release-authority.js";
 import { autoReleaseSealed } from "./release-auto.js";
 import { fullCheckGate, requestFollowUpChecks } from "./result-follow-ups.js";
@@ -292,6 +292,9 @@ export async function followPullRequests(store, seen, options) {
             continue;
         const pr = publication.prNumber;
         const taskId = taskIdOf(store, publication);
+        // A put-away task (v145) gets no automatic revision, merge or ready notice: restoring it resumes following.
+        if (refArchived(store, publication.taskRef))
+            continue;
         if (one.remoteState === "MERGED") {
             updateFollow(store, publication.id, { merge_commit: one.mergeCommit ?? "", merged_by: "GitHub", merged_at: clock().toISOString() }, clock());
             continue;
@@ -397,6 +400,8 @@ export async function mergePullRequest(store, input) {
     // The nightly check of main (release-once.md, part 3) is a check only: it never merges.
     const mergedRun = store.getRun(input.runId);
     const mergedTask = mergedRun === null ? null : store.refById(mergedRun.taskRef)?.externalId ?? null;
+    if (mergedRun !== null && refArchived(store, mergedRun.taskRef))
+        return refuse("archived", "This task is put away. Restore it before merging.");
     if (mergedTask !== null && store.handle.prepare("SELECT 1 AS hit FROM nightly_check WHERE task = ?").get(mergedTask) !== undefined)
         return refuse("check-only", "The nightly check of main is only a check; it never merges.");
     // A release's task merges only through `toolroll release` (release-once.md), which proves the live release, reserves
@@ -470,8 +475,34 @@ export async function mergePullRequest(store, input) {
         return fail("moved", "The pull request has commits that weren't part of the completed result, so it won't be merged from here.");
     if (before.checks !== "passing")
         return fail("checks", before.checks === "failing" ? "Checks are failing, so it can't merge." : before.checks === "running" ? "Checks are still running. Merge once they pass." : "No checks have reported yet. Merge once they pass.");
-    const merged = await exec("gh", ["pr", "merge", pr, "--repo", publication.githubRepo, `--${method}`, "--match-head-commit", publication.headSha, "--delete-branch"], { timeoutMs: EXEC_TIMEOUT_MS, env: { GH_PROMPT_DISABLED: "1", GH_NO_UPDATE_NOTIFIER: "1" } });
-    const after = await view();
+    // The merge is reserved with the put-away check in one write (v145): a put away that committed first refuses it, and
+    // one that comes after waits for GitHub's answer (the reservation counts as work going on).
+    // One merge at a time, each owning its reservation by its token: a second caller is refused, and each releases only its own.
+    const token = randomUUID();
+    const reserved = store.transact(() => {
+        if (refArchived(store, publication.taskRef))
+            return "archived";
+        if (store.handle.prepare("SELECT 1 FROM hold WHERE task_ref = ? AND owner_id LIKE 'project-delete:%' AND (until IS NULL OR until > ?)").get(publication.taskRef, clock().toISOString()) !== undefined)
+            return "deleting";
+        if (store.handle.prepare("SELECT 1 FROM merge_in_flight WHERE publication = ? AND at > ?").get(publication.id, new Date(clock().getTime() - 15 * 60_000).toISOString()) !== undefined)
+            return "merging";
+        store.handle.prepare("INSERT OR REPLACE INTO merge_in_flight (publication, task_ref, token, by, at) VALUES (?, ?, ?, ?, ?)").run(publication.id, publication.taskRef, token, input.by, clock().toISOString());
+        return "ok";
+    });
+    if (reserved === "archived")
+        return refuse("archived", "This task is put away. Restore it before merging.");
+    if (reserved === "deleting")
+        return refuse("deleting", "This task's project is being deleted, so nothing merges.");
+    if (reserved === "merging")
+        return refuse("merging", "This pull request is already being merged. Wait for that to finish.");
+    let merged, after;
+    try {
+        merged = await exec("gh", ["pr", "merge", pr, "--repo", publication.githubRepo, `--${method}`, "--match-head-commit", publication.headSha, "--delete-branch"], { timeoutMs: EXEC_TIMEOUT_MS, env: { GH_PROMPT_DISABLED: "1", GH_NO_UPDATE_NOTIFIER: "1" } });
+        after = await view();
+    }
+    finally {
+        store.handle.prepare("DELETE FROM merge_in_flight WHERE publication = ? AND token = ?").run(publication.id, token);
+    }
     if (after?.state === "MERGED") {
         record(after.commit, input.by);
         return { ok: true, commit: after.commit };

package/dist/result-actions.d.ts

@@ -1,4 +1,5 @@
 import type { Store } from "./store.js";
+import { type FeedbackImage } from "./result-review.js";
 export type RevisionResult = {
     ok: true;
     id: string;
@@ -8,6 +9,8 @@ export type RevisionResult = {
     message: string;
 };
 type RevisionInput = Parameters<typeof createResultRevision>[2];
+/** Re-prove image custody and current result at each write. No file paths supplied by callers. */
+export declare function feedbackImageProblem(store: Store, root: string, runId: number, image: FeedbackImage | null | undefined): string | null;
 /** One user action: add the typed change and seal exactly the displayed
  * saved notes. A refusal rolls back the note; a replay returns the same task. */
 export declare function requestResultChanges(store: Store, evidenceRoot: string, input: RevisionInput & {
@@ -15,6 +18,7 @@ export declare function requestResultChanges(store: Store, evidenceRoot: string,
     path: string;
     line: string;
     request: string | null;
+    image?: FeedbackImage | null;
 }, now: Date): RevisionResult;
 export declare function createResultRevision(store: Store, evidenceRoot: string, input: {
     run: number;

package/dist/result-actions.js

@@ -1,13 +1,33 @@
+import { verifyResultImage } from "./chat-evidence.js";
 /** Shared result-to-revision action for the result form and chat.
  * The caller authenticates; this service checks project access and the exact
  * displayed note batch, then uses the existing atomic revision/approval boundary.
  */
 import { createHash, randomBytes } from "node:crypto";
 import { EVIDENCE_CAPS, readVerifiedArtifact, writeEvidenceFile } from "./evidence.js";
-import { isRevisionFeedback, parseRevisionBatch, revisionSourceOf, commentSourceKey, REQUEST_TOKEN } from "./result-review.js";
+import { parseFeedbackImage, sameFeedbackImage, isRevisionFeedback, parseRevisionBatch, revisionSourceOf, commentSourceKey, REQUEST_TOKEN } from "./result-review.js";
 import { validateNote, hasForbiddenControls } from "./decision.js";
 import { TASK_TEXT_LIMITS, validateTaskText } from "./task-text.js";
 import { modeFilingCoverage } from "./scope.js";
+/** Re-prove image custody and current result at each write. No file paths supplied by callers. */
+export function feedbackImageProblem(store, root, runId, image) {
+    if (image == null)
+        return null;
+    const parsed = parseFeedbackImage(image);
+    if (!parsed || image.run !== runId)
+        return "Choose a screenshot from this result. Your draft is unchanged.";
+    const run = store.getRun(runId);
+    const task = run === null ? null : store.externalIdFor(run.taskRef);
+    const repo = run === null ? null : store.refById(run.taskRef)?.repo;
+    if (!task || !repo)
+        return "This screenshot is no longer available. Your draft is unchanged.";
+    const family = store.taskFamilyOf(task, [repo], false);
+    const latest = store.runsFor(run.taskRef).find(one => ["builder", "repair", "scout"].includes(one.role) && one.outcome !== null);
+    if (family?.problem !== null || family.current.id !== task || latest?.id !== runId)
+        return "A newer result is current. Open it before commenting on a screenshot. Your draft is unchanged.";
+    const verified = verifyResultImage(store, root, [repo], { taskId: task, ...image });
+    return verified.ok ? null : "This screenshot is unavailable or changed. Restore it or remove it from your feedback. Your draft is unchanged.";
+}
 /** One user action: add the typed change and seal exactly the displayed
  * saved notes. A refusal rolls back the note; a replay returns the same task. */
 export function requestResultChanges(store, evidenceRoot, input, now) {
@@ -15,8 +35,8 @@ export function requestResultChanges(store, evidenceRoot, input, now) {
         return store.transact(() => store.savepoint(() => {
             const fail = (status, message) => { throw new ChangeRequestRefusal(status, message); };
             if (!input.note.trim()) {
-                if (input.path.trim() || input.line.trim())
-                    return fail(400, "Describe the change before attaching a file or line.");
+                if (input.path.trim() || input.line.trim() || input.image != null)
+                    return fail(400, "Describe the change before attaching an image, file or line.");
                 if (!input.batch)
                     return fail(400, "Describe a change or use a saved note.");
                 return createResultRevision(store, evidenceRoot, input, now);
@@ -43,13 +63,19 @@ export function requestResultChanges(store, evidenceRoot, input, now) {
             if (!artifact || !readVerifiedArtifact(evidenceRoot, artifact).ok)
                 return fail(409, "The saved changes could not be verified. Restore the result before requesting changes.");
             const sourceKey = commentSourceKey(input.actor, input.request);
-            let noteId = store.addDiffComment({ artifactId: artifact.id, runId: run.id, path, line, note: valid.note, author: input.actor, sourceKey }, now);
-            if (noteId === null) {
-                const earlier = store.diffCommentBySourceKey(sourceKey);
-                if (!earlier || earlier.run !== run.id || earlier.path !== path || earlier.line !== line || earlier.note !== valid.note)
-                    return fail(409, "This submission already saved different feedback. Reopen the result and try again.");
-                noteId = earlier.id;
+            const earlier = store.diffCommentBySourceKey(sourceKey);
+            if (earlier && (earlier.run !== run.id || earlier.path !== path || earlier.line !== line || earlier.note !== valid.note || !sameFeedbackImage(earlier.image, input.image)))
+                return fail(409, "This submission already saved different feedback. Reopen the result and try again.");
+            // An exact consumed replay only returns its existing revision. Every new
+            // use proves the image before insertion, so malformed targets refuse cleanly.
+            if (earlier?.consumedBy == null) {
+                const problem = feedbackImageProblem(store, evidenceRoot, run.id, input.image);
+                if (problem !== null)
+                    return fail(409, problem);
             }
+            const noteId = earlier?.id ?? store.addDiffComment({ artifactId: artifact.id, runId: run.id, path, line, note: valid.note, author: input.actor, sourceKey, image: input.image ?? null }, now);
+            if (noteId === null)
+                return fail(409, "This feedback changed while saving. Your draft is unchanged; reopen the result.");
             const result = createResultRevision(store, evidenceRoot, { ...input, batch: [...new Set([...batch, noteId])].sort((a, b) => a - b).join(",") }, now);
             if (!result.ok)
                 return fail(result.status, result.message);
@@ -141,6 +167,11 @@ export function createResultRevision(store, evidenceRoot, input, now) {
         }
         if (batch.some(one => !isRevisionFeedback(one)))
             return fail(409, "Review observations are not requested changes. Use Request change to add your feedback first.");
+        for (const one of batch) {
+            const problem = feedbackImageProblem(store, evidenceRoot, id, one.image);
+            if (problem !== null)
+                return fail(409, problem);
+        }
         const comments = batch;
         // Keep the subject recognizable, including when revising a revision.
         // Reserve the suffix before truncating, at whole grapheme boundaries.
@@ -180,6 +211,7 @@ export function createResultRevision(store, evidenceRoot, input, now) {
                 note: one.note,
                 author: one.author,
                 createdAt: one.createdAt,
+                ...(one.image == null ? {} : { image: one.image }),
             })),
         };
         const briefBytes = Buffer.from(JSON.stringify(brief, null, 2), "utf8");

package/dist/result-follow-ups.js

@@ -2,6 +2,7 @@ import { checkoutRunner, ranAtLine, widestRan } from "./invoke.js";
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { refArchived } from "./task-archive.js";
 import { belongsToRelease } from "./release-authority.js";
 import { run as execRun } from "./exec.js";
 import { hardenedGit } from "./teardown-git.js";
@@ -126,6 +127,9 @@ function checkTarget(store, runId, level) {
         return refuse("no-commit", "This result has no finished commit to check.");
     if (ref.repo === null)
         return refuse("unplaced", "This result isn't in a project, so there is no check to run.");
+    // A put-away task (v145) runs no checks: asked for or already waiting, it is refused until restored.
+    if (refArchived(store, ref.id))
+        return refuse("archived", "This task is put away. Restore it first.");
     const chosen = checkCommandFor(store, ref.repo, level);
     if (chosen.command === null)
         return refuse("no-check", `${ref.repo} has no approved ${level === "quick" ? "quick or full" : "full"} check. Set one in Settings → Projects → Checks.`);

package/dist/result-review.d.ts

@@ -19,6 +19,14 @@
  * selected tab, and the reading position in this tab's sessionStorage,
  * keyed by the server-named account, the task, and the run. */
 import { type ResultFacts, type PublicationFacts, type DisplayStatus } from "./workspace-ui.js";
+/** Optional context for feedback. The sealed diff remains the revision authority. */
+export type FeedbackImage = {
+    run: number;
+    artifact: number;
+    sha256: string;
+};
+export declare function parseFeedbackImage(value: unknown): FeedbackImage | null | false;
+export declare function sameFeedbackImage(a: FeedbackImage | null | undefined, b: FeedbackImage | null | undefined): boolean;
 /** Add re-read evidence health to the existing result/review projection.
  * This is presentation only: the recorded verdict and acceptance stay intact. */
 export declare function evidenceResultStatusOf(result: ResultFacts, publication: PublicationFacts, evidence: EvidenceHealth): DisplayStatus;
@@ -49,6 +57,7 @@ export type ResultScreenshot = {
     path: string;
     caption: string;
     artifactId: number;
+    sha256?: string;
     problem: string | null;
 };
 export type ResultEvidenceInput = {

package/dist/result-review.js

@@ -19,6 +19,26 @@
  * selected tab, and the reading position in this tab's sessionStorage,
  * keyed by the server-named account, the task, and the run. */
 import { resultStatusOf } from "./workspace-ui.js";
+export function parseFeedbackImage(value) {
+    if (value === undefined || value === null || value === "")
+        return null;
+    try {
+        const image = typeof value === "string" ? JSON.parse(value) : value;
+        if (image === null || typeof image !== "object" || Array.isArray(image)
+            || !Number.isSafeInteger(image.run) || image.run < 1
+            || !Number.isSafeInteger(image.artifact) || image.artifact < 1
+            || typeof image.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(image.sha256)
+            || Object.keys(image).some(key => !["run", "artifact", "sha256"].includes(key)))
+            return false;
+        return { run: image.run, artifact: image.artifact, sha256: image.sha256 };
+    }
+    catch {
+        return false;
+    }
+}
+export function sameFeedbackImage(a, b) {
+    return (a == null && b == null) || (a != null && b != null && a.run === b.run && a.artifact === b.artifact && a.sha256 === b.sha256);
+}
 /** Add re-read evidence health to the existing result/review projection.
  * This is presentation only: the recorded verdict and acceptance stay intact. */
 export function evidenceResultStatusOf(result, publication, evidence) {
@@ -155,6 +175,8 @@ export function resultFactsFromHtml(html) {
  * page. Matched exactly — never a bare open redirect. */
 export function resultReturnTarget(raw, runId, tasks = []) {
     if (raw !== null && raw !== undefined) {
+        if (raw === `/r/${runId}?record=1`)
+            return raw;
         const review = /^\/review\?result=[A-Za-z0-9._~%-]{1,200}(?:&run=([0-9]{1,15}))?(?:&tab=(?:summary|changes|checks))?$/.exec(raw);
         if (review !== null && (review[1] === undefined || Number(review[1]) === runId))
             return raw;
@@ -299,6 +321,22 @@ export const RESULT_REVIEW_SCRIPT = String.raw `
   document.addEventListener('click',function(ev){var link=ev.target&&ev.target.closest?ev.target.closest('a[href="#request-changes"]'):null;if(link)openForm();});
   if(form){
     var noteBox=form.querySelector('[name=note]'),pathBox=form.querySelector('[name=path]'),lineBox=form.querySelector('[name=line]'),pin=form.querySelector('details.result-pin');
+    var imageBox=form.querySelector('[name=image]'),imagePreview=form.querySelector('[data-feedback-image]');
+    function showImage(){
+      if(!imageBox||!imagePreview)return;
+      imagePreview.hidden=!imageBox.value;
+      var img=imagePreview.querySelector('img'),caption=imagePreview.querySelector('figcaption'),selected=null;
+      document.querySelectorAll('[data-comment-image]').forEach(function(button){if(button.getAttribute('data-comment-image')===imageBox.value)selected=button;});
+      img.hidden=!selected;
+      if(selected){var identity=JSON.parse(imageBox.value);img.src='/r/'+identity.run+'/evidence/'+identity.artifact;img.alt=selected.getAttribute('data-image-caption');caption.textContent=img.alt+' · Screenshot '+identity.artifact;}
+      else{img.removeAttribute('src');caption.textContent='This screenshot is unavailable. Restore it or remove it from your feedback.';}
+    }
+    document.addEventListener('click',function(event){
+      var button=event.target&&event.target.closest?event.target.closest('[data-comment-image],[data-remove-image]'):null;
+      if(!button||!imageBox)return;
+      event.preventDefault();imageBox.value=button.getAttribute('data-comment-image')||'';showImage();openForm();save();
+      if(noteBox){noteBox.dispatchEvent(new Event('input',{bubbles:true}));noteBox.scrollIntoView({block:'center',behavior:'instant'});noteBox.focus();}
+    });
     var limit=document.getElementById('comment-note-limit'),requestBox=form.querySelector('[name=request]');
     function updateActions(){
       var typed=!!(noteBox&&noteBox.value.trim()),batch=form.querySelector('[name=batch]');
@@ -333,7 +371,7 @@ export const RESULT_REVIEW_SCRIPT = String.raw `
     // A fresh request identity: 16 random bytes as hex, the server's own shape.
     function mint(){var bytes=new Uint8Array(16);try{crypto.getRandomValues(bytes);}catch(e){for(var i=0;i<16;i++)bytes[i]=Math.floor(Math.random()*256);}
       var hex='';for(var j=0;j<16;j++)hex+=(bytes[j]<16?'0':'')+bytes[j].toString(16);return hex;}
-    function payload(){return JSON.stringify([noteBox?noteBox.value:'',pathBox?pathBox.value:'',lineBox?lineBox.value:'']);}
+    function payload(){return JSON.stringify([noteBox?noteBox.value:'',pathBox?pathBox.value:'',lineBox?lineBox.value:'',imageBox?imageBox.value:'']);}
     // What the current token was last submitted with; null = never sent.
     var sent=null,bound=null;
     // The server refused this token for a different note or another result:
@@ -347,7 +385,7 @@ export const RESULT_REVIEW_SCRIPT = String.raw `
       var focusNote=function(){setTimeout(function(){noteBox.focus({preventScroll:true});},0);};
       if(document.readyState==='complete')focusNote();else window.addEventListener('load',focusNote);
     }
-    if(saved&&typeof saved.note==='string'&&saved.note.length<=2000){
+    if(saved&&typeof saved.note==='string'&&saved.note.length<=(noteBox?noteBox.maxLength:4000)){
       if(noteBox&&!noteBox.value)noteBox.value=saved.note;
       if(saved.note)openForm();
       if(pathBox&&!pathBox.value&&typeof saved.path==='string')pathBox.value=saved.path;
@@ -355,7 +393,9 @@ export const RESULT_REVIEW_SCRIPT = String.raw `
       if(pin&&(pathBox&&pathBox.value||lineBox&&lineBox.value))pin.open=true;
       if(typeof saved.request==='string'&&/^[a-f0-9]{32}$/.test(saved.request)&&requestBox)requestBox.value=saved.request;
       if(typeof saved.sent==='string')sent=saved.sent;
-      bound=JSON.stringify([saved.note,saved.path||'',saved.line||'']);
+      if(imageBox&&typeof saved.image==='string'&&saved.image.length<250)imageBox.value=saved.image;
+      showImage();
+      bound=JSON.stringify([saved.note,saved.path||'',saved.line||'',saved.image||'']);
       if(noteBox)noteBox.dispatchEvent(new Event('input'));
     }
     function save(){
@@ -365,8 +405,8 @@ export const RESULT_REVIEW_SCRIPT = String.raw `
       var current=payload();
       if((bound!==null&&current!==bound)||(sent!==null&&current!==sent)){sent=null;if(requestBox)requestBox.value=mint();}
       bound=current;
-      if(!note&&!path&&!line){write(draftKey,null);return;}
-      write(draftKey,{note:note,path:path,line:line,request:requestBox?requestBox.value:'',sent:sent,at:Date.now()});
+      if(!note&&!path&&!line&&!(imageBox&&imageBox.value)){write(draftKey,null);return;}
+      write(draftKey,{note:note,path:path,line:line,image:imageBox?imageBox.value:'',request:requestBox?requestBox.value:'',sent:sent,at:Date.now()});
       if(!storage&&limit)limit.textContent='Draft stays on this page only. Browser storage is unavailable.';
     }
     form.addEventListener('input',save);

package/dist/scope.d.ts

@@ -597,6 +597,11 @@ export type ApproveResult = {
  | {
     ok: false;
     reason: "machine-proof";
+}
+/** v145 (task-tidy.md): the task is put away; it is restored before anyone can approve it. */
+ | {
+    ok: false;
+    reason: "archived";
 };
 /**
  * Whether this name-and-token pair is a person the store knows. Shared by

package/dist/scope.js

@@ -48,6 +48,7 @@ import { z } from "zod";
 import {} from "./contracts/acceptance-terms.js";
 import { parseContract } from "./contracts/contract.js";
 import { readAcceptance, readScopeTerms, storedRubricSchema } from "./contracts/scope.js";
+import { taskArchived } from "./task-archive.js";
 import { releaseCiHoldOf, releaseCiHoldWords } from "./release-ci-hold.js";
 import { NO_READINESS, exactModelId, legOf, projectRoute, routeDigestOf, routeFromJson, routeJsonProblem, routeWords, } from "./phase-routing.js";
 /** Same shape as a runner's credential, for the same reasons. */
@@ -1074,6 +1075,9 @@ export function approve(store, taskId, by, now, sawDigest, token, mutation = {})
         const scope = store.getScope(taskId);
         if (scope === null)
             return { ok: false, reason: "no-scope" };
+        // A put-away task (v145) is restored first; sealScopeApproval refuses it too, on every road.
+        if (taskArchived(store, taskId))
+            return { ok: false, reason: "archived" };
         // The digest is required, not optional. An operator reads a scope, somebody
         // rewrites it, and an approval that did not name what it saw would agree to
         // the new one in silence — which is the whole failure this guards.
@@ -1472,6 +1476,9 @@ export function liveReleaseOf(store, taskId, action, now = new Date()) {
         return { applies: false };
     const { authority: a, carry } = found;
     const refuse = (why) => ({ applies: true, ok: false, why, authority: a });
+    // A put-away task (v145, task-tidy.md), or a put-away anchor, deploys, merges and carries nothing: restore it first.
+    if (taskArchived(store, taskId) || taskArchived(store, a.anchorTask))
+        return refuse("the release task is put away");
     const newest = newestReleaseGeneration(store, a.repo, a.version, a.pr);
     if (newest === null || newest.id !== a.id)
         return refuse("a newer approval of this release replaced this one");

package/dist/server/chat.js

@@ -389,9 +389,11 @@ export function createChatHandlers(runtime) {
             const id = proposalId, saved = store.getLeadProposal(id), savedAction = saved?.kind === 'action' ? sharedActionPayload(saved.payload) : null;
             if (saved && savedAction && saved.state !== 'pending' && (sharedConversation !== null || store.getLeadThread(saved.thread)?.approver === principal.name) && principal.repos.includes(savedAction.repo) && store.accountCanAccess(principal.name, savedAction.repo)) {
                 const task = typeof saved.outcome?.['taskId'] === 'string' ? saved.outcome['taskId'] : typeof savedAction.request['task'] === 'string' ? savedAction.request['task'] : null;
-                const destination = task ? taskHref(task) : `/settings/${savedAction.operation.startsWith('skill_') ? 'skills' : 'knowledge'}?repo=${encodeURIComponent(savedAction.repo)}`;
+                // A flow action leads back to its flow (a page path of our own making, never the proposal's words).
+                const flowId = savedAction.operation.startsWith('flow_') && Number.isSafeInteger(savedAction.request['flow']) ? Number(savedAction.request['flow']) : null;
+                const destination = task ? taskHref(task) : flowId !== null ? `/flows/${flowId}` : `/settings/${savedAction.operation.startsWith('skill_') ? 'skills' : 'knowledge'}?repo=${encodeURIComponent(savedAction.repo)}`;
                 const said = typeof saved.outcome?.['said'] === 'string' ? saved.outcome['said'] : saved.state === 'dismissed' ? 'Action dismissed.' : saved.state === 'expired' ? 'This proposal expired. Ask for a fresh proposal.' : 'This action has no completed outcome yet.';
-                return sendScreen(response, 200, screen('Action outcome', html `<h1>${savedAction.title}</h1><p>${said}</p><a class="button-link" href="${destination}">${task ? 'Open task' : 'Open project settings'}</a>`, { chrome: chromeFor(savedAction.repo, 'chat') }));
+                return sendScreen(response, 200, screen('Action outcome', html `<h1>${savedAction.title}</h1><p>${said}</p><a class="button-link" href="${destination}">${task ? 'Open task' : flowId !== null ? 'Open flow' : 'Open project settings'}</a>`, { chrome: chromeFor(savedAction.repo, 'chat') }));
             }
             const review = mintSharedActionReview(store, principal, id, evidenceRoot, clock()), action = review.payload;
             const terms = action.terms.map(term => html `<p style="white-space:pre-wrap;overflow-wrap:anywhere">${term}</p>`);