toolroll 0.9.92 → 0.9.94

package/dist/operate.js

@@ -21,7 +21,7 @@ import { parseProtectedPaths } from "./approval-policy.js";
 import { rulesSummary } from "./approval-rules-ui.js";
 import { evidencePack, exportDay, ledgerExportChunks, standaloneEvidenceHtml } from "./evidence-pack.js";
 import { matchesOutsideCheckpoint } from "./ledger-chain.js";
-import { CLEANUP_CHOICES, bytesWords, cleanupWords, diskBytes, parseCleanup, storageReport } from "./storage.js";
+import { CLEANUP_CHOICES, bytesWords, cleanupWords, diskBytes, idleCleanupWords, idleWords, parseCleanup, parseIdle, storageReport } from "./storage.js";
 import { removeStaleTestTemp, tempRoots, testTempFolders } from "./test-temp.js";
 import { storageSweepSupervisor } from "./storage-sweep-process.js";
 import { idleStorageSweep, sweepSchedule, sweepScheduleWords } from "./storage-sweep-schedule.js";
@@ -33,6 +33,7 @@ import { personProof } from "./person-proof.js";
 import { RemoteMains } from "./remote-main.js";
 import { checkoutPlan, cleanCheckouts, discardCheckout, finishedCheckouts, slimKeptCheckouts, whyWords } from "./checkout-cleanup.js";
 import { closeOutCheckouts, closeOutRuns, stoppedWords } from "./run-closeout.js";
+import { proveFinishedRunsStopped, proveRunStopped } from "./stop-proof.js";
 import { MIN_DAYS, RETENTION_KINDS, countWords, dailyRetention, isRetentionKind, lastSweepAt, parsePeriod, periodLabel, periodWords, retentionPlan, sweepWords } from "./retention.js";
 import { checkPolicy, parseList, policyParts } from "./policy.js";
 import { billingOf, budgetHoldWords, budgetLabel, budgetStates, monthNamed, monthOf, spendItems, subagentNames, usd as spendUsd } from "./spend.js";
@@ -63,7 +64,12 @@ import { sendSubagentSummaries } from "./subagent-admin.js";
 import { runRequestedUndos, sendSubagentWeeklies } from "./subagent-week.js";
 import { refreshConnections } from "./mcp-connect.js";
 import { releaseCheckPurposeFor, releaseTermsFor } from "./release-carry.js";
+import { approveReleaseCard, journalMatchesPlane, releaseApprovalCard, releaseCardLines, releaseTaskOf, waitingJournals } from "./release-approval.js";
+import { journalFile } from "./release.js";
 import { refreshTrustedMains, settleReleaseChecks } from "./nightly-check.js";
+import { refreshCodeMaps } from "./code-map-build.js";
+import { sweepDeliveries } from "./code-map-admission.js";
+import { runMapCommand } from "./code-map-cli.js";
 import { githubNightlyRepos, readGithubNightlies } from "./nightly-github.js";
 import { exec as releaseExec, githubReads } from "./release-adapters.js";
 import { releaseTools } from "./release-git.js";
@@ -73,11 +79,17 @@ import { followTeams } from "./teams.js";
 import { followSlack } from "./slack.js";
 import { validateScopeText } from "./task-text.js";
 import { runMemoryCommand } from "./memory-cli.js";
+import { runFlakyCommand } from "./flaky-cli.js";
+import { backfillMemoryUse } from "./memory-use.js";
+import { scheduledTidy } from "./memory-tidy.js";
+import { CI_READ_EVERY_MS, ciCursorKey, ciRepositoriesOf, observeCiAttempts } from "./flaky-ci.js";
 import { runKnowledgeApply, runKnowledgeCommand } from "./knowledge-cli.js";
 import { FLOWS_VALUE_FLAGS, runFlowsCommand } from "./flows-cli.js";
 import { runAssignmentCommand } from "./assignment-adapters.js";
 import { applyProjectProfile, runProjectCommand } from "./project-cli.js";
 import { pullRequestLines, runTaskMergeCommand, runTaskOutcomeCommand } from "./task-outcome-cli.js";
+import { withTaskAlias } from "./task-aliases.js";
+import { checklistLines, mergeChecklistOf } from "./merge-checklist.js";
 import { taskReviewBrief, renderReviewBrief } from "./task-review-brief.js";
 /**
  * The commands that actually move work: authoring tasks, and the claim loop.
@@ -109,10 +121,10 @@ import { homedir, hostname } from "node:os";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { releaseStalledUpdate, waitingUpdate } from "./toolroll-update.js";
 import { dur } from "./design/kit.js";
-import { openStore, openStoreNoMigrate, initLocalMode, enrollOwnerPassword, installationCreatedBy, laptopPortOf, recordLaptopPort, localModeOf, localOwnerBinding, archiveTaskFamily, restoreTaskFamily, shipChecksForTask, elapsedSeconds, CONCURRENT_WRITER_WAIT_MS, isDatabaseBusy, databasePath, BUILT_IN, parseCapabilityKey, verifiedAuthor, isDigestTime, predecessorWatches, RESULT_SCREENSHOTS, lifecycleOf, reportLifecycle, beatLifecycle, } from "./store.js";
+import { checkoutIdle, setCheckoutIdle, openStore, openStoreNoMigrate, initLocalMode, enrollOwnerPassword, installationCreatedBy, laptopPortOf, recordLaptopPort, localModeOf, localOwnerBinding, archiveTaskFamily, restoreTaskFamily, shipChecksForTask, elapsedSeconds, CONCURRENT_WRITER_WAIT_MS, isDatabaseBusy, databasePath, BUILT_IN, parseCapabilityKey, verifiedAuthor, isDigestTime, predecessorWatches, RESULT_SCREENSHOTS, lifecycleOf, reportLifecycle, beatLifecycle, } from "./store.js";
 import { createHash, randomBytes, randomInt, randomUUID } from "node:crypto";
 import { claimInstance, clearInstance, openInstanceSocket } from "./console-instance.js";
-import { backgroundOff, backgroundOn, backgroundShow, laptopStatus, laptopStop } from "./laptop-background.js";
+import { backgroundOff, backgroundOn, backgroundShow, laptopStatus, laptopStop, restartOwnBuilder } from "./laptop-background.js";
 import { authorizePlanUnderMode } from "./plan-auto.js";
 import { ghDispatchAdapter, mirrorTaskId, syncPass } from "./sync.js";
 import { LIVE_FILE_BOUND, LIVE_RETAIN_MS, sweepLiveLogs } from "./live.js";
@@ -182,7 +194,7 @@ function planContractLines(store, evidenceRoot, taskId) {
         ...describeContractChanges(record.changes).map(line => `    ${line}`),
     ];
 }
-import { verdictWords as proofVerdictWords, matrixWords, semanticCoverage, coverageWords } from "./proof.js";
+import { verdictWords as proofVerdictWords, matrixWords, plainReasonWords, semanticCoverage, coverageWords } from "./proof.js";
 import { probeRepo } from "./probe.js";
 import { diagnoseTaskDispatch, diagnosisIsDispatchable, scopeApprovedForDispatch, } from "./dispatch.js";
 import { createDecisionServer } from "./serve.js";
@@ -234,6 +246,17 @@ import { resolvePhaseAgent, resolveScopeProfile, resolveRouteCandidates, routeOf
 import { applyModelChoices, stateDigest } from "./model-choices.js";
 import { isTaskSize, legOf, projectRoute, routeDigestOf, routeWords, TASK_SIZES, PHASES as ROUTE_PHASES } from "./phase-routing.js";
 import { observeProviderReadiness, reportProviderReadinessAuthed } from "./runner.js";
+import { retryVanishedWhenStopped } from "./vanished-retry.js";
+import { requestMissingRechecks } from "./check-only.js";
+import { recordBuilderWish } from "./builder-restart.js";
+import { expireFastStarts, fastRefusalWords, fastStartBuild, keepGrownChange, prepareFastStart } from "./fast-start.js";
+import { fastTermsLines } from "./fast-terms.js";
+import { resumeAllowedReleases } from "./release-next.js";
+import { fileGithubItem, readGithubItem } from "./github-import.js";
+import { runRelease } from "./release.js";
+import { releaseAdapters } from "./release-adapters.js";
+import { routeChangeOf, routeLegacyPlans } from "./route-change.js";
+import { passwordlessOn } from "./passwordless.js";
 import { parseDemoUrl, projectDemoUrl, saveProjectDemo } from "./project-demo.js";
 import { effectiveConcurrency, maySlotTake, parseProjectConcurrency, PROJECT_CONCURRENCY_DEFAULT, ProjectPasses, projectConcurrency, saveProjectConcurrency, savedProjectConcurrency } from "./project-concurrency.js";
 import { activeWebhookTargets, webhookPass, LEGACY_WEBHOOK_WARNING, loadWebhookTargets, effectivePrimary, isMessagingChannel, loadConsoleUrl, phoneOrigin, readUpConsoleUrl, saveConsoleUrl, savePrimary, UP_CONSOLE_FILE } from "./webhooks.js";
@@ -317,10 +340,16 @@ export const OPERATE_HELP = `toolroll — operating the queue
                                         the project's own demo or dev server, the one non-public address a
                                         report's scout may screenshot
   toolroll task evidence <id>        the task's evidence pack as JSON (--html for a printable page; --out <file>)
+  toolroll map [<project>] [--json]  a project's code map, made by Toolroll from main: areas and how they use each other
+  toolroll map area <id> | file <path> | search <words> [--cursor <c>]
+                                     one area, one file, or files and exported names; --cursor reads the next page of the same version
+  toolroll map refresh               ask for a check of main now (an approver)
   toolroll storage                   where the disk goes: database, build checkouts, releases, evidence, leftover test temp folders
   toolroll storage clean [--yes]     preview removing finished tasks' clean checkouts (their branches stay) and test temp folders older than a day; --yes removes them
   toolroll storage clean --landed [--yes]   preview work that landed in main over a week ago: marks its results complete, removes their clean checkouts and local branches; --yes does it (instance operator)
-  toolroll storage cleanup <when>    remove a finished task's clean checkout: finished|2d|7d|never (instance operator)
+  toolroll storage cleanup <when>    remove a finished task's clean folder: finished|2d|7d|never (instance operator)
+  toolroll storage cleanup idle <days>
+                                     remove an idle task's clean folder: 7|14|30|never (instance operator)
   toolroll storage discard <path> --yes   throw away a checkout kept for its changes; its branch stays
   toolroll integrations [--json]     which integrations work: Connected, Not set up or Broken, and what to do (--saved: no new checks)
   toolroll monitoring                where the audit stream and traces go, and how each destination is doing
@@ -685,10 +714,10 @@ Exit codes
  * (surface.ts) is tested for exact equality against them.
  */
 export const TASK_ACTIONS = [
-    "add", "list", "show", "wait", "state", "block", "unblock", "next", "steer", "pause", "continue", "assign",
+    "add", "new", "keep", "list", "show", "wait", "state", "block", "unblock", "next", "steer", "pause", "continue", "assign",
     "reopen", "scope", "approve", "hold", "unhold", "require", "requeue", "regate", "plan",
     "review", "accept", "repair", "route", "stop", "resume", "complete", "revise", "merge", "ask",
-    "checks", "add-tests", "archive", "restore", "tidy", "ship",
+    "checks", "add-tests", "archive", "restore", "tidy", "ship", "ready",
 ];
 export const PUBLISH_ACTIONS = ["setup", "grant", "revoke", "status", "unblock", "rearm", "merge", "refire"];
 export const CONFIG_ACTIONS = ["show", "set", "clear"];
@@ -703,11 +732,11 @@ export const KEYS_ACTIONS = ["status", "set", "clear", "verify", "auth"];
 /** Flags whose value is a secret someone types or pastes: taken as the next argument even when it starts with "--". */
 export const SECRET_VALUE_FLAGS = new Set(["token", "password"]);
 export const OPERATE_VALUE_FLAGS = new Set([
-    "key", "db", "runner", "ttl", "state", "on", "reason", "until", "id", "backend",
+    "key", "db", "runner", "ttl", "state", "on", "reason", "until", "id", "backend", "build", "from",
     "allow", "selector", "paths", "credentials", "repo", "token", "capacity",
     "goal", "not", "touches", "acceptance", "candidate", "by", "digest", "as", "branch", "pool", "base", "model", "turns",
     "max", "cap", "probe", "kind", "expires", "cmd", "since", "repair-model",
-    "choose", "note", "max-open-decisions", "name", "days", "publication", "auto-approve", "review-auto", "port", "host", "allow-host",
+    "choose", "choice", "claim", "revision", "note", "max-open-decisions", "name", "days", "publication", "auto-approve", "review-auto", "port", "host", "allow-host",
     "for", "tick-every", "bridge-every", "reconcile-every", "incarnation",
     "say", "ceiling-usd", "cap-usd",
     // evals: the cases a diagnostic campaign runs, its k, an attempt's world and what its builds may not read, and the
@@ -751,8 +780,14 @@ export const OPERATE_VALUE_FLAGS = new Set([
     "read-deny", "mach",
     // task scope --release <version>:<pr>:<branch>: a release scope's terms (release-once.md).
     "release",
+    // task accept --despite "<reason>": acceptance with a reason, never a completion.
+    "despite",
 ]);
 export const OPERATE_BOOLEAN_FLAGS = new Set([
+    // task accept --finish: the person's Accept, exactly task complete's exact-receipt completion.
+    "finish",
+    // task new --preview: the terminal UI's own, the exact terms with nothing started.
+    "preview",
     // evals run: a report-only campaign; keep each attempt's world for a look afterwards.
     "diagnostic", "keep",
     // task scope --release ... --no-carry: every later commit asks again.
@@ -844,6 +879,9 @@ export function parseOperateArgs(argv, ownValues = new Set()) {
 }
 /** Route a native command and return its exit code. Its password source cannot be selected by an HTTP request. */
 export async function runOperate(command, argv, write, options = {}) {
+    // People's names for task commands (task-aliases.ts) are the commands they name, before any rule reads the command.
+    if (command === "task")
+        argv = withTaskAlias(["task", ...argv]).slice(1);
     // Each command gets its own remembered-login holder (Passwordless: "cli-login" is this command's, never the next one's).
     return withPasswordSource(CLI_PASSWORD_SOURCE, () => rememberedLogin.run({ login: null }, () => runOperateLocal(command, argv, write, options)));
 }
@@ -1059,6 +1097,8 @@ export async function runOperateAs(argv, opts) {
     const source = opts.source === "mcp" ? "mcp" : "api";
     const options = opts.options ?? {};
     const now = options.now ?? new Date();
+    // People's names for task commands are the commands they name, before the remote policy reads the command.
+    argv = [...withTaskAlias(argv)];
     const [root = "", ...rest] = argv;
     const json = rest.includes("--json");
     let invocation = root;
@@ -1215,6 +1255,9 @@ async function dispatch(command, positional, flags, context) {
     switch (command) {
         case "status":
             return statusCommand(positional, flags, context);
+        // `toolroll release approve` (cli.ts routes only this verb here; every other `release` form is release-cli.ts).
+        case "release":
+            return releaseApproveCommand(positional, flags, context);
         case "evals":
             return evalsCommand(positional, flags, context);
         case "ready":
@@ -1299,6 +1342,8 @@ async function dispatch(command, positional, flags, context) {
             const verified = acting === null || lead ? null : authenticateApprover(context.store, acting.name, acting.token, repo === undefined ? null : resolve(repo));
             return runKnowledgeApply(flags, { ...context, now: context.clock(), actor: verified !== null && verified.ok ? acting.name : null });
         }
+        case "map":
+            return mapCommand(positional, flags, context);
         case "models": {
             // A local owner's lowering act (models turn-off / dismiss, through the terminal UI) asks for no credential: the
             // rule door re-checks the owner and its exact act itself.
@@ -1319,10 +1364,13 @@ async function dispatch(command, positional, flags, context) {
             const acting = await askCredentials(flags, context);
             if (memoryWriteVerb(positional) && acting !== null && parseLeadToken(acting.token) !== null)
                 return fail(context.write, context.json, `memory ${positional[0]}`, "unauthenticated", MEMORY_WRITE_REFUSAL, EXIT.refused);
-            const verified = acting === null ? null : verifyApproverByPassword(context.store, acting.name, acting.token, context.store.knownRepos().filter(repo => context.store.accountCanAccess(acting.name, repo)));
-            const who = verified !== null && verified.ok ? verified.who : null;
+            // The laptop's local owner: only the rows LOCAL_ALLOW names reach here, and each writer checks the exact act.
+            const verified = acting === null || currentLocalOwner() !== null ? null : verifyApproverByPassword(context.store, acting.name, acting.token, context.store.knownRepos().filter(repo => context.store.accountCanAccess(acting.name, repo)));
+            const who = currentLocalOwner() !== null ? localReader(context) : verified !== null && verified.ok ? verified.who : null;
             return runMemoryCommand(positional, flags, { store: context.store, write: context.write, json: context.json, now: context.clock(), actor: who?.name ?? null, repos: who?.repos ?? [], configDir: dirname(context.databaseFile), ...(context.evidenceRoot === undefined ? {} : { evidenceRoot: context.evidenceRoot }) });
         }
+        case "flaky":
+            return flakyCommand(positional, flags, context);
         case "claim":
             return claimCommand(positional, flags, context);
         case "heartbeat":
@@ -1758,7 +1806,7 @@ async function runnerCommand(positional, flags, context) {
         // at the mint. A caller flag never grants what the mint did not.
         const acting = await askCredentials(flags, context);
         if (acting === null) {
-            return fail(write, json, "runner register", "usage", "`runner register <name> --repo <path> --as <you> --token <t>` — minting runner authority is an operator act", EXIT.usage);
+            return fail(write, json, "runner register", "usage", "`runner register <name> --repo <path> --as <you> --token <t>` — adding a builder is an approver's act", EXIT.usage);
         }
         const authenticated = credentialApprover(store, acting.name, acting.token);
         if (!authenticated.ok)
@@ -1858,7 +1906,7 @@ async function runnerCommand(positional, flags, context) {
         const acting = await askCredentials(flags, context);
         const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
         if (acting === null || !verified?.ok)
-            return refuseApprover(context, "runner retire", verified, "`runner retire <name> --as <you> --token <t>` — revoking runner authority is an operator act", name);
+            return refuseApprover(context, "runner retire", verified, "`runner retire <name> --as <you> --token <t>` — retiring a builder is an approver's act", name);
         const retired = store.retireRunner(name, now, mutationFrom(flags, now));
         if (!retired)
             return fail(write, json, "runner retire", "unknown", `no runner \`${name}\``, EXIT.refused);
@@ -1874,7 +1922,7 @@ async function runnerCommand(positional, flags, context) {
         // stated authority, never accumulation nobody can read back.
         const acting = await askCredentials(flags, context);
         if (acting === null) {
-            return fail(write, json, "runner bind", "usage", "`runner bind <name> --repo <path> --as <you> --token <t>` — binding repositories is an operator act", EXIT.usage);
+            return fail(write, json, "runner bind", "usage", "`runner bind <name> --repo <path> --as <you> --token <t>` — choosing a builder's projects is an approver's act", EXIT.usage);
         }
         const authenticated = credentialApprover(store, acting.name, acting.token);
         if (!authenticated.ok)
@@ -1954,7 +2002,7 @@ async function coordinatorCommand(positional, flags, context) {
         }
         const acting = await askCredentials(flags, context);
         if (acting === null) {
-            return fail(write, json, "coordinator mint", "usage", "`coordinator mint <name> --repo <path> --as <you> --token <t>` — minting filing authority is an operator act", EXIT.usage);
+            return fail(write, json, "coordinator mint", "usage", "`coordinator mint <name> --repo <path> --as <you> --token <t>` — minting your lead's credential is an approver's act", EXIT.usage);
         }
         const authenticated = credentialApprover(store, acting.name, acting.token);
         if (!authenticated.ok)
@@ -2001,7 +2049,7 @@ async function coordinatorCommand(positional, flags, context) {
         const acting = await askCredentials(flags, context);
         const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
         if (acting === null || !verified?.ok)
-            return refuseApprover(context, "coordinator revoke", verified, "`coordinator revoke <cid> --as <you> --token <t>` — revoking is an operator act", name);
+            return refuseApprover(context, "coordinator revoke", verified, "`coordinator revoke <cid> --as <you> --token <t>` — revoking is an approver's act", name);
         const revoked = revokeCoordinator(store, name, acting.name, now);
         if (!revoked.ok) {
             const said = revoked.reason === "unknown" ? `no coordinator \`${name}\` — \`coordinator list\` shows cids` : "already revoked";
@@ -3576,7 +3624,16 @@ async function reconcileCommand(flags, context) {
     // A witness reserved for a spawn that never made a process (a crash or a
     // thrown spawn) settles once its run's process groups are proven gone.
     store.settleUnspawnedWitnesses(clock());
+    // What no record proves stopped, Toolroll proves itself from this computer's processes (stop-proof.ts): nobody is
+    // asked to confirm a build stopped, so a release waiting on its check moves on by itself.
+    await proveFinishedRunsStopped(store, clock);
     store.settleQuiescentStops(clock());
+    // A vanished build whose old process is now proven stopped gets its retry decision (vanished-retry.ts).
+    retryVanishedWhenStopped(store, clock());
+    // A fast start that didn't start in time goes back to the ordinary Approve plan (fast-start.ts).
+    expireFastStarts(store, clock());
+    // A plan from before agent routing gets its route and one Approve (route-change.ts).
+    routeLegacyPlans(store, clock());
     // An update whose updater ended while letting work finish must not leave new work paused.
     try {
         releaseStalledUpdate(dirname(context.databaseFile), clock());
@@ -6457,6 +6514,11 @@ async function runWatchLoop(args) {
             const batched = await runBatchChecks(store, context.evidenceRoot, { now: context.clock, shouldStop: stopping });
             if (batched > 0)
                 progress(`watch: settled ${batched} batch-checked result(s)`);
+            // A held release a person let go on resumes by itself, in the background of this pass (release-next.ts).
+            if (context.agentRunner === undefined)
+                void resumeHeldReleases(store, dirname(context.databaseFile), context.clock());
+            // A result whose verdict went missing asks for its one automatic recheck (check-only.ts).
+            requestMissingRechecks(store, context.evidenceRoot, context.clock());
             const ran = await runWaitingChecks(store, context.evidenceRoot, { now: context.clock, shouldStop: stopping });
             if (ran > 0)
                 progress(`watch: ran ${ran} follow-up check(s)`);
@@ -6469,11 +6531,27 @@ async function runWatchLoop(args) {
             // all. A test's injected agent runner means a test: no real gh.
             if (context.agentRunner === undefined)
                 await refreshGithubNightlies(store, context.clock);
+            // The flaky tests list's GitHub rows (flaky-ci.ts): read-only, each project at most every 30 minutes.
+            if (context.agentRunner === undefined)
+                await refreshLearning(store, context.clock);
             // A finished check may send a build's card down its failure path: now, not on the next beat.
             if (ran + batched > 0)
                 moveCards(store, repo, context.clock(), context.evidenceRoot);
         },
     });
+    // The code map (docs/plans/code-map.md §2): its own beat, so a slow remote holds nothing else. A test's injected agent
+    // runner means a test: no real fetch.
+    const codeMapChecks = startMaintenance({
+        intervalMs: 60_000,
+        shouldStop: stopping,
+        onError: error => progress(`watch: a code map check failed — ${describe(error)}; it tries again`),
+        run: async () => {
+            if (store.isDemo() || context.agentRunner !== undefined)
+                return;
+            await refreshCodeMaps(store, { scratch: join(context.evidenceRoot, ".code-map"), clock: context.clock });
+            sweepDeliveries(store);
+        },
+    });
     // Flows on their own cadence (flow-cadence.ts), not between builds: while builds hold every slot of this
     // project, a card whose step finished still moves within one beat. Moves run apart from triggers, replies
     // and steps, so a long check script doesn't hold them either. Neither starts a build: a card entering a
@@ -6753,6 +6831,7 @@ async function runWatchLoop(args) {
         await Promise.all(lanes);
         await maintenance.stop();
         await followUpChecks.stop();
+        await codeMapChecks.stop();
         await flowMoves.stop();
         await flowSteps.stop();
         await modelWatch.stop();
@@ -7427,6 +7506,8 @@ async function upCommand(flags, context) {
                     retireRunnerIfCurrent(store, runnerName, runnerToken, clock());
                     return fail(write, json, "up", "runner-alive", "The worker process record could not be saved; nothing started", EXIT.refused);
                 }
+                // What a person asked for, and what ran: an automatic restart acts on exactly this (builder-restart.ts).
+                recordBuilderWish(store, "running", "up", packageVersion(), clock());
                 doorAnswer = answer;
                 break;
             }
@@ -8599,6 +8680,9 @@ async function statusCommand(positional, flags, context) {
     // This installation's console and background service (easy-start D), beside its updates and integrations: a person
     // limited to some projects returned above without it; an all-project caller reads what a local one does.
     const laptop = { laptop: await laptopStatus(context.store, context.databaseFile, context.laptopSeams) };
+    // Nothing else on this computer is left to notice a builder that died: a look at status brings it back when it may.
+    if (!laptop.laptop.running && laptop.laptop.background === "on" && !machineActing())
+        await restartOwnBuilder(context.store, context.databaseFile, context.laptopSeams, context.clock()).catch(() => null);
     return succeed(context.write, context.json, command, { ...status, projects, ...laptop, ...update, ...integrations, ...updateWaiting, ...unsentReplies, ...(legacyWebhookWarning === null ? {} : { legacyWebhookWarning }) }, () => [...(waiting === null ? [] : [waiting.words]), ...(unsentLine === null ? [] : [unsentLine]), ...renderInstallationStatus(status), ...(projectsLine === null ? [] : [projectsLine]), ...(line === null ? [] : [line]), ...(brokenLine === null ? [] : [brokenLine]), ...(legacyWebhookWarning === null ? [] : [legacyWebhookWarning])]);
 }
 function unsentRepliesLine(unsent) {
@@ -8743,10 +8827,16 @@ function taskAction(action, rest, flags, context) {
                 demo: context.store.isDemo(), credentials: () => askCredentials(flags, context), ...(context.publishExec === undefined ? {} : { exec: context.publishExec }) });
         case "add":
             return addTask(rest, flags, context);
+        case "new":
+            return newTaskCommand(rest, flags, context);
+        case "keep":
+            return keepGrownCommand(rest, flags, context);
         case "checks":
             return runTaskChecks(rest, flags, context);
         case "ship":
             return taskShipCommand(rest, context);
+        case "ready":
+            return taskReadyCommand(rest, context);
         case "add-tests":
             return addTestsTask(rest, flags, context);
         case "list":
@@ -9323,8 +9413,8 @@ function showTask(positional, context) {
         ...(task.state !== "done" || detail.proofVerdict === null
             ? []
             : [
-                `  proof: ${proofVerdictWords(current?.receipt?.runId === latestFinished?.id ? current?.readiness?.verdict ?? detail.proofVerdict : detail.proofVerdict, detail.proofReasons).word}${detail.proofAccepted ? " (accepted)" : ""}`,
-                ...(detail.proofReasons.length > 0 ? [`    ${detail.proofReasons.join("; ")}`] : []),
+                `  checked: ${proofVerdictWords(current?.receipt?.runId === latestFinished?.id ? current?.readiness?.verdict ?? detail.proofVerdict : detail.proofVerdict, detail.proofReasons).word}${detail.proofAccepted ? " (accepted)" : ""}`,
+                ...(detail.proofReasons.length > 0 ? [`    ${detail.proofReasons.map(plainReasonWords).join(" ")}`] : []),
                 ...matrixWords(detail.proofMatrix),
                 ...(detail.semanticCoverage === null ? [] : coverageWords(detail.semanticCoverage).map(line => `  ${line}`)),
             ]),
@@ -9332,11 +9422,11 @@ function showTask(positional, context) {
             ? []
             : detail.report.ok
                 ? [
-                    `  report: ${detail.report.report.title} (run ${detail.report.run})`,
+                    `  report: ${detail.report.report.title} (build #${detail.report.run})`,
                     `    ${detail.report.report.summary}`,
                     ...detail.report.report.followUps.map((one, index) => `    follow-up ${index + 1}: ${one.title}`),
                 ]
-                : [`  report: ${detail.report.problem} (run ${detail.report.run})`]),
+                : [`  report: ${detail.report.problem} (build #${detail.report.run})`]),
         ...pullRequestLines(detail.pullRequest),
         ...(base === null ? [] : [`  base: ${baseStandingWords(base)}`]),
         ...(detail.blockedBy.length > 0 ? [`  waits for ${detail.blockedBy.join(", ")}`] : []),
@@ -9369,7 +9459,7 @@ function showTask(positional, context) {
         ...detail.runs
             .filter(one => one.route !== null)
             .slice(0, 8)
-            .map(one => `  run #${one.id}  ${one.role.padEnd(8)} ${one.route.provider}${one.route.model === null ? "" : ` · ${one.route.model}`}  [${one.route.chosen}] route ${one.route.routeDigest}`),
+            .map(one => `  build #${one.id}  ${one.role.padEnd(8)} ${one.route.provider}${one.route.model === null ? "" : ` · ${one.route.model}`}  [${one.route.chosen}]`),
     ]);
 }
 /** The review status lines `task show` prints (v50): the state word, the
@@ -9409,47 +9499,72 @@ function taskRouteStandingLines(id, routed) {
     if (routed === null)
         return [];
     if (routed.kind === "route") {
-        return [`  agents       ${routed.source === "approved" ? "sealed by the approval — configuration changes cannot reroute it" : routed.source === "proposed" ? "proposed — the next approval seals them" : "recommended live — no scope filed yet"}`];
+        return [`  agents       ${routed.source === "approved" ? "approved with the plan — a configuration change never moves them" : routed.source === "proposed" ? "proposed — approving the plan approves them" : "recommended now — no plan filed yet"}`];
     }
     if (routed.kind === "legacy") {
         return [`  agents       approved before agent routing existed — ${routed.profile.provider} · ${routed.profile.model} builds and repairs (repair model ${routed.profile.repairModel === "inherit" ? routed.profile.model : routed.profile.repairModel}); the planner and reviewer resolve from configuration at run time`];
     }
-    return [`  agents       UNREADABLE — ${routed.problem}`, `               nothing runs for ${id} until its scope is re-filed and approved again`];
+    return [`  agents       UNREADABLE — ${routed.problem}`, `               nothing runs for ${id} until its plan is saved again and approved`];
 }
 /**
- * `task accept <id>` (Priority 2): the operator's explicit acceptance of a
- * short or refuted proof verdict — the one act that lets the task read
- * done despite incomplete evidence. Credentialed like approving a scope:
- * accepting bad news is still authority.
+ * `task accept <id>`: every call names what it means (docs/plans/plain-toolroll.md P1.1), so the same words never
+ * quietly start meaning something else.
+ * - `--finish` or `--digest <receipt>` is the person's Accept: exactly `task complete`'s exact-receipt completion, with
+ *   the same rule that `--json` and scoped credentials must pass `--digest`.
+ * - `--despite "<reason>"` (`--note` is its alias) is acceptance only: an explicit acceptance of a short or refuted
+ *   result with a reason, credentialed like approving a plan. It never completes, and never combines with the above.
+ * - A bare `task accept <id>` refuses, for good, naming both.
  */
 async function acceptTaskProof(positional, flags, context) {
     const { store, write, json, now } = context;
+    const finishing = flags.has("finish") || flags.has("digest");
+    const despiteFlag = flags.has("despite") ? flags.get("despite") : flags.get("note");
+    const despiting = flags.has("despite") || flags.has("note");
+    if (flags.has("despite") && flags.has("note"))
+        return fail(write, json, "task accept", "usage", "Use --despite \"<reason>\" once (--note is the same flag).", EXIT.usage);
+    if (finishing && despiting) {
+        return fail(write, json, "task accept", "usage", "--despite accepts a result with a reason and never finishes the task; --finish and --digest finish it. Use one: first accept with --despite, then finish with --finish.", EXIT.usage);
+    }
+    if (!finishing && !despiting) {
+        return fail(write, json, "task accept", "usage", "Say what accepting means: `toolroll task accept <id> --finish` accepts the result and finishes the task, or `--despite \"<reason>\"` accepts it with a reason without finishing.", EXIT.usage);
+    }
+    if (finishing) {
+        // The person's Accept: `task complete`, unchanged, under this command's name.
+        if (flags.get("finish") !== undefined && flags.get("finish") !== true)
+            return fail(write, json, "task accept", "usage", "--finish takes no value.", EXIT.usage);
+        const rest = new Map(flags);
+        rest.delete("finish");
+        return runTaskOutcomeCommand("complete", positional, rest, { ...context, command: "task accept", operator: async () => {
+                const acting = await askCredentials(flags, context);
+                if (acting === null)
+                    return null;
+                const authenticated = verifyApproverByPassword(context.store, acting.name, acting.token, context.store.knownRepos().filter(repo => context.store.accountCanAccess(acting.name, repo)));
+                return authenticated.ok ? authenticated.who : null;
+            } });
+    }
     const id = positional[0];
     if (id === undefined)
-        return fail(write, json, "task accept", "usage", "`toolroll task accept <id> [--note <text>] --as <you> --token <t>`", EXIT.usage);
+        return fail(write, json, "task accept", "usage", "`toolroll task accept <id> --despite \"<reason>\" --as <you> --token <t>`", EXIT.usage);
+    if (typeof despiteFlag !== "string" || despiteFlag.trim() === "")
+        return fail(write, json, "task accept", "usage", "--despite needs the reason you accept it anyway: `--despite \"<reason>\"`.", EXIT.usage);
+    const validated = validateNote(despiteFlag);
+    if (!validated.ok)
+        return fail(write, json, "task accept", "invalid", validated.problem, EXIT.usage);
     const task = store.getTask(id);
     if (task === null)
         return fail(write, json, "task accept", "unknown-task", `no task \`${id}\``, EXIT.refused);
     const acting = await askCredentials(flags, context);
     const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
     if (acting === null || !verified?.ok)
-        return refuseApprover(context, "task accept", verified, "accepting incomplete proof is a person's act — it takes `--as <you> --token <t>`", id);
+        return refuseApprover(context, "task accept", verified, "accepting a result with a reason is a person's act — it takes `--as <you> --token <t>`", id);
     const ref = store.refFor(BUILT_IN, id);
     // v40 fix: a reviewer run is never the attempt whose proof is accepted.
     const latest = store.runsFor(ref.id).find(one => one.finishedAt !== null && (one.role === "builder" || one.role === "scout"));
     if (latest === undefined)
         return fail(write, json, "task accept", "no-run", `${id} has no finished attempt to accept`, EXIT.refused);
-    const rawNote = text(flags, "note");
-    let note = null;
-    if (rawNote !== undefined && rawNote.trim() !== "") {
-        const validated = validateNote(rawNote);
-        if (!validated.ok)
-            return fail(write, json, "task accept", "invalid", validated.problem, EXIT.usage);
-        note = validated.note;
-    }
-    store.acceptProof(latest.id, acting.name, note, now);
+    store.acceptProof(latest.id, acting.name, validated.note, now);
     return succeed(write, json, "task accept", { id, run: latest.id, acceptedBy: acting.name }, () => [
-        `Accepted: ${id}'s build #${latest.id} reads done despite its proof, on ${acting.name}'s say-so.`,
+        `Accepted ${id}'s build #${latest.id} with your reason, ${acting.name}. It isn't finished: \`toolroll task accept ${id} --finish\` finishes it.`,
     ]);
 }
 /**
@@ -9721,7 +9836,7 @@ async function pauseTask(positional, flags, context) {
         return fail(write, json, "task pause", "usage", "`toolroll task pause <id> [--run <run-id>] --as <you> --token <t>`", EXIT.usage);
     const acting = await askCredentials(flags, context);
     if (acting === null)
-        return fail(write, json, "task pause", "usage", "pausing takes `--as <you> --token <t>` — it is an operator's act and is recorded against your name", EXIT.usage);
+        return fail(write, json, "task pause", "usage", "pausing takes `--as <you> --token <t>` — it is an approver's act and is recorded against your name", EXIT.usage);
     const authed = authenticateApprover(store, acting.name, acting.token);
     if (!authed.ok)
         return fail(write, json, "task pause", "not-an-approver", "that is not an approver, or the token does not match", EXIT.refused);
@@ -9739,7 +9854,7 @@ async function continueTask(positional, flags, context) {
         return fail(write, json, "task continue", "usage", "`toolroll task continue <id> [--run <run-id>] --as <you> --token <t>`", EXIT.usage);
     const acting = await askCredentials(flags, context);
     if (acting === null)
-        return fail(write, json, "task continue", "usage", "resuming takes `--as <you> --token <t>` — it is an operator's act and is recorded against your name", EXIT.usage);
+        return fail(write, json, "task continue", "usage", "resuming takes `--as <you> --token <t>` — it is an approver's act and is recorded against your name", EXIT.usage);
     const authed = authenticateApprover(store, acting.name, acting.token);
     if (!authed.ok)
         return fail(write, json, "task continue", "not-an-approver", "that is not an approver, or the token does not match", EXIT.refused);
@@ -10274,6 +10389,11 @@ async function approveTask(positional, flags, context) {
         interactive() && !json) {
         write(`Approving lets a builder work on ${id}, within exactly this:`);
         write("");
+        const changed = routeChangeOf(store, id);
+        if (changed !== null) {
+            write(changed);
+            write("");
+        }
         for (const line of describeScope(scope))
             write(line);
         for (const line of planContractLines(store, context.evidenceRoot, id))
@@ -10301,6 +10421,11 @@ async function approveTask(positional, flags, context) {
         }
         write(`Would approve this, and let a builder work on ${id}:`);
         write("");
+        const changed = routeChangeOf(store, id);
+        if (changed !== null) {
+            write(changed);
+            write("");
+        }
         for (const line of describeScope(scope))
             write(line);
         for (const line of planContractLines(store, context.evidenceRoot, id))
@@ -10737,7 +10862,7 @@ async function stopTaskCommand(positional, flags, context) {
     const acting = await askCredentials(flags, context);
     const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
     if (acting === null || !verified?.ok)
-        return refuseApprover(context, "task stop", verified, "stopping takes `--as <you> --token <t>` — it is an operator's act and is recorded against your name", id);
+        return refuseApprover(context, "task stop", verified, "stopping takes `--as <you> --token <t>` — it is an approver's act and is recorded against your name", id);
     const asked = requestTaskStop(store, { taskId: id, runId, by: acting.name, via: "cli" }, clock());
     if (!asked.ok)
         return fail(write, json, "task stop", asked.reason, asked.detail, EXIT.refused, { run: runId });
@@ -10790,43 +10915,47 @@ async function resumeTaskCommand(positional, flags, context) {
     ]);
 }
 /**
- * `toolroll run settle <id> --why "<text>" --as <you> --token <t>`: an
- * approver's last resort for a finished run whose process witnesses can be
- * proven neither exited nor alive (a spawn interrupted before its pid was
- * written). Refuses while anything of the run is alive; the reason is kept
- * in the ledger against the approver's name. Signals nothing.
+ * `toolroll run settle <id> --as <you> --token <t>`: have Toolroll check again whether a finished run stopped. Nobody
+ * vouches that a build stopped (a person can't see whether a process exited): this runs Toolroll's own look at this
+ * computer's processes (stop-proof.ts), the one the worker makes on its own, and settles the run when none of them is
+ * the run's. A leftover proven the run's is stopped; anything else is left alone. `--why` is still accepted from older
+ * scripts and ignored.
  */
 async function runCommand(positional, flags, context) {
     const { store, write, json, clock } = context;
     const [action, id, ...extra] = positional;
     const command = "run settle";
-    const usage = "`toolroll run settle <run-id> --why \"<reason>\" --as <you> --token <t>`";
+    const usage = "`toolroll run settle <run-id>`";
     if (action !== "settle")
         return fail(write, json, "run", "usage", usage, EXIT.usage);
     const runId = Number(id ?? "");
-    const why = text(flags, "why")?.trim();
     if (id === undefined || extra.length > 0 || !/^[1-9]\d*$/.test(id) || !Number.isSafeInteger(runId))
         return fail(write, json, command, "usage", usage, EXIT.usage);
-    if (why === undefined || why === "" || why.length > 300 || /[\x00-\x1f\x7f]/.test(why))
-        return fail(write, json, command, "usage", "say why in one line with --why (at most 300 characters) — it is kept in the ledger", EXIT.usage);
     const run = store.getRun(runId);
     if (run === null)
         return fail(write, json, command, "unknown-run", `no run #${runId}`, EXIT.refused);
     const acting = await askCredentials(flags, context);
     if (acting === null)
-        return fail(write, json, command, "usage", "settling takes `--as <you> --token <t>` — it is an approver's act and is recorded against your name", EXIT.usage);
+        return fail(write, json, command, "usage", "checking a run again takes `--as <you> --token <t>` (or your sign-in from `toolroll up`)", EXIT.usage);
     const authenticated = authenticateApprover(store, acting.name, acting.token);
     const repo = store.refById(run.taskRef)?.repo ?? null;
     if (!authenticated.ok || !store.accountCanAccess(acting.name, repo))
         return fail(write, json, command, "not-an-approver", "that is not an approver for this run's project, or the token does not match", EXIT.refused);
-    const settled = store.settleRunWitnessesByApprover({ runId, by: acting.name, why }, clock());
-    if (!settled.ok)
-        return fail(write, json, command, settled.reason, settled.detail, EXIT.refused, { run: runId });
-    return succeed(write, json, command, { run: runId, witnesses: settled.witnesses, repeated: settled.repeated }, () => [
-        settled.repeated
-            ? `Run #${runId} has no unsettled process witness; nothing changed.`
-            : `Settled run #${runId}: ${settled.witnesses.length} process witness${settled.witnesses.length === 1 ? "" : "es"} recorded as ended, with your reason in the ledger.`,
-    ]);
+    if (run.outcome === null)
+        return fail(write, json, command, "still-running", `run #${runId} is still open`, EXIT.refused, { run: runId });
+    const proved = await proveRunStopped(store, runId, clock);
+    const stopped = store.stopQuiescenceFact(runId);
+    if (stopped === null) {
+        return succeed(write, json, command, { run: runId, outcome: proved.outcome === "skipped" ? "already-stopped" : "stopped", stoppedProcesses: proved.stopped ?? 0 }, () => [
+            proved.outcome === "skipped" ? `Run #${runId} had already stopped; nothing changed.`
+                : `Run #${runId} stopped: Toolroll checked this computer's processes and none of them is the run's${proved.stopped ? ` (it stopped ${proved.stopped} the run left running)` : ""}. The check is in the ledger.`,
+        ]);
+    }
+    const reason = proved.outcome === "blocked" ? "unproven" : stopped.kind === "alive" ? "alive" : "waiting";
+    const words = proved.outcome === "blocked" ? `Run #${proved.run} ${proved.words}.`
+        : stopped.kind === "alive" ? `Something of run #${stopped.run} is still running; Toolroll stops what is proven the run's on its own.`
+            : `Toolroll is still making sure run #${stopped.run} stopped. This clears on its own.`;
+    return fail(write, json, command, reason, words, EXIT.refused, { run: runId });
 }
 // ---- shared ---------------------------------------------------------------
 /**
@@ -11422,9 +11551,11 @@ async function storageCommand(positional, flags, context) {
     };
     const refused = (what) => fail(context.write, context.json, command, "refused", `An instance operator ${what}: pass --as and --token (or use the remembered login).`, EXIT.refused);
     const summary = (plan) => [
-        `Checkouts: ${plan.count}, ${bytesWords(plan.totalBytes)}. ${plan.waitingReview} waiting for review, ${plan.withChanges} kept because they have changes.`,
-        plan.go.length === 0 ? "A clean up now would free nothing." : `A clean up now would free about ${bytesWords(plan.freeBytes)} (${plan.go.length} checkout${plan.go.length === 1 ? "" : "s"}): toolroll storage clean`,
-        `A finished task's clean checkout is removed ${cleanupWords(plan.cleanup)}; its branch stays.`,
+        `Task folders: ${plan.count}, ${bytesWords(plan.totalBytes)}. ${plan.waitingReview} waiting for review, ${plan.withChanges} with uncommitted changes.`,
+        plan.go.length === 0 ? "A clean up now would free nothing." : `A clean up now would free about ${bytesWords(plan.freeBytes)} (${plan.go.length} task folder${plan.go.length === 1 ? "" : "s"}): toolroll storage clean`,
+        `A finished task's clean folder is removed ${cleanupWords(plan.cleanup)}; its branch stays.`,
+        idleCleanupWords(plan),
+        ...uncommittedLines(plan),
     ];
     const itemLine = (one) => `  ${bytesWords(one.bytes).padStart(8)}  ${one.path}${one.why === null ? "" : `  (${whyWords(one)})`}`;
     // Test temp folders the tests, journeys and scripts left (a killed run, an older version): those nothing touched for a day go.
@@ -11477,16 +11608,28 @@ async function storageCommand(positional, flags, context) {
     if (action === "cleanup") {
         if (rest.length === 0) {
             const cleanup = store.checkoutCleanup();
-            return succeed(context.write, context.json, command, { cleanup }, () => [`A finished task's clean checkout is removed ${cleanupWords(cleanup)}; its branch stays.`]);
+            const idle = checkoutIdle(store);
+            return succeed(context.write, context.json, command, { cleanup, idle }, () => [`A finished task's clean folder is removed ${cleanupWords(cleanup)}; its branch stays.`, `A task's clean folder is removed ${idleWords(idle)}; its branch stays.`]);
+        }
+        const usage = `Use storage cleanup <${CLEANUP_CHOICES.map(one => one.value).join("|")}> or storage cleanup idle <7|14|30|never>.`;
+        if (rest[0] === "idle") {
+            const idle = rest.length === 2 ? parseIdle(rest[1]) : undefined;
+            if (idle === undefined)
+                return fail(context.write, context.json, command, "usage", usage, EXIT.usage);
+            const actor = await operator();
+            if (actor === null)
+                return refused("sets idle cleanup");
+            const saved = setCheckoutIdle(store, idle, actor, context.clock());
+            return succeed(context.write, context.json, command, { idle: saved }, () => [`Saved. A task's clean folder is removed ${idleWords(saved)}; its branch stays.`]);
         }
         const cleanup = rest.length === 1 ? parseCleanup(rest[0]) : undefined;
         if (cleanup === undefined)
-            return fail(context.write, context.json, command, "usage", `Use storage cleanup <${CLEANUP_CHOICES.map(one => one.value).join("|")}>.`, EXIT.usage);
+            return fail(context.write, context.json, command, "usage", usage, EXIT.usage);
         const actor = await operator();
         if (actor === null)
             return refused("sets checkout cleanup");
         const saved = store.setCheckoutCleanup(cleanup, actor, context.clock());
-        return succeed(context.write, context.json, command, { cleanup: saved }, () => [`Saved. A finished task's clean checkout is removed ${cleanupWords(saved)}; its branch stays.`]);
+        return succeed(context.write, context.json, command, { cleanup: saved }, () => [`Saved. A finished task's clean folder is removed ${cleanupWords(saved)}; its branch stays.`]);
     }
     if (action === "clean" && flags.has("landed")) {
         if (rest.length > 0 || flags.get("landed") !== true)
@@ -11506,7 +11649,7 @@ async function storageCommand(positional, flags, context) {
             const sharedBytes = sharedGo.reduce((sum, one) => sum + one.bytes, 0);
             const anything = plan.go.length > 0 || temp.stale > 0 || sharedGo.length > 0;
             return succeed(context.write, context.json, command, { preview: true, go: plan.go, stay: plan.stay, freeBytes: plan.freeBytes, testTemp: temp, sharedGo, sharedFreeBytes: sharedBytes }, () => [
-                ...(plan.go.length === 0 ? [anything ? "No checkouts to clean up." : "Nothing to clean up."] : [`Would remove ${plan.go.length} checkout${plan.go.length === 1 ? "" : "s"}, freeing about ${bytesWords(plan.freeBytes)} (their branches stay):`, ...plan.go.map(itemLine)]),
+                ...(plan.go.length === 0 ? [anything ? "No task folders to clean up." : "Nothing to clean up."] : [`Would remove ${plan.go.length} task folder${plan.go.length === 1 ? "" : "s"}, freeing about ${bytesWords(plan.freeBytes)} (their branches stay):`, ...plan.go.map(itemLine)]),
                 ...(sharedGo.length === 0 ? [] : [`Would remove ${sharedGo.length} shared dependency install${sharedGo.length === 1 ? "" : "s"} no checkout uses, about ${bytesWords(sharedBytes)}:`, ...sharedGo.map(sharedLine)]),
                 ...(plan.stay.length === 0 ? [] : [`Stays (${plan.stay.length}):`, ...plan.stay.map(itemLine)]),
                 ...(temp.stale === 0 ? [] : [`Would remove ${temp.stale} test temp folder${temp.stale === 1 ? "" : "s"} older than a day, about ${bytesWords(temp.staleBytes)}.`]),
@@ -11541,7 +11684,7 @@ async function storageCommand(positional, flags, context) {
         ];
         saveSweep(store, { at: context.clock().toISOString(), source: "manual", actor, parts });
         return succeed(context.write, context.json, command, { removed: done.removed, kept: done.kept, freedBytes: done.freed, testTempRemoved: swept.removed.length, testTempFailed: swept.failed, sharedRemoved, sharedFreedBytes: sharedFreed }, () => [
-            done.removed.length === 0 ? (swept.removed.length === 0 && sharedRemoved.length === 0 ? "Nothing to clean up." : "No checkouts to clean up.") : `Removed ${done.removed.length} checkout${done.removed.length === 1 ? "" : "s"}, about ${bytesWords(done.freed)}; their branches stay.`,
+            done.removed.length === 0 ? (swept.removed.length === 0 && sharedRemoved.length === 0 ? "Nothing to clean up." : "No task folders to clean up.") : `Removed ${done.removed.length} task folder${done.removed.length === 1 ? "" : "s"}, about ${bytesWords(done.freed)}; their branches stay.`,
             ...done.removed.map(itemLine),
             ...(sharedRemoved.length === 0 ? [] : [`Removed ${sharedRemoved.length} shared dependency install${sharedRemoved.length === 1 ? "" : "s"} no checkout used, about ${bytesWords(sharedFreed)}.`, ...sharedRemoved.map(sharedLine)]),
             ...done.kept.map(one => `  kept ${one.path} (${whyWords({ why: one.why })})`),
@@ -11619,7 +11762,8 @@ async function landedCommandWith(remotes, yes, operator, refused, pool, context)
     ]);
 }
 function checkoutSummary(plan) {
-    return { count: plan.count, totalBytes: plan.totalBytes, waitingReview: plan.waitingReview, withChanges: plan.withChanges, cleanBytes: plan.freeBytes, cleanCount: plan.go.length, cleanup: plan.cleanup };
+    return { count: plan.count, totalBytes: plan.totalBytes, waitingReview: plan.waitingReview, withChanges: plan.withChanges, cleanBytes: plan.freeBytes, cleanCount: plan.go.length, cleanup: plan.cleanup,
+        idle: plan.idle, idleCount: plan.idleCount, idleBytes: plan.idleBytes, uncommitted: plan.stay.filter(one => one.why === "has changes").map(one => ({ path: one.path, taskId: one.taskId, bytes: one.bytes })) };
 }
 /** `review [show] | on | off --repo <path>`: the project's one automatic review
  * of finished builds. Changing it takes an approver of that project; the
@@ -13298,6 +13442,8 @@ async function backgroundCommand(positional, flags, context) {
         return succeed(write, json, command, off, () => [off.action === "already-off" ? "Toolroll wasn't set to run in the background." : "Toolroll no longer runs in the background. Start it with `toolroll` when you need it."]);
     }
     const on = await backgroundOn(context.store, context.databaseFile, port, seams);
+    if (on.ok)
+        recordBuilderWish(context.store, "running", "background on", packageVersion(), context.clock());
     if (!on.ok) {
         const code = ["agent", "conflict", "declined", "running-elsewhere", "unsupported", "console-unproven", "invalid-unit", "unreadable"].includes(on.reason) ? EXIT.refused : EXIT.failed;
         if (json) {
@@ -13461,8 +13607,332 @@ export function upLaptopPortCandidates(store, fromSeam) {
 }
 /** The memory verbs that change project memory (memory-cli.ts), and `propose`, which files the proposals a person then
  * applies: a person's act, never the lead's. The reads stay as they are. */
-const MEMORY_WRITE_VERBS = new Set(["decide", "retire", "apply", "propose"]);
+const MEMORY_WRITE_VERBS = new Set(["decide", "retire", "apply", "propose", "tidy", "restore", "unmerge"]);
 function memoryWriteVerb(positional) {
     return MEMORY_WRITE_VERBS.has(positional[0] ?? "");
 }
 const MEMORY_WRITE_REFUSAL = "Project memory is changed by a person with their own sign-in, not the lead. The lead proposes decisions in chat for you to confirm.";
+/**
+ * `toolroll release approve [<branch>] [--repo <path>]` (docs/plans/trusted-release-reports.md, slice A, A8): approve
+ * the release waiting for a person from this terminal, without copying a task id or a digest. The release journals are
+ * discovery only, read strictly; the plane's sealed release identity decides which release this is. The card prints
+ * control-free; the person is asked through `askCredentials` (or its remembered login, under its existing conditions);
+ * the card is built again AFTER that prompt and anything changed refuses; then the shared card wrapper hands the
+ * snapshot's scope digest to the unchanged approve(). `--json` never prompts.
+ */
+async function releaseApproveCommand(positional, flags, context) {
+    const { store, write, json } = context;
+    const command = "release approve";
+    const usage = "`toolroll release approve [<branch>] [--repo <path>]` (with --json: --as <you> --token <password> --digest <card digest>)";
+    const branchFlag = text(flags, "branch");
+    if (positional[0] !== "approve" || positional.length > 2 || (branchFlag !== undefined && positional.length > 1))
+        return fail(write, json, command, "usage", usage, EXIT.usage);
+    const branch = branchFlag ?? positional[1];
+    if (branch !== undefined && (!/^[A-Za-z0-9._/-]{1,255}$/.test(branch) || branch.startsWith("-") || branch.includes("..")))
+        return fail(write, json, command, "usage", `${branch} is not a branch name this command takes.`, EXIT.usage);
+    const repoFlag = text(flags, "repo");
+    const repo = repoFlag === undefined ? null : resolve(repoFlag);
+    const stateDir = dirname(context.databaseFile);
+    const { journals, unreadable } = waitingJournals(stateDir, name => journalFile(stateDir, name));
+    // The exact branch asked for, never another that shares its file name (feature/foo and feature_foo).
+    const named = branch === undefined ? journals : journals.filter(one => one.branch === branch);
+    if (branch !== undefined && named.length === 0 && unreadable.includes(basename(journalFile(stateDir, branch)))) {
+        return fail(write, json, command, "unreadable", `${branch}'s release journal can't be read as one; nothing was approved. Run \`toolroll release ${branch}\` again.`, EXIT.refused);
+    }
+    const matches = [], refusals = [];
+    for (const one of named) {
+        if (releaseTaskOf(store, one.taskId) !== null && approvalOf(store.getScope(one.taskId)).approved)
+            continue;
+        const proved = journalMatchesPlane(store, one, repo);
+        if (proved.ok)
+            matches.push(one);
+        else
+            refusals.push(proved.why);
+    }
+    if (matches.length === 0) {
+        const why = refusals.length > 0 ? `${refusals[0]}; nothing was approved` : branch === undefined ? "No release is waiting for your approval" : `No release of ${branch} is waiting for your approval`;
+        return fail(write, json, command, refusals.length > 0 ? "mismatch" : "none", `${why}.`, EXIT.refused);
+    }
+    if (matches.length > 1) {
+        return fail(write, json, command, "ambiguous", `More than one release is waiting: ${matches.map(one => `${one.branch} (${one.version})`).join(", ")}. Name the branch: \`toolroll release approve <branch>\`.`, EXIT.refused, { releases: matches.map(one => ({ branch: one.branch, version: one.version, task: one.taskId })) });
+    }
+    const chosen = matches[0];
+    const built = releaseApprovalCard(store, chosen.taskId);
+    if (!built.ok)
+        return fail(write, json, command, "none", built.why, EXIT.refused);
+    const shown = built.card;
+    const cardData = { task: shown.taskId, version: shown.seal.identity.packageVersion, branch: shown.seal.identity.branch, candidate: shown.seal.identity.approvedSha, digest: shown.digest, ci: shown.ci?.state ?? null };
+    if (shown.approved !== null)
+        return fail(write, json, command, "approved", `Release ${cardData.version} is already approved by ${shown.approved.by}.`, EXIT.refused, { release: cardData });
+    if (shown.refusal !== null) {
+        if (!json)
+            for (const line of releaseCardLines(shown))
+                write(line);
+        return fail(write, json, command, "refused", `Can't approve now: ${shown.refusal}`, EXIT.refused, { release: cardData });
+    }
+    let name, token;
+    if (json) {
+        const given = credentialsFrom(flags, context);
+        if (given.name === undefined || given.token === undefined || given.name === "" || given.token === "")
+            return fail(write, json, command, "credentials", "Approving a release needs who is agreeing: --as <you> --token <password>. Nothing was approved.", EXIT.usage, { release: cardData });
+        if (text(flags, "digest") !== shown.digest)
+            return fail(write, json, command, "unconfirmed", "Name the card you read: --digest <card digest>. Nothing was approved.", EXIT.refused, { release: cardData });
+        name = given.name;
+        token = given.token;
+    }
+    else {
+        for (const line of releaseCardLines(shown))
+            write(line);
+        write("");
+        if (interactive()) {
+            if (!await confirm(`Approve release ${cardData.version}?`)) {
+                write("Nothing approved.");
+                return EXIT.refused;
+            }
+        }
+        else if (!flags.has("yes") || text(flags, "digest") !== shown.digest) {
+            write(`Nothing has been approved. Agree to exactly this card with: toolroll release approve ${chosen.branch} --yes --digest ${shown.digest} --as <you> --token <your password>`);
+            return EXIT.refused;
+        }
+        const acting = await askCredentials(flags, context);
+        if (acting === null)
+            return fail(write, json, command, "credentials", "Approving a release needs who is agreeing. Nothing was approved.", EXIT.usage);
+        name = acting.name;
+        token = acting.token;
+    }
+    // After the prompt: the card again, from the plane. A change refuses; it is never approved in place of what was shown.
+    const again = releaseApprovalCard(store, chosen.taskId);
+    if (!again.ok || again.card.digest !== shown.digest)
+        return fail(write, json, command, "changed", "This release changed while you were being asked; nothing was approved. Run the command again to read it.", EXIT.refused);
+    const now = context.clock();
+    const answer = approveReleaseCard(store, { taskId: chosen.taskId, cardDigest: shown.digest, approveNow: scopeDigest => approve(store, chosen.taskId, name, now, scopeDigest, token, mutationFrom(flags, now)) });
+    if (!answer.ok) {
+        if (answer.reason !== "approve")
+            return fail(write, json, command, answer.reason, `${answer.message} Nothing was approved.`, EXIT.refused);
+        const refused = answer.result;
+        if (refused.reason === "policy")
+            return fail(write, json, command, "policy", `${chosen.taskId}: ${refused.message}`, EXIT.refused);
+        return fail(write, json, command, refused.reason, describeApproveFailure(refused.reason, chosen.taskId), EXIT.refused);
+    }
+    return succeed(write, json, command, { release: cardData }, () => [
+        `Approved release ${cardData.version} (${cardData.candidate.slice(0, 7)}). The release check runs next; it deploys, merges and publishes once GitHub CI and the check pass.`,
+        ...(shown.stopped === null ? [] : [`The release isn't running: run \`toolroll release ${chosen.branch}\` to go on.`]),
+    ]);
+}
+/**
+ * `toolroll task ready <task>` (read-only; docs/plans/plain-toolroll.md P1.6): "Can I merge?" — the task's checklist
+ * from the records the task page reads (merge-checklist.ts), each blocker with the existing act that clears it. A task
+ * outside the caller's projects is no task here.
+ */
+function taskReadyCommand(positional, context) {
+    const { store, write, json } = context;
+    const command = "task ready";
+    const id = positional[0];
+    if (id === undefined || positional.length > 1)
+        return fail(write, json, command, "usage", "`toolroll task ready <task>`", EXIT.usage);
+    const lens = context.principal?.lens ?? null;
+    const ref = store.lookupRef(id);
+    if (ref === null || store.getTask(id) === null || (lens !== null && (ref.repo === null || !lens.includes(ref.repo))))
+        return fail(write, json, command, "unknown-task", `no task \`${id}\``, EXIT.refused);
+    const now = (context.clock ?? (() => context.now))();
+    const list = mergeChecklistOf(store, id, now, { principal: "operator", repos: lens, includeUnplaced: lens === null, dependencyRepos: lens }, context.evidenceRoot);
+    if (list === null)
+        return fail(write, json, command, "unknown-task", `no task \`${id}\``, EXIT.refused);
+    return succeed(write, json, command, list, () => checklistLines(list));
+}
+/** The folders with uncommitted changes: `toolroll storage` lists them so a person can decide. Never removed automatically. */
+function uncommittedLines(plan) {
+    const changed = plan.stay.filter(one => one.why === "has changes");
+    if (changed.length === 0)
+        return [];
+    return [`${changed.length === 1 ? "This folder has" : "These folders have"} uncommitted changes and stay${changed.length === 1 ? "s" : ""} until you decide (toolroll storage discard <path> --yes throws one away):`,
+        ...changed.map(one => `  ${bytesWords(one.bytes).padStart(8)}  ${one.path}${one.taskId === null ? "" : `  (${one.taskId})`}`)];
+}
+/** `toolroll map` (code-map-cli.ts): who is asking, and which projects they can open. A read needs no sign-in on this
+ * computer's own database, as `knowledge search`; a sign-in limits it to that person's projects. */
+async function mapCommand(positional, flags, context) {
+    const { store } = context;
+    const local = currentLocalOwner();
+    const { name, token } = credentialsFrom(flags, context);
+    let actor = null;
+    let repos = null;
+    const all = [...new Set([...store.knownRepos(), ...store.listProjects().map(one => one.path)])];
+    if (local !== null) {
+        actor = local.account;
+        repos = all.filter(repo => store.accountCanAccess(local.account, repo));
+    }
+    else if (name !== undefined && token !== undefined) {
+        if (!authenticateAccount(store, name, token).ok)
+            return fail(context.write, context.json, "map", "unauthenticated", "Sign in again: that login doesn't work here.", EXIT.refused);
+        const remote = activeRemote();
+        actor = name;
+        repos = all.filter(repo => store.accountCanAccess(name, repo) && (remote === null || remote.allows(repo)));
+    }
+    else
+        repos = all;
+    return runMapCommand(positional, flags, { store, write: context.write, json: context.json, now: context.clock(), actor, repos,
+        approver: repo => local === null && name !== undefined && token !== undefined && authenticateApprover(store, name, token, repo).ok,
+        door: repo => {
+            if (local !== null)
+                return { kind: "local-owner", actor: local.account };
+            if (name === undefined || token === undefined)
+                return null;
+            // The credential generation the proof is checked against, read before it, as `models` does.
+            const generation = store.accountOf(name)?.generation ?? -1;
+            const proved = authenticateApprover(store, name, token, repo);
+            return proved.ok ? { kind: "person", person: { actor: name, generation, method: proved.method } } : null;
+        } });
+}
+// ---- `toolroll task new` (docs/plans/plain-toolroll.md P2.4) -----------------------------------------------------------
+/**
+ * Start a task from a person's own terminal: their words become the exact terms, printed; "Build now?" is their yes.
+ * Filing and approving are one step (fast-start.ts), for small work a person approves without typing a password here;
+ * anything else is the ordinary `task add`, then Approve plan. Never for a script or an agent: `--json`, no terminal, a
+ * token or a remote run all refuse. The terminal UI drives it as the local owner, with --preview and --build.
+ */
+async function newTaskCommand(positional, flags, context) {
+    const { store, write, json } = context;
+    const clock = context.clock ?? (() => new Date());
+    const command = "task new";
+    const local = currentLocalOwner();
+    if (context.principal !== undefined || machineActing())
+        return fail(write, json, command, "person-only", "Only a person starts a build this way. File it with `task add`.", EXIT.refused);
+    if (local === null && (json || !personAtTerminal(context)))
+        return fail(write, json, command, "person-only", "`task new` asks a person at a terminal. Use `task add` from a script or an agent.", EXIT.refused);
+    const { name, token } = credentialsFrom(flags, context);
+    const passwordFree = token !== undefined && (local !== null || passwordlessOn(store));
+    const facts = { passwordless: local === null && passwordFree, localOwner: local !== null, freshAt: null, returnTo: "/" };
+    const buildNow = (preview, digest) => fastStartBuild(store, { preview, digest, actor: name ?? "", via: local === null ? "cli" : "terminal-ui", password: facts,
+        approveNow: (taskId, sawDigest, fast) => approve(store, taskId, name ?? "", clock(), sawDigest, token ?? "", {}, fast) }, clock());
+    const answerBuild = (built) => built.ok
+        ? succeed(write, json, command, { task: built.taskId }, () => [`Building ${built.taskId}. A builder starts it next.`])
+        : fail(write, json, command, built.reason, built.message, EXIT.refused);
+    const pressed = text(flags, "build");
+    if (pressed !== undefined) {
+        if (local === null)
+            return fail(write, json, command, "person-only", "--build is the terminal UI's own.", EXIT.refused);
+        return answerBuild(buildNow(pressed, text(flags, "digest") ?? ""));
+    }
+    const fromLink = text(flags, "from");
+    if (fromLink !== undefined)
+        return importTaskCommand(fromLink, flags, context, name);
+    const words = positional.join(" ").trim();
+    const repo = text(flags, "repo");
+    if (words === "" || repo === undefined)
+        return fail(write, json, command, "usage", "`toolroll task new \"<what should change>\" --repo <project>`", EXIT.usage);
+    const placed = canonicalProject(repo) ?? resolve(repo);
+    const prepared = name === undefined || token === undefined ? { eligible: false, reason: "password" }
+        : await prepareFastStart(store, { actor: name, repo: placed, title: words, via: local === null ? "cli" : "terminal-ui", password: facts }, clock());
+    const terms = prepared.eligible ? fastTermsLines(store, prepared.scope, placed) : [];
+    if (flags.has("preview")) {
+        if (local === null)
+            return fail(write, json, command, "person-only", "--preview is the terminal UI's own.", EXIT.refused);
+        return succeed(write, json, command, prepared.eligible ? { eligible: true, preview: prepared.preview, digest: prepared.digest, terms } : { eligible: false, reason: prepared.reason, message: fastRefusalWords(prepared.reason) }, () => []);
+    }
+    if (!prepared.eligible) {
+        write(`${fastRefusalWords(prepared.reason)} Filing it for a plan.`);
+        return addTask([words], flags, context);
+    }
+    write("Build approves exactly this:");
+    write("");
+    for (const line of terms)
+        write(`  ${line.label}: ${line.words}`);
+    write("");
+    if (!(await (context.easySeams?.confirm ?? confirm)("Build now?"))) {
+        write("Nothing started. File it for a plan with `toolroll task add`.");
+        return EXIT.refused;
+    }
+    return answerBuild(buildNow(prepared.preview, prepared.digest));
+}
+/** `toolroll task keep <id>`: "Approve it to keep it", a plan for the exact commit a fast start grew into. Approve it with `task approve`. */
+async function keepGrownCommand(positional, flags, context) {
+    const { store, write, json, clock } = context;
+    const id = positional[0];
+    if (id === undefined)
+        return fail(write, json, "task keep", "usage", "`toolroll task keep <id> --as <you> --token <t>`", EXIT.usage);
+    const acting = await askCredentials(flags, context);
+    const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
+    if (acting === null || !verified?.ok)
+        return refuseApprover(context, "task keep", verified, "keeping a change takes `--as <you> --token <t>`", id);
+    const kept = keepGrownChange(store, id, clock());
+    if (!kept.ok)
+        return fail(write, json, "task keep", "refused", kept.message, EXIT.refused);
+    return succeed(write, json, "task keep", { id, digest: kept.digest }, () => [`Its plan now names the exact commit. Approve it with \`toolroll task approve ${id}\`.`]);
+}
+/** One resume at a time per process; a release's own steps can take many minutes. */
+let resumingReleases = false;
+async function resumeHeldReleases(store, stateDir, now) {
+    if (resumingReleases)
+        return;
+    resumingReleases = true;
+    try {
+        await resumeAllowedReleases(store, stateDir, journal => runRelease({ branch: journal.branch, checkout: journal.checkout, stateDir, limits: {} }, releaseAdapters({ checkout: journal.checkout, say: () => { } })), now);
+    }
+    catch { /* the release's own journal says where it stopped; the next person act tries again */ }
+    finally {
+        resumingReleases = false;
+    }
+}
+/** `task new --from <url>`: read and quote an issue or pull request, then, on a person's yes, file it for the ordinary approval. */
+async function importTaskCommand(url, flags, context, actor) {
+    const { store, write, json } = context;
+    const clock = context.clock ?? (() => new Date());
+    const command = "task new";
+    const repo = text(flags, "repo");
+    if (repo === undefined)
+        return fail(write, json, command, "usage", "`toolroll task new --from <url> --repo <project>`", EXIT.usage);
+    const placed = canonicalProject(repo) ?? resolve(repo);
+    const read = await readGithubItem(store, { url, repo: placed }, context.easySeams?.github ?? {});
+    if (!read.ok)
+        return fail(write, json, command, read.reason, read.message, EXIT.refused);
+    write(`${read.item.kind === "pull" ? "Pull request" : "Issue"} #${read.item.number}, written outside Toolroll:`);
+    write(`  > ${read.item.title}`);
+    for (const line of read.item.body.split(/\r?\n/))
+        write(`  > ${line}`);
+    write("");
+    if (!(await (context.easySeams?.confirm ?? confirm)("Add this task? You approve its plan before anything builds."))) {
+        write("Nothing filed.");
+        return EXIT.refused;
+    }
+    const filed = await fileGithubItem(store, { url, repo: placed, actor: actor ?? "cli", shownHead: read.item.head }, clock(), context.easySeams?.github ?? {});
+    if (!filed.ok)
+        return fail(write, json, command, filed.reason, filed.message, EXIT.refused);
+    return succeed(write, json, command, { task: filed.taskId }, () => [`Filed ${filed.taskId}. Its plan is ready for you to approve.`]);
+}
+/** `toolroll flaky list|show`: reads only, for the remembered local login (or --as/--token) and its projects. */
+async function flakyCommand(positional, flags, context) {
+    const acting = await askCredentials(flags, context);
+    const verified = acting === null || currentLocalOwner() !== null ? null : verifyApproverByPassword(context.store, acting.name, acting.token, context.store.knownRepos().filter(repo => context.store.accountCanAccess(acting.name, repo)));
+    const who = currentLocalOwner() !== null ? localReader(context) : verified !== null && verified.ok ? verified.who : null;
+    return runFlakyCommand(positional, flags, { store: context.store, write: context.write, json: context.json, now: context.clock(), actor: who?.name ?? null, repos: who?.repos ?? [] });
+}
+/** The watch loop's background learning pass (docs/plans/learning-loops.md): advisory reads, each project at most every
+ * 30 minutes through the plane's own gh. A failure here never reaches the loop: it is tried on the next pass. */
+export async function refreshLearning(store, now, reads) {
+    try {
+        backfillMemoryUse(store, now());
+    }
+    catch { /* advisory: the next pass tries again */ }
+    // Project memory's clean-up proposals: deterministic, a quiet project at most weekly. Nothing changes until a person accepts.
+    for (const repo of store.knownRepos()) {
+        try {
+            scheduledTidy(store, repo, now());
+        }
+        catch { /* the next pass tries again */ }
+    }
+    for (const repo of store.knownRepos()) {
+        try {
+            const key = ciCursorKey(repo), at = now();
+            if (at.getTime() - store.serviceCursor(key) < CI_READ_EVERY_MS || ciRepositoriesOf(store, repo).length === 0)
+                continue;
+            store.setServiceCursor(key, at.getTime(), at);
+            await observeCiAttempts(store, repo, reads ?? githubReads(releaseExec, releaseTools().gh, { retry: true }), at);
+        }
+        catch { /* advisory: the next pass tries again */ }
+    }
+}
+/** The laptop's local owner as a reader: its name and its projects. Never a proof: every write proves its own act. */
+function localReader(context) {
+    const local = currentLocalOwner();
+    return local === null ? null : { name: local.account, repos: context.store.knownRepos().filter(repo => context.store.accountCanAccess(local.account, repo)) };
+}