toolroll 0.9.85 → 0.9.87

package/dist/store.js

@@ -9,6 +9,8 @@ import { isAcpProfile, isAcpProvider } from "./acp-agents.js";
 import { ACP_CONFORMANCE_VERSION, launchFromJson } from "./acp-attest.js";
 import { reclaimDatabase } from "./database-reclaim.js";
 import { BASELINE_SCHEMA, BASELINE_SCHEMA_VERSION } from "./store-baseline.js";
+import { refArchived, taskArchived } from "./task-archive.js";
+export { refArchived, taskArchived } from "./task-archive.js";
 import { CHAT_PROVIDERS, CHAT_SCHEMA } from "./contracts/chat-tables.js";
 import {} from "./chat-core.js";
 import { ChatMessages, TELEGRAM_HOLD_REASONS, TELEGRAM_SKIPPED_ELSEWHERE, TELEGRAM_SKIPPED_OTHER_CHAT, TELEGRAM_SKIPPED_QUIET, TELEGRAM_UNSETTLED } from "./chat-messages.js";
@@ -94,6 +96,8 @@ import { LEDGER_COLUMNS, LEDGER_SCHEMA, LEDGER_TABLE, LEDGER_V99_TABLE, installL
 import { PLAN_AUTO_SCHEMA } from "./plan-auto.js";
 import { CONSOLE_INSTANCE_SCHEMA } from "./console-instance.js";
 import { endUnattendedGrants, FLOW_UNATTENDED_SCHEMA, grantStandsSql } from "./flow-unattended.js";
+import { flowChanged } from "./flow-changed.js";
+import { FLOW_BROWSER_SCHEMA } from "./flow-browser.js";
 import { RECIPE_SCHEMA } from "./recipes.js";
 import { POLICY_SCHEMA, agentRefusal, approvalRefusal, policyParts, readPolicy, underCeiling, sessionCeilingRefusal } from "./policy.js";
 import { PROVIDER_AUTH_SCHEMA } from "./provider-auth.js";
@@ -1092,7 +1096,15 @@ const REGISTERED_AT_FILING = "again, as it was filed";
 // project's intake choice and last answer, and each request taken, with the task it became.
 // v143 adds, and changes no saved row: optional exact-screenshot context on result feedback
 // (diff_comment.image_json, V143_ADDED_COLUMNS; saved notes read NULL and keep their file/line target).
-export const SCHEMA_VERSION = 143;
+// v144 adds, and changes no saved row: a person's approval of browser use in a flow's script zones (flow_browser_grant;
+// flow-browser.ts), the one sandbox rule a project check gets for Chromium; saved flows have none and get nothing.
+// v145 adds, and changes no saved row (docs/plans/task-tidy.md): put-away tasks (task_archive, one row per archived task
+// version; no row is every saved task: not archived), the completed workflow runs on a watched branch the checks
+// trigger saw (branch_check_run), and the reservations that hold work back from being put away (merge_in_flight,
+// deploy_in_flight, flow_step_task; V145_SCHEMA, new tables only).
+// v146 adds, and changes no saved row: each pull request check's own timing as GitHub last reported it for the head the
+// plane observed (ci_check), and each release step's start, end and outcome (release_step; V146_SCHEMA, new tables only).
+export const SCHEMA_VERSION = 146;
 /** v118: the tables merged into `credential`, in the order they move (a person's API tokens keep their ids first). */
 export const V118_MERGED_TABLES = Object.freeze({ api_token: "person", coordinator_credential: "coordinator", lead_credential: "lead" });
 /** The foreign keys that named a merged table, exactly as their DDL wrote them; each names `credential(id)` instead. */
@@ -1225,7 +1237,7 @@ const V115_DROPPED_REFERENCES = /\s+REFERENCES (?:contestant|contest|tournament_
  * unchanged), and adds the nullable column in V125_ADDED_COLUMNS, checked the same way. v126 only adds a new table
  * (task_source) and the columns in V126_ADDED_COLUMNS (null or 0), checked the same way.
  */
-export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143]);
+export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146]);
 /** v119: the columns it adds, by table, with the value every row saved before it reads (toolroll-update's HISTORY_RULES). */
 export const V119_ADDED_COLUMNS = Object.freeze({
     task_ref: { planning_generation: { definition: "INTEGER NOT NULL DEFAULT 0", saved: "0" } },
@@ -1365,6 +1377,92 @@ export const V140_ADDED_COLUMNS = Object.freeze({
 export const V143_ADDED_COLUMNS = Object.freeze({
     diff_comment: { image_json: { definition: "TEXT", saved: "NULL" } },
 });
+/** v145 (docs/plans/task-tidy.md): `task_archive` is a put-away task version. A row hides it from every list and count
+ * and refuses every door that would dispatch, claim or approve it; restore deletes the row. Its history, results,
+ * approvals and ledger stay exactly as they were. `merge_in_flight` is a direct merge between its last check and GitHub's
+ * answer, owned by its token: a task can't be put away under it (a row older than 15 minutes is a crash, and no
+ * longer counts). `deploy_in_flight` is a deployment whose candidate passed its gate (30 minutes, refreshed by every
+ * phase that proves it again). `flow_step_task` is the tasks a flow step was admitted for, kept whatever the card does
+ * next, so a step still running holds them. `branch_check_run` keeps each completed GitHub workflow run (pushed to
+ * the watched branch of the watched repository) the "checks failed" trigger saw, green or red, so tidy can tell a
+ * failure notice was fixed by a later commit. */
+export const V145_SCHEMA = `
+CREATE TABLE IF NOT EXISTS task_archive (
+  task_ref INTEGER PRIMARY KEY REFERENCES task_ref(id),
+  by       TEXT NOT NULL,
+  by_kind  TEXT NOT NULL CHECK (by_kind IN ('person','tidy')),
+  rule     TEXT,
+  reason   TEXT NOT NULL,
+  at       TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS branch_check_run (
+  repo           TEXT NOT NULL,
+  run_id         INTEGER NOT NULL,
+  branch         TEXT NOT NULL,
+  workflow       TEXT NOT NULL,
+  head_sha       TEXT NOT NULL,
+  conclusion     TEXT NOT NULL CHECK (conclusion IN ('success','failure')),
+  run_created_at TEXT NOT NULL,
+  observed_at    TEXT NOT NULL,
+  PRIMARY KEY (repo, run_id)
+);
+CREATE INDEX IF NOT EXISTS branch_check_run_by_workflow ON branch_check_run (repo, branch, workflow, run_created_at);
+CREATE TABLE IF NOT EXISTS merge_in_flight (
+  publication INTEGER PRIMARY KEY REFERENCES publication(id),
+  task_ref    INTEGER NOT NULL REFERENCES task_ref(id),
+  token       TEXT NOT NULL,
+  by          TEXT NOT NULL,
+  at          TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS deploy_in_flight (
+  task_ref INTEGER PRIMARY KEY REFERENCES task_ref(id),
+  run      INTEGER NOT NULL,
+  at       TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS flow_step_task (
+  card    INTEGER NOT NULL,
+  entry   INTEGER NOT NULL,
+  task_id TEXT NOT NULL,
+  PRIMARY KEY (card, entry, task_id)
+);
+`;
+/** v146: `ci_check` is one pull request check (a GitHub check run or commit status) as the plane's winning observation of
+ * that head read it: written only with the observation that won its generation, replacing that head's rows wholesale.
+ * `release_step` is one step of a release (release.ts RELEASE_STEPS) as `toolroll release` moved through it: when it
+ * started, when it ended and how; recording it never changes the release. Both are read-only history for the Ship and
+ * Release views and their CLI twins. */
+export const V146_SCHEMA = `
+CREATE TABLE IF NOT EXISTS ci_check (
+  github_repo  TEXT NOT NULL,
+  pr_number    INTEGER NOT NULL,
+  head_sha     TEXT NOT NULL,
+  -- A check's identity: its kind (check run or commit status), its workflow and its name, so two workflows' checks
+  -- with the same name stay two rows (a failing one never hides behind a passing namesake).
+  ident        TEXT NOT NULL,
+  name         TEXT NOT NULL,
+  workflow     TEXT,
+  state        TEXT NOT NULL CHECK (state IN ('queued','running','passed','failed','skipped','cancelled','neutral')),
+  started_at   TEXT,
+  completed_at TEXT,
+  url          TEXT,
+  observed_at  TEXT NOT NULL,
+  PRIMARY KEY (github_repo, pr_number, head_sha, ident)
+);
+CREATE TABLE IF NOT EXISTS release_step (
+  task_id    TEXT NOT NULL,
+  tag        TEXT NOT NULL,
+  version    TEXT NOT NULL,
+  pr         INTEGER,
+  step       TEXT NOT NULL,
+  state      TEXT NOT NULL CHECK (state IN ('running','done','failed','waiting')),
+  started_at TEXT NOT NULL,
+  ended_at   TEXT,
+  detail     TEXT,
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (task_id, tag, step)
+);
+CREATE INDEX IF NOT EXISTS release_step_by_task ON release_step (task_id, updated_at);
+`;
 /**
  * v135: one approval per release (docs/plans/release-once.md). `release_authority` is the single source of truth for a
  * release a person approved: one row per generation, changed only by compare-and-swap on `rev`, with a lease whose
@@ -4622,6 +4720,12 @@ CREATE INDEX IF NOT EXISTS run_checkpoint_by_task ON run_checkpoint (task_ref, i
         for (const [column, { definition }] of Object.entries(columns))
             addColumn(db, table, column, definition);
     }
+    // v144: approvals of browser use in flows' script zones (a new table only).
+    db.exec(FLOW_BROWSER_SCHEMA);
+    // v145: put-away tasks, green checks per branch and the reservations that hold work back (new tables only).
+    db.exec(V145_SCHEMA);
+    // v146: pull request checks' own timing and release steps (new tables only).
+    db.exec(V146_SCHEMA);
     // Keep the epoch until reclamation succeeds, including a retry after compaction already committed. A new file has
     // nothing to reclaim.
     if (!fresh)
@@ -6361,6 +6465,7 @@ export class Store {
            FROM task JOIN task_ref ON task_ref.backend = ? AND task_ref.external_id = task.id
           WHERE task.state = 'queued'
             AND (? IS NULL OR task_ref.repo IS NULL OR task_ref.repo = ?)
+            AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)
           ORDER BY task.priority DESC, task.created_at, task_ref.id
           LIMIT 200`)
             .all(stamp, BUILT_IN, repo, repo)
@@ -6385,7 +6490,8 @@ export class Store {
             .prepare(`SELECT task.priority AS priority, task.created_at AS created_at, task_ref.id AS ref,
                 task_ref.repo AS repo, task_ref.assigned_runner AS assigned
            FROM task JOIN task_ref ON task_ref.backend = ? AND task_ref.external_id = task.id
-          WHERE task.id = ? AND task.state = 'queued'`)
+          WHERE task.id = ? AND task.state = 'queued'
+            AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)`)
             .get(BUILT_IN, taskId);
         if (me === undefined)
             return null;
@@ -6397,7 +6503,8 @@ export class Store {
                  OR (task.priority = ? AND task.created_at = ? AND task_ref.id < ?)
                THEN 1 ELSE 0 END) AS ahead
            FROM task JOIN task_ref ON task_ref.backend = ? AND task_ref.external_id = task.id
-          WHERE task.state = 'queued' AND (task_ref.assigned_runner IS ?) AND (task_ref.repo IS ?)`)
+          WHERE task.state = 'queued' AND (task_ref.assigned_runner IS ?) AND (task_ref.repo IS ?)
+            AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)`)
             .get(Number(me["priority"]), Number(me["priority"]), String(me["created_at"]), Number(me["priority"]), String(me["created_at"]), Number(me["ref"]), BUILT_IN, me["assigned"], me["repo"]);
         return {
             position: Number(row?.["ahead"] ?? 0) + 1,
@@ -6547,6 +6654,8 @@ export class Store {
          JOIN task_ref ON task_ref.backend = ? AND task_ref.external_id = task.id
          WHERE task.state = 'queued'
            ${reservation}
+           -- A put-away task (v145) never dispatches.
+           AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)
            AND NOT EXISTS (
              SELECT 1 FROM hold
              WHERE hold.task_ref = task_ref.id
@@ -7328,6 +7437,9 @@ export class Store {
             // road it came by.
             if (basis === undefined && machineActing())
                 return false;
+            // A PUT-AWAY TASK (v145, task-tidy.md) is never approved, by any road: restore it first.
+            if (taskArchived(this, taskId))
+                return false;
             // A RELEASE WAITING FOR CI (Codex review round 1, finding 4): filed while its pull request's checks still ran,
             // only the automatic road (which proves CI itself) seals it until the plane read exact-head CI passing.
             if (basis?.kind !== "auto-check" && basis?.kind !== "auto-green" && releaseCiHoldOf(this, taskId) !== null)
@@ -10587,7 +10699,7 @@ export class Store {
         versions.sort((a, b) => a.id === root.id ? -1 : b.id === root.id ? 1 : a.createdAt.localeCompare(b.createdAt) || a.refId - b.refId);
         const current = versions.at(-1);
         return { root, current, versions,
-            otherActive: versions.filter(one => one.id !== current.id && (one.state === "queued" || one.state === "running")),
+            otherActive: versions.filter(one => one.id !== current.id && (one.state === "queued" || one.state === "running") && !refArchived(this, one.refId)),
             problem: Number(rows[0]["broken"]) === 0 ? null : "Task history is unavailable or incomplete. This task is shown separately." };
     }
     /** Group and filter BEFORE the family limit; hydrate only that page's
@@ -10597,6 +10709,8 @@ export class Store {
         const order = options.order === "updated" ? "updated_at" : "created_at";
         const rows = this.db.prepare(`${projection.sql}, selected AS MATERIALIZED (
         SELECT * FROM ordered WHERE version_rank = 1
+          -- A put-away family (v145) is out of every list, before the page is cut.
+          AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = ordered.ref_id)
           ${options.states === undefined ? "" : `AND state IN (${options.states.map(() => "?").join(",")})`}
         ORDER BY ${order} DESC, ref_id DESC LIMIT ?
       ) SELECT task.*, members.repo, members.ref_id, members.root_ref, members.broken
@@ -10687,7 +10801,8 @@ export class Store {
         COUNT(CASE WHEN live_families.root_ref IS NOT NULL THEN 1 END) AS running,
         COUNT(CASE WHEN live_families.root_ref IS NULL AND ordered.state = 'queued' THEN 1 END) AS queued,
         COUNT(CASE WHEN live_families.root_ref IS NULL AND ordered.state = 'done' AND ordered.updated_at >= ? THEN 1 END) AS doneRecently
-      FROM ordered LEFT JOIN live_families ON live_families.root_ref = ordered.root_ref WHERE version_rank = 1`)
+      FROM ordered LEFT JOIN live_families ON live_families.root_ref = ordered.root_ref WHERE version_rank = 1
+        AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = ordered.ref_id)`)
             .get(...projection.params, JSON.stringify(liveTasks), new Date(now.getTime() - 24 * 60 * 60_000).toISOString());
         return { running: Number(row["running"]), queued: Number(row["queued"]), doneRecently: Number(row["doneRecently"]) };
     }
@@ -11121,6 +11236,9 @@ export class Store {
             if (ref === undefined)
                 return { ok: false, reason: "unknown-task" };
             const taskRef = Number(ref["id"]);
+            // A put-away task (v145) is restored before it runs again.
+            if (refArchived(this, taskRef))
+                return { ok: false, reason: "archived" };
             const stamp = now.toISOString();
             if (this.hasLiveClaim(taskRef, now))
                 return { ok: false, reason: "claimed" };
@@ -12732,10 +12850,12 @@ export class Store {
             : source !== undefined && "project" in source && source.project !== "" ? "project"
                 : source !== undefined && "installation" in source ? "installation" : "unknown";
         const project = scope === "task" ? String(ref["repo"]) : scope === "project" && source !== undefined && "project" in source ? source.project : null;
+        // A put-away task (v145) nudges nobody: no notification about it is enqueued, whoever produced it. The check is
+        // part of the insert itself, so a put away that commits first always wins.
         const { changes, lastInsertRowid } = this.db
             .prepare(`INSERT OR IGNORE INTO notification (dedupe_key, kind, subject, body, created_at, push_class, link, provenance_scope, project, task_ref, task_id, source_run, recipient)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-            .run(notification.dedupeKey, notification.kind, notification.subject, notification.body, now.toISOString(), notification.pushClass ?? null, notification.link ?? null, scope, project, ref === undefined ? null : taskRef, ref === undefined ? null : String(ref["external_id"]), run?.id ?? null, notification.recipient ?? null);
+         SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ? WHERE NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = ?)`)
+            .run(notification.dedupeKey, notification.kind, notification.subject, notification.body, now.toISOString(), notification.pushClass ?? null, notification.link ?? null, scope, project, ref === undefined ? null : taskRef, ref === undefined ? null : String(ref["external_id"]), run?.id ?? null, notification.recipient ?? null, ref === undefined ? null : Number(ref["id"]));
         // Whose act made this fact: pings follow it (see pingAllowed).
         const actor = currentActor();
         if (Number(changes) > 0 && actor !== null) {
@@ -14227,6 +14347,7 @@ export class Store {
            JOIN task_ref ON task_ref.backend = ? AND task_ref.external_id = task.id
            WHERE (? IS NULL OR task_ref.repo IS NULL OR task_ref.repo = ?)
              AND (? IS NULL OR task.state = ?)
+             AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)
            ORDER BY task.created_at DESC, task.id DESC LIMIT ?
          )
          UNION
@@ -14395,8 +14516,10 @@ export class Store {
     resolvePlanRevision(id, outcome, resolvedBy, now) {
         const { changes } = this.db
             .prepare(`UPDATE plan_revision SET status = ?, resolved_at = ?, resolved_by = ?
-          WHERE id = ? AND status = 'blocked'`)
-            .run(outcome, now.toISOString(), resolvedBy, id);
+          WHERE id = ? AND status = 'blocked'
+            -- A put-away task's (v145) plan change is never applied; rejecting it still is.
+            AND (? = 'rejected' OR NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = plan_revision.task_ref))`)
+            .run(outcome, now.toISOString(), resolvedBy, id, outcome);
         return Number(changes) > 0;
     }
     /** Stamp the exact plan revision and authority snapshot a run's brief was
@@ -15626,6 +15749,12 @@ export class Store {
             if (row === undefined || String(row["state"]) !== "claimed" || Number(row["generation"]) !== generation) {
                 return { ok: false, outcome: "raced", why: "the claim moved" };
             }
+            // A put-away task (v145) merges nothing: the intent waits for a person, who restores it first.
+            const archivedTask = this.db.prepare("SELECT 1 FROM publication p JOIN task_archive a ON a.task_ref = p.task_ref WHERE p.id = ?").get(Number(row["publication"]));
+            if (archivedTask !== undefined) {
+                this.settleMergeIntent(id, generation, "waiting-human", now, { error: "the task is put away", from: "claimed", bumpGeneration: true });
+                return { ok: false, outcome: "waiting-human", why: "the task is put away" };
+            }
             const supersede = (why) => {
                 this.settleMergeIntent(id, generation, "superseded", now, { error: why, from: "claimed" });
                 return { ok: false, outcome: "superseded", why };
@@ -16040,9 +16169,12 @@ export class Store {
     }
     /** Save a new drawing of the flow only over the revision the editor saw (two editors never overwrite each other silently). */
     saveFlow(id, change, now) {
-        const { changes } = this.db.prepare("UPDATE flow SET name = ?, definition_json = ?, revision = revision + 1, updated_by = ?, updated_at = ? WHERE id = ? AND revision = ? AND state = 'active'")
-            .run(change.name, flowDefinitionForStore(change.definitionJson), change.by, now.toISOString(), id, change.sawRevision);
-        return Number(changes) === 1;
+        // The one road for a changed flow (flow-changed.ts): what a person approved for the flow as it was ends with it.
+        return flowChanged(this, { flow: id }, change.by, now, () => {
+            const { changes } = this.db.prepare("UPDATE flow SET name = ?, definition_json = ?, revision = revision + 1, updated_by = ?, updated_at = ? WHERE id = ? AND revision = ? AND state = 'active'")
+                .run(change.name, flowDefinitionForStore(change.definitionJson), change.by, now.toISOString(), id, change.sawRevision);
+            return Number(changes) === 1;
+        });
     }
     archiveFlow(id, by, now) {
         const { changes } = this.db.prepare("UPDATE flow SET state = 'archived', updated_by = ?, updated_at = ? WHERE id = ? AND state = 'active'").run(by, now.toISOString(), id);
@@ -16465,26 +16597,35 @@ export class Store {
         return this.transact(() => {
             const current = this.flowScript(script.repo, script.name);
             const version = (current?.version ?? Number(this.db.prepare("SELECT COALESCE(MAX(version), 0) AS v FROM flow_script WHERE repo = ? AND name = ?").get(script.repo, script.name)?.["v"] ?? 0)) + 1;
-            if (current !== null)
-                this.db.prepare("UPDATE flow_script SET state = 'removed' WHERE id = ?").run(current.id);
-            // A "runs on its own" grant signed this script's code: a new version ends it (flow-unattended.ts).
-            endUnattendedGrants(this, { script: { repo: script.repo, name: script.name } }, script.by, "script changed", now);
-            this.db.prepare(`INSERT INTO flow_script (repo, name, about, body, timeout_minutes, version, digest, saved_by, saved_at, state, language, file, held)
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'active', ?, ?, ?)`).run(script.repo, script.name, script.about, script.body, script.timeoutMinutes, version, script.digest, script.by, now.toISOString(), script.language ?? "shell", script.file ?? null, script.held ?? null);
-            return version;
+            // A new version ends what was approved for the flows that run this script (flow-changed.ts): "runs on its own"
+            // grants that signed its code, and browser use that sealed it.
+            return flowChanged(this, { script: { repo: script.repo, name: script.name } }, script.by, now, () => {
+                if (current !== null)
+                    this.db.prepare("UPDATE flow_script SET state = 'removed' WHERE id = ?").run(current.id);
+                this.db.prepare(`INSERT INTO flow_script (repo, name, about, body, timeout_minutes, version, digest, saved_by, saved_at, state, language, file, held)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'active', ?, ?, ?)`).run(script.repo, script.name, script.about, script.body, script.timeoutMinutes, version, script.digest, script.by, now.toISOString(), script.language ?? "shell", script.file ?? null, script.held ?? null);
+                return version;
+            }, () => true);
         });
     }
-    /** A person approves a held script (one an imported flow brought): from now on it runs. False when it wasn't held. */
-    approveFlowScript(repo, name) {
-        const { changes } = this.db.prepare("UPDATE flow_script SET held = NULL WHERE repo = ? AND name = ? AND state = 'active' AND held IS NOT NULL").run(repo, name);
-        return Number(changes) === 1;
+    /** A person approves a held script (one an imported flow brought): from now on it runs. The approval covers exactly
+     * the version and content the person read (`seen`): the check and the release of the hold are one statement in one
+     * transaction, so a script removed and brought back under the same name is never approved unseen. */
+    approveFlowScript(repo, name, seen) {
+        return this.transact(() => {
+            const current = this.flowScript(repo, name);
+            if (current === null || current.held === null)
+                return "not-held";
+            if (current.version !== seen.version || current.digest !== seen.digest)
+                return "changed";
+            const { changes } = this.db.prepare("UPDATE flow_script SET held = NULL WHERE id = ? AND version = ? AND digest = ? AND state = 'active' AND held IS NOT NULL").run(current.id, seen.version, seen.digest);
+            return Number(changes) === 1 ? "approved" : "changed";
+        });
     }
     removeFlowScript(repo, name, by = "flow", now = new Date()) {
-        return this.transact(() => {
+        // A grant that signed this script's code covers nothing without it: it ends, as does browser use that sealed it (flow-changed.ts).
+        return flowChanged(this, { script: { repo, name } }, by, now, () => {
             const { changes } = this.db.prepare("UPDATE flow_script SET state = 'removed' WHERE repo = ? AND name = ? AND state = 'active'").run(repo, name);
-            // A grant that signed this script's code covers nothing without it: it ends (flow-unattended.ts).
-            if (Number(changes) === 1)
-                endUnattendedGrants(this, { script: { repo, name } }, by, "script changed", now);
             return Number(changes) === 1;
         });
     }
@@ -17384,9 +17525,10 @@ export class Store {
         const page = Math.max(1, Math.min(Math.floor(limit), 50));
         // Roll-up admission binds BEFORE the LIMIT (Codex roll-up review,
         // finding 2): a repo outside the ceiling must not consume the page.
-        const admission = admitted === null
+        // A put-away task (v145, task-tidy.md) is left out here, as from every list and count.
+        const admission = (admitted === null
             ? "(? IS NULL OR task_ref.repo IS NULL OR task_ref.repo = ?)"
-            : `(task_ref.repo IS NULL${admitted.length === 0 ? "" : ` OR task_ref.repo IN (${admitted.map(() => "?").join(",")})`})`;
+            : `(task_ref.repo IS NULL${admitted.length === 0 ? "" : ` OR task_ref.repo IN (${admitted.map(() => "?").join(",")})`})`) + " AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)";
         const params = admitted === null ? [repo, repo] : admitted;
         return this.db
             .prepare(`SELECT task.id AS task_id, task.title, task_scope.goal, task_scope.digest, task_scope.proposed_at, task_ref.repo AS task_repo
@@ -17416,9 +17558,10 @@ export class Store {
      */
     listRequeueablesScoped(repo, now, limit = 10, admitted = null) {
         const page = Math.max(1, Math.min(Math.floor(limit), 50));
-        const admission = admitted === null
+        // A put-away task (v145, task-tidy.md) is left out here, as from every list and count.
+        const admission = (admitted === null
             ? "(? IS NULL OR task_ref.repo IS NULL OR task_ref.repo = ?)"
-            : `(task_ref.repo IS NULL${admitted.length === 0 ? "" : ` OR task_ref.repo IN (${admitted.map(() => "?").join(",")})`})`;
+            : `(task_ref.repo IS NULL${admitted.length === 0 ? "" : ` OR task_ref.repo IN (${admitted.map(() => "?").join(",")})`})`) + " AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)";
         const params = admitted === null ? [repo, repo] : admitted;
         return this.db
             .prepare(`WITH open_incidents AS (
@@ -17482,6 +17625,8 @@ export class Store {
          JOIN task_ref AS blocker_ref ON blocker_ref.backend = ? AND blocker_ref.external_id = task_edge.blocker
          WHERE ${admissionOf("dependent_ref")}
            AND ${admissionOf("blocker_ref")}
+           -- Put-away tasks (v145) need no repair card, on either side.
+           AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref IN (dependent_ref.id, blocker_ref.id))
          GROUP BY task_edge.blocker, dependent_ref.repo, blocker_ref.repo
          ORDER BY task_edge.blocker LIMIT ?`)
             .all(BUILT_IN, BUILT_IN, ...paramsOf(), ...paramsOf(), page)
@@ -17514,6 +17659,7 @@ export class Store {
            WHERE task.state = 'done'
              AND (? IS NULL OR task_ref.repo IS NULL OR task_ref.repo = ?)
              ${admission}
+             AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)
          )
          SELECT completed.*, run.id AS run_id, run.outcome, run.handoff, run.cost_usd, run.provider, run.auth_mode, run.started_at, run.finished_at,
                 publication.state AS pub_state, publication.pr_number, publication.pr_url,
@@ -17620,9 +17766,10 @@ export class Store {
         // finding 11): in the roll-up, rows outside the ceiling must not
         // consume the page and crowd out admitted cards. Serve still filters
         // per-row afterward — this is the bound, that is the law.
-        const admission = admitted === null
+        // A put-away task (v145, task-tidy.md) is left out here, as from every list and count.
+        const admission = (admitted === null
             ? "(? IS NULL OR task_ref.repo IS NULL OR task_ref.repo = ?)"
-            : `(task_ref.repo IS NULL OR task_ref.repo IN (${admitted.map(() => "?").join(",")}))`;
+            : `(task_ref.repo IS NULL OR task_ref.repo IN (${admitted.map(() => "?").join(",")}))`) + " AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)";
         const admissionParams = admitted === null ? [repo, repo] : admitted;
         const columns = `
         SELECT task.id, task.title, task.state, task.updated_at, task.priority, task_ref.strikes, task_ref.repo AS task_repo,
@@ -17826,14 +17973,15 @@ export class Store {
            SUM(CASE WHEN task.state = 'queued' THEN 1 ELSE 0 END) AS queued,
            SUM(CASE WHEN task.state = 'running' THEN 1 ELSE 0 END) AS running
            FROM task JOIN task_ref ON task_ref.backend = 'built-in' AND task_ref.external_id = task.id
-          WHERE task_ref.repo = ?`)
+          WHERE task_ref.repo = ? AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)`)
             .get(repo);
         const since = new Date(now.getTime() - 24 * 60 * 60_000).toISOString();
         const done = this.db
             .prepare(`SELECT COUNT(*) AS n FROM run
            JOIN task_ref ON task_ref.id = run.task_ref
           WHERE task_ref.repo = ? AND run.role IN ('builder','scout')
-            AND run.outcome IN ('built','no-change') AND run.finished_at IS NOT NULL AND run.finished_at >= ?`)
+            AND run.outcome IN ('built','no-change') AND run.finished_at IS NOT NULL AND run.finished_at >= ?
+            AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)`)
             .get(repo, since);
         return { waiting: waiting, queued: Number(q.queued ?? 0), running: Number(q.running ?? 0), doneRecently: Number(done.n) };
     }
@@ -17842,9 +17990,10 @@ export class Store {
         // review, finding 11): with repo NULL the old predicate admitted every
         // stored project, ceiling or not. An empty admitted list reduces to
         // unplaced rows only — never IN ().
-        const admission = admitted === null
+        // A put-away task (v145, task-tidy.md) is left out here, as from every list and count.
+        const admission = (admitted === null
             ? "(? IS NULL OR task_ref.repo IS NULL OR task_ref.repo = ?)"
-            : `(task_ref.repo IS NULL${admitted.length === 0 ? "" : ` OR task_ref.repo IN (${admitted.map(() => "?").join(",")})`})`;
+            : `(task_ref.repo IS NULL${admitted.length === 0 ? "" : ` OR task_ref.repo IN (${admitted.map(() => "?").join(",")})`})`) + " AND NOT EXISTS (SELECT 1 FROM task_archive WHERE task_archive.task_ref = task_ref.id)";
         const params = () => (admitted === null ? [repo, repo] : [...admitted]);
         const row = this.db
             .prepare(`SELECT COUNT(*) AS n FROM (
@@ -18697,6 +18846,8 @@ export class Store {
      */
     resumeRunStop(args, now) {
         return this.transact(() => {
+            if (refArchived(this, args.taskRef))
+                return { ok: false, reason: "archived", detail: "this task is put away — restore it first" };
             const stop = this.stopOf(args.runId);
             const run = this.getRun(args.runId);
             if (stop === null || run === null)
@@ -21669,3 +21820,326 @@ export function dropFeedbackImage(store, runId, commentId, actor, unusable, now)
         return { ok: true, id };
     });
 }
+/** The put-away record of this task, or null when it is not put away. */
+export function archiveOf(store, taskId) {
+    const row = store.handle.prepare(`SELECT a.*, r.external_id FROM task_archive a JOIN task_ref r ON r.id = a.task_ref
+    WHERE r.backend = 'built-in' AND r.external_id = ?`).get(taskId);
+    return row === undefined ? null : { taskRef: Number(row["task_ref"]), taskId: String(row["external_id"]), by: String(row["by"]),
+        byKind: row["by_kind"] === "tidy" ? "tidy" : "person", rule: row["rule"] == null ? null : String(row["rule"]), reason: String(row["reason"]), at: String(row["at"]) };
+}
+/** Every version of a task's family, by the same proven lineage the task page reads (`taskFamilyOf`: same project, each
+ * revision bound to its parent's own run by its brief). A family whose lineage doesn't prove is just this task. */
+export function taskFamilyRefs(store, taskId) {
+    const family = store.taskFamilyOf(taskId, null, true);
+    return family === null ? [] : family.versions.map(one => ({ id: one.refId, taskId: one.id })).sort((a, b) => a.id - b.id);
+}
+/** The first family version with something still going on, or null: running, a live newest claim, an unfinished run,
+ * a process Toolroll hasn't seen exit, a build whose processes were never recorded, a stop still settling, a follow-up
+ * check asked for and not finished, a flow step running for its card, a release in flight (a live release approval
+ * that names it, or a deploy or merge reserved, running or unknown), or a pull request merging (an intent claimed or
+ * firing, or a person's merge between its last check and GitHub's answer). */
+export function liveFamilyAttempt(store, refs, now) {
+    if (refs.length === 0)
+        return null;
+    const row = store.handle.prepare(`SELECT r.external_id FROM task_ref r JOIN task t ON t.id = r.external_id
+    WHERE r.id IN (SELECT value FROM json_each(?)) AND (t.state = 'running'
+      OR EXISTS (SELECT 1 FROM claim c WHERE c.task_ref = r.id AND c.released_at IS NULL AND c.expires_at > ?
+        AND c.lease_generation = (SELECT MAX(n.lease_generation) FROM claim n WHERE n.task_ref = r.id))
+      OR EXISTS (SELECT 1 FROM run x WHERE x.task_ref = r.id AND x.outcome IS NULL)
+      OR EXISTS (SELECT 1 FROM run_process p JOIN run x ON x.id = p.run WHERE x.task_ref = r.id AND p.exited_at IS NULL AND p.container_empty_at IS NULL)
+      OR EXISTS (SELECT 1 FROM run x WHERE x.task_ref = r.id AND x.provider_started_at IS NOT NULL
+        AND NOT EXISTS (SELECT 1 FROM run_process p WHERE p.run = x.id) AND NOT EXISTS (SELECT 1 FROM run_process_summary s WHERE s.run = x.id))
+      OR EXISTS (SELECT 1 FROM run_stop s WHERE s.task_ref = r.id AND s.resumed_at IS NULL AND s.settled_at IS NULL)
+      OR EXISTS (SELECT 1 FROM action_ledger q JOIN run x ON x.id = q.run_id WHERE x.task_ref = r.id AND q.action = 'checks requested'
+        AND NOT EXISTS (SELECT 1 FROM action_ledger f WHERE f.run_id = q.run_id AND f.action = 'checks finished' AND f.outcome LIKE q.id || ':%'))
+      OR EXISTS (SELECT 1 FROM flow_card c JOIN flow_step_run s ON s.card = c.id
+        WHERE s.state = 'running' AND (c.task = r.external_id OR c.primary_task = r.external_id))
+      OR EXISTS (SELECT 1 FROM flow_step_task t JOIN flow_step_run s ON s.card = t.card AND s.entry = t.entry
+        WHERE s.state = 'running' AND t.task_id = r.external_id)
+      OR EXISTS (SELECT 1 FROM deploy_in_flight d WHERE d.task_ref = r.id AND d.at > ?)
+      OR EXISTS (SELECT 1 FROM release_authority a WHERE a.state IN ('open','deploying','merge-reserved') AND (a.anchor_task = r.external_id OR a.tip_task = r.external_id))
+      OR EXISTS (SELECT 1 FROM release_operation o WHERE o.task_id = r.external_id AND o.state IN ('reserved','running','unknown'))
+      OR EXISTS (SELECT 1 FROM merge_intent i JOIN publication p ON p.id = i.publication WHERE p.task_ref = r.id AND i.state IN ('claimed','firing'))
+      OR EXISTS (SELECT 1 FROM merge_in_flight m WHERE m.task_ref = r.id AND m.at > ?))
+    LIMIT 1`).get(JSON.stringify(refs), now.toISOString(), new Date(now.getTime() - 30 * 60_000).toISOString(), new Date(now.getTime() - 15 * 60_000).toISOString());
+    return row === undefined ? null : String(row["external_id"]);
+}
+/** Puts a task away (v145): every version of its family, in one write transaction that re-checks it has no live
+ * attempt, that its versions are exactly `expect` when the caller showed a person a family (a preview), and that
+ * `guard` (the caller's own rule, re-read under the lock) still allows it. Its state, history, results, approvals and
+ * ledger are untouched; its open notifications are resolved; one ledger row records who and why. */
+export function archiveTaskFamily(store, taskId, by, now, options = {}) {
+    return store.transact(() => {
+        const family = taskFamilyRefs(store, taskId);
+        if (family.length === 0)
+            return { ok: false, reason: "unknown-task", message: `No task ${taskId}.` };
+        const refs = family.map(one => one.id);
+        if (options.expect !== undefined && [...options.expect].sort((a, b) => a - b).join(",") !== refs.join(",")) {
+            return { ok: false, reason: "blocked", message: `${taskId}'s versions changed since the list was shown.` };
+        }
+        // Already put away, every version: nothing to do. A family a person revived with a new revision puts away the rest.
+        const remaining = refs.filter(ref => !refArchived(store, ref));
+        if (remaining.length === 0)
+            return { ok: false, reason: "archived", message: `${taskId} is already put away.` };
+        const live = liveFamilyAttempt(store, refs, now);
+        if (live !== null)
+            return { ok: false, reason: "live", message: `${taskId} still has work going on. Stop it or let it finish, then put it away.` };
+        const blocked = options.guard?.(refs) ?? null;
+        if (blocked !== null)
+            return { ok: false, reason: "blocked", message: blocked };
+        const reason = by.reason.replace(/[\u0000-\u001f\u007f]+/g, " ").trim().slice(0, 300) || "Put away";
+        const at = now.toISOString();
+        const insert = store.handle.prepare("INSERT INTO task_archive (task_ref, by, by_kind, rule, reason, at) VALUES (?, ?, ?, ?, ?, ?)");
+        for (const ref of remaining)
+            insert.run(ref, by.by, by.byKind, by.rule, reason, at);
+        store.handle.prepare("UPDATE notification SET resolved_at = ? WHERE resolved_at IS NULL AND task_ref IN (SELECT value FROM json_each(?))")
+            .run(at, JSON.stringify(refs));
+        // The family's flow cards hold while it is put away, so what they queued for people is settled too.
+        store.handle.prepare(`UPDATE notification SET resolved_at = ? WHERE resolved_at IS NULL AND EXISTS (SELECT 1 FROM flow_card c
+        WHERE (c.task IN (SELECT value FROM json_each(?)) OR c.primary_task IN (SELECT value FROM json_each(?)))
+          AND (notification.dedupe_key LIKE 'flow:' || c.id || ':%' OR notification.dedupe_key LIKE 'flow-card:' || c.id || ':%'))`)
+            .run(at, JSON.stringify(family.map(one => one.taskId)), JSON.stringify(family.map(one => one.taskId)));
+        const repo = store.refById(refs[0])?.repo ?? null;
+        store.recordAction({ at, actor: by.byKind === "tidy" ? "tidy" : `operator:${by.by}`, repo, taskId, runId: null, action: "task archived",
+            outcome: by.rule ?? "by hand", source: "work", detail: `${reason}${refs.length > 1 ? ` (${refs.length} versions)` : ""}` });
+        return { ok: true, refs };
+    });
+}
+/** Brings a put-away task back (v145): every version of its family, with a ledger row. Tidy never puts a restored
+ * task away again (tidy.ts reads the `task restored` row). */
+export function restoreTaskFamily(store, taskId, by, now, guard) {
+    return store.transact(() => {
+        const family = taskFamilyRefs(store, taskId);
+        if (family.length === 0)
+            return { ok: false, reason: "unknown-task", message: `No task ${taskId}.` };
+        const refs = family.map(one => one.id).filter(ref => refArchived(store, ref));
+        if (refs.length === 0)
+            return { ok: false, reason: "not-archived", message: `${taskId} isn't put away.` };
+        const blocked = guard?.(refs) ?? null;
+        if (blocked !== null)
+            return { ok: false, reason: "blocked", message: blocked };
+        store.handle.prepare("DELETE FROM task_archive WHERE task_ref IN (SELECT value FROM json_each(?))").run(JSON.stringify(refs));
+        const at = now.toISOString();
+        store.recordAction({ at, actor: `operator:${by}`, repo: store.refById(refs[0])?.repo ?? null, taskId, runId: null, action: "task restored",
+            outcome: "recorded", source: "work", detail: refs.length > 1 ? `${refs.length} versions` : null });
+        return { ok: true, refs };
+    });
+}
+/**
+ * What a LIVE invite grants, for its own join page (Wave E, "Your access"): the role, who invited, the projects and
+ * when it expires. Read without spending an attempt and under exactly inviteIsLive's predicate, so every dead shape
+ * reads as null and still gets the one indistinguishable page (D6). Only a holder of the live token sees it.
+ */
+export function liveInviteTerms(store, tokenValue, now) {
+    const row = store.handle
+        .prepare("SELECT role, minted_by, expires_at, projects_json FROM invite WHERE token_hash = ? AND revoked_at IS NULL AND consumed_at IS NULL AND expires_at > ? AND attempts < 10")
+        .get(createHash("sha256").update(tokenValue, "utf8").digest("hex"), now.toISOString());
+    if (row === undefined)
+        return null;
+    return { role: String(row["role"]) === "approver" ? "approver" : "viewer", mintedBy: String(row["minted_by"]), expiresAt: String(row["expires_at"]), projects: readProjectAccess(row["projects_json"]) };
+}
+/** At most this many checks are kept for one head; GitHub's rollup is far smaller in practice. */
+export const CI_CHECKS_MAX = 200;
+const CI_CHECK_TEXT_MAX = 200;
+const CI_CHECK_URL_MAX = 2048;
+const CI_FAILED_CONCLUSIONS = new Set(["FAILURE", "ERROR", "TIMED_OUT", "ACTION_REQUIRED", "STARTUP_FAILURE"]);
+const CI_PENDING = new Set(["QUEUED", "WAITING", "PENDING", "REQUESTED"]);
+const ISO_INSTANT = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?(?:Z|[+-]\d{2}:\d{2})$/;
+/** A timestamp GitHub gave, as an exact ISO instant, or null (GitHub's zero time "0001-01-01T00:00:00Z" is no time). */
+function ciInstant(value) {
+    if (typeof value !== "string" || value.length > 40 || !ISO_INSTANT.test(value))
+        return null;
+    const at = Date.parse(value);
+    if (!Number.isFinite(at) || at < Date.UTC(2000, 0, 1))
+        return null;
+    return new Date(at).toISOString();
+}
+/** The same ordering in SQL, for a column holding a check state. */
+const CI_SEVERITY_SQL = (column) => `CASE ${column} ${Object.entries({ failed: 6, cancelled: 5, running: 4, queued: 3, neutral: 2, skipped: 1, passed: 0 }).map(([state, n]) => `WHEN '${state}' THEN ${n}`).join(" ")} ELSE 0 END`;
+/** How bad a check state is: when one check identity appears twice, the worse stands. */
+const CI_SEVERITY = { failed: 6, cancelled: 5, running: 4, queued: 3, neutral: 2, skipped: 1, passed: 0 };
+/** A check's identity: its kind, its workflow and its name. */
+function ciCheckIdent(kind, row) {
+    // Unit separators, never NUL (SQLite text ends at one): names and workflows had every control character removed.
+    return `${kind}\u001f${row.workflow ?? ""}\u001f${row.name}`;
+}
+/** Short, printable text, or null. Every control (C0, DEL, C1) and format character (bidi overrides and isolates,
+ * zero-width marks) is removed, so a check name can't move the terminal's cursor or reorder what `task ship` prints.
+ * Check names never need a zero-width joiner, so emoji sequences lose theirs: that is the accepted cost. */
+function ciText(value) {
+    if (typeof value !== "string")
+        return null;
+    const text = value.replace(/[\p{Cc}\p{Cf}]/gu, "").trim();
+    return text === "" || text.length > CI_CHECK_TEXT_MAX ? null : text;
+}
+/** Only an https link to GitHub itself is kept; anything else reads null. */
+function ciUrl(value) {
+    if (typeof value !== "string" || value.length > CI_CHECK_URL_MAX)
+        return null;
+    try {
+        const url = new URL(value);
+        return url.protocol === "https:" && url.username === "" && url.password === "" && url.port === "" && url.hostname === "github.com" ? url.toString() : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * GitHub's statusCheckRollup (gh pr view --json statusCheckRollup) as check rows: CheckRun items (name, workflowName,
+ * status, conclusion, startedAt, completedAt, detailsUrl) and StatusContext items (context, state, startedAt, targetUrl).
+ * Strict: an item that is not one of those shapes, has no usable name, or names a state it doesn't know is dropped; one
+ * row per identity (kind, workflow and name), and when one identity appears twice (a re-run) the worse state stands;
+ * at most CI_CHECKS_MAX.
+ */
+export function parseCiRollup(rollup) {
+    if (!Array.isArray(rollup))
+        return [];
+    const rows = [];
+    const seen = new Map();
+    for (const item of rollup.slice(0, CI_CHECKS_MAX * 2)) {
+        if (rows.length >= CI_CHECKS_MAX)
+            break;
+        if (typeof item !== "object" || item === null || Array.isArray(item))
+            continue;
+        const raw = item;
+        const kind = raw["__typename"];
+        let row = null;
+        if (kind === "CheckRun" || (kind === undefined && typeof raw["status"] === "string" && raw["context"] === undefined)) {
+            const name = ciText(raw["name"]);
+            const status = typeof raw["status"] === "string" ? raw["status"].toUpperCase() : "";
+            const conclusion = typeof raw["conclusion"] === "string" ? raw["conclusion"].toUpperCase() : "";
+            const state = status === "IN_PROGRESS" ? "running"
+                : CI_PENDING.has(status) ? "queued"
+                    : status !== "COMPLETED" ? null
+                        : conclusion === "SUCCESS" ? "passed"
+                            : CI_FAILED_CONCLUSIONS.has(conclusion) ? "failed"
+                                : conclusion === "CANCELLED" ? "cancelled"
+                                    : conclusion === "SKIPPED" ? "skipped"
+                                        : conclusion === "NEUTRAL" || conclusion === "STALE" ? "neutral"
+                                            : null;
+            if (name === null || state === null)
+                continue;
+            const completedAt = state === "running" || state === "queued" ? null : ciInstant(raw["completedAt"]);
+            row = { name, workflow: ciText(raw["workflowName"]), state, startedAt: state === "queued" ? null : ciInstant(raw["startedAt"]), completedAt, url: ciUrl(raw["detailsUrl"]), kind: "run" };
+        }
+        else if (kind === "StatusContext" || (kind === undefined && typeof raw["context"] === "string")) {
+            const name = ciText(raw["context"]);
+            const value = typeof raw["state"] === "string" ? raw["state"].toUpperCase() : "";
+            const state = value === "SUCCESS" ? "passed" : value === "FAILURE" || value === "ERROR" ? "failed"
+                : value === "PENDING" || value === "EXPECTED" ? "running" : null;
+            if (name === null || state === null)
+                continue;
+            row = { name, workflow: null, state, startedAt: ciInstant(raw["startedAt"] ?? raw["createdAt"]), completedAt: null, url: ciUrl(raw["targetUrl"]), kind: "status" };
+        }
+        if (row === null)
+            continue;
+        // A completion before its start is GitHub's clock disagreeing with itself: keep the state, drop the end.
+        if (row.startedAt !== null && row.completedAt !== null && row.completedAt < row.startedAt)
+            row = { ...row, completedAt: null };
+        const ident = ciCheckIdent(row.kind ?? "run", row);
+        const at = seen.get(ident);
+        if (at !== undefined) {
+            if (CI_SEVERITY[row.state] > CI_SEVERITY[rows[at].state])
+                rows[at] = row;
+            continue;
+        }
+        seen.set(ident, rows.length);
+        rows.push(row);
+    }
+    return rows;
+}
+/**
+ * Replace one head's checks wholesale (v146). Call ONLY with an observation that won its generation (publish.ts settles
+ * and records in one transaction): a losing, stale answer never writes here.
+ */
+export function recordCiChecks(store, githubRepo, prNumber, headSha, rows, now) {
+    store.transact(() => {
+        // One head per pull request is kept: an older head's rows go with the new observation.
+        store.handle.prepare("DELETE FROM ci_check WHERE github_repo = ? AND pr_number = ?").run(githubRepo, prNumber);
+        const insert = store.handle.prepare(`INSERT INTO ci_check (github_repo, pr_number, head_sha, ident, name, workflow, state, started_at, completed_at, url, observed_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT (github_repo, pr_number, head_sha, ident) DO UPDATE SET state = excluded.state, started_at = excluded.started_at,
+        completed_at = excluded.completed_at, url = excluded.url WHERE ${CI_SEVERITY_SQL("excluded.state")} > ${CI_SEVERITY_SQL("ci_check.state")}`);
+        const at = now.toISOString();
+        // Rows a caller built itself carry no kind: a row with a workflow is a check run, one without may be a status; the
+        // identity keeps the two apart either way.
+        for (const row of rows.slice(0, CI_CHECKS_MAX))
+            insert.run(githubRepo, prNumber, headSha, ciCheckIdent(row.kind ?? (row.workflow === null ? "status" : "run"), row), row.name, row.workflow, row.state, row.startedAt, row.completedAt, row.url, at);
+    });
+}
+/** A pull request's checks for the head the plane's last winning observation recorded, or null when none was. */
+export function ciChecksFor(store, githubRepo, prNumber) {
+    const observation = store.handle.prepare("SELECT head_sha, state, observed_at FROM ci_observation WHERE github_repo = ? AND pr_number = ?").get(githubRepo, prNumber);
+    if (observation === undefined || String(observation["head_sha"]) === "" || String(observation["observed_at"]) === "")
+        return null;
+    const headSha = String(observation["head_sha"]);
+    const rows = store.handle.prepare(`SELECT ident, name, workflow, state, started_at, completed_at, url, observed_at FROM ci_check
+      WHERE github_repo = ? AND pr_number = ? AND head_sha = ? ORDER BY COALESCE(started_at, '9999'), name`).all(githubRepo, prNumber, headSha);
+    const text = (value) => value === null || value === undefined ? null : String(value);
+    return {
+        githubRepo, prNumber, headSha, observedAt: String(observation["observed_at"]),
+        observed: ["passing", "failing", "running"].find(one => one === String(observation["state"])) ?? "none",
+        checks: rows.map(row => ({ name: String(row["name"]), workflow: text(row["workflow"]), state: String(row["state"]),
+            startedAt: text(row["started_at"]), completedAt: text(row["completed_at"]), url: text(row["url"]),
+            kind: String(row["ident"]).startsWith("status\u001f") ? "status" : "run" })),
+    };
+}
+/** A task's pull request checks: its family's newest publication that has a pull request number, and that pull
+ * request's checks (ciChecksFor). Null: no pull request, or none observed yet. */
+export function shipChecksForTask(store, taskId) {
+    const refs = taskFamilyRefs(store, taskId).map(one => one.id);
+    if (refs.length === 0)
+        return null;
+    const row = store.handle.prepare(`SELECT github_repo, pr_number FROM publication WHERE task_ref IN (SELECT value FROM json_each(?))
+      AND pr_number IS NOT NULL ORDER BY id DESC LIMIT 1`).get(JSON.stringify(refs));
+    return row === undefined ? null : ciChecksFor(store, String(row["github_repo"]), Number(row["pr_number"]));
+}
+const RELEASE_STEP_NAMES = new Set(["gate", "approval", "check", "complete", "quiet", "deploy", "link", "ci", "merge", "tree", "tag", "publish", "homebrew"]);
+/**
+ * Record a release step (v146): `running` or `waiting` opens it (its first start is kept), `done` or `failed` ends it.
+ * A step that runs again after a stop starts its row again. A failed write throws here; the release's adapter swallows
+ * it, so recording never changes a release.
+ */
+export function recordReleaseStep(store, entry) {
+    if (!RELEASE_STEP_NAMES.has(entry.step) || entry.taskId === "" || entry.tag === "")
+        return;
+    const at = entry.at.toISOString();
+    // A stop message can carry a remote tool's words: no control or format character reaches `release status`.
+    const detail = entry.detail == null ? null : entry.detail.replace(/[\p{Cc}\p{Cf}]+/gu, " ").trim().slice(0, 1000);
+    const ended = entry.state === "done" || entry.state === "failed";
+    store.handle.prepare(`INSERT INTO release_step (task_id, tag, version, pr, step, state, started_at, ended_at, detail, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT (task_id, tag, step) DO UPDATE SET
+        state = excluded.state, version = excluded.version, pr = excluded.pr, updated_at = excluded.updated_at,
+        started_at = CASE WHEN release_step.ended_at IS NOT NULL AND excluded.ended_at IS NULL THEN excluded.started_at ELSE release_step.started_at END,
+        ended_at = excluded.ended_at,
+        detail = CASE WHEN excluded.detail IS NOT NULL OR excluded.ended_at IS NULL THEN excluded.detail ELSE release_step.detail END`)
+        .run(entry.taskId, entry.tag, entry.version, entry.pr, entry.step, entry.state, at, ended ? at : null, detail, at);
+}
+/** A release's steps, for the release task: the newest tag recorded for it, its steps in the order they ran, and the
+ * step it stopped at when the last thing recorded was a failure. Null: no step recorded. */
+export function releaseProgressFor(store, taskId) {
+    const newest = store.handle.prepare("SELECT tag FROM release_step WHERE task_id = ? ORDER BY updated_at DESC, rowid DESC LIMIT 1").get(taskId);
+    if (newest === undefined)
+        return null;
+    const tag = String(newest["tag"]);
+    const rows = store.handle.prepare("SELECT * FROM release_step WHERE task_id = ? AND tag = ? ORDER BY started_at, rowid").all(taskId, tag);
+    const steps = rows.map(row => ({ step: String(row["step"]), state: String(row["state"]), startedAt: String(row["started_at"]),
+        endedAt: row["ended_at"] === null ? null : String(row["ended_at"]), detail: row["detail"] === null ? null : String(row["detail"]) }));
+    const last = [...rows].sort((a, b) => String(a["updated_at"]).localeCompare(String(b["updated_at"]))).at(-1);
+    const stopped = String(last["state"]) === "failed" ? { step: String(last["step"]), message: last["detail"] === null ? "" : String(last["detail"]), at: String(last["updated_at"]) } : null;
+    const pr = last["pr"] === null ? null : Number(last["pr"]);
+    return { tag, version: String(last["version"]), pr, startedAt: steps[0].startedAt, updatedAt: String(last["updated_at"]), steps, stopped };
+}
+/** The release task whose steps were recorded most recently (v146), or null when none was. */
+export function latestReleaseStepTask(store) {
+    const row = store.handle.prepare("SELECT task_id FROM release_step ORDER BY updated_at DESC, rowid DESC LIMIT 1").get();
+    return row === undefined ? null : String(row["task_id"]);
+}
+/** Seconds a step or check took (to its end, or to `now` while it runs); null without a start. */
+export function elapsedSeconds(startedAt, endedAt, now) {
+    if (startedAt === null)
+        return null;
+    const start = Date.parse(startedAt), end = endedAt === null ? now.getTime() : Date.parse(endedAt);
+    return Number.isFinite(start) && Number.isFinite(end) ? Math.max(0, Math.round((end - start) / 1000)) : null;
+}