toolroll 0.9.85 → 0.9.86

package/dist/store.js

@@ -9,6 +9,8 @@ import { isAcpProfile, isAcpProvider } from "./acp-agents.js";
 import { ACP_CONFORMANCE_VERSION, launchFromJson } from "./acp-attest.js";
 import { reclaimDatabase } from "./database-reclaim.js";
 import { BASELINE_SCHEMA, BASELINE_SCHEMA_VERSION } from "./store-baseline.js";
+import { refArchived, taskArchived } from "./task-archive.js";
+export { refArchived, taskArchived } from "./task-archive.js";
 import { CHAT_PROVIDERS, CHAT_SCHEMA } from "./contracts/chat-tables.js";
 import {} from "./chat-core.js";
 import { ChatMessages, TELEGRAM_HOLD_REASONS, TELEGRAM_SKIPPED_ELSEWHERE, TELEGRAM_SKIPPED_OTHER_CHAT, TELEGRAM_SKIPPED_QUIET, TELEGRAM_UNSETTLED } from "./chat-messages.js";
@@ -94,6 +96,7 @@ import { LEDGER_COLUMNS, LEDGER_SCHEMA, LEDGER_TABLE, LEDGER_V99_TABLE, installL
 import { PLAN_AUTO_SCHEMA } from "./plan-auto.js";
 import { CONSOLE_INSTANCE_SCHEMA } from "./console-instance.js";
 import { endUnattendedGrants, FLOW_UNATTENDED_SCHEMA, grantStandsSql } from "./flow-unattended.js";
+import { FLOW_BROWSER_SCHEMA } from "./flow-browser.js";
 import { RECIPE_SCHEMA } from "./recipes.js";
 import { POLICY_SCHEMA, agentRefusal, approvalRefusal, policyParts, readPolicy, underCeiling, sessionCeilingRefusal } from "./policy.js";
 import { PROVIDER_AUTH_SCHEMA } from "./provider-auth.js";
@@ -1092,7 +1095,13 @@ const REGISTERED_AT_FILING = "again, as it was filed";
 // project's intake choice and last answer, and each request taken, with the task it became.
 // v143 adds, and changes no saved row: optional exact-screenshot context on result feedback
 // (diff_comment.image_json, V143_ADDED_COLUMNS; saved notes read NULL and keep their file/line target).
-export const SCHEMA_VERSION = 143;
+// v144 adds, and changes no saved row: a person's approval of browser use in a flow's script zones (flow_browser_grant;
+// flow-browser.ts), the one sandbox rule a project check gets for Chromium; saved flows have none and get nothing.
+// v145 adds, and changes no saved row (docs/plans/task-tidy.md): put-away tasks (task_archive, one row per archived task
+// version; no row is every saved task: not archived), the completed workflow runs on a watched branch the checks
+// trigger saw (branch_check_run), and the reservations that hold work back from being put away (merge_in_flight,
+// deploy_in_flight, flow_step_task; V145_SCHEMA, new tables only).
+export const SCHEMA_VERSION = 145;
 /** v118: the tables merged into `credential`, in the order they move (a person's API tokens keep their ids first). */
 export const V118_MERGED_TABLES = Object.freeze({ api_token: "person", coordinator_credential: "coordinator", lead_credential: "lead" });
 /** The foreign keys that named a merged table, exactly as their DDL wrote them; each names `credential(id)` instead. */
@@ -1225,7 +1234,7 @@ const V115_DROPPED_REFERENCES = /\s+REFERENCES (?:contestant|contest|tournament_
  * unchanged), and adds the nullable column in V125_ADDED_COLUMNS, checked the same way. v126 only adds a new table
  * (task_source) and the columns in V126_ADDED_COLUMNS (null or 0), checked the same way.
  */
-export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143]);
+export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145]);
 /** v119: the columns it adds, by table, with the value every row saved before it reads (toolroll-update's HISTORY_RULES). */
 export const V119_ADDED_COLUMNS = Object.freeze({
     task_ref: { planning_generation: { definition: "INTEGER NOT NULL DEFAULT 0", saved: "0" } },
@@ -1365,6 +1374,55 @@ export const V140_ADDED_COLUMNS = Object.freeze({
 export const V143_ADDED_COLUMNS = Object.freeze({
     diff_comment: { image_json: { definition: "TEXT", saved: "NULL" } },
 });
+/** v145 (docs/plans/task-tidy.md): `task_archive` is a put-away task version. A row hides it from every list and count
+ * and refuses every door that would dispatch, claim or approve it; restore deletes the row. Its history, results,
+ * approvals and ledger stay exactly as they were. `merge_in_flight` is a direct merge between its last check and GitHub's
+ * answer, owned by its token: a task can't be put away under it (a row older than 15 minutes is a crash, and no
+ * longer counts). `deploy_in_flight` is a deployment whose candidate passed its gate (30 minutes, refreshed by every
+ * phase that proves it again). `flow_step_task` is the tasks a flow step was admitted for, kept whatever the card does
+ * next, so a step still running holds them. `branch_check_run` keeps each completed GitHub workflow run (pushed to
+ * the watched branch of the watched repository) the "checks failed" trigger saw, green or red, so tidy can tell a
+ * failure notice was fixed by a later commit. */
+export const V145_SCHEMA = `
+CREATE TABLE IF NOT EXISTS task_archive (
+  task_ref INTEGER PRIMARY KEY REFERENCES task_ref(id),
+  by       TEXT NOT NULL,
+  by_kind  TEXT NOT NULL CHECK (by_kind IN ('person','tidy')),
+  rule     TEXT,
+  reason   TEXT NOT NULL,
+  at       TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS branch_check_run (
+  repo           TEXT NOT NULL,
+  run_id         INTEGER NOT NULL,
+  branch         TEXT NOT NULL,
+  workflow       TEXT NOT NULL,
+  head_sha       TEXT NOT NULL,
+  conclusion     TEXT NOT NULL CHECK (conclusion IN ('success','failure')),
+  run_created_at TEXT NOT NULL,
+  observed_at    TEXT NOT NULL,
+  PRIMARY KEY (repo, run_id)
+);
+CREATE INDEX IF NOT EXISTS branch_check_run_by_workflow ON branch_check_run (repo, branch, workflow, run_created_at);
+CREATE TABLE IF NOT EXISTS merge_in_flight (
+  publication INTEGER PRIMARY KEY REFERENCES publication(id),
+  task_ref    INTEGER NOT NULL REFERENCES task_ref(id),
+  token       TEXT NOT NULL,
+  by          TEXT NOT NULL,
+  at          TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS deploy_in_flight (
+  task_ref INTEGER PRIMARY KEY REFERENCES task_ref(id),
+  run      INTEGER NOT NULL,
+  at       TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS flow_step_task (
+  card    INTEGER NOT NULL,
+  entry   INTEGER NOT NULL,
+  task_id TEXT NOT NULL,
+  PRIMARY KEY (card, entry, task_id)
+);
+`;
 /**
  * v135: one approval per release (docs/plans/release-once.md). `release_authority` is the single source of truth for a
  * release a person approved: one row per generation, changed only by compare-and-swap on `rev`, with a lease whose
@@ -4622,6 +4680,10 @@ CREATE INDEX IF NOT EXISTS run_checkpoint_by_task ON run_checkpoint (task_ref, i
         for (const [column, { definition }] of Object.entries(columns))
             addColumn(db, table, column, definition);
     }
+    // v144: approvals of browser use in flows' script zones (a new table only).
+    db.exec(FLOW_BROWSER_SCHEMA);
+    // v145: put-away tasks, green checks per branch and the reservations that hold work back (new tables only).
+    db.exec(V145_SCHEMA);
     // Keep the epoch until reclamation succeeds, including a retry after compaction already committed. A new file has
     // nothing to reclaim.
     if (!fresh)
@@ -6361,6 +6423,7 @@ export class Store {
            FROM task JOIN task_ref ON task_ref.backend = ? AND task_ref.external_id = task.id
           WHERE task.state = 'queued'
             AND (? IS NULL OR task_ref.repo IS NULL OR task_ref.repo = ?)
+            AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)
           ORDER BY task.priority DESC, task.created_at, task_ref.id
           LIMIT 200`)
             .all(stamp, BUILT_IN, repo, repo)
@@ -6385,7 +6448,8 @@ export class Store {
             .prepare(`SELECT task.priority AS priority, task.created_at AS created_at, task_ref.id AS ref,
                 task_ref.repo AS repo, task_ref.assigned_runner AS assigned
            FROM task JOIN task_ref ON task_ref.backend = ? AND task_ref.external_id = task.id
-          WHERE task.id = ? AND task.state = 'queued'`)
+          WHERE task.id = ? AND task.state = 'queued'
+            AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)`)
             .get(BUILT_IN, taskId);
         if (me === undefined)
             return null;
@@ -6397,7 +6461,8 @@ export class Store {
                  OR (task.priority = ? AND task.created_at = ? AND task_ref.id < ?)
                THEN 1 ELSE 0 END) AS ahead
            FROM task JOIN task_ref ON task_ref.backend = ? AND task_ref.external_id = task.id
-          WHERE task.state = 'queued' AND (task_ref.assigned_runner IS ?) AND (task_ref.repo IS ?)`)
+          WHERE task.state = 'queued' AND (task_ref.assigned_runner IS ?) AND (task_ref.repo IS ?)
+            AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)`)
             .get(Number(me["priority"]), Number(me["priority"]), String(me["created_at"]), Number(me["priority"]), String(me["created_at"]), Number(me["ref"]), BUILT_IN, me["assigned"], me["repo"]);
         return {
             position: Number(row?.["ahead"] ?? 0) + 1,
@@ -6547,6 +6612,8 @@ export class Store {
          JOIN task_ref ON task_ref.backend = ? AND task_ref.external_id = task.id
          WHERE task.state = 'queued'
            ${reservation}
+           -- A put-away task (v145) never dispatches.
+           AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)
            AND NOT EXISTS (
              SELECT 1 FROM hold
              WHERE hold.task_ref = task_ref.id
@@ -7328,6 +7395,9 @@ export class Store {
             // road it came by.
             if (basis === undefined && machineActing())
                 return false;
+            // A PUT-AWAY TASK (v145, task-tidy.md) is never approved, by any road: restore it first.
+            if (taskArchived(this, taskId))
+                return false;
             // A RELEASE WAITING FOR CI (Codex review round 1, finding 4): filed while its pull request's checks still ran,
             // only the automatic road (which proves CI itself) seals it until the plane read exact-head CI passing.
             if (basis?.kind !== "auto-check" && basis?.kind !== "auto-green" && releaseCiHoldOf(this, taskId) !== null)
@@ -10587,7 +10657,7 @@ export class Store {
         versions.sort((a, b) => a.id === root.id ? -1 : b.id === root.id ? 1 : a.createdAt.localeCompare(b.createdAt) || a.refId - b.refId);
         const current = versions.at(-1);
         return { root, current, versions,
-            otherActive: versions.filter(one => one.id !== current.id && (one.state === "queued" || one.state === "running")),
+            otherActive: versions.filter(one => one.id !== current.id && (one.state === "queued" || one.state === "running") && !refArchived(this, one.refId)),
             problem: Number(rows[0]["broken"]) === 0 ? null : "Task history is unavailable or incomplete. This task is shown separately." };
     }
     /** Group and filter BEFORE the family limit; hydrate only that page's
@@ -10597,6 +10667,8 @@ export class Store {
         const order = options.order === "updated" ? "updated_at" : "created_at";
         const rows = this.db.prepare(`${projection.sql}, selected AS MATERIALIZED (
         SELECT * FROM ordered WHERE version_rank = 1
+          -- A put-away family (v145) is out of every list, before the page is cut.
+          AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = ordered.ref_id)
           ${options.states === undefined ? "" : `AND state IN (${options.states.map(() => "?").join(",")})`}
         ORDER BY ${order} DESC, ref_id DESC LIMIT ?
       ) SELECT task.*, members.repo, members.ref_id, members.root_ref, members.broken
@@ -10687,7 +10759,8 @@ export class Store {
         COUNT(CASE WHEN live_families.root_ref IS NOT NULL THEN 1 END) AS running,
         COUNT(CASE WHEN live_families.root_ref IS NULL AND ordered.state = 'queued' THEN 1 END) AS queued,
         COUNT(CASE WHEN live_families.root_ref IS NULL AND ordered.state = 'done' AND ordered.updated_at >= ? THEN 1 END) AS doneRecently
-      FROM ordered LEFT JOIN live_families ON live_families.root_ref = ordered.root_ref WHERE version_rank = 1`)
+      FROM ordered LEFT JOIN live_families ON live_families.root_ref = ordered.root_ref WHERE version_rank = 1
+        AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = ordered.ref_id)`)
             .get(...projection.params, JSON.stringify(liveTasks), new Date(now.getTime() - 24 * 60 * 60_000).toISOString());
         return { running: Number(row["running"]), queued: Number(row["queued"]), doneRecently: Number(row["doneRecently"]) };
     }
@@ -11121,6 +11194,9 @@ export class Store {
             if (ref === undefined)
                 return { ok: false, reason: "unknown-task" };
             const taskRef = Number(ref["id"]);
+            // A put-away task (v145) is restored before it runs again.
+            if (refArchived(this, taskRef))
+                return { ok: false, reason: "archived" };
             const stamp = now.toISOString();
             if (this.hasLiveClaim(taskRef, now))
                 return { ok: false, reason: "claimed" };
@@ -12732,10 +12808,12 @@ export class Store {
             : source !== undefined && "project" in source && source.project !== "" ? "project"
                 : source !== undefined && "installation" in source ? "installation" : "unknown";
         const project = scope === "task" ? String(ref["repo"]) : scope === "project" && source !== undefined && "project" in source ? source.project : null;
+        // A put-away task (v145) nudges nobody: no notification about it is enqueued, whoever produced it. The check is
+        // part of the insert itself, so a put away that commits first always wins.
         const { changes, lastInsertRowid } = this.db
             .prepare(`INSERT OR IGNORE INTO notification (dedupe_key, kind, subject, body, created_at, push_class, link, provenance_scope, project, task_ref, task_id, source_run, recipient)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-            .run(notification.dedupeKey, notification.kind, notification.subject, notification.body, now.toISOString(), notification.pushClass ?? null, notification.link ?? null, scope, project, ref === undefined ? null : taskRef, ref === undefined ? null : String(ref["external_id"]), run?.id ?? null, notification.recipient ?? null);
+         SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ? WHERE NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = ?)`)
+            .run(notification.dedupeKey, notification.kind, notification.subject, notification.body, now.toISOString(), notification.pushClass ?? null, notification.link ?? null, scope, project, ref === undefined ? null : taskRef, ref === undefined ? null : String(ref["external_id"]), run?.id ?? null, notification.recipient ?? null, ref === undefined ? null : Number(ref["id"]));
         // Whose act made this fact: pings follow it (see pingAllowed).
         const actor = currentActor();
         if (Number(changes) > 0 && actor !== null) {
@@ -14227,6 +14305,7 @@ export class Store {
            JOIN task_ref ON task_ref.backend = ? AND task_ref.external_id = task.id
            WHERE (? IS NULL OR task_ref.repo IS NULL OR task_ref.repo = ?)
              AND (? IS NULL OR task.state = ?)
+             AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)
            ORDER BY task.created_at DESC, task.id DESC LIMIT ?
          )
          UNION
@@ -14395,8 +14474,10 @@ export class Store {
     resolvePlanRevision(id, outcome, resolvedBy, now) {
         const { changes } = this.db
             .prepare(`UPDATE plan_revision SET status = ?, resolved_at = ?, resolved_by = ?
-          WHERE id = ? AND status = 'blocked'`)
-            .run(outcome, now.toISOString(), resolvedBy, id);
+          WHERE id = ? AND status = 'blocked'
+            -- A put-away task's (v145) plan change is never applied; rejecting it still is.
+            AND (? = 'rejected' OR NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = plan_revision.task_ref))`)
+            .run(outcome, now.toISOString(), resolvedBy, id, outcome);
         return Number(changes) > 0;
     }
     /** Stamp the exact plan revision and authority snapshot a run's brief was
@@ -15626,6 +15707,12 @@ export class Store {
             if (row === undefined || String(row["state"]) !== "claimed" || Number(row["generation"]) !== generation) {
                 return { ok: false, outcome: "raced", why: "the claim moved" };
             }
+            // A put-away task (v145) merges nothing: the intent waits for a person, who restores it first.
+            const archivedTask = this.db.prepare("SELECT 1 FROM publication p JOIN task_archive a ON a.task_ref = p.task_ref WHERE p.id = ?").get(Number(row["publication"]));
+            if (archivedTask !== undefined) {
+                this.settleMergeIntent(id, generation, "waiting-human", now, { error: "the task is put away", from: "claimed", bumpGeneration: true });
+                return { ok: false, outcome: "waiting-human", why: "the task is put away" };
+            }
             const supersede = (why) => {
                 this.settleMergeIntent(id, generation, "superseded", now, { error: why, from: "claimed" });
                 return { ok: false, outcome: "superseded", why };
@@ -17384,9 +17471,10 @@ export class Store {
         const page = Math.max(1, Math.min(Math.floor(limit), 50));
         // Roll-up admission binds BEFORE the LIMIT (Codex roll-up review,
         // finding 2): a repo outside the ceiling must not consume the page.
-        const admission = admitted === null
+        // A put-away task (v145, task-tidy.md) is left out here, as from every list and count.
+        const admission = (admitted === null
             ? "(? IS NULL OR task_ref.repo IS NULL OR task_ref.repo = ?)"
-            : `(task_ref.repo IS NULL${admitted.length === 0 ? "" : ` OR task_ref.repo IN (${admitted.map(() => "?").join(",")})`})`;
+            : `(task_ref.repo IS NULL${admitted.length === 0 ? "" : ` OR task_ref.repo IN (${admitted.map(() => "?").join(",")})`})`) + " AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)";
         const params = admitted === null ? [repo, repo] : admitted;
         return this.db
             .prepare(`SELECT task.id AS task_id, task.title, task_scope.goal, task_scope.digest, task_scope.proposed_at, task_ref.repo AS task_repo
@@ -17416,9 +17504,10 @@ export class Store {
      */
     listRequeueablesScoped(repo, now, limit = 10, admitted = null) {
         const page = Math.max(1, Math.min(Math.floor(limit), 50));
-        const admission = admitted === null
+        // A put-away task (v145, task-tidy.md) is left out here, as from every list and count.
+        const admission = (admitted === null
             ? "(? IS NULL OR task_ref.repo IS NULL OR task_ref.repo = ?)"
-            : `(task_ref.repo IS NULL${admitted.length === 0 ? "" : ` OR task_ref.repo IN (${admitted.map(() => "?").join(",")})`})`;
+            : `(task_ref.repo IS NULL${admitted.length === 0 ? "" : ` OR task_ref.repo IN (${admitted.map(() => "?").join(",")})`})`) + " AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)";
         const params = admitted === null ? [repo, repo] : admitted;
         return this.db
             .prepare(`WITH open_incidents AS (
@@ -17482,6 +17571,8 @@ export class Store {
          JOIN task_ref AS blocker_ref ON blocker_ref.backend = ? AND blocker_ref.external_id = task_edge.blocker
          WHERE ${admissionOf("dependent_ref")}
            AND ${admissionOf("blocker_ref")}
+           -- Put-away tasks (v145) need no repair card, on either side.
+           AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref IN (dependent_ref.id, blocker_ref.id))
          GROUP BY task_edge.blocker, dependent_ref.repo, blocker_ref.repo
          ORDER BY task_edge.blocker LIMIT ?`)
             .all(BUILT_IN, BUILT_IN, ...paramsOf(), ...paramsOf(), page)
@@ -17514,6 +17605,7 @@ export class Store {
            WHERE task.state = 'done'
              AND (? IS NULL OR task_ref.repo IS NULL OR task_ref.repo = ?)
              ${admission}
+             AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)
          )
          SELECT completed.*, run.id AS run_id, run.outcome, run.handoff, run.cost_usd, run.provider, run.auth_mode, run.started_at, run.finished_at,
                 publication.state AS pub_state, publication.pr_number, publication.pr_url,
@@ -17620,9 +17712,10 @@ export class Store {
         // finding 11): in the roll-up, rows outside the ceiling must not
         // consume the page and crowd out admitted cards. Serve still filters
         // per-row afterward — this is the bound, that is the law.
-        const admission = admitted === null
+        // A put-away task (v145, task-tidy.md) is left out here, as from every list and count.
+        const admission = (admitted === null
             ? "(? IS NULL OR task_ref.repo IS NULL OR task_ref.repo = ?)"
-            : `(task_ref.repo IS NULL OR task_ref.repo IN (${admitted.map(() => "?").join(",")}))`;
+            : `(task_ref.repo IS NULL OR task_ref.repo IN (${admitted.map(() => "?").join(",")}))`) + " AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)";
         const admissionParams = admitted === null ? [repo, repo] : admitted;
         const columns = `
         SELECT task.id, task.title, task.state, task.updated_at, task.priority, task_ref.strikes, task_ref.repo AS task_repo,
@@ -17826,14 +17919,15 @@ export class Store {
            SUM(CASE WHEN task.state = 'queued' THEN 1 ELSE 0 END) AS queued,
            SUM(CASE WHEN task.state = 'running' THEN 1 ELSE 0 END) AS running
            FROM task JOIN task_ref ON task_ref.backend = 'built-in' AND task_ref.external_id = task.id
-          WHERE task_ref.repo = ?`)
+          WHERE task_ref.repo = ? AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)`)
             .get(repo);
         const since = new Date(now.getTime() - 24 * 60 * 60_000).toISOString();
         const done = this.db
             .prepare(`SELECT COUNT(*) AS n FROM run
            JOIN task_ref ON task_ref.id = run.task_ref
           WHERE task_ref.repo = ? AND run.role IN ('builder','scout')
-            AND run.outcome IN ('built','no-change') AND run.finished_at IS NOT NULL AND run.finished_at >= ?`)
+            AND run.outcome IN ('built','no-change') AND run.finished_at IS NOT NULL AND run.finished_at >= ?
+            AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)`)
             .get(repo, since);
         return { waiting: waiting, queued: Number(q.queued ?? 0), running: Number(q.running ?? 0), doneRecently: Number(done.n) };
     }
@@ -17842,9 +17936,10 @@ export class Store {
         // review, finding 11): with repo NULL the old predicate admitted every
         // stored project, ceiling or not. An empty admitted list reduces to
         // unplaced rows only — never IN ().
-        const admission = admitted === null
+        // A put-away task (v145, task-tidy.md) is left out here, as from every list and count.
+        const admission = (admitted === null
             ? "(? IS NULL OR task_ref.repo IS NULL OR task_ref.repo = ?)"
-            : `(task_ref.repo IS NULL${admitted.length === 0 ? "" : ` OR task_ref.repo IN (${admitted.map(() => "?").join(",")})`})`;
+            : `(task_ref.repo IS NULL${admitted.length === 0 ? "" : ` OR task_ref.repo IN (${admitted.map(() => "?").join(",")})`})`) + " AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)";
         const params = () => (admitted === null ? [repo, repo] : [...admitted]);
         const row = this.db
             .prepare(`SELECT COUNT(*) AS n FROM (
@@ -18697,6 +18792,8 @@ export class Store {
      */
     resumeRunStop(args, now) {
         return this.transact(() => {
+            if (refArchived(this, args.taskRef))
+                return { ok: false, reason: "archived", detail: "this task is put away — restore it first" };
             const stop = this.stopOf(args.runId);
             const run = this.getRun(args.runId);
             if (stop === null || run === null)
@@ -21669,3 +21766,108 @@ export function dropFeedbackImage(store, runId, commentId, actor, unusable, now)
         return { ok: true, id };
     });
 }
+/** The put-away record of this task, or null when it is not put away. */
+export function archiveOf(store, taskId) {
+    const row = store.handle.prepare(`SELECT a.*, r.external_id FROM task_archive a JOIN task_ref r ON r.id = a.task_ref
+    WHERE r.backend = 'built-in' AND r.external_id = ?`).get(taskId);
+    return row === undefined ? null : { taskRef: Number(row["task_ref"]), taskId: String(row["external_id"]), by: String(row["by"]),
+        byKind: row["by_kind"] === "tidy" ? "tidy" : "person", rule: row["rule"] == null ? null : String(row["rule"]), reason: String(row["reason"]), at: String(row["at"]) };
+}
+/** Every version of a task's family, by the same proven lineage the task page reads (`taskFamilyOf`: same project, each
+ * revision bound to its parent's own run by its brief). A family whose lineage doesn't prove is just this task. */
+export function taskFamilyRefs(store, taskId) {
+    const family = store.taskFamilyOf(taskId, null, true);
+    return family === null ? [] : family.versions.map(one => ({ id: one.refId, taskId: one.id })).sort((a, b) => a.id - b.id);
+}
+/** The first family version with something still going on, or null: running, a live newest claim, an unfinished run,
+ * a process Toolroll hasn't seen exit, a build whose processes were never recorded, a stop still settling, a follow-up
+ * check asked for and not finished, a flow step running for its card, a release in flight (a live release approval
+ * that names it, or a deploy or merge reserved, running or unknown), or a pull request merging (an intent claimed or
+ * firing, or a person's merge between its last check and GitHub's answer). */
+export function liveFamilyAttempt(store, refs, now) {
+    if (refs.length === 0)
+        return null;
+    const row = store.handle.prepare(`SELECT r.external_id FROM task_ref r JOIN task t ON t.id = r.external_id
+    WHERE r.id IN (SELECT value FROM json_each(?)) AND (t.state = 'running'
+      OR EXISTS (SELECT 1 FROM claim c WHERE c.task_ref = r.id AND c.released_at IS NULL AND c.expires_at > ?
+        AND c.lease_generation = (SELECT MAX(n.lease_generation) FROM claim n WHERE n.task_ref = r.id))
+      OR EXISTS (SELECT 1 FROM run x WHERE x.task_ref = r.id AND x.outcome IS NULL)
+      OR EXISTS (SELECT 1 FROM run_process p JOIN run x ON x.id = p.run WHERE x.task_ref = r.id AND p.exited_at IS NULL AND p.container_empty_at IS NULL)
+      OR EXISTS (SELECT 1 FROM run x WHERE x.task_ref = r.id AND x.provider_started_at IS NOT NULL
+        AND NOT EXISTS (SELECT 1 FROM run_process p WHERE p.run = x.id) AND NOT EXISTS (SELECT 1 FROM run_process_summary s WHERE s.run = x.id))
+      OR EXISTS (SELECT 1 FROM run_stop s WHERE s.task_ref = r.id AND s.resumed_at IS NULL AND s.settled_at IS NULL)
+      OR EXISTS (SELECT 1 FROM action_ledger q JOIN run x ON x.id = q.run_id WHERE x.task_ref = r.id AND q.action = 'checks requested'
+        AND NOT EXISTS (SELECT 1 FROM action_ledger f WHERE f.run_id = q.run_id AND f.action = 'checks finished' AND f.outcome LIKE q.id || ':%'))
+      OR EXISTS (SELECT 1 FROM flow_card c JOIN flow_step_run s ON s.card = c.id
+        WHERE s.state = 'running' AND (c.task = r.external_id OR c.primary_task = r.external_id))
+      OR EXISTS (SELECT 1 FROM flow_step_task t JOIN flow_step_run s ON s.card = t.card AND s.entry = t.entry
+        WHERE s.state = 'running' AND t.task_id = r.external_id)
+      OR EXISTS (SELECT 1 FROM deploy_in_flight d WHERE d.task_ref = r.id AND d.at > ?)
+      OR EXISTS (SELECT 1 FROM release_authority a WHERE a.state IN ('open','deploying','merge-reserved') AND (a.anchor_task = r.external_id OR a.tip_task = r.external_id))
+      OR EXISTS (SELECT 1 FROM release_operation o WHERE o.task_id = r.external_id AND o.state IN ('reserved','running','unknown'))
+      OR EXISTS (SELECT 1 FROM merge_intent i JOIN publication p ON p.id = i.publication WHERE p.task_ref = r.id AND i.state IN ('claimed','firing'))
+      OR EXISTS (SELECT 1 FROM merge_in_flight m WHERE m.task_ref = r.id AND m.at > ?))
+    LIMIT 1`).get(JSON.stringify(refs), now.toISOString(), new Date(now.getTime() - 30 * 60_000).toISOString(), new Date(now.getTime() - 15 * 60_000).toISOString());
+    return row === undefined ? null : String(row["external_id"]);
+}
+/** Puts a task away (v145): every version of its family, in one write transaction that re-checks it has no live
+ * attempt, that its versions are exactly `expect` when the caller showed a person a family (a preview), and that
+ * `guard` (the caller's own rule, re-read under the lock) still allows it. Its state, history, results, approvals and
+ * ledger are untouched; its open notifications are resolved; one ledger row records who and why. */
+export function archiveTaskFamily(store, taskId, by, now, options = {}) {
+    return store.transact(() => {
+        const family = taskFamilyRefs(store, taskId);
+        if (family.length === 0)
+            return { ok: false, reason: "unknown-task", message: `No task ${taskId}.` };
+        const refs = family.map(one => one.id);
+        if (options.expect !== undefined && [...options.expect].sort((a, b) => a - b).join(",") !== refs.join(",")) {
+            return { ok: false, reason: "blocked", message: `${taskId}'s versions changed since the list was shown.` };
+        }
+        // Already put away, every version: nothing to do. A family a person revived with a new revision puts away the rest.
+        const remaining = refs.filter(ref => !refArchived(store, ref));
+        if (remaining.length === 0)
+            return { ok: false, reason: "archived", message: `${taskId} is already put away.` };
+        const live = liveFamilyAttempt(store, refs, now);
+        if (live !== null)
+            return { ok: false, reason: "live", message: `${taskId} still has work going on. Stop it or let it finish, then put it away.` };
+        const blocked = options.guard?.(refs) ?? null;
+        if (blocked !== null)
+            return { ok: false, reason: "blocked", message: blocked };
+        const reason = by.reason.replace(/[\u0000-\u001f\u007f]+/g, " ").trim().slice(0, 300) || "Put away";
+        const at = now.toISOString();
+        const insert = store.handle.prepare("INSERT INTO task_archive (task_ref, by, by_kind, rule, reason, at) VALUES (?, ?, ?, ?, ?, ?)");
+        for (const ref of remaining)
+            insert.run(ref, by.by, by.byKind, by.rule, reason, at);
+        store.handle.prepare("UPDATE notification SET resolved_at = ? WHERE resolved_at IS NULL AND task_ref IN (SELECT value FROM json_each(?))")
+            .run(at, JSON.stringify(refs));
+        // The family's flow cards hold while it is put away, so what they queued for people is settled too.
+        store.handle.prepare(`UPDATE notification SET resolved_at = ? WHERE resolved_at IS NULL AND EXISTS (SELECT 1 FROM flow_card c
+        WHERE (c.task IN (SELECT value FROM json_each(?)) OR c.primary_task IN (SELECT value FROM json_each(?)))
+          AND (notification.dedupe_key LIKE 'flow:' || c.id || ':%' OR notification.dedupe_key LIKE 'flow-card:' || c.id || ':%'))`)
+            .run(at, JSON.stringify(family.map(one => one.taskId)), JSON.stringify(family.map(one => one.taskId)));
+        const repo = store.refById(refs[0])?.repo ?? null;
+        store.recordAction({ at, actor: by.byKind === "tidy" ? "tidy" : `operator:${by.by}`, repo, taskId, runId: null, action: "task archived",
+            outcome: by.rule ?? "by hand", source: "work", detail: `${reason}${refs.length > 1 ? ` (${refs.length} versions)` : ""}` });
+        return { ok: true, refs };
+    });
+}
+/** Brings a put-away task back (v145): every version of its family, with a ledger row. Tidy never puts a restored
+ * task away again (tidy.ts reads the `task restored` row). */
+export function restoreTaskFamily(store, taskId, by, now, guard) {
+    return store.transact(() => {
+        const family = taskFamilyRefs(store, taskId);
+        if (family.length === 0)
+            return { ok: false, reason: "unknown-task", message: `No task ${taskId}.` };
+        const refs = family.map(one => one.id).filter(ref => refArchived(store, ref));
+        if (refs.length === 0)
+            return { ok: false, reason: "not-archived", message: `${taskId} isn't put away.` };
+        const blocked = guard?.(refs) ?? null;
+        if (blocked !== null)
+            return { ok: false, reason: "blocked", message: blocked };
+        store.handle.prepare("DELETE FROM task_archive WHERE task_ref IN (SELECT value FROM json_each(?))").run(JSON.stringify(refs));
+        const at = now.toISOString();
+        store.recordAction({ at, actor: `operator:${by}`, repo: store.refById(refs[0])?.repo ?? null, taskId, runId: null, action: "task restored",
+            outcome: "recorded", source: "work", detail: refs.length > 1 ? `${refs.length} versions` : null });
+        return { ok: true, refs };
+    });
+}

package/dist/surface.js

@@ -171,7 +171,7 @@ const GUIDE_ROWS = [
         notableReasons: ["no-result"] },
     { invocation: "task list", synopsis: "a page of saved task status", audience: "agent", agentMayInvoke: true, mutation: "none",
         flags: [jsonFlag, dbFlag, { name: "state", takesValue: true, meaning: "queued|running|done|failed|cancelled" },
-            { name: "view", takesValue: true, meaning: "all|needs-you|running|completed" },
+            { name: "view", takesValue: true, meaning: "all|needs-you|running|completed|archived" },
             { name: "limit", takesValue: true, meaning: "page size, 1–100; default 40" },
             { name: "cursor", takesValue: true, meaning: "nextCursor from the previous response" },
             { name: "repo", takesValue: true, meaning: "filter to one project" }] },
@@ -299,6 +299,18 @@ const GUIDE_ROWS = [
     operator("task route", "which configured agents plan, build and repair this task; phase and size changes require renewed approval"),
     operator("task reopen", "resume external work its tracker closed and has been SEEN open again"),
     operator("task stop", "stop ONE exact live attempt (--run <id>): durable before any process is signalled, answers 'stopping' until its own processes are established gone; work, branch, and evidence preserved; no strike, no retry"),
+    { ...operator("task archive", "put tasks away (a person's act): out of every list, count and nudge, history and approvals kept; nothing claims, approves or dispatches them until restored"),
+        positionals: [{ name: "id", required: true, meaning: "one or more tasks (any version: the whole family goes)" }],
+        flags: [jsonFlag, dbFlag, { name: "reason", takesValue: true, meaning: "why, shown on the task page" }], notableReasons: ["unknown-task", "not-an-approver"] },
+    { ...operator("task restore", "bring put-away tasks back exactly as they were (a person's act)"),
+        positionals: [{ name: "id", required: true, meaning: "one or more put-away tasks" }], flags: [jsonFlag, dbFlag], notableReasons: ["unknown-task", "not-an-approver"] },
+    { ...operator("task tidy", "Put away old tasks: --preview lists what would go and why (read-only), --apply --digest <d> puts away exactly that list (a person's act)"),
+        flags: [jsonFlag, dbFlag, { name: "preview", takesValue: false, meaning: "show the list and the digest; changes nothing" },
+            { name: "apply", takesValue: false, meaning: "put away exactly the previewed list (needs --digest)" },
+            { name: "digest", takesValue: true, meaning: "the digest --preview printed" },
+            { name: "days", takesValue: true, meaning: "also finished tasks untouched this many days (1–365, default 14)" },
+            { name: "except", takesValue: true, meaning: "comma-separated tasks from the list to leave out" }],
+        notableReasons: ["usage", "not-an-approver", "empty"] },
     operator("run settle", "last resort for a finished run whose process witness can't be proven either way: records your --why in the ledger; refuses while any of the run's processes is alive"),
     operator("task resume", "resume the exact stopped attempt (--run <id>): refuses until it is quiescent, lifts only that stop's hold, approves nothing — the next pass re-proves the scope and inherits the draft with fresh proof"),
     // ---- leases (runner surface) ----
@@ -443,11 +455,15 @@ const REMOTE_NO = [
     "enroll", "revoke",
     // Flow steps that fetch addresses or run checks and scripts here.
     "flows import", "flows trigger check", "flows script save",
+    // Lets a flow script on this machine start Chromium in its sandbox: a person here, with their own password.
+    "flows browser",
     // Reads this machine owner's own Claude and Codex session files (~/.claude, ~/.codex).
     "memory propose",
 ];
 const REMOTE_STEP_UP = [
-    "proposals", "decide", "task regate", "task approve", "task accept", "task merge", "run settle", "knowledge apply", "memory apply",
+    "proposals", "decide", "task regate", "task approve", "task accept", "task merge", "run settle",
+    // Putting tasks away and restoring them: a person's act, in the console or on the server's machine.
+    "task archive", "task restore", "task tidy", "knowledge apply", "memory apply",
     "flows card approve", "flows card send-back", "flows script approve", "flows unattended",
     "approver list", "approver add", "people list", "people invite", "people projects", "people revoke",
     // A person's own API tokens: a password step-up on the server's machine, or the console. Never with a token.

package/dist/task-archive.d.ts

@@ -0,0 +1,10 @@
+/** Put-away checks (v145, docs/plans/task-tidy.md), in a leaf module so every door can ask without loading the store. */
+import type { Store } from "./store.js";
+/** Whether this task version is put away. Every door that dispatches, claims or approves asks this (fail closed: a
+ * row means no). */
+export declare function refArchived(store: Store, taskRef: number): boolean;
+/** Whether the built-in task with this id is put away. */
+export declare function taskArchived(store: Store, taskId: string): boolean;
+/** Whether a flow card's work is put away: its current task or its first build task (a later stage keeps the first
+ * and may clear the current one). Read from the card's own row now, so a put away that committed first holds it. */
+export declare function cardTaskArchived(store: Store, cardId: number): boolean;

package/dist/task-archive.js

@@ -0,0 +1,16 @@
+/** Whether this task version is put away. Every door that dispatches, claims or approves asks this (fail closed: a
+ * row means no). */
+export function refArchived(store, taskRef) {
+    return store.handle.prepare("SELECT 1 FROM task_archive WHERE task_ref = ?").get(taskRef) !== undefined;
+}
+/** Whether the built-in task with this id is put away. */
+export function taskArchived(store, taskId) {
+    return store.handle.prepare(`SELECT 1 FROM task_archive a JOIN task_ref r ON r.id = a.task_ref
+    WHERE r.backend = 'built-in' AND r.external_id = ?`).get(taskId) !== undefined;
+}
+/** Whether a flow card's work is put away: its current task or its first build task (a later stage keeps the first
+ * and may clear the current one). Read from the card's own row now, so a put away that committed first holds it. */
+export function cardTaskArchived(store, cardId) {
+    return store.handle.prepare(`SELECT 1 FROM flow_card c JOIN task_ref r ON r.backend = 'built-in' AND r.external_id IN (c.task, c.primary_task)
+    JOIN task_archive a ON a.task_ref = r.id WHERE c.id = ?`).get(cardId) !== undefined;
+}

package/dist/task-control.d.ts

@@ -102,7 +102,7 @@ export type ResumeOutcome = {
     gate: DispatchDiagnosis | null;
 } | {
     ok: false;
-    reason: "no-task" | "no-stop" | "wrong-task" | "stopping" | "already-resumed" | "superseded" | "busy" | "review" | "occupied";
+    reason: "no-task" | "no-stop" | "wrong-task" | "stopping" | "already-resumed" | "superseded" | "busy" | "review" | "occupied" | "archived";
     detail: string;
 };
 /**