toolroll 0.9.84 → 0.9.86

package/dist/store.js

@@ -1,3 +1,5 @@
+import { verifyResultImage } from "./chat-evidence.js";
+import { parseFeedbackImage } from "./result-review.js";
 import { mintSecret } from "./secret-mint.js";
 import { WRITES_DEFAULT } from "./writes-mode.js";
 import { checkAccessOf, widerThan } from "./check-access.js";
@@ -7,6 +9,8 @@ import { isAcpProfile, isAcpProvider } from "./acp-agents.js";
 import { ACP_CONFORMANCE_VERSION, launchFromJson } from "./acp-attest.js";
 import { reclaimDatabase } from "./database-reclaim.js";
 import { BASELINE_SCHEMA, BASELINE_SCHEMA_VERSION } from "./store-baseline.js";
+import { refArchived, taskArchived } from "./task-archive.js";
+export { refArchived, taskArchived } from "./task-archive.js";
 import { CHAT_PROVIDERS, CHAT_SCHEMA } from "./contracts/chat-tables.js";
 import {} from "./chat-core.js";
 import { ChatMessages, TELEGRAM_HOLD_REASONS, TELEGRAM_SKIPPED_ELSEWHERE, TELEGRAM_SKIPPED_OTHER_CHAT, TELEGRAM_SKIPPED_QUIET, TELEGRAM_UNSETTLED } from "./chat-messages.js";
@@ -92,6 +96,7 @@ import { LEDGER_COLUMNS, LEDGER_SCHEMA, LEDGER_TABLE, LEDGER_V99_TABLE, installL
 import { PLAN_AUTO_SCHEMA } from "./plan-auto.js";
 import { CONSOLE_INSTANCE_SCHEMA } from "./console-instance.js";
 import { endUnattendedGrants, FLOW_UNATTENDED_SCHEMA, grantStandsSql } from "./flow-unattended.js";
+import { FLOW_BROWSER_SCHEMA } from "./flow-browser.js";
 import { RECIPE_SCHEMA } from "./recipes.js";
 import { POLICY_SCHEMA, agentRefusal, approvalRefusal, policyParts, readPolicy, underCeiling, sessionCeilingRefusal } from "./policy.js";
 import { PROVIDER_AUTH_SCHEMA } from "./provider-auth.js";
@@ -107,6 +112,8 @@ import { configBase, envValue, namedPath } from "./names.js";
 import { PULL_REQUEST_SCHEMA } from "./pull-request-schema.js";
 import { chatTurnAmountOf, combineReportedModels, providerTurnsOf, reportedCostUsdOf, reportedModelOf, runAmountOf } from "./reported-usage.js";
 import { usageOf } from "./run-efficiency.js";
+import { YOUIYOUX_FILED_VIA } from "./contracts/youiyoux-request.js";
+import { shownTermsDigest } from "./chat-terms.js";
 // PR #263 follow-up: the built-ins the Store money seal uses, captured as this module is evaluated, so code that later
 // replaces `Object.defineProperty` and the like can't fool the seal or the lock (lockStoreMoneyMethods refuses when
 // they've been replaced). The four sealed method references are recorded once, at the seal, in SEALED_MONEY_METHODS.
@@ -717,6 +724,60 @@ export const V141_ADDED_COLUMNS = Object.freeze({
     },
     chat_turn: { billing_reported: { definition: "TEXT CHECK (billing_reported IS NULL OR billing_reported IN ('subscription','api-key'))", saved: "NULL" } },
 });
+/** v142 (youiyoux-intake.ts): youiyoux change requests as tasks. `youiyoux_intake` is one row per project the intake
+ * has looked at: a person's on/off choice (`enabled` NULL: automatic, on while the project uses youiyoux) and the last
+ * pass's answer (whether the project uses youiyoux, how many request files couldn't be read, and the problem, if any).
+ * `youiyoux_request` is one row per request taken, keyed by project and request id: the task it became (NULL: left
+ * out, `note` says why), never filed again, the status last written beside it, with the console address its links
+ * named ('' for none), and where the person pointed (route, component, file:line), cleaned, for the task page. An
+ * options request (`kind`) also keeps the options file its agent writes (`proposal`, p-<its hex>), set when filed and
+ * never read from the request again: whether it went to the project's main checkout from which result (`proposal_state`,
+ * `proposal_run`, and why not in `proposal_note`; `taken`: a file was already there, so it was left and is never read
+ * for a decision), the digest of what was copied apart from what a decision changes (`proposal_digest`), and what a
+ * person decided on it in youiyoux's hub (`decided`, `decided_note`: what Toolroll did about it). New tables only. */
+export const V142_SCHEMA = `
+CREATE TABLE IF NOT EXISTS youiyoux_intake (
+  repo        TEXT PRIMARY KEY,
+  enabled     INTEGER CHECK (enabled IS NULL OR enabled IN (0, 1)),
+  uses        INTEGER NOT NULL DEFAULT 0 CHECK (uses IN (0, 1)),
+  changed_by  TEXT,
+  changed_at  TEXT,
+  checked_at  TEXT,
+  invalid     INTEGER NOT NULL DEFAULT 0 CHECK (invalid >= 0),
+  problem     TEXT
+);
+CREATE TABLE IF NOT EXISTS youiyoux_request (
+  repo          TEXT NOT NULL,
+  request       TEXT NOT NULL CHECK (length(request) = 12 AND request GLOB 'r-[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]'),
+  task_id       TEXT,
+  note          TEXT,
+  filed_at      TEXT NOT NULL,
+  status        TEXT CHECK (status IS NULL OR status IN ('queued','needs-you','building','ready','done','failed','stopped')),
+  detail        TEXT,
+  status_at     TEXT,
+  written_at    TEXT,
+  written_base  TEXT,
+  write_problem TEXT,
+  route         TEXT,
+  component     TEXT,
+  source_at     TEXT,
+  kind          TEXT NOT NULL DEFAULT 'change' CHECK (kind IN ('change','options')),
+  proposal      TEXT CHECK (proposal IS NULL OR (length(proposal) = 12 AND proposal GLOB 'p-[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]')),
+  proposal_state TEXT CHECK (proposal_state IS NULL OR proposal_state IN ('copied','taken','missing','unsafe','retry')),
+  proposal_digest TEXT CHECK (proposal_digest IS NULL OR (length(proposal_digest) = 64 AND proposal_digest NOT GLOB '*[^0-9a-f]*')),
+  proposal_run  INTEGER,
+  proposal_note TEXT,
+  proposal_at   TEXT,
+  decided       TEXT CHECK (decided IS NULL OR decided IN ('chosen','dismissed')),
+  decided_at    TEXT,
+  decided_note  TEXT,
+  PRIMARY KEY (repo, request),
+  UNIQUE (task_id),
+  CHECK ((kind = 'options') = (proposal IS NOT NULL)),
+  CHECK (proposal_state IS NULL OR kind = 'options'),
+  CHECK (decided IS NULL OR coalesce(proposal_state = 'copied' AND proposal_digest IS NOT NULL, 0))
+);
+`;
 /** A project's "Show commands in the live view" (live-detail.ts): absent means off. */
 export const LIVE_DETAIL_SCHEMA = `
 CREATE TABLE IF NOT EXISTS live_detail_setting (
@@ -1030,7 +1091,17 @@ const REGISTERED_AT_FILING = "again, as it was filed";
 // v141 adds, and changes no saved row: the eval set's records (docs/plans/evals-nightly.md, part C) — campaigns,
 // attempts, each attempt's provider dispatches, the baseline pin and eval debt (V141_SCHEMA) — and how a run's or chat
 // request's billing was known (V141_ADDED_COLUMNS; saved rows NULL: unknown).
-export const SCHEMA_VERSION = 141;
+// v142 adds, and changes no saved row: youiyoux change requests as tasks (V142_SCHEMA, new tables only) — each
+// project's intake choice and last answer, and each request taken, with the task it became.
+// v143 adds, and changes no saved row: optional exact-screenshot context on result feedback
+// (diff_comment.image_json, V143_ADDED_COLUMNS; saved notes read NULL and keep their file/line target).
+// v144 adds, and changes no saved row: a person's approval of browser use in a flow's script zones (flow_browser_grant;
+// flow-browser.ts), the one sandbox rule a project check gets for Chromium; saved flows have none and get nothing.
+// v145 adds, and changes no saved row (docs/plans/task-tidy.md): put-away tasks (task_archive, one row per archived task
+// version; no row is every saved task: not archived), the completed workflow runs on a watched branch the checks
+// trigger saw (branch_check_run), and the reservations that hold work back from being put away (merge_in_flight,
+// deploy_in_flight, flow_step_task; V145_SCHEMA, new tables only).
+export const SCHEMA_VERSION = 145;
 /** v118: the tables merged into `credential`, in the order they move (a person's API tokens keep their ids first). */
 export const V118_MERGED_TABLES = Object.freeze({ api_token: "person", coordinator_credential: "coordinator", lead_credential: "lead" });
 /** The foreign keys that named a merged table, exactly as their DDL wrote them; each names `credential(id)` instead. */
@@ -1163,7 +1234,7 @@ const V115_DROPPED_REFERENCES = /\s+REFERENCES (?:contestant|contest|tournament_
  * unchanged), and adds the nullable column in V125_ADDED_COLUMNS, checked the same way. v126 only adds a new table
  * (task_source) and the columns in V126_ADDED_COLUMNS (null or 0), checked the same way.
  */
-export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141]);
+export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145]);
 /** v119: the columns it adds, by table, with the value every row saved before it reads (toolroll-update's HISTORY_RULES). */
 export const V119_ADDED_COLUMNS = Object.freeze({
     task_ref: { planning_generation: { definition: "INTEGER NOT NULL DEFAULT 0", saved: "0" } },
@@ -1299,6 +1370,59 @@ export const V140_ADDED_COLUMNS = Object.freeze({
         reported_cost_usd: { definition: "REAL CHECK (reported_cost_usd IS NULL OR reported_cost_usd >= 0)", saved: "NULL" },
     },
 });
+/** v143: optional screenshot context on result feedback; existing feedback stays unchanged (saved rows read NULL). */
+export const V143_ADDED_COLUMNS = Object.freeze({
+    diff_comment: { image_json: { definition: "TEXT", saved: "NULL" } },
+});
+/** v145 (docs/plans/task-tidy.md): `task_archive` is a put-away task version. A row hides it from every list and count
+ * and refuses every door that would dispatch, claim or approve it; restore deletes the row. Its history, results,
+ * approvals and ledger stay exactly as they were. `merge_in_flight` is a direct merge between its last check and GitHub's
+ * answer, owned by its token: a task can't be put away under it (a row older than 15 minutes is a crash, and no
+ * longer counts). `deploy_in_flight` is a deployment whose candidate passed its gate (30 minutes, refreshed by every
+ * phase that proves it again). `flow_step_task` is the tasks a flow step was admitted for, kept whatever the card does
+ * next, so a step still running holds them. `branch_check_run` keeps each completed GitHub workflow run (pushed to
+ * the watched branch of the watched repository) the "checks failed" trigger saw, green or red, so tidy can tell a
+ * failure notice was fixed by a later commit. */
+export const V145_SCHEMA = `
+CREATE TABLE IF NOT EXISTS task_archive (
+  task_ref INTEGER PRIMARY KEY REFERENCES task_ref(id),
+  by       TEXT NOT NULL,
+  by_kind  TEXT NOT NULL CHECK (by_kind IN ('person','tidy')),
+  rule     TEXT,
+  reason   TEXT NOT NULL,
+  at       TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS branch_check_run (
+  repo           TEXT NOT NULL,
+  run_id         INTEGER NOT NULL,
+  branch         TEXT NOT NULL,
+  workflow       TEXT NOT NULL,
+  head_sha       TEXT NOT NULL,
+  conclusion     TEXT NOT NULL CHECK (conclusion IN ('success','failure')),
+  run_created_at TEXT NOT NULL,
+  observed_at    TEXT NOT NULL,
+  PRIMARY KEY (repo, run_id)
+);
+CREATE INDEX IF NOT EXISTS branch_check_run_by_workflow ON branch_check_run (repo, branch, workflow, run_created_at);
+CREATE TABLE IF NOT EXISTS merge_in_flight (
+  publication INTEGER PRIMARY KEY REFERENCES publication(id),
+  task_ref    INTEGER NOT NULL REFERENCES task_ref(id),
+  token       TEXT NOT NULL,
+  by          TEXT NOT NULL,
+  at          TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS deploy_in_flight (
+  task_ref INTEGER PRIMARY KEY REFERENCES task_ref(id),
+  run      INTEGER NOT NULL,
+  at       TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS flow_step_task (
+  card    INTEGER NOT NULL,
+  entry   INTEGER NOT NULL,
+  task_id TEXT NOT NULL,
+  PRIMARY KEY (card, entry, task_id)
+);
+`;
 /**
  * v135: one approval per release (docs/plans/release-once.md). `release_authority` is the single source of truth for a
  * release a person approved: one row per generation, changed only by compare-and-swap on `rev`, with a lease whose
@@ -4549,6 +4673,17 @@ CREATE INDEX IF NOT EXISTS run_checkpoint_by_task ON run_checkpoint (task_ref, i
         for (const [column, { definition }] of Object.entries(columns))
             addColumn(db, table, column, definition);
     }
+    // v142: youiyoux change requests as tasks (new tables only).
+    db.exec(V142_SCHEMA);
+    // v143: optional exact-screenshot context on result feedback (V143_ADDED_COLUMNS: saved notes read NULL).
+    for (const [table, columns] of Object.entries(V143_ADDED_COLUMNS)) {
+        for (const [column, { definition }] of Object.entries(columns))
+            addColumn(db, table, column, definition);
+    }
+    // v144: approvals of browser use in flows' script zones (a new table only).
+    db.exec(FLOW_BROWSER_SCHEMA);
+    // v145: put-away tasks, green checks per branch and the reservations that hold work back (new tables only).
+    db.exec(V145_SCHEMA);
     // Keep the epoch until reclamation succeeds, including a retry after compaction already committed. A new file has
     // nothing to reclaim.
     if (!fresh)
@@ -6288,6 +6423,7 @@ export class Store {
            FROM task JOIN task_ref ON task_ref.backend = ? AND task_ref.external_id = task.id
           WHERE task.state = 'queued'
             AND (? IS NULL OR task_ref.repo IS NULL OR task_ref.repo = ?)
+            AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)
           ORDER BY task.priority DESC, task.created_at, task_ref.id
           LIMIT 200`)
             .all(stamp, BUILT_IN, repo, repo)
@@ -6312,7 +6448,8 @@ export class Store {
             .prepare(`SELECT task.priority AS priority, task.created_at AS created_at, task_ref.id AS ref,
                 task_ref.repo AS repo, task_ref.assigned_runner AS assigned
            FROM task JOIN task_ref ON task_ref.backend = ? AND task_ref.external_id = task.id
-          WHERE task.id = ? AND task.state = 'queued'`)
+          WHERE task.id = ? AND task.state = 'queued'
+            AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)`)
             .get(BUILT_IN, taskId);
         if (me === undefined)
             return null;
@@ -6324,7 +6461,8 @@ export class Store {
                  OR (task.priority = ? AND task.created_at = ? AND task_ref.id < ?)
                THEN 1 ELSE 0 END) AS ahead
            FROM task JOIN task_ref ON task_ref.backend = ? AND task_ref.external_id = task.id
-          WHERE task.state = 'queued' AND (task_ref.assigned_runner IS ?) AND (task_ref.repo IS ?)`)
+          WHERE task.state = 'queued' AND (task_ref.assigned_runner IS ?) AND (task_ref.repo IS ?)
+            AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)`)
             .get(Number(me["priority"]), Number(me["priority"]), String(me["created_at"]), Number(me["priority"]), String(me["created_at"]), Number(me["ref"]), BUILT_IN, me["assigned"], me["repo"]);
         return {
             position: Number(row?.["ahead"] ?? 0) + 1,
@@ -6474,6 +6612,8 @@ export class Store {
          JOIN task_ref ON task_ref.backend = ? AND task_ref.external_id = task.id
          WHERE task.state = 'queued'
            ${reservation}
+           -- A put-away task (v145) never dispatches.
+           AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)
            AND NOT EXISTS (
              SELECT 1 FROM hold
              WHERE hold.task_ref = task_ref.id
@@ -7255,6 +7395,9 @@ export class Store {
             // road it came by.
             if (basis === undefined && machineActing())
                 return false;
+            // A PUT-AWAY TASK (v145, task-tidy.md) is never approved, by any road: restore it first.
+            if (taskArchived(this, taskId))
+                return false;
             // A RELEASE WAITING FOR CI (Codex review round 1, finding 4): filed while its pull request's checks still ran,
             // only the automatic road (which proves CI itself) seals it until the plane read exact-head CI passing.
             if (basis?.kind !== "auto-check" && basis?.kind !== "auto-green" && releaseCiHoldOf(this, taskId) !== null)
@@ -7282,6 +7425,14 @@ export class Store {
                     .get(taskId);
                 if (writtenByLead !== undefined)
                     return false;
+                // THE OUTSIDE-REQUEST QUARANTINE (youiyoux-intake.ts): a task filed from a youiyoux change request is text
+                // anyone who can write the project's folder wrote, so only a person who read every word of it approves it.
+                // Its provenance is immutable, so no road around this exists. A mode, a grant, a schedule, auto-check and
+                // auto-green (approvals no person read) never seal it. A person's own ceremony does. So does their paired-
+                // chat tap, only with the digest of every word the card showed (`terms`, chat-terms.ts), recomputed below
+                // from the live scope: a card that cut a word, or terms that changed since, seal nothing.
+                if (basis.kind !== "chat" && this.filedViaOf(taskId) === YOUIYOUX_FILED_VIA)
+                    return false;
                 // CHECK ACCESS (v132, check-access.ts): a scope whose checks reach beyond the fence (sign-ins, or no sandbox at
                 // all) seals only on a person's password ceremony — never a mode, a grant, a chat confirmation or a carry.
                 const profileText = this.db.prepare("SELECT profile_json FROM task_scope WHERE task_id = ?").get(taskId)?.["profile_json"];
@@ -7348,6 +7499,10 @@ export class Store {
                 return false;
             if (deployGate && basis?.kind === "chat" && !(basis.card === "release" && typeof basis.cardDigest === "string" && /^[0-9a-f]{64}$/.test(basis.cardDigest)))
                 return false;
+            // The outside-request quarantine's chat road (above): the card showed every word of these live terms.
+            if (basis?.kind === "chat" && this.filedViaOf(taskId) === YOUIYOUX_FILED_VIA
+                && !(basis.card === "terms" && typeof basis.cardDigest === "string" && basis.cardDigest === shownTermsDigest(readScope(working))))
+                return false;
             // AUTOMATIC RELEASE SEALS (auto-approve-green.md): only on a release task (a candidate and release terms signed
             // in), only naming the evidence row the plane wrote for exactly this task, kind, digest and candidate.
             const automatic = basis?.kind === "auto-check" || basis?.kind === "auto-green";
@@ -9535,13 +9690,21 @@ export class Store {
         if (artifact === undefined || artifact.kind !== "terminal-diff") {
             throw new Error(`artifact ${args.artifactId} is not run ${args.runId}'s terminal diff — comments bind to the exact bytes reviewed`);
         }
+        const image = parseFeedbackImage(args.image);
+        if (image === false)
+            throw new Error("Invalid feedback image.");
+        if (image !== null) {
+            const shot = this.artifactForRun(args.runId, image.artifact);
+            if (image.run !== args.runId || shot?.kind !== "screenshot" || shot.sha256 !== image.sha256)
+                throw new Error("The feedback image does not belong to this result.");
+        }
         // The unique index is the real concurrent guard (audit C-9): a race on
         // the same source key lands in DO NOTHING, not in a thrown constraint.
         const inserted = this.db
-            .prepare(`INSERT INTO diff_comment (artifact, artifact_sha, run, path, line, note, author, created_at, source_key)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+            .prepare(`INSERT INTO diff_comment (artifact, artifact_sha, run, path, line, note, author, created_at, source_key, image_json)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
          ON CONFLICT (source_key) WHERE source_key IS NOT NULL DO NOTHING`)
-            .run(args.artifactId, artifact.sha256, args.runId, args.path, args.line, args.note, args.author, now.toISOString(), args.sourceKey ?? null);
+            .run(args.artifactId, artifact.sha256, args.runId, args.path, args.line, args.note, args.author, now.toISOString(), args.sourceKey ?? null, image === null ? null : JSON.stringify(image));
         return Number(inserted.changes) === 0 ? null : Number(inserted.lastInsertRowid);
     }
     /** Live (unsuperseded, unconsumed) comments on a run's terminal diff. */
@@ -10229,6 +10392,19 @@ export class Store {
         const row = this.db.prepare("SELECT flow, card, card_entry, source_json FROM task_source WHERE task_id = ?").get(taskId);
         return row === undefined ? null : { flow: Number(row["flow"]), card: Number(row["card"]), entry: Number(row["card_entry"]), sourceJson: String(row["source_json"]) };
     }
+    /** v142: where a task filed from a youiyoux change or options request came from, as kept when it was filed
+     * (youiyoux-intake.ts; a revision reads its first version's): the request, its kind, and where the person pointed. Null for every other task. */
+    youiyouxOriginOf(taskId) {
+        const text = (value) => typeof value === "string" && value !== "" ? value : null;
+        let id = taskId;
+        for (let hop = 0; id !== null && hop < 20; hop++) {
+            const row = this.db.prepare("SELECT request, kind, route, component, source_at FROM youiyoux_request WHERE task_id = ?").get(id);
+            if (row !== undefined)
+                return { request: String(row["request"]), kind: row["kind"] === "options" ? "options" : "change", route: text(row["route"]), component: text(row["component"]), at: text(row["source_at"]) };
+            id = this.lookupRef(id)?.revisionOf ?? null;
+        }
+        return null;
+    }
     // ---- the revision boundary: ONE field-by-field policy -------------------
     /**
      * Seal a revision in ONE transaction (Codex M5-M8 audit, C-3; contract
@@ -10320,7 +10496,14 @@ export class Store {
                     if (ids.size !== args.commentIds.length || live.length !== ids.size) {
                         throw new RevisionRaced("this annotation batch is no longer whole — read the current comments before sealing it");
                     }
-                    const exactComment = (one) => ({ id: one["id"], path: one["path"], line: one["line"], note: one["note"], author: one["author"], createdAt: one["createdAt"] });
+                    for (const one of live) {
+                        if (one.image == null)
+                            continue;
+                        const image = sourceRef.repo === null ? null : verifyResultImage(this, args.brief.evidenceRoot, [sourceRef.repo], { taskId: args.source.task, ...one.image });
+                        if (one.image.run !== sourceRun.id || image === null || !image.ok)
+                            return refuse("brief-custody", "A feedback screenshot is unavailable or changed. The notes were not consumed.");
+                    }
+                    const exactComment = (one) => ({ id: one["id"], path: one["path"], line: one["line"], note: one["note"], author: one["author"], createdAt: one["createdAt"], image: one["image"] ?? null });
                     const expected = live.map(one => exactComment({ ...one }));
                     const described = Array.isArray(named.comments) && named.comments.every(one => one !== null && typeof one === "object" && !Array.isArray(one))
                         ? named.comments.map(one => exactComment(one)) : null;
@@ -10474,7 +10657,7 @@ export class Store {
         versions.sort((a, b) => a.id === root.id ? -1 : b.id === root.id ? 1 : a.createdAt.localeCompare(b.createdAt) || a.refId - b.refId);
         const current = versions.at(-1);
         return { root, current, versions,
-            otherActive: versions.filter(one => one.id !== current.id && (one.state === "queued" || one.state === "running")),
+            otherActive: versions.filter(one => one.id !== current.id && (one.state === "queued" || one.state === "running") && !refArchived(this, one.refId)),
             problem: Number(rows[0]["broken"]) === 0 ? null : "Task history is unavailable or incomplete. This task is shown separately." };
     }
     /** Group and filter BEFORE the family limit; hydrate only that page's
@@ -10484,6 +10667,8 @@ export class Store {
         const order = options.order === "updated" ? "updated_at" : "created_at";
         const rows = this.db.prepare(`${projection.sql}, selected AS MATERIALIZED (
         SELECT * FROM ordered WHERE version_rank = 1
+          -- A put-away family (v145) is out of every list, before the page is cut.
+          AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = ordered.ref_id)
           ${options.states === undefined ? "" : `AND state IN (${options.states.map(() => "?").join(",")})`}
         ORDER BY ${order} DESC, ref_id DESC LIMIT ?
       ) SELECT task.*, members.repo, members.ref_id, members.root_ref, members.broken
@@ -10574,7 +10759,8 @@ export class Store {
         COUNT(CASE WHEN live_families.root_ref IS NOT NULL THEN 1 END) AS running,
         COUNT(CASE WHEN live_families.root_ref IS NULL AND ordered.state = 'queued' THEN 1 END) AS queued,
         COUNT(CASE WHEN live_families.root_ref IS NULL AND ordered.state = 'done' AND ordered.updated_at >= ? THEN 1 END) AS doneRecently
-      FROM ordered LEFT JOIN live_families ON live_families.root_ref = ordered.root_ref WHERE version_rank = 1`)
+      FROM ordered LEFT JOIN live_families ON live_families.root_ref = ordered.root_ref WHERE version_rank = 1
+        AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = ordered.ref_id)`)
             .get(...projection.params, JSON.stringify(liveTasks), new Date(now.getTime() - 24 * 60 * 60_000).toISOString());
         return { running: Number(row["running"]), queued: Number(row["queued"]), doneRecently: Number(row["doneRecently"]) };
     }
@@ -11008,6 +11194,9 @@ export class Store {
             if (ref === undefined)
                 return { ok: false, reason: "unknown-task" };
             const taskRef = Number(ref["id"]);
+            // A put-away task (v145) is restored before it runs again.
+            if (refArchived(this, taskRef))
+                return { ok: false, reason: "archived" };
             const stamp = now.toISOString();
             if (this.hasLiveClaim(taskRef, now))
                 return { ok: false, reason: "claimed" };
@@ -12619,10 +12808,12 @@ export class Store {
             : source !== undefined && "project" in source && source.project !== "" ? "project"
                 : source !== undefined && "installation" in source ? "installation" : "unknown";
         const project = scope === "task" ? String(ref["repo"]) : scope === "project" && source !== undefined && "project" in source ? source.project : null;
+        // A put-away task (v145) nudges nobody: no notification about it is enqueued, whoever produced it. The check is
+        // part of the insert itself, so a put away that commits first always wins.
         const { changes, lastInsertRowid } = this.db
             .prepare(`INSERT OR IGNORE INTO notification (dedupe_key, kind, subject, body, created_at, push_class, link, provenance_scope, project, task_ref, task_id, source_run, recipient)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-            .run(notification.dedupeKey, notification.kind, notification.subject, notification.body, now.toISOString(), notification.pushClass ?? null, notification.link ?? null, scope, project, ref === undefined ? null : taskRef, ref === undefined ? null : String(ref["external_id"]), run?.id ?? null, notification.recipient ?? null);
+         SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ? WHERE NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = ?)`)
+            .run(notification.dedupeKey, notification.kind, notification.subject, notification.body, now.toISOString(), notification.pushClass ?? null, notification.link ?? null, scope, project, ref === undefined ? null : taskRef, ref === undefined ? null : String(ref["external_id"]), run?.id ?? null, notification.recipient ?? null, ref === undefined ? null : Number(ref["id"]));
         // Whose act made this fact: pings follow it (see pingAllowed).
         const actor = currentActor();
         if (Number(changes) > 0 && actor !== null) {
@@ -14114,6 +14305,7 @@ export class Store {
            JOIN task_ref ON task_ref.backend = ? AND task_ref.external_id = task.id
            WHERE (? IS NULL OR task_ref.repo IS NULL OR task_ref.repo = ?)
              AND (? IS NULL OR task.state = ?)
+             AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)
            ORDER BY task.created_at DESC, task.id DESC LIMIT ?
          )
          UNION
@@ -14282,8 +14474,10 @@ export class Store {
     resolvePlanRevision(id, outcome, resolvedBy, now) {
         const { changes } = this.db
             .prepare(`UPDATE plan_revision SET status = ?, resolved_at = ?, resolved_by = ?
-          WHERE id = ? AND status = 'blocked'`)
-            .run(outcome, now.toISOString(), resolvedBy, id);
+          WHERE id = ? AND status = 'blocked'
+            -- A put-away task's (v145) plan change is never applied; rejecting it still is.
+            AND (? = 'rejected' OR NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = plan_revision.task_ref))`)
+            .run(outcome, now.toISOString(), resolvedBy, id, outcome);
         return Number(changes) > 0;
     }
     /** Stamp the exact plan revision and authority snapshot a run's brief was
@@ -15513,6 +15707,12 @@ export class Store {
             if (row === undefined || String(row["state"]) !== "claimed" || Number(row["generation"]) !== generation) {
                 return { ok: false, outcome: "raced", why: "the claim moved" };
             }
+            // A put-away task (v145) merges nothing: the intent waits for a person, who restores it first.
+            const archivedTask = this.db.prepare("SELECT 1 FROM publication p JOIN task_archive a ON a.task_ref = p.task_ref WHERE p.id = ?").get(Number(row["publication"]));
+            if (archivedTask !== undefined) {
+                this.settleMergeIntent(id, generation, "waiting-human", now, { error: "the task is put away", from: "claimed", bumpGeneration: true });
+                return { ok: false, outcome: "waiting-human", why: "the task is put away" };
+            }
             const supersede = (why) => {
                 this.settleMergeIntent(id, generation, "superseded", now, { error: why, from: "claimed" });
                 return { ok: false, outcome: "superseded", why };
@@ -17271,9 +17471,10 @@ export class Store {
         const page = Math.max(1, Math.min(Math.floor(limit), 50));
         // Roll-up admission binds BEFORE the LIMIT (Codex roll-up review,
         // finding 2): a repo outside the ceiling must not consume the page.
-        const admission = admitted === null
+        // A put-away task (v145, task-tidy.md) is left out here, as from every list and count.
+        const admission = (admitted === null
             ? "(? IS NULL OR task_ref.repo IS NULL OR task_ref.repo = ?)"
-            : `(task_ref.repo IS NULL${admitted.length === 0 ? "" : ` OR task_ref.repo IN (${admitted.map(() => "?").join(",")})`})`;
+            : `(task_ref.repo IS NULL${admitted.length === 0 ? "" : ` OR task_ref.repo IN (${admitted.map(() => "?").join(",")})`})`) + " AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)";
         const params = admitted === null ? [repo, repo] : admitted;
         return this.db
             .prepare(`SELECT task.id AS task_id, task.title, task_scope.goal, task_scope.digest, task_scope.proposed_at, task_ref.repo AS task_repo
@@ -17303,9 +17504,10 @@ export class Store {
      */
     listRequeueablesScoped(repo, now, limit = 10, admitted = null) {
         const page = Math.max(1, Math.min(Math.floor(limit), 50));
-        const admission = admitted === null
+        // A put-away task (v145, task-tidy.md) is left out here, as from every list and count.
+        const admission = (admitted === null
             ? "(? IS NULL OR task_ref.repo IS NULL OR task_ref.repo = ?)"
-            : `(task_ref.repo IS NULL${admitted.length === 0 ? "" : ` OR task_ref.repo IN (${admitted.map(() => "?").join(",")})`})`;
+            : `(task_ref.repo IS NULL${admitted.length === 0 ? "" : ` OR task_ref.repo IN (${admitted.map(() => "?").join(",")})`})`) + " AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)";
         const params = admitted === null ? [repo, repo] : admitted;
         return this.db
             .prepare(`WITH open_incidents AS (
@@ -17369,6 +17571,8 @@ export class Store {
          JOIN task_ref AS blocker_ref ON blocker_ref.backend = ? AND blocker_ref.external_id = task_edge.blocker
          WHERE ${admissionOf("dependent_ref")}
            AND ${admissionOf("blocker_ref")}
+           -- Put-away tasks (v145) need no repair card, on either side.
+           AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref IN (dependent_ref.id, blocker_ref.id))
          GROUP BY task_edge.blocker, dependent_ref.repo, blocker_ref.repo
          ORDER BY task_edge.blocker LIMIT ?`)
             .all(BUILT_IN, BUILT_IN, ...paramsOf(), ...paramsOf(), page)
@@ -17401,6 +17605,7 @@ export class Store {
            WHERE task.state = 'done'
              AND (? IS NULL OR task_ref.repo IS NULL OR task_ref.repo = ?)
              ${admission}
+             AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)
          )
          SELECT completed.*, run.id AS run_id, run.outcome, run.handoff, run.cost_usd, run.provider, run.auth_mode, run.started_at, run.finished_at,
                 publication.state AS pub_state, publication.pr_number, publication.pr_url,
@@ -17507,9 +17712,10 @@ export class Store {
         // finding 11): in the roll-up, rows outside the ceiling must not
         // consume the page and crowd out admitted cards. Serve still filters
         // per-row afterward — this is the bound, that is the law.
-        const admission = admitted === null
+        // A put-away task (v145, task-tidy.md) is left out here, as from every list and count.
+        const admission = (admitted === null
             ? "(? IS NULL OR task_ref.repo IS NULL OR task_ref.repo = ?)"
-            : `(task_ref.repo IS NULL OR task_ref.repo IN (${admitted.map(() => "?").join(",")}))`;
+            : `(task_ref.repo IS NULL OR task_ref.repo IN (${admitted.map(() => "?").join(",")}))`) + " AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)";
         const admissionParams = admitted === null ? [repo, repo] : admitted;
         const columns = `
         SELECT task.id, task.title, task.state, task.updated_at, task.priority, task_ref.strikes, task_ref.repo AS task_repo,
@@ -17713,14 +17919,15 @@ export class Store {
            SUM(CASE WHEN task.state = 'queued' THEN 1 ELSE 0 END) AS queued,
            SUM(CASE WHEN task.state = 'running' THEN 1 ELSE 0 END) AS running
            FROM task JOIN task_ref ON task_ref.backend = 'built-in' AND task_ref.external_id = task.id
-          WHERE task_ref.repo = ?`)
+          WHERE task_ref.repo = ? AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)`)
             .get(repo);
         const since = new Date(now.getTime() - 24 * 60 * 60_000).toISOString();
         const done = this.db
             .prepare(`SELECT COUNT(*) AS n FROM run
            JOIN task_ref ON task_ref.id = run.task_ref
           WHERE task_ref.repo = ? AND run.role IN ('builder','scout')
-            AND run.outcome IN ('built','no-change') AND run.finished_at IS NOT NULL AND run.finished_at >= ?`)
+            AND run.outcome IN ('built','no-change') AND run.finished_at IS NOT NULL AND run.finished_at >= ?
+            AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)`)
             .get(repo, since);
         return { waiting: waiting, queued: Number(q.queued ?? 0), running: Number(q.running ?? 0), doneRecently: Number(done.n) };
     }
@@ -17729,9 +17936,10 @@ export class Store {
         // review, finding 11): with repo NULL the old predicate admitted every
         // stored project, ceiling or not. An empty admitted list reduces to
         // unplaced rows only — never IN ().
-        const admission = admitted === null
+        // A put-away task (v145, task-tidy.md) is left out here, as from every list and count.
+        const admission = (admitted === null
             ? "(? IS NULL OR task_ref.repo IS NULL OR task_ref.repo = ?)"
-            : `(task_ref.repo IS NULL${admitted.length === 0 ? "" : ` OR task_ref.repo IN (${admitted.map(() => "?").join(",")})`})`;
+            : `(task_ref.repo IS NULL${admitted.length === 0 ? "" : ` OR task_ref.repo IN (${admitted.map(() => "?").join(",")})`})`) + " AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)";
         const params = () => (admitted === null ? [repo, repo] : [...admitted]);
         const row = this.db
             .prepare(`SELECT COUNT(*) AS n FROM (
@@ -18584,6 +18792,8 @@ export class Store {
      */
     resumeRunStop(args, now) {
         return this.transact(() => {
+            if (refArchived(this, args.taskRef))
+                return { ok: false, reason: "archived", detail: "this task is put away — restore it first" };
             const stop = this.stopOf(args.runId);
             const run = this.getRun(args.runId);
             if (stop === null || run === null)
@@ -20632,6 +20842,7 @@ function readDiffComment(row) {
         id: Number(row["id"]),
         artifact: Number(row["artifact"]),
         artifactSha: String(row["artifact_sha"]),
+        image: readFeedbackImage(row["image_json"]),
         run: Number(row["run"]),
         path: row["path"] === null ? null : String(row["path"]),
         line: row["line"] === null ? null : Number(row["line"]),
@@ -21510,3 +21721,153 @@ export function lockStoreMoneyMethods(store, prototype = Store.prototype) {
             throw new Error(`Store.${name} couldn't be locked`);
     }
 }
+/** A saved note's screenshot reference (v143), or null; a damaged one refuses rather than reading as none. */
+function readFeedbackImage(value) {
+    const image = parseFeedbackImage(value);
+    if (image === false)
+        throw new Error("The saved feedback image is damaged.");
+    return image;
+}
+/** Takes a saved note's screenshot off without losing the note or its history (v143). Fail closed, in one write
+ * transaction: the note must be live and unconsumed on this run, its screenshot must be genuinely unusable right now
+ * (`unusable` is result-actions.ts feedbackImageProblem, re-read inside the transaction, never the page's say-so), and
+ * the change is recorded in the action ledger under the person who made it. The note is superseded by an exact
+ * imageless copy; the original stays in history. The caller has already proved the person may request changes on
+ * this run (the same authority that seals any saved note into a revision); that standing is re-proved here too. */
+export function dropFeedbackImage(store, runId, commentId, actor, unusable, now) {
+    return store.transact(() => {
+        // The person's standing is re-read under the write lock: a revocation, a downgrade or a lost project committed
+        // after the request was admitted refuses here (check and write together).
+        const run = store.getRun(runId);
+        const repo = run === null ? null : store.refById(run.taskRef)?.repo ?? null;
+        const account = store.accountOf(actor);
+        if (run === null || account === null || account.revokedAt !== null || account.role !== "approver" || !store.accountCanAccess(actor, repo)) {
+            return { ok: false, reason: "not-authorized" };
+        }
+        const live = store.handle.prepare(`SELECT id, image_json FROM diff_comment WHERE id = ? AND run = ? AND superseded_by IS NULL AND consumed_by IS NULL
+      AND reviewer_run IS NULL AND image_json IS NOT NULL`).get(commentId, runId);
+        if (live === undefined)
+            return { ok: false, reason: "not-found" };
+        const image = readFeedbackImage(live["image_json"]);
+        if (image === null)
+            return { ok: false, reason: "not-found" };
+        const problem = unusable(image);
+        if (problem === null)
+            return { ok: false, reason: "image-usable" };
+        const copy = store.handle.prepare(`INSERT INTO diff_comment (artifact, artifact_sha, run, path, line, note, author, created_at, reviewer_run, severity)
+      SELECT artifact, artifact_sha, run, path, line, note, author, ?, reviewer_run, severity FROM diff_comment WHERE id = ?`).run(now.toISOString(), commentId);
+        const id = Number(copy.lastInsertRowid);
+        const moved = store.handle.prepare("UPDATE diff_comment SET superseded_by = ? WHERE id = ? AND superseded_by IS NULL AND consumed_by IS NULL").run(id, commentId);
+        if (Number(moved.changes) !== 1)
+            throw new Error("The saved note changed while its screenshot was being removed.");
+        store.recordAction({ at: now.toISOString(), actor, repo,
+            taskId: store.externalIdFor(run.taskRef) ?? null, runId, action: "feedback screenshot removed", outcome: "recorded", source: "work",
+            detail: `note ${commentId} kept as note ${id} without screenshot ${image.artifact}: ${problem}` });
+        return { ok: true, id };
+    });
+}
+/** The put-away record of this task, or null when it is not put away. */
+export function archiveOf(store, taskId) {
+    const row = store.handle.prepare(`SELECT a.*, r.external_id FROM task_archive a JOIN task_ref r ON r.id = a.task_ref
+    WHERE r.backend = 'built-in' AND r.external_id = ?`).get(taskId);
+    return row === undefined ? null : { taskRef: Number(row["task_ref"]), taskId: String(row["external_id"]), by: String(row["by"]),
+        byKind: row["by_kind"] === "tidy" ? "tidy" : "person", rule: row["rule"] == null ? null : String(row["rule"]), reason: String(row["reason"]), at: String(row["at"]) };
+}
+/** Every version of a task's family, by the same proven lineage the task page reads (`taskFamilyOf`: same project, each
+ * revision bound to its parent's own run by its brief). A family whose lineage doesn't prove is just this task. */
+export function taskFamilyRefs(store, taskId) {
+    const family = store.taskFamilyOf(taskId, null, true);
+    return family === null ? [] : family.versions.map(one => ({ id: one.refId, taskId: one.id })).sort((a, b) => a.id - b.id);
+}
+/** The first family version with something still going on, or null: running, a live newest claim, an unfinished run,
+ * a process Toolroll hasn't seen exit, a build whose processes were never recorded, a stop still settling, a follow-up
+ * check asked for and not finished, a flow step running for its card, a release in flight (a live release approval
+ * that names it, or a deploy or merge reserved, running or unknown), or a pull request merging (an intent claimed or
+ * firing, or a person's merge between its last check and GitHub's answer). */
+export function liveFamilyAttempt(store, refs, now) {
+    if (refs.length === 0)
+        return null;
+    const row = store.handle.prepare(`SELECT r.external_id FROM task_ref r JOIN task t ON t.id = r.external_id
+    WHERE r.id IN (SELECT value FROM json_each(?)) AND (t.state = 'running'
+      OR EXISTS (SELECT 1 FROM claim c WHERE c.task_ref = r.id AND c.released_at IS NULL AND c.expires_at > ?
+        AND c.lease_generation = (SELECT MAX(n.lease_generation) FROM claim n WHERE n.task_ref = r.id))
+      OR EXISTS (SELECT 1 FROM run x WHERE x.task_ref = r.id AND x.outcome IS NULL)
+      OR EXISTS (SELECT 1 FROM run_process p JOIN run x ON x.id = p.run WHERE x.task_ref = r.id AND p.exited_at IS NULL AND p.container_empty_at IS NULL)
+      OR EXISTS (SELECT 1 FROM run x WHERE x.task_ref = r.id AND x.provider_started_at IS NOT NULL
+        AND NOT EXISTS (SELECT 1 FROM run_process p WHERE p.run = x.id) AND NOT EXISTS (SELECT 1 FROM run_process_summary s WHERE s.run = x.id))
+      OR EXISTS (SELECT 1 FROM run_stop s WHERE s.task_ref = r.id AND s.resumed_at IS NULL AND s.settled_at IS NULL)
+      OR EXISTS (SELECT 1 FROM action_ledger q JOIN run x ON x.id = q.run_id WHERE x.task_ref = r.id AND q.action = 'checks requested'
+        AND NOT EXISTS (SELECT 1 FROM action_ledger f WHERE f.run_id = q.run_id AND f.action = 'checks finished' AND f.outcome LIKE q.id || ':%'))
+      OR EXISTS (SELECT 1 FROM flow_card c JOIN flow_step_run s ON s.card = c.id
+        WHERE s.state = 'running' AND (c.task = r.external_id OR c.primary_task = r.external_id))
+      OR EXISTS (SELECT 1 FROM flow_step_task t JOIN flow_step_run s ON s.card = t.card AND s.entry = t.entry
+        WHERE s.state = 'running' AND t.task_id = r.external_id)
+      OR EXISTS (SELECT 1 FROM deploy_in_flight d WHERE d.task_ref = r.id AND d.at > ?)
+      OR EXISTS (SELECT 1 FROM release_authority a WHERE a.state IN ('open','deploying','merge-reserved') AND (a.anchor_task = r.external_id OR a.tip_task = r.external_id))
+      OR EXISTS (SELECT 1 FROM release_operation o WHERE o.task_id = r.external_id AND o.state IN ('reserved','running','unknown'))
+      OR EXISTS (SELECT 1 FROM merge_intent i JOIN publication p ON p.id = i.publication WHERE p.task_ref = r.id AND i.state IN ('claimed','firing'))
+      OR EXISTS (SELECT 1 FROM merge_in_flight m WHERE m.task_ref = r.id AND m.at > ?))
+    LIMIT 1`).get(JSON.stringify(refs), now.toISOString(), new Date(now.getTime() - 30 * 60_000).toISOString(), new Date(now.getTime() - 15 * 60_000).toISOString());
+    return row === undefined ? null : String(row["external_id"]);
+}
+/** Puts a task away (v145): every version of its family, in one write transaction that re-checks it has no live
+ * attempt, that its versions are exactly `expect` when the caller showed a person a family (a preview), and that
+ * `guard` (the caller's own rule, re-read under the lock) still allows it. Its state, history, results, approvals and
+ * ledger are untouched; its open notifications are resolved; one ledger row records who and why. */
+export function archiveTaskFamily(store, taskId, by, now, options = {}) {
+    return store.transact(() => {
+        const family = taskFamilyRefs(store, taskId);
+        if (family.length === 0)
+            return { ok: false, reason: "unknown-task", message: `No task ${taskId}.` };
+        const refs = family.map(one => one.id);
+        if (options.expect !== undefined && [...options.expect].sort((a, b) => a - b).join(",") !== refs.join(",")) {
+            return { ok: false, reason: "blocked", message: `${taskId}'s versions changed since the list was shown.` };
+        }
+        // Already put away, every version: nothing to do. A family a person revived with a new revision puts away the rest.
+        const remaining = refs.filter(ref => !refArchived(store, ref));
+        if (remaining.length === 0)
+            return { ok: false, reason: "archived", message: `${taskId} is already put away.` };
+        const live = liveFamilyAttempt(store, refs, now);
+        if (live !== null)
+            return { ok: false, reason: "live", message: `${taskId} still has work going on. Stop it or let it finish, then put it away.` };
+        const blocked = options.guard?.(refs) ?? null;
+        if (blocked !== null)
+            return { ok: false, reason: "blocked", message: blocked };
+        const reason = by.reason.replace(/[\u0000-\u001f\u007f]+/g, " ").trim().slice(0, 300) || "Put away";
+        const at = now.toISOString();
+        const insert = store.handle.prepare("INSERT INTO task_archive (task_ref, by, by_kind, rule, reason, at) VALUES (?, ?, ?, ?, ?, ?)");
+        for (const ref of remaining)
+            insert.run(ref, by.by, by.byKind, by.rule, reason, at);
+        store.handle.prepare("UPDATE notification SET resolved_at = ? WHERE resolved_at IS NULL AND task_ref IN (SELECT value FROM json_each(?))")
+            .run(at, JSON.stringify(refs));
+        // The family's flow cards hold while it is put away, so what they queued for people is settled too.
+        store.handle.prepare(`UPDATE notification SET resolved_at = ? WHERE resolved_at IS NULL AND EXISTS (SELECT 1 FROM flow_card c
+        WHERE (c.task IN (SELECT value FROM json_each(?)) OR c.primary_task IN (SELECT value FROM json_each(?)))
+          AND (notification.dedupe_key LIKE 'flow:' || c.id || ':%' OR notification.dedupe_key LIKE 'flow-card:' || c.id || ':%'))`)
+            .run(at, JSON.stringify(family.map(one => one.taskId)), JSON.stringify(family.map(one => one.taskId)));
+        const repo = store.refById(refs[0])?.repo ?? null;
+        store.recordAction({ at, actor: by.byKind === "tidy" ? "tidy" : `operator:${by.by}`, repo, taskId, runId: null, action: "task archived",
+            outcome: by.rule ?? "by hand", source: "work", detail: `${reason}${refs.length > 1 ? ` (${refs.length} versions)` : ""}` });
+        return { ok: true, refs };
+    });
+}
+/** Brings a put-away task back (v145): every version of its family, with a ledger row. Tidy never puts a restored
+ * task away again (tidy.ts reads the `task restored` row). */
+export function restoreTaskFamily(store, taskId, by, now, guard) {
+    return store.transact(() => {
+        const family = taskFamilyRefs(store, taskId);
+        if (family.length === 0)
+            return { ok: false, reason: "unknown-task", message: `No task ${taskId}.` };
+        const refs = family.map(one => one.id).filter(ref => refArchived(store, ref));
+        if (refs.length === 0)
+            return { ok: false, reason: "not-archived", message: `${taskId} isn't put away.` };
+        const blocked = guard?.(refs) ?? null;
+        if (blocked !== null)
+            return { ok: false, reason: "blocked", message: blocked };
+        store.handle.prepare("DELETE FROM task_archive WHERE task_ref IN (SELECT value FROM json_each(?))").run(JSON.stringify(refs));
+        const at = now.toISOString();
+        store.recordAction({ at, actor: `operator:${by}`, repo: store.refById(refs[0])?.repo ?? null, taskId, runId: null, action: "task restored",
+            outcome: "recorded", source: "work", detail: refs.length > 1 ? `${refs.length} versions` : null });
+        return { ok: true, refs };
+    });
+}