toolroll 0.9.85 → 0.9.86

package/dist/lead-voice.js

@@ -8,7 +8,7 @@
 import { actorLabel, withActor } from "./actor.js";
 import { chatControlHref } from "./chat-controls.js";
 import { BATCH_MS, chatText, chatTitle } from "./chat-voice.js";
-import { BUILT_IN } from "./store.js";
+import { BUILT_IN, refArchived } from "./store.js";
 import { leadNameOf } from "./lead-identity.js";
 import { leadLapsed } from "./task-status.js";
 import { phoneText as plain } from "./telegram-status.js";
@@ -85,19 +85,24 @@ export function leadSay(store, actor, text, taskId, now) {
     // The task's own id never reaches a chat: it reads as the task's short title (chat-voice.ts).
     const said = taskId === null ? text.trim() : chatText(text.trim(), [{ id: taskId, title: chatTitle(store, taskId) }]);
     return store.transact(() => {
+        // A put-away task (v145) gets no messages: the lead's words about it would nudge a person about nothing.
+        if (task !== null && refArchived(store, task.refId))
+            return { ok: false, reason: "refused", message: "This task is put away. A person can restore it first." };
         const stamp = now.toISOString();
         const ledger = store.recordAction({ at: stamp, actor: actorLabel(actor), repo: task?.repo ?? null, taskId, runId: null,
             action: LEAD_SAID, outcome: "recorded", source: "work", detail: text.trim() });
-        const open = store.handle.prepare(`SELECT id, dedupe_key, body FROM notification WHERE kind = ? AND recipient = ? ORDER BY id DESC LIMIT 1`)
+        const open = store.handle.prepare(`SELECT id, dedupe_key, body, task_ref FROM notification WHERE kind = ? AND recipient = ? ORDER BY id DESC LIMIT 1`)
             .get(LEAD_SAY_KIND, actor.account);
         const opened = open === undefined ? null : /^lead-say:(.+):\d+$/.exec(String(open["dedupe_key"]))?.[1] ?? null;
-        const joined = open !== undefined && opened !== null && Date.parse(opened) > now.getTime() - BATCH_MS && Date.parse(opened) <= now.getTime();
+        // A batch is about one task (or none): words about another start a row of their own, so each row keeps its task.
+        const sameTask = open !== undefined && (open["task_ref"] ?? null) === (task === null ? null : task.refId);
+        const joined = sameTask && opened !== null && Date.parse(opened) > now.getTime() - BATCH_MS && Date.parse(opened) <= now.getTime();
         const lines = [...(joined ? String(open["body"]).split("\n") : []), said].slice(-BATCH_LINES);
         if (joined)
             store.handle.prepare("UPDATE notification SET resolved_at = ? WHERE id = ? AND resolved_at IS NULL").run(stamp, Number(open["id"]));
         const key = `lead-say:${joined ? opened : stamp}:${ledger}`;
         store.enqueueNotification({ dedupeKey: key, kind: LEAD_SAY_KIND, subject: leadNameOf(store, actor.account), body: lines.join("\n"),
-            recipient: actor.account, source: { installation: true }, ...(taskId === null ? {} : { link: chatControlHref("task", taskId) }) }, now);
+            recipient: actor.account, source: task === null ? { installation: true } : { taskRef: task.refId }, ...(taskId === null ? {} : { link: chatControlHref("task", taskId) }) }, now);
         const row = store.handle.prepare("SELECT id FROM notification WHERE dedupe_key = ?").get(key);
         return { ok: true, joined, notification: row === undefined ? null : Number(row["id"]) };
     });
@@ -136,14 +141,20 @@ export function leadClaim(store, actor, taskId, now) {
     if ("ok" in task)
         return task;
     const { root } = familyOf(store, taskId);
-    store.transact(() => {
+    const taken = store.transact(() => {
+        // A put-away task (v145) waits on nobody, so the lead takes nothing on there: checked with the claim's own write.
+        if (refArchived(store, task.refId))
+            return false;
         const ledger = store.recordAction({ at: now.toISOString(), actor: actorLabel(actor), repo: task.repo, taskId: root, runId: null,
             action: LEAD_CLAIMED, outcome: "recorded", source: "work" });
         // The owner's card for this task repaints to "<name> is on it": quiet chat edits its card, and every-update
         // chat edits the attempt's own card (the Failed alert), or follows it up when that message is gone.
         store.enqueueNotification({ dedupeKey: `lead-on-it:${ledger}`, kind: LEAD_ON_IT_KIND, subject: `${leadNameOf(store, actor.account)} is on it`, body: "",
             link: chatControlHref("task", taskId), source: cardSource(store, root) ?? { taskRef: task.refId } }, now);
+        return true;
     });
+    if (!taken)
+        return { ok: false, reason: "refused", message: "This task is put away. A person can restore it first." };
     return { ok: true, root, claim: leadClaimOf(store, taskId, now, actor.account) };
 }
 /** Where a task's chat card lives: the family's newest attempt (the card every-update chat edits), else its newest

package/dist/operate.d.ts

@@ -115,7 +115,7 @@ type Args = {
  * exports are behavior, not commentary — and the declared command guide
  * (surface.ts) is tested for exact equality against them.
  */
-export declare const TASK_ACTIONS: readonly ["add", "list", "show", "wait", "state", "block", "unblock", "next", "steer", "pause", "continue", "assign", "reopen", "scope", "approve", "hold", "unhold", "require", "requeue", "regate", "plan", "review", "accept", "repair", "route", "stop", "resume", "complete", "revise", "merge", "ask", "checks", "add-tests"];
+export declare const TASK_ACTIONS: readonly ["add", "list", "show", "wait", "state", "block", "unblock", "next", "steer", "pause", "continue", "assign", "reopen", "scope", "approve", "hold", "unhold", "require", "requeue", "regate", "plan", "review", "accept", "repair", "route", "stop", "resume", "complete", "revise", "merge", "ask", "checks", "add-tests", "archive", "restore", "tidy"];
 export declare const PUBLISH_ACTIONS: readonly ["setup", "grant", "revoke", "status", "unblock", "rearm", "merge", "refire"];
 export declare const CONFIG_ACTIONS: readonly ["show", "set", "clear"];
 export declare const APPROVER_ACTIONS: readonly ["list", "add"];

package/dist/operate.js

@@ -28,6 +28,8 @@ import { idleStorageSweep, sweepSchedule, sweepScheduleWords } from "./storage-s
 import { lastSweep, saveSweep, sweepDetails, sweepWords as storageSweepWords } from "./storage-sweep.js";
 import { removeShared, sharedDepsRoot, sharedUse, unusedShared } from "./shared-deps.js";
 import { cleanLandedBacklog, gitOf, landedBacklog, reconcileLanded, BACKLOG_DAYS } from "./landed-cleanup.js";
+import { accessOf, applyTidy, approverStandsNow, withinLens, familyRepoOf, releaseFactsFor, runTidy, tidyDays, tidyDigest, tidyGroups, tidyPreview, TIDY_DEFAULT_DAYS, TIDY_PASS_LIMIT } from "./tidy.js";
+import { personProof } from "./person-proof.js";
 import { RemoteMains } from "./remote-main.js";
 import { checkoutPlan, cleanCheckouts, discardCheckout, finishedCheckouts, slimKeptCheckouts, whyWords } from "./checkout-cleanup.js";
 import { closeOutCheckouts, closeOutRuns, stoppedWords } from "./run-closeout.js";
@@ -105,7 +107,7 @@ import { taskReviewBrief, renderReviewBrief } from "./task-review-brief.js";
 import { homedir, hostname } from "node:os";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { releaseStalledUpdate, waitingUpdate } from "./toolroll-update.js";
-import { openStore, openStoreNoMigrate, CONCURRENT_WRITER_WAIT_MS, isDatabaseBusy, databasePath, BUILT_IN, parseCapabilityKey, verifiedAuthor, isDigestTime, predecessorWatches, RESULT_SCREENSHOTS, lifecycleOf, reportLifecycle, beatLifecycle, } from "./store.js";
+import { openStore, openStoreNoMigrate, archiveTaskFamily, restoreTaskFamily, CONCURRENT_WRITER_WAIT_MS, isDatabaseBusy, databasePath, BUILT_IN, parseCapabilityKey, verifiedAuthor, isDigestTime, predecessorWatches, RESULT_SCREENSHOTS, lifecycleOf, reportLifecycle, beatLifecycle, } from "./store.js";
 import { createHash, randomBytes, randomInt, randomUUID } from "node:crypto";
 import { claimInstance, clearInstance, openInstanceSocket } from "./console-instance.js";
 import { authorizePlanUnderMode } from "./plan-auto.js";
@@ -273,7 +275,11 @@ export const OPERATE_HELP = `toolroll — operating the queue
                                         the lead passes it as --token, or TOOLROLL_LEAD_TOKEN, and its work pings nobody
   toolroll task ask <id> --person <name> --why "<text>"
                                         hand a task to a person: it pings them, and it is theirs
-  toolroll task list [--view <v>] [--limit <n>] [--cursor <c>]   paginated saved task status
+  toolroll task list [--view <v>] [--limit <n>] [--cursor <c>]   paginated saved task status (--view archived: put away)
+  toolroll task archive <id...> [--reason <why>]   put tasks away: out of every list, history kept (a person's act)
+  toolroll task restore <id...>      bring put-away tasks back exactly as they were
+  toolroll task tidy --preview [--days N]   what Put away old tasks would put away, and why (read-only)
+  toolroll task tidy --apply --digest <d> [--except <id,...>]   put away exactly that list
   toolroll task show <id>
   toolroll task wait <id> [--timeout <seconds>]
                                         wait for this attempt to finish or need a person
@@ -663,7 +669,7 @@ export const TASK_ACTIONS = [
     "add", "list", "show", "wait", "state", "block", "unblock", "next", "steer", "pause", "continue", "assign",
     "reopen", "scope", "approve", "hold", "unhold", "require", "requeue", "regate", "plan",
     "review", "accept", "repair", "route", "stop", "resume", "complete", "revise", "merge", "ask",
-    "checks", "add-tests",
+    "checks", "add-tests", "archive", "restore", "tidy",
 ];
 export const PUBLISH_ACTIONS = ["setup", "grant", "revoke", "status", "unblock", "rearm", "merge", "refire"];
 export const CONFIG_ACTIONS = ["show", "set", "clear"];
@@ -707,6 +713,8 @@ export const OPERATE_VALUE_FLAGS = new Set([
     "starter",
     // flows: templates, steps, scripts and cards.
     "template", "steps", "about", "language", "timeout-minutes", "body", "description", "zone", "option",
+    // task tidy --apply: the previewed tasks to leave out.
+    "except",
     "token-env", "after", "repair-max-attempts", "consumer", "batch", "feedback", "source", "view", "cursor", "why", "supersedes", "decision", "sessions", "timeout",
     // pings follow responsibility: replacements.
     "replaced-by", "replaces",
@@ -757,6 +765,8 @@ export const OPERATE_BOOLEAN_FLAGS = new Set([
     "password-stdin",
     // task steer: pause the running Claude build, then send the note.
     "now",
+    // task tidy: look first (--preview), then put away exactly what was shown (--apply --digest).
+    "preview", "apply",
 ]);
 /** `project network` reads --remove <hosts> and --local any|none as values, where every other verb's --remove and
  * --local are switches. */
@@ -1564,6 +1574,8 @@ function claimCommand(positional, flags, context) {
             return fail(write, json, "claim", "sweep-limit", `its sweep already has ${result.limit} running at once — it starts when one finishes`, EXIT.refused, { sweep: result.sweep, limit: result.limit });
         if (result.reason === "watch-custody")
             return fail(write, json, "claim", "watch-custody", "This worker no longer holds the project; restart the watch", EXIT.refused);
+        if (result.reason === "archived")
+            return fail(write, json, "claim", "archived", `${id} is put away — restore it with \`toolroll task restore ${id}\` first`, EXIT.refused);
         if (result.reason === "draining")
             return fail(write, json, "claim", "draining", `Toolroll is restarting (draining): ${runner} takes no new work until it is back (by ${result.until})`, EXIT.refused, { until: result.until });
         return fail(write, json, "claim", result.reason, `held by ${result.by} until ${result.until}`, EXIT.refused, { holder: result.by, until: result.until });
@@ -3562,6 +3574,13 @@ async function reconcileCommand(flags, context) {
         remotes.close();
     }
     const landedGone = landed.steps.filter(one => one.outcome === "removed");
+    // Tidy (task-tidy.md): old routine runs a newer run replaces, release tasks already published or replaced, and CI
+    // notices main has fixed are put away, at most a bounded number a pass, each with its reason in the ledger.
+    let tidied = [];
+    try {
+        tidied = runTidy(store, clock(), releaseFactsFor(context.databaseFile), TIDY_PASS_LIMIT, { principal: "operator", repos: [repo], includeUnplaced: false });
+    }
+    catch { /* the next pass tries again */ }
     // Checkout cleanup (Settings → Storage): finished work's clean checkouts go as the setting says (by default when
     // the task is complete or cancelled); their branches stay. Each removal is in the ledger.
     // Completing or cancelling a task stops anything still running from its checkout first.
@@ -3605,6 +3624,7 @@ async function reconcileCommand(flags, context) {
         slimmed.slimmed.length === 0 &&
         landed.completed.length === 0 &&
         landedGone.length === 0 &&
+        tidied.length === 0 &&
         liveSwept.removed.length === 0;
     return succeed(write, json, "reconcile", {
         recovered,
@@ -3616,6 +3636,7 @@ async function reconcileCommand(flags, context) {
         processesStopped: [...closedRuns.map(one => ({ run: one.runId, pids: one.done.stopped.map(row => row.pid) })), ...closedCheckouts.map(one => ({ checkout: one.path, pids: one.done.stopped.map(row => row.pid) }))],
         checkoutsSlimmed: slimmed.slimmed.map(one => one.path),
         landed: { completed: landed.completed, steps: landed.steps },
+        tidied: tidied.map(one => ({ id: one.taskId, rule: one.rule, reason: one.reason })),
         liveViewsSwept: liveSwept.removed.length,
         retention: retention === null ? null : { counts: retention.counts, freedBytes: retention.freed },
         storageSweep: storageSwept,
@@ -3630,6 +3651,7 @@ async function reconcileCommand(flags, context) {
             ...closedRuns.map(one => `Run #${one.runId} ended; stopped ${stoppedWords(one.done)}.`),
             ...closedCheckouts.map(one => `${one.path}: its task finished; stopped ${stoppedWords(one.done)}.`),
             ...(landed.completed.length === 0 ? [] : [`Marked ${landed.completed.length} landed result(s) complete: ${landed.completed.join(", ")}.`]),
+            ...(tidied.length === 0 ? [] : [`Put away ${tidied.length} old task(s): ${tidied.map(one => one.taskId).join(", ")}.`]),
             ...(landedGone.length === 0 ? [] : [`Removed landed work: ${landedGone.filter(one => one.kind === "checkout").length} checkout(s), ${landedGone.filter(one => one.kind === "branch").length} local branch(es).`]),
             ...(slimmed.slimmed.length === 0 ? [] : [`Dropped dependencies and build output from ${slimmed.slimmed.length} kept checkout(s), about ${bytesWords(slimmed.slimmed.reduce((sum, one) => sum + one.bytes, 0))}.`]),
             ...(liveSwept.removed.length === 0 ? [] : [`Cleared ${liveSwept.removed.length} finished live view(s).`]),
@@ -4112,6 +4134,7 @@ async function requeueTask(positional, flags, context) {
             published: `${id}'s last result is published; revise it through its pull request`,
             // Only an Approve & build again asks for an exact build; the CLI never does.
             moved: `${id} changed since its page was read; read it again`,
+            archived: `${id} is put away — restore it with \`toolroll task restore ${id}\` first`,
         };
         return fail(write, json, "task requeue", result.reason, why[result.reason], EXIT.refused);
     }
@@ -8567,6 +8590,12 @@ function taskAction(action, rest, flags, context) {
             return addTestsTask(rest, flags, context);
         case "list":
             return listTasks(flags, context);
+        case "archive":
+            return archiveTasksCommand(rest, flags, context);
+        case "restore":
+            return restoreTasksCommand(rest, flags, context);
+        case "tidy":
+            return tidyTasksCommand(rest, flags, context);
         case "show":
             return showTask(rest, context);
         case "wait":
@@ -8988,9 +9017,9 @@ function listTasks(flags, context) {
     const limit = rawLimit === undefined ? 40 : Number(rawLimit);
     if (wanted !== undefined && !STATES.includes(wanted))
         return fail(write, json, 'task list', 'usage', `--state takes one of ${STATES.join(', ')}`, EXIT.usage);
-    if (rawView !== undefined && !['all', 'needs-you', 'running', 'completed'].includes(rawView) ||
+    if (rawView !== undefined && !['all', 'needs-you', 'running', 'completed', 'archived'].includes(rawView) ||
         !Number.isSafeInteger(limit) || limit < 1 || limit > 100) {
-        return fail(write, json, 'task list', 'usage', '--view takes all, needs-you, running or completed; --limit takes 1–100', EXIT.usage);
+        return fail(write, json, 'task list', 'usage', '--view takes all, needs-you, running, completed or archived; --limit takes 1–100', EXIT.usage);
     }
     // A remote person limited to some projects (remoteLensOf) pages and counts only theirs.
     const lens = context.principal?.lens ?? null;
@@ -9017,7 +9046,8 @@ function listTasks(flags, context) {
             write(wanted === undefined ? 'The task list is empty.' : `Nothing is ${wanted}.`);
         const width = Math.max(0, ...tasks.map(task => task.id.length));
         for (const task of tasks)
-            write(`  ${task.id.padEnd(width)}  ${task.status.label.padEnd(16)}  ${task.title}`);
+            write(task.archived === undefined ? `  ${task.id.padEnd(width)}  ${task.status.label.padEnd(16)}  ${task.title}`
+                : `  ${task.id.padEnd(width)}  ${'Archived'.padEnd(16)}  ${task.title} — by ${task.archived.byKind === 'tidy' ? 'tidy' : task.archived.by}: ${task.archived.reason}`);
         if (page.nextCursor !== null)
             write(`Next page: --cursor ${page.nextCursor}`);
         return EXIT.ok;
@@ -10149,6 +10179,8 @@ function describeApproveFailure(reason, id) {
     // Approval policy, phase 1: the lead's token (or a remote API token) proves a credential, not a person.
     if (reason === "machine-proof")
         return "only a person can approve this — approve it on the task page or from your paired chat";
+    if (reason === "archived")
+        return `${id} is put away — restore it with \`toolroll task restore ${id}\` first`;
     if (reason === "second-approver")
         return `your approval of ${id} is recorded; it is protected work, so a second person needs to approve it (toolroll task approve ${id} as them)`;
     if (reason === "no-approvers") {
@@ -12754,3 +12786,180 @@ export function consoleIdentitiesInBackground(identities, paths) {
 export function writeModelRow(store, proved, scope, knownProject, slot, to, now, extra = []) {
     return applyModelChoices(store, { scope, change: slot === null ? [] : [{ slot, to }], expected: null, strict: false, knownProject, extra }, { ...proved, live: () => true }, now);
 }
+/** Putting away and restoring are a person's acts (docs/plans/task-tidy.md): never the lead's token, never a remote
+ * API token, never a machine proof. Null when a person is acting. */
+function refuseMachineTidy(context, command, method) {
+    if (machineActing() || process.env["TOOLROLL_LEAD_TOKEN"] !== undefined || (method !== undefined && !personProof(method))) {
+        return fail(context.write, context.json, command, "person-only", "Only a person puts tasks away or restores them. Use the console or your own login.", EXIT.refused);
+    }
+    return null;
+}
+/** `toolroll task archive <id...> [--reason <text>]`: put tasks away by hand (v145). Each keeps its history, results and
+ * approvals; nothing can run, claim or approve it until it is restored. Credentialed, a person's act. */
+async function archiveTasksCommand(positional, flags, context) {
+    const { store, write, json, clock } = context;
+    const command = "task archive";
+    const ids = [...new Set(positional)];
+    if (ids.length === 0 || ids.length > 100)
+        return fail(write, json, command, "usage", "`toolroll task archive <id...> [--reason <why>] --as <you> --token <t>` — 1 to 100 tasks", EXIT.usage);
+    const machine = refuseMachineTidy(context, command);
+    if (machine !== null)
+        return machine;
+    const demo = refuseDemo(context, command);
+    if (demo !== null)
+        return demo;
+    const acting = await askCredentials(flags, context);
+    // The password is proved against a project the person can see (the first task's); each task's own project is
+    // re-proved inside its put-away transaction.
+    const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token, firstVisibleRepo(store, acting.name, ids));
+    if (acting === null || !verified?.ok)
+        return refuseApprover(context, command, verified, "putting a task away takes `--as <you> --token <t>` — it is recorded against your name", ids[0]);
+    const personal = refuseMachineTidy(context, command, verified.method);
+    if (personal !== null)
+        return personal;
+    const reason = text(flags, "reason") ?? "Put away by hand";
+    const archived = [], refused = [];
+    for (const id of ids) {
+        const ref = store.lookupRef(id);
+        if (ref === null || store.getTask(id) === null || !store.accountCanAccess(acting.name, ref.repo)) {
+            refused.push({ id, reason: "unknown-task", message: `No task ${id}.` });
+            continue;
+        }
+        const done = archiveTaskFamily(store, id, { by: acting.name, byKind: "person", rule: null, reason }, clock(), { guard: refs => approverStandsNow(store, acting.name, familyRepoOf(store, refs)) });
+        if (done.ok)
+            archived.push({ id, versions: done.refs.length });
+        else
+            refused.push({ id, reason: done.reason, message: done.message });
+    }
+    const lines = () => [
+        ...archived.map(one => `Put away ${one.id}${one.versions > 1 ? ` (${one.versions} versions)` : ""}.`),
+        ...refused.map(one => `Not put away: ${one.message}`),
+        ...(archived.length === 0 ? [] : [`Restore with \`toolroll task restore ${archived.map(one => one.id).join(" ")}\`.`]),
+    ];
+    if (refused.length === 0)
+        return succeed(write, json, command, { archived, refused }, lines);
+    if (json)
+        return fail(write, json, command, refused[0].reason, refused[0].message, EXIT.refused, { archived, refused });
+    write(lines().join("\n"));
+    return EXIT.refused;
+}
+/** `toolroll task restore <id...>`: bring put-away tasks back exactly as they were (v145). Credentialed, a person's act. */
+async function restoreTasksCommand(positional, flags, context) {
+    const { store, write, json, clock } = context;
+    const command = "task restore";
+    const ids = [...new Set(positional)];
+    if (ids.length === 0 || ids.length > 100)
+        return fail(write, json, command, "usage", "`toolroll task restore <id...> --as <you> --token <t>` — 1 to 100 tasks", EXIT.usage);
+    const machine = refuseMachineTidy(context, command);
+    if (machine !== null)
+        return machine;
+    const demo = refuseDemo(context, command);
+    if (demo !== null)
+        return demo;
+    const acting = await askCredentials(flags, context);
+    const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token, firstVisibleRepo(store, acting.name, ids));
+    if (acting === null || !verified?.ok)
+        return refuseApprover(context, command, verified, "restoring takes `--as <you> --token <t>` — it is recorded against your name", ids[0]);
+    const personal = refuseMachineTidy(context, command, verified.method);
+    if (personal !== null)
+        return personal;
+    const restored = [], refused = [];
+    for (const id of ids) {
+        const ref = store.lookupRef(id);
+        if (ref === null || store.getTask(id) === null || !store.accountCanAccess(acting.name, ref.repo)) {
+            refused.push({ id, reason: "unknown-task", message: `No task ${id}.` });
+            continue;
+        }
+        const done = restoreTaskFamily(store, id, acting.name, clock(), refs => approverStandsNow(store, acting.name, familyRepoOf(store, refs)));
+        if (done.ok)
+            restored.push(id);
+        else
+            refused.push({ id, reason: done.reason, message: done.message });
+    }
+    const lines = () => [...restored.map(id => `Restored ${id}.`), ...refused.map(one => `Not restored: ${one.message}`)];
+    if (refused.length === 0)
+        return succeed(write, json, command, { restored, refused }, lines);
+    if (json)
+        return fail(write, json, command, refused[0].reason, refused[0].message, EXIT.refused, { restored, refused });
+    write(lines().join("\n"));
+    return EXIT.refused;
+}
+/** `toolroll task tidy --preview [--days N]` (read-only, no credential) and `toolroll task tidy --apply --digest <d>
+ * [--days N] [--except <id,...>]` (credentialed, a person's act): the console's Put away old tasks, word for word,
+ * with the same preview and digest. Apply puts away exactly what the preview with that digest showed. */
+async function tidyTasksCommand(positional, flags, context) {
+    const { store, write, json, clock } = context;
+    const command = "task tidy";
+    const preview = flag(flags, "preview"), apply = flag(flags, "apply");
+    const days = tidyDays(text(flags, "days"));
+    const digest = text(flags, "digest");
+    const except = (text(flags, "except") ?? "").split(",").map(one => one.trim()).filter(one => one !== "");
+    const usage = "`toolroll task tidy --preview [--days N]`, then `toolroll task tidy --apply --digest <d> [--days N] [--except <id,...>]`";
+    if (positional.length > 0 || preview === apply || days === null || (preview && (digest !== undefined || except.length > 0)) || (apply && digest === undefined))
+        return fail(write, json, command, "usage", usage, EXIT.usage);
+    const releases = releaseFactsFor(context.databaseFile);
+    // One scope for the preview and the apply: `--as <you>` previews exactly your projects (no password: it reads), and
+    // the apply reads the same person's projects, so an unchanged list keeps its digest.
+    // Whose lists: `--as <you>`, else this machine's saved login (`toolroll up`), else everything (an unrestricted
+    // person's list; a person limited to some projects previews with --as).
+    const previewAs = text(flags, "as") ?? readLoginFile(join(dirname(context.databaseFile), UP_LOGIN_FILE))?.name;
+    const daysArg = `${days === TIDY_DEFAULT_DAYS ? "" : ` --days ${days}`}${previewAs === undefined ? "" : ` --as ${previewAs}`}`;
+    // `--as` only ever narrows: the named person's projects within the caller's own lens, never beyond it.
+    const lens = context.principal?.lens ?? null;
+    const own = { principal: "operator", repos: lens, includeUnplaced: lens === null };
+    const access = previewAs !== undefined ? withinLens(accessOf(store, previewAs), lens) : own;
+    if (preview) {
+        const items = tidyPreview(store, clock(), { releases, days, access });
+        const shown = tidyDigest(items, days);
+        const groups = tidyGroups(items, days);
+        const next = `toolroll task tidy --apply --digest ${shown}${daysArg}`;
+        return succeed(write, json, command, { preview: true, days, digest: shown, count: items.length, groups, next: items.length === 0 ? null : next,
+            ...(releases.problem === null ? {} : { releasesSkipped: releases.problem }) }, () => items.length === 0
+            ? ["Nothing to put away."]
+            : [`Put away old tasks: ${items.length} task${items.length === 1 ? "" : "s"}.`,
+                ...groups.flatMap(group => ["", `${group.label} (${group.items.length})`, ...group.items.map(one => `  ${one.taskId}  ${one.reason}${one.members.length > 1 ? ` (${one.members.length} versions)` : ""}`)]),
+                ...(releases.problem === null ? [] : ["", `Release tasks were left out: ${releases.problem}.`]),
+                "", `To put these away, run: ${next}`, "Leave some out with --except <id,...>.",
+                ...(previewAs === undefined ? ["Limited to some projects? Preview with --as <you> so the list is yours."] : [])]);
+    }
+    const machine = refuseMachineTidy(context, command);
+    if (machine !== null)
+        return machine;
+    const demo = refuseDemo(context, command);
+    if (demo !== null)
+        return demo;
+    const acting = await askCredentials(flags, context);
+    const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token, firstVisibleRepo(store, acting.name, []));
+    if (acting === null || !verified?.ok)
+        return refuseApprover(context, command, verified, "putting tasks away takes `--as <you> --token <t>` — it is recorded against your name", undefined);
+    const personal = refuseMachineTidy(context, command, verified.method);
+    if (personal !== null)
+        return personal;
+    // The person's own view of the lists, from the verified credential (never a flag), within the caller's lens: the
+    // same scope `--preview --as <them>` read.
+    const mine = withinLens(accessOf(store, acting.name), lens);
+    const shownItems = tidyPreview(store, clock(), { releases, days, access: mine });
+    const only = except.length === 0 ? null : shownItems.map(one => one.taskId).filter(id => !except.includes(id));
+    if (except.some(id => !shownItems.some(one => one.taskId === id)))
+        return fail(write, json, command, "outside", "--except names a task that isn't in the list. Check it again with --preview.", EXIT.refused);
+    const done = applyTidy(store, clock(), { by: acting.name, days, digest: digest, only, releases, access: mine });
+    if (!done.ok) {
+        const again = `toolroll task tidy --apply --digest ${done.digest}${daysArg}`;
+        return fail(write, json, command, done.reason, done.reason === "changed" ? `${done.message} Look again with \`toolroll task tidy --preview${daysArg}\`.` : done.message, EXIT.refused, { digest: done.digest, count: done.items.length, ...(done.reason === "changed" ? { next: done.items.length === 0 ? null : again } : {}) });
+    }
+    return succeed(write, json, command, { archived: done.archived.map(one => ({ id: one.taskId, rule: one.rule, reason: one.reason })), skipped: done.skipped }, () => [
+        `Put away ${done.archived.length} task${done.archived.length === 1 ? "" : "s"}.`,
+        ...done.skipped.map(one => `Not put away: ${one.message}`),
+        "Find them with `toolroll task list --view archived`; bring one back with `toolroll task restore <id>`.",
+    ]);
+}
+/** The project a put-away or restore proves the person's password against: the first named task's, when they can see
+ * it; otherwise the first project they can see at all (null when none: an unrestricted person, or none to prove). */
+function firstVisibleRepo(store, name, ids) {
+    for (const id of ids) {
+        const repo = store.lookupRef(id)?.repo ?? null;
+        if (repo !== null && store.accountCanAccess(name, repo))
+            return repo;
+    }
+    return store.accountCanAccess(name, null) ? null : store.knownRepos().find(repo => store.accountCanAccess(name, repo)) ?? null;
+}

package/dist/project-delete.js

@@ -86,7 +86,9 @@ export function projectRunning(store, repo, now) {
     const chats = count("SELECT COUNT(*) AS n FROM mate_turn WHERE state IN ('queued','running') AND id IN (SELECT value FROM json_each(?))", json(d.turns));
     const steps = count("SELECT COUNT(*) AS n FROM flow_step_run WHERE state = 'running' AND card IN (SELECT value FROM json_each(?))", json(d.cards));
     const calls = count("SELECT COUNT(*) AS n FROM subagent_call WHERE state = 'running' AND subagent IN (SELECT value FROM json_each(?))", json(d.subagents));
-    const merges = count(`SELECT COUNT(*) AS n FROM merge_intent WHERE state IN ('claimed','firing') AND publication IN (SELECT id FROM publication WHERE task_ref IN (SELECT value FROM json_each(?)))`, json(d.refs));
+    const merges = count(`SELECT COUNT(*) AS n FROM merge_intent WHERE state IN ('claimed','firing') AND publication IN (SELECT id FROM publication WHERE task_ref IN (SELECT value FROM json_each(?)))`, json(d.refs))
+        // A person's merge between its last check and GitHub's answer (v145); a row older than 15 minutes is a crash.
+        + count("SELECT COUNT(*) AS n FROM merge_in_flight WHERE at > ? AND task_ref IN (SELECT value FROM json_each(?))", new Date(now.getTime() - 15 * 60_000).toISOString(), json(d.refs));
     const checkouts = count("SELECT COUNT(*) AS n FROM worktree WHERE repo = ? AND runner IS NOT NULL AND released_at IS NULL", repo);
     return [
         ...(building > 0 ? [`${plural(building, "task")} ${building === 1 ? "is" : "are"} being built`] : []),
@@ -267,6 +269,8 @@ function deleteRows(store, repo, d, now) {
     del("skill_test", `${IN("task_ref")} OR ${IN("source_run")}`, T, R);
     del("merge_blocker", `${IN("publication")} OR ${IN("task_id")}`, publications, K);
     del("merge_intent", IN("publication"), publications);
+    del("merge_in_flight", IN("publication"), publications);
+    del("deploy_in_flight", IN("task_ref"), T);
     del("publication", IN("id"), publications);
     del("artifact", IN("id"), A);
     // Tasks and their versions.
@@ -282,7 +286,7 @@ function deleteRows(store, repo, d, now) {
     del("workflow_preview", "repo = ?", repo);
     del("coding_handoff_scope", `id IN (SELECT id FROM coding_handoff WHERE json_extract(payload, '$.repo') = ?)`, repo);
     del("coding_handoff", "json_extract(payload, '$.repo') = ?", repo);
-    for (const table of ["task_act", "task_replacement"])
+    for (const table of ["task_act", "task_replacement", "task_archive"])
         del(table, IN("task_ref"), T);
     del("task_ref", IN("id"), T);
     del("task_scope", IN("task_id"), K);
@@ -293,7 +297,7 @@ function deleteRows(store, repo, d, now) {
     del("flow_trigger", IN("flow"), F);
     del("flow_unattended_run", `grant_id IN (SELECT id FROM flow_unattended_grant WHERE ${IN("flow")})`, F);
     del("flow_unattended_grant", IN("flow"), F);
-    for (const table of ["flow_card_watcher", "flow_comment", "flow_event", "flow_mail", "flow_step_run"])
+    for (const table of ["flow_card_watcher", "flow_comment", "flow_event", "flow_mail", "flow_step_run", "flow_step_task"])
         del(table, IN("card"), C);
     del("subagent_question", IN("id"), questions);
     del("subagent_call", `${IN("subagent")} OR ${IN("card")}`, M, C);

package/dist/pull-request-flow.js

@@ -14,7 +14,7 @@
  * read must show the PR open, on the accepted commit, with checks passing; GitHub's head-commit match guards
  * the race; the branch is deleted; the merge commit and who merged are recorded in the ledger.
  */
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { run as execRun } from "./exec.js";
 import { bodyHashOf, publicationBody, publicationGrantOf } from "./publish.js";
 import { failingChecks, summarizeChecks } from "./pulls.js";
@@ -23,7 +23,7 @@ import { requestResultChanges } from "./result-actions.js";
 import { revisionSourceOf } from "./result-review.js";
 import { authenticateApprover, personProof } from "./scope.js";
 import { BRANCH_PREFIX, headWithin } from "./names.js";
-import { NIGHTLY_CHECK_ONLY, RELEASE_MERGES_ONLY, nightlyTaskRef, releaseTaskRef } from "./store.js";
+import { NIGHTLY_CHECK_ONLY, RELEASE_MERGES_ONLY, nightlyTaskRef, refArchived, releaseTaskRef } from "./store.js";
 import { belongsToRelease } from "./release-authority.js";
 import { autoReleaseSealed } from "./release-auto.js";
 import { fullCheckGate, requestFollowUpChecks } from "./result-follow-ups.js";
@@ -292,6 +292,9 @@ export async function followPullRequests(store, seen, options) {
             continue;
         const pr = publication.prNumber;
         const taskId = taskIdOf(store, publication);
+        // A put-away task (v145) gets no automatic revision, merge or ready notice: restoring it resumes following.
+        if (refArchived(store, publication.taskRef))
+            continue;
         if (one.remoteState === "MERGED") {
             updateFollow(store, publication.id, { merge_commit: one.mergeCommit ?? "", merged_by: "GitHub", merged_at: clock().toISOString() }, clock());
             continue;
@@ -397,6 +400,8 @@ export async function mergePullRequest(store, input) {
     // The nightly check of main (release-once.md, part 3) is a check only: it never merges.
     const mergedRun = store.getRun(input.runId);
     const mergedTask = mergedRun === null ? null : store.refById(mergedRun.taskRef)?.externalId ?? null;
+    if (mergedRun !== null && refArchived(store, mergedRun.taskRef))
+        return refuse("archived", "This task is put away. Restore it before merging.");
     if (mergedTask !== null && store.handle.prepare("SELECT 1 AS hit FROM nightly_check WHERE task = ?").get(mergedTask) !== undefined)
         return refuse("check-only", "The nightly check of main is only a check; it never merges.");
     // A release's task merges only through `toolroll release` (release-once.md), which proves the live release, reserves
@@ -470,8 +475,34 @@ export async function mergePullRequest(store, input) {
         return fail("moved", "The pull request has commits that weren't part of the completed result, so it won't be merged from here.");
     if (before.checks !== "passing")
         return fail("checks", before.checks === "failing" ? "Checks are failing, so it can't merge." : before.checks === "running" ? "Checks are still running. Merge once they pass." : "No checks have reported yet. Merge once they pass.");
-    const merged = await exec("gh", ["pr", "merge", pr, "--repo", publication.githubRepo, `--${method}`, "--match-head-commit", publication.headSha, "--delete-branch"], { timeoutMs: EXEC_TIMEOUT_MS, env: { GH_PROMPT_DISABLED: "1", GH_NO_UPDATE_NOTIFIER: "1" } });
-    const after = await view();
+    // The merge is reserved with the put-away check in one write (v145): a put away that committed first refuses it, and
+    // one that comes after waits for GitHub's answer (the reservation counts as work going on).
+    // One merge at a time, each owning its reservation by its token: a second caller is refused, and each releases only its own.
+    const token = randomUUID();
+    const reserved = store.transact(() => {
+        if (refArchived(store, publication.taskRef))
+            return "archived";
+        if (store.handle.prepare("SELECT 1 FROM hold WHERE task_ref = ? AND owner_id LIKE 'project-delete:%' AND (until IS NULL OR until > ?)").get(publication.taskRef, clock().toISOString()) !== undefined)
+            return "deleting";
+        if (store.handle.prepare("SELECT 1 FROM merge_in_flight WHERE publication = ? AND at > ?").get(publication.id, new Date(clock().getTime() - 15 * 60_000).toISOString()) !== undefined)
+            return "merging";
+        store.handle.prepare("INSERT OR REPLACE INTO merge_in_flight (publication, task_ref, token, by, at) VALUES (?, ?, ?, ?, ?)").run(publication.id, publication.taskRef, token, input.by, clock().toISOString());
+        return "ok";
+    });
+    if (reserved === "archived")
+        return refuse("archived", "This task is put away. Restore it before merging.");
+    if (reserved === "deleting")
+        return refuse("deleting", "This task's project is being deleted, so nothing merges.");
+    if (reserved === "merging")
+        return refuse("merging", "This pull request is already being merged. Wait for that to finish.");
+    let merged, after;
+    try {
+        merged = await exec("gh", ["pr", "merge", pr, "--repo", publication.githubRepo, `--${method}`, "--match-head-commit", publication.headSha, "--delete-branch"], { timeoutMs: EXEC_TIMEOUT_MS, env: { GH_PROMPT_DISABLED: "1", GH_NO_UPDATE_NOTIFIER: "1" } });
+        after = await view();
+    }
+    finally {
+        store.handle.prepare("DELETE FROM merge_in_flight WHERE publication = ? AND token = ?").run(publication.id, token);
+    }
     if (after?.state === "MERGED") {
         record(after.commit, input.by);
         return { ok: true, commit: after.commit };

package/dist/result-follow-ups.js

@@ -2,6 +2,7 @@ import { checkoutRunner, ranAtLine, widestRan } from "./invoke.js";
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { refArchived } from "./task-archive.js";
 import { belongsToRelease } from "./release-authority.js";
 import { run as execRun } from "./exec.js";
 import { hardenedGit } from "./teardown-git.js";
@@ -126,6 +127,9 @@ function checkTarget(store, runId, level) {
         return refuse("no-commit", "This result has no finished commit to check.");
     if (ref.repo === null)
         return refuse("unplaced", "This result isn't in a project, so there is no check to run.");
+    // A put-away task (v145) runs no checks: asked for or already waiting, it is refused until restored.
+    if (refArchived(store, ref.id))
+        return refuse("archived", "This task is put away. Restore it first.");
     const chosen = checkCommandFor(store, ref.repo, level);
     if (chosen.command === null)
         return refuse("no-check", `${ref.repo} has no approved ${level === "quick" ? "quick or full" : "full"} check. Set one in Settings → Projects → Checks.`);

package/dist/scope.d.ts

@@ -597,6 +597,11 @@ export type ApproveResult = {
  | {
     ok: false;
     reason: "machine-proof";
+}
+/** v145 (task-tidy.md): the task is put away; it is restored before anyone can approve it. */
+ | {
+    ok: false;
+    reason: "archived";
 };
 /**
  * Whether this name-and-token pair is a person the store knows. Shared by

package/dist/scope.js

@@ -48,6 +48,7 @@ import { z } from "zod";
 import {} from "./contracts/acceptance-terms.js";
 import { parseContract } from "./contracts/contract.js";
 import { readAcceptance, readScopeTerms, storedRubricSchema } from "./contracts/scope.js";
+import { taskArchived } from "./task-archive.js";
 import { releaseCiHoldOf, releaseCiHoldWords } from "./release-ci-hold.js";
 import { NO_READINESS, exactModelId, legOf, projectRoute, routeDigestOf, routeFromJson, routeJsonProblem, routeWords, } from "./phase-routing.js";
 /** Same shape as a runner's credential, for the same reasons. */
@@ -1074,6 +1075,9 @@ export function approve(store, taskId, by, now, sawDigest, token, mutation = {})
         const scope = store.getScope(taskId);
         if (scope === null)
             return { ok: false, reason: "no-scope" };
+        // A put-away task (v145) is restored first; sealScopeApproval refuses it too, on every road.
+        if (taskArchived(store, taskId))
+            return { ok: false, reason: "archived" };
         // The digest is required, not optional. An operator reads a scope, somebody
         // rewrites it, and an approval that did not name what it saw would agree to
         // the new one in silence — which is the whole failure this guards.
@@ -1472,6 +1476,9 @@ export function liveReleaseOf(store, taskId, action, now = new Date()) {
         return { applies: false };
     const { authority: a, carry } = found;
     const refuse = (why) => ({ applies: true, ok: false, why, authority: a });
+    // A put-away task (v145, task-tidy.md), or a put-away anchor, deploys, merges and carries nothing: restore it first.
+    if (taskArchived(store, taskId) || taskArchived(store, a.anchorTask))
+        return refuse("the release task is put away");
     const newest = newestReleaseGeneration(store, a.repo, a.version, a.pr);
     if (newest === null || newest.id !== a.id)
         return refuse("a newer approval of this release replaced this one");

package/dist/server/chat.js

@@ -389,9 +389,11 @@ export function createChatHandlers(runtime) {
             const id = proposalId, saved = store.getLeadProposal(id), savedAction = saved?.kind === 'action' ? sharedActionPayload(saved.payload) : null;
             if (saved && savedAction && saved.state !== 'pending' && (sharedConversation !== null || store.getLeadThread(saved.thread)?.approver === principal.name) && principal.repos.includes(savedAction.repo) && store.accountCanAccess(principal.name, savedAction.repo)) {
                 const task = typeof saved.outcome?.['taskId'] === 'string' ? saved.outcome['taskId'] : typeof savedAction.request['task'] === 'string' ? savedAction.request['task'] : null;
-                const destination = task ? taskHref(task) : `/settings/${savedAction.operation.startsWith('skill_') ? 'skills' : 'knowledge'}?repo=${encodeURIComponent(savedAction.repo)}`;
+                // A flow action leads back to its flow (a page path of our own making, never the proposal's words).
+                const flowId = savedAction.operation.startsWith('flow_') && Number.isSafeInteger(savedAction.request['flow']) ? Number(savedAction.request['flow']) : null;
+                const destination = task ? taskHref(task) : flowId !== null ? `/flows/${flowId}` : `/settings/${savedAction.operation.startsWith('skill_') ? 'skills' : 'knowledge'}?repo=${encodeURIComponent(savedAction.repo)}`;
                 const said = typeof saved.outcome?.['said'] === 'string' ? saved.outcome['said'] : saved.state === 'dismissed' ? 'Action dismissed.' : saved.state === 'expired' ? 'This proposal expired. Ask for a fresh proposal.' : 'This action has no completed outcome yet.';
-                return sendScreen(response, 200, screen('Action outcome', html `<h1>${savedAction.title}</h1><p>${said}</p><a class="button-link" href="${destination}">${task ? 'Open task' : 'Open project settings'}</a>`, { chrome: chromeFor(savedAction.repo, 'chat') }));
+                return sendScreen(response, 200, screen('Action outcome', html `<h1>${savedAction.title}</h1><p>${said}</p><a class="button-link" href="${destination}">${task ? 'Open task' : flowId !== null ? 'Open flow' : 'Open project settings'}</a>`, { chrome: chromeFor(savedAction.repo, 'chat') }));
             }
             const review = mintSharedActionReview(store, principal, id, evidenceRoot, clock()), action = review.payload;
             const terms = action.terms.map(term => html `<p style="white-space:pre-wrap;overflow-wrap:anywhere">${term}</p>`);