toolroll 0.9.93 → 0.9.95

package/dist/operate.js

@@ -1,3 +1,4 @@
+import { runCardCommand } from "./card-cli.js";
 import { mintSecret } from "./secret-mint.js";
 import { ACP_AGENTS, ACP_PROVIDER_IDS, isAcpProvider, isKeyedProvider } from "./acp-agents.js";
 import { inspectAcpAgent } from "./acp-inspect.js";
@@ -21,7 +22,7 @@ import { parseProtectedPaths } from "./approval-policy.js";
 import { rulesSummary } from "./approval-rules-ui.js";
 import { evidencePack, exportDay, ledgerExportChunks, standaloneEvidenceHtml } from "./evidence-pack.js";
 import { matchesOutsideCheckpoint } from "./ledger-chain.js";
-import { CLEANUP_CHOICES, bytesWords, cleanupWords, diskBytes, parseCleanup, storageReport } from "./storage.js";
+import { CLEANUP_CHOICES, bytesWords, cleanupWords, diskBytes, idleCleanupWords, idleWords, parseCleanup, parseIdle, storageReport } from "./storage.js";
 import { removeStaleTestTemp, tempRoots, testTempFolders } from "./test-temp.js";
 import { storageSweepSupervisor } from "./storage-sweep-process.js";
 import { idleStorageSweep, sweepSchedule, sweepScheduleWords } from "./storage-sweep-schedule.js";
@@ -67,6 +68,9 @@ import { releaseCheckPurposeFor, releaseTermsFor } from "./release-carry.js";
 import { approveReleaseCard, journalMatchesPlane, releaseApprovalCard, releaseCardLines, releaseTaskOf, waitingJournals } from "./release-approval.js";
 import { journalFile } from "./release.js";
 import { refreshTrustedMains, settleReleaseChecks } from "./nightly-check.js";
+import { refreshCodeMaps } from "./code-map-build.js";
+import { sweepDeliveries } from "./code-map-admission.js";
+import { runMapCommand } from "./code-map-cli.js";
 import { githubNightlyRepos, readGithubNightlies } from "./nightly-github.js";
 import { exec as releaseExec, githubReads } from "./release-adapters.js";
 import { releaseTools } from "./release-git.js";
@@ -76,11 +80,17 @@ import { followTeams } from "./teams.js";
 import { followSlack } from "./slack.js";
 import { validateScopeText } from "./task-text.js";
 import { runMemoryCommand } from "./memory-cli.js";
+import { runFlakyCommand } from "./flaky-cli.js";
+import { backfillMemoryUse } from "./memory-use.js";
+import { scheduledTidy } from "./memory-tidy.js";
+import { CI_READ_EVERY_MS, ciCursorKey, ciRepositoriesOf, observeCiAttempts } from "./flaky-ci.js";
 import { runKnowledgeApply, runKnowledgeCommand } from "./knowledge-cli.js";
 import { FLOWS_VALUE_FLAGS, runFlowsCommand } from "./flows-cli.js";
 import { runAssignmentCommand } from "./assignment-adapters.js";
 import { applyProjectProfile, runProjectCommand } from "./project-cli.js";
 import { pullRequestLines, runTaskMergeCommand, runTaskOutcomeCommand } from "./task-outcome-cli.js";
+import { withTaskAlias } from "./task-aliases.js";
+import { checklistLines, mergeChecklistOf } from "./merge-checklist.js";
 import { taskReviewBrief, renderReviewBrief } from "./task-review-brief.js";
 /**
  * The commands that actually move work: authoring tasks, and the claim loop.
@@ -112,10 +122,10 @@ import { homedir, hostname } from "node:os";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { releaseStalledUpdate, waitingUpdate } from "./toolroll-update.js";
 import { dur } from "./design/kit.js";
-import { openStore, openStoreNoMigrate, initLocalMode, enrollOwnerPassword, installationCreatedBy, laptopPortOf, recordLaptopPort, localModeOf, localOwnerBinding, archiveTaskFamily, restoreTaskFamily, shipChecksForTask, elapsedSeconds, CONCURRENT_WRITER_WAIT_MS, isDatabaseBusy, databasePath, BUILT_IN, parseCapabilityKey, verifiedAuthor, isDigestTime, predecessorWatches, RESULT_SCREENSHOTS, lifecycleOf, reportLifecycle, beatLifecycle, } from "./store.js";
+import { checkoutIdle, setCheckoutIdle, openStore, openStoreNoMigrate, initLocalMode, enrollOwnerPassword, installationCreatedBy, laptopPortOf, recordLaptopPort, localModeOf, localOwnerBinding, archiveTaskFamily, restoreTaskFamily, shipChecksForTask, elapsedSeconds, CONCURRENT_WRITER_WAIT_MS, isDatabaseBusy, databasePath, BUILT_IN, parseCapabilityKey, verifiedAuthor, isDigestTime, predecessorWatches, RESULT_SCREENSHOTS, lifecycleOf, reportLifecycle, beatLifecycle, } from "./store.js";
 import { createHash, randomBytes, randomInt, randomUUID } from "node:crypto";
 import { claimInstance, clearInstance, openInstanceSocket } from "./console-instance.js";
-import { backgroundOff, backgroundOn, backgroundShow, laptopStatus, laptopStop } from "./laptop-background.js";
+import { backgroundOff, backgroundOn, backgroundShow, laptopStatus, laptopStop, restartOwnBuilder } from "./laptop-background.js";
 import { authorizePlanUnderMode } from "./plan-auto.js";
 import { ghDispatchAdapter, mirrorTaskId, syncPass } from "./sync.js";
 import { LIVE_FILE_BOUND, LIVE_RETAIN_MS, sweepLiveLogs } from "./live.js";
@@ -185,7 +195,7 @@ function planContractLines(store, evidenceRoot, taskId) {
         ...describeContractChanges(record.changes).map(line => `    ${line}`),
     ];
 }
-import { verdictWords as proofVerdictWords, matrixWords, semanticCoverage, coverageWords } from "./proof.js";
+import { verdictWords as proofVerdictWords, matrixWords, plainReasonWords, semanticCoverage, coverageWords } from "./proof.js";
 import { probeRepo } from "./probe.js";
 import { diagnoseTaskDispatch, diagnosisIsDispatchable, scopeApprovedForDispatch, } from "./dispatch.js";
 import { createDecisionServer } from "./serve.js";
@@ -233,10 +243,24 @@ import { createScheduledFlow, describeSchedule, parseSchedule } from "./flow-sch
 import { fileTaskProposal, validateTaskText } from "./proposal.js";
 import { TEMPLATES, templateByName } from "./templates.js";
 import { isDirectChatProvider, isSubscriptionChatProvider, priceOf, PRICED_MODELS } from "./converse.js";
+import { clearFallbackChain, dispatchEntryOf, entryMovesOnWords, entryWords, fallbackSettingOf, parseEntry, reconcileWalks, setFallbackChain, setPaidGrant } from "./fallback.js";
 import { resolvePhaseAgent, resolveScopeProfile, resolveRouteCandidates, routeOfTask, INSTALLATION_SCOPE } from "./agentconfig.js";
 import { applyModelChoices, stateDigest } from "./model-choices.js";
 import { isTaskSize, legOf, projectRoute, routeDigestOf, routeWords, TASK_SIZES, PHASES as ROUTE_PHASES } from "./phase-routing.js";
 import { observeProviderReadiness, reportProviderReadinessAuthed } from "./runner.js";
+import { retryVanishedWhenStopped } from "./vanished-retry.js";
+import { requestMissingRechecks } from "./check-only.js";
+import { checkRepairOfRun, resumeParkedRepairs, startCheckRepair } from "./check-repair.js";
+import { capturesCommand, evidenceCommand, failingFirstCommand, findingCommand, handoverCommand } from "./follow-through-cli.js";
+import { recordBuilderWish } from "./builder-restart.js";
+import { expireFastStarts, fastRefusalWords, fastStartBuild, keepGrownChange, prepareFastStart } from "./fast-start.js";
+import { fastTermsLines } from "./fast-terms.js";
+import { resumeAllowedReleases } from "./release-next.js";
+import { fileGithubItem, readGithubItem } from "./github-import.js";
+import { runRelease } from "./release.js";
+import { releaseAdapters } from "./release-adapters.js";
+import { routeChangeOf, routeLegacyPlans } from "./route-change.js";
+import { passwordlessOn } from "./passwordless.js";
 import { parseDemoUrl, projectDemoUrl, saveProjectDemo } from "./project-demo.js";
 import { effectiveConcurrency, maySlotTake, parseProjectConcurrency, PROJECT_CONCURRENCY_DEFAULT, ProjectPasses, projectConcurrency, saveProjectConcurrency, savedProjectConcurrency } from "./project-concurrency.js";
 import { activeWebhookTargets, webhookPass, LEGACY_WEBHOOK_WARNING, loadWebhookTargets, effectivePrimary, isMessagingChannel, loadConsoleUrl, phoneOrigin, readUpConsoleUrl, saveConsoleUrl, savePrimary, UP_CONSOLE_FILE } from "./webhooks.js";
@@ -301,6 +325,8 @@ export const OPERATE_HELP = `toolroll — operating the queue
   toolroll project activity --json   read the current project supervision report
   toolroll project rules --repo <p>  a project's approval rules; an instance operator changes them with
                                         --not-requester on|off, --protect none|project, --protect-paths "a/**,b/**"
+  toolroll project fallback --repo <p> [--agents provider:model:plan|api-key,…] [--clear] [--allow-paid|--no-paid]
+    Which agents take over when one runs out of its plan. New tasks seal the chain; a paid agent also needs --allow-paid.
   toolroll project network --repo <p> [--allow h,…] [--remove h,…] [--open|--allowlist] [--local any|none]
                                         what the project's builds may reach on the network; an approver changes it
                                         (new scopes seal it; approved ones keep theirs)
@@ -320,10 +346,16 @@ export const OPERATE_HELP = `toolroll — operating the queue
                                         the project's own demo or dev server, the one non-public address a
                                         report's scout may screenshot
   toolroll task evidence <id>        the task's evidence pack as JSON (--html for a printable page; --out <file>)
+  toolroll map [<project>] [--json]  a project's code map, made by Toolroll from main: areas and how they use each other
+  toolroll map area <id> | file <path> | search <words> [--cursor <c>]
+                                     one area, one file, or files and exported names; --cursor reads the next page of the same version
+  toolroll map refresh               ask for a check of main now (an approver)
   toolroll storage                   where the disk goes: database, build checkouts, releases, evidence, leftover test temp folders
   toolroll storage clean [--yes]     preview removing finished tasks' clean checkouts (their branches stay) and test temp folders older than a day; --yes removes them
   toolroll storage clean --landed [--yes]   preview work that landed in main over a week ago: marks its results complete, removes their clean checkouts and local branches; --yes does it (instance operator)
-  toolroll storage cleanup <when>    remove a finished task's clean checkout: finished|2d|7d|never (instance operator)
+  toolroll storage cleanup <when>    remove a finished task's clean folder: finished|2d|7d|never (instance operator)
+  toolroll storage cleanup idle <days>
+                                     remove an idle task's clean folder: 7|14|30|never (instance operator)
   toolroll storage discard <path> --yes   throw away a checkout kept for its changes; its branch stays
   toolroll integrations [--json]     which integrations work: Connected, Not set up or Broken, and what to do (--saved: no new checks)
   toolroll monitoring                where the audit stream and traces go, and how each destination is doing
@@ -688,10 +720,10 @@ Exit codes
  * (surface.ts) is tested for exact equality against them.
  */
 export const TASK_ACTIONS = [
-    "add", "list", "show", "wait", "state", "block", "unblock", "next", "steer", "pause", "continue", "assign",
+    "add", "new", "keep", "list", "show", "wait", "state", "block", "unblock", "next", "steer", "pause", "continue", "assign",
     "reopen", "scope", "approve", "hold", "unhold", "require", "requeue", "regate", "plan",
     "review", "accept", "repair", "route", "stop", "resume", "complete", "revise", "merge", "ask",
-    "checks", "add-tests", "archive", "restore", "tidy", "ship",
+    "checks", "add-tests", "archive", "restore", "tidy", "ship", "ready", "handover", "before-after", "failing-first",
 ];
 export const PUBLISH_ACTIONS = ["setup", "grant", "revoke", "status", "unblock", "rearm", "merge", "refire"];
 export const CONFIG_ACTIONS = ["show", "set", "clear"];
@@ -706,11 +738,11 @@ export const KEYS_ACTIONS = ["status", "set", "clear", "verify", "auth"];
 /** Flags whose value is a secret someone types or pastes: taken as the next argument even when it starts with "--". */
 export const SECRET_VALUE_FLAGS = new Set(["token", "password"]);
 export const OPERATE_VALUE_FLAGS = new Set([
-    "key", "db", "runner", "ttl", "state", "on", "reason", "until", "id", "backend",
-    "allow", "selector", "paths", "credentials", "repo", "token", "capacity",
+    "key", "db", "runner", "ttl", "state", "flow", "on", "reason", "until", "id", "backend", "build", "from",
+    "allow", "selector", "paths", "credentials", "repo", "token", "capacity", "agents",
     "goal", "not", "touches", "acceptance", "candidate", "by", "digest", "as", "branch", "pool", "base", "model", "turns",
     "max", "cap", "probe", "kind", "expires", "cmd", "since", "repair-model",
-    "choose", "note", "max-open-decisions", "name", "days", "publication", "auto-approve", "review-auto", "port", "host", "allow-host",
+    "choose", "choice", "claim", "revision", "note", "max-open-decisions", "name", "days", "publication", "auto-approve", "review-auto", "port", "host", "allow-host",
     "for", "tick-every", "bridge-every", "reconcile-every", "incarnation",
     "say", "ceiling-usd", "cap-usd",
     // evals: the cases a diagnostic campaign runs, its k, an attempt's world and what its builds may not read, and the
@@ -730,7 +762,7 @@ export const OPERATE_VALUE_FLAGS = new Set([
     "command", "timeout-seconds", "setup-digest", "stop-grace", "title", "name", "every", "lines",
     "label", "reviewers", "limit", "role", "key-file", "weekly-usd", "daily-turns", "per-hour", "token-file", "budget-usd", "build-usd", "sync-max-age", "merge-method",
     "phase", "tier", "clear-phase", "size", "risky",
-    "run", "containment", "agent",
+    "run", "containment", "agent", "path", "line", "action", "from-review", "from-check", "task",
     // onboard: the starter flows to switch on.
     "starter",
     // flows: templates, steps, scripts and cards.
@@ -754,8 +786,14 @@ export const OPERATE_VALUE_FLAGS = new Set([
     "read-deny", "mach",
     // task scope --release <version>:<pr>:<branch>: a release scope's terms (release-once.md).
     "release",
+    // task accept --despite "<reason>": acceptance with a reason, never a completion.
+    "despite",
 ]);
 export const OPERATE_BOOLEAN_FLAGS = new Set([
+    // task accept --finish: the person's Accept, exactly task complete's exact-receipt completion.
+    "finish",
+    // task new --preview: the terminal UI's own, the exact terms with nothing started.
+    "preview",
     // evals run: a report-only campaign; keep each attempt's world for a look afterwards.
     "diagnostic", "keep",
     // task scope --release ... --no-carry: every later commit asks again.
@@ -767,6 +805,8 @@ export const OPERATE_BOOLEAN_FLAGS = new Set([
     "html", "csv", "alerts-only",
     // project network: what its builds may reach (--open | --allowlist).
     "open", "allowlist",
+    // project fallback: whether paid fallback agents may spend.
+    "allow-paid", "no-paid",
     // v105: the full export.
     "zip",
     // Settings → Integrations: the last checks, without checking again.
@@ -847,6 +887,9 @@ export function parseOperateArgs(argv, ownValues = new Set()) {
 }
 /** Route a native command and return its exit code. Its password source cannot be selected by an HTTP request. */
 export async function runOperate(command, argv, write, options = {}) {
+    // People's names for task commands (task-aliases.ts) are the commands they name, before any rule reads the command.
+    if (command === "task")
+        argv = withTaskAlias(["task", ...argv]).slice(1);
     // Each command gets its own remembered-login holder (Passwordless: "cli-login" is this command's, never the next one's).
     return withPasswordSource(CLI_PASSWORD_SOURCE, () => rememberedLogin.run({ login: null }, () => runOperateLocal(command, argv, write, options)));
 }
@@ -1062,6 +1105,8 @@ export async function runOperateAs(argv, opts) {
     const source = opts.source === "mcp" ? "mcp" : "api";
     const options = opts.options ?? {};
     const now = options.now ?? new Date();
+    // People's names for task commands are the commands they name, before the remote policy reads the command.
+    argv = [...withTaskAlias(argv)];
     const [root = "", ...rest] = argv;
     const json = rest.includes("--json");
     let invocation = root;
@@ -1277,6 +1322,8 @@ async function dispatch(command, positional, flags, context) {
                 return projectConcurrencyCommand(positional, flags, context);
             if (positional[0] === "network")
                 return projectNetworkCommand(positional, flags, context);
+            if (positional[0] === "fallback")
+                return projectFallbackCommand(positional, flags, context);
             if (positional[0] === "writes")
                 return projectWritesCommand(positional, flags, context);
             if (positional[0] === "check-access")
@@ -1305,6 +1352,8 @@ async function dispatch(command, positional, flags, context) {
             const verified = acting === null || lead ? null : authenticateApprover(context.store, acting.name, acting.token, repo === undefined ? null : resolve(repo));
             return runKnowledgeApply(flags, { ...context, now: context.clock(), actor: verified !== null && verified.ok ? acting.name : null });
         }
+        case "map":
+            return mapCommand(positional, flags, context);
         case "models": {
             // A local owner's lowering act (models turn-off / dismiss, through the terminal UI) asks for no credential: the
             // rule door re-checks the owner and its exact act itself.
@@ -1325,10 +1374,19 @@ async function dispatch(command, positional, flags, context) {
             const acting = await askCredentials(flags, context);
             if (memoryWriteVerb(positional) && acting !== null && parseLeadToken(acting.token) !== null)
                 return fail(context.write, context.json, `memory ${positional[0]}`, "unauthenticated", MEMORY_WRITE_REFUSAL, EXIT.refused);
-            const verified = acting === null ? null : verifyApproverByPassword(context.store, acting.name, acting.token, context.store.knownRepos().filter(repo => context.store.accountCanAccess(acting.name, repo)));
-            const who = verified !== null && verified.ok ? verified.who : null;
+            // The laptop's local owner: only the rows LOCAL_ALLOW names reach here, and each writer checks the exact act.
+            const verified = acting === null || currentLocalOwner() !== null ? null : verifyApproverByPassword(context.store, acting.name, acting.token, context.store.knownRepos().filter(repo => context.store.accountCanAccess(acting.name, repo)));
+            const who = currentLocalOwner() !== null ? localReader(context) : verified !== null && verified.ok ? verified.who : null;
             return runMemoryCommand(positional, flags, { store: context.store, write: context.write, json: context.json, now: context.clock(), actor: who?.name ?? null, repos: who?.repos ?? [], configDir: dirname(context.databaseFile), ...(context.evidenceRoot === undefined ? {} : { evidenceRoot: context.evidenceRoot }) });
         }
+        case "card":
+            return cardCommand(positional, flags, context);
+        case "flaky":
+            return flakyCommand(positional, flags, context);
+        case "finding":
+            return findingCommand(positional, flags, followThroughContext(context, flags));
+        case "captures":
+            return capturesCommand(positional, followThroughContext(context, flags));
         case "claim":
             return claimCommand(positional, flags, context);
         case "heartbeat":
@@ -1764,7 +1822,7 @@ async function runnerCommand(positional, flags, context) {
         // at the mint. A caller flag never grants what the mint did not.
         const acting = await askCredentials(flags, context);
         if (acting === null) {
-            return fail(write, json, "runner register", "usage", "`runner register <name> --repo <path> --as <you> --token <t>` — minting runner authority is an operator act", EXIT.usage);
+            return fail(write, json, "runner register", "usage", "`runner register <name> --repo <path> --as <you> --token <t>` — adding a builder is an approver's act", EXIT.usage);
         }
         const authenticated = credentialApprover(store, acting.name, acting.token);
         if (!authenticated.ok)
@@ -1864,7 +1922,7 @@ async function runnerCommand(positional, flags, context) {
         const acting = await askCredentials(flags, context);
         const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
         if (acting === null || !verified?.ok)
-            return refuseApprover(context, "runner retire", verified, "`runner retire <name> --as <you> --token <t>` — revoking runner authority is an operator act", name);
+            return refuseApprover(context, "runner retire", verified, "`runner retire <name> --as <you> --token <t>` — retiring a builder is an approver's act", name);
         const retired = store.retireRunner(name, now, mutationFrom(flags, now));
         if (!retired)
             return fail(write, json, "runner retire", "unknown", `no runner \`${name}\``, EXIT.refused);
@@ -1880,7 +1938,7 @@ async function runnerCommand(positional, flags, context) {
         // stated authority, never accumulation nobody can read back.
         const acting = await askCredentials(flags, context);
         if (acting === null) {
-            return fail(write, json, "runner bind", "usage", "`runner bind <name> --repo <path> --as <you> --token <t>` — binding repositories is an operator act", EXIT.usage);
+            return fail(write, json, "runner bind", "usage", "`runner bind <name> --repo <path> --as <you> --token <t>` — choosing a builder's projects is an approver's act", EXIT.usage);
         }
         const authenticated = credentialApprover(store, acting.name, acting.token);
         if (!authenticated.ok)
@@ -1960,7 +2018,7 @@ async function coordinatorCommand(positional, flags, context) {
         }
         const acting = await askCredentials(flags, context);
         if (acting === null) {
-            return fail(write, json, "coordinator mint", "usage", "`coordinator mint <name> --repo <path> --as <you> --token <t>` — minting filing authority is an operator act", EXIT.usage);
+            return fail(write, json, "coordinator mint", "usage", "`coordinator mint <name> --repo <path> --as <you> --token <t>` — minting your lead's credential is an approver's act", EXIT.usage);
         }
         const authenticated = credentialApprover(store, acting.name, acting.token);
         if (!authenticated.ok)
@@ -2007,7 +2065,7 @@ async function coordinatorCommand(positional, flags, context) {
         const acting = await askCredentials(flags, context);
         const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
         if (acting === null || !verified?.ok)
-            return refuseApprover(context, "coordinator revoke", verified, "`coordinator revoke <cid> --as <you> --token <t>` — revoking is an operator act", name);
+            return refuseApprover(context, "coordinator revoke", verified, "`coordinator revoke <cid> --as <you> --token <t>` — revoking is an approver's act", name);
         const revoked = revokeCoordinator(store, name, acting.name, now);
         if (!revoked.ok) {
             const said = revoked.reason === "unknown" ? `no coordinator \`${name}\` — \`coordinator list\` shows cids` : "already revoked";
@@ -2535,6 +2593,8 @@ async function tickCommand(flags, context) {
     const ready = store.listReady(clock(), runner);
     const considered = ready.length;
     const dispatched = [];
+    // Every walk settled before anything dispatches: a crash anywhere leaves a state this pass closes the same way.
+    reconcileWalks(store, clock());
     // The stale-scan (dispatch v3, finding 20): mirrors the courtesy filter
     // kept out of ready are REPORTED here, typed, with a paged episode —
     // an undispatakable tracker item is a 9am fact, not a silent absence.
@@ -2627,7 +2687,15 @@ async function tickCommand(flags, context) {
             }
         }
         const planLeg = route === null ? null : legOf(route.route, "plan");
-        const sealedBuildLeg = route !== null && route.source === "approved" ? legOf(route.route, "build") : null;
+        // A task whose agent ran out runs as the next approved entry: every gate below is keyed to that entry (fallback.ts).
+        const fallback = route !== null && route.source === "approved" && !wantsPlan && !wantsScout ? dispatchEntryOf(store, ref.id, id, clock()) : null;
+        if (fallback !== null && "problem" in fallback) {
+            dispatched.push({ id, outcome: "skipped", reason: "agent-config", detail: `${id}: ${fallback.problem}` });
+            continue;
+        }
+        const sealedBuildLeg = route !== null && route.source === "approved"
+            ? fallback !== null ? { provider: fallback.entry.profile.provider, model: fallback.entry.profile.model, chosen: "fallback" } : legOf(route.route, "build")
+            : null;
         const planFlagged = planProvider !== undefined || planModel !== undefined || providerFlag !== undefined || model !== undefined;
         if (wantsPlan && planLeg !== null && planFlagged) {
             // Pass flags cannot contradict the task's plan leg: a flag that names
@@ -2762,7 +2830,7 @@ async function tickCommand(flags, context) {
         // existing approval refusals own that road, and attestation must
         // never mask them. The gateway re-checks before spawn; this skip only
         // keeps the normal road cheap.
-        const skipProviders = wantsPlan
+        const skipProviders = wantsPlan || fallback !== null
             ? [spec.provider]
             : [store.getScope(id)?.approvedProfile?.provider].filter((one) => one !== null && one !== undefined);
         let unattestedLane = null;
@@ -2799,7 +2867,7 @@ async function tickCommand(flags, context) {
         }
         // Sprint 8: the organisation policy before the claim (build() looks again before spawn, and lowers).
         {
-            const sealed = wantsPlan || wantsScout ? null : store.getScope(id)?.approvedProfile ?? null;
+            const sealed = wantsPlan || wantsScout ? null : fallback?.entry.profile ?? store.getScope(id)?.approvedProfile ?? null;
             const refused = policyHold([sealed !== null ? { profile: sealed }
                     : { provider: spec.provider, model: spec.model, ...(wantsPlan ? { session: "planning" } : wantsScout ? { session: "scouting" } : {}) }]);
             if (refused !== null) {
@@ -2813,7 +2881,8 @@ async function tickCommand(flags, context) {
         // Each provider as it bills now.
         // An ACP agent bills as its declaration for the exact model it would run on this runner.
         const sealedModel = store.getScope(id)?.approvedProfile?.model ?? null;
-        const budgeted = budgetHold(ref.id, [...new Set([spec.provider, ...skipProviders])].map(provider => isAcpProvider(provider) ? store.agentFor(provider, provider === spec.provider ? spec.model ?? sealedModel : sealedModel, runner) : store.agentsFor([provider])[0]));
+        // A paid fallback entry is a dollar spend whatever its provider's current setting says.
+        const budgeted = budgetHold(ref.id, fallback?.paid === true ? [{ provider: spec.provider, billing: "api-key" }] : [...new Set([spec.provider, ...skipProviders])].map(provider => isAcpProvider(provider) ? store.agentFor(provider, provider === spec.provider ? spec.model ?? sealedModel : sealedModel, runner) : store.agentsFor([provider])[0]));
         if (budgeted.over !== null) {
             dispatched.push({ id, outcome: "skipped", reason: "budget", detail: budgetWords(budgeted) });
             continue;
@@ -2837,6 +2906,7 @@ async function tickCommand(flags, context) {
             repo,
             provider: spec.provider,
             ...(spec.model === null ? {} : { model: spec.model }),
+            ...(fallback === null ? {} : { authMode: fallback.entry.authMode }),
             ...(text(flags, "incarnation") === undefined ? {} : { incarnation: text(flags, "incarnation") }),
             ...(text(flags, "max-open-decisions") === undefined
                 ? {}
@@ -3434,12 +3504,16 @@ async function tickCommand(flags, context) {
                     reason: disposition.sealed
                         ? disposition.disposition === "auth-expired"
                             ? "auth-expired — requeued, sign-in needed"
-                            : `${disposition.failureClass}${disposition.disposition === "backoff" ? ` — retry ${disposition.strikes}/3` : disposition.disposition === "stalled" ? " — stalled" : ""}`
+                            : disposition.disposition === "fallback"
+                                ? `out of plan — moved to the next approved agent`
+                                : `${disposition.failureClass}${disposition.disposition === "backoff" ? ` — retry ${disposition.strikes}/3` : disposition.disposition === "stalled" ? " — stalled" : ""}`
                         : "fenced",
                     ...(result.ok ? {} : { detail: result.message.slice(0, 200) }),
                     worktree: leased.worktree.path,
                 });
-                broke++;
+                // Moving on isn't this pass breaking: the task is queued for its next agent.
+                if (!(disposition.sealed && disposition.disposition === "fallback"))
+                    broke++;
                 break;
             case "recorded":
                 // The standalone-only arm; unreachable under the tick policy.
@@ -3586,6 +3660,12 @@ async function reconcileCommand(flags, context) {
     // asked to confirm a build stopped, so a release waiting on its check moves on by itself.
     await proveFinishedRunsStopped(store, clock);
     store.settleQuiescentStops(clock());
+    // A vanished build whose old process is now proven stopped gets its retry decision (vanished-retry.ts).
+    retryVanishedWhenStopped(store, clock());
+    // A fast start that didn't start in time goes back to the ordinary Approve plan (fast-start.ts).
+    expireFastStarts(store, clock());
+    // A plan from before agent routing gets its route and one Approve (route-change.ts).
+    routeLegacyPlans(store, clock());
     // An update whose updater ended while letting work finish must not leave new work paused.
     try {
         releaseStalledUpdate(dirname(context.databaseFile), clock());
@@ -4956,7 +5036,7 @@ async function modeCommand(positional, flags, context) {
     if (acting === null)
         return fail(write, json, "mode", "usage", "signing or revoking a mode takes `--as <you> --token <t>`", EXIT.usage);
     // Signing a mode that lets a chat app approve is a credential act; any other mode signing or revoking is ordinary.
-    const authed = (flag(flags, "chat-approve") ? credentialApprover(store, acting.name, acting.token) : authenticateApprover(store, acting.name, acting.token));
+    const authed = (flag(flags, "chat-approve") || flag(flags, "repair-auto") ? credentialApprover(store, acting.name, acting.token) : authenticateApprover(store, acting.name, acting.token));
     if (!authed.ok)
         return fail(write, json, "mode", authed.reason, "that is not an active approver, or the token does not match", EXIT.refused);
     if (action === "revoke") {
@@ -4984,8 +5064,18 @@ async function modeCommand(positional, flags, context) {
         terms.autoApproveFiling = true;
     if (flag(flags, "plan-auto"))
         terms.planAuto = true;
-    if (["review-auto", "review-retry-auto", "repair-auto", "repair-max-attempts"].some(name => flags.has(name)))
-        return fail(write, json, "mode set", "invalid", "Separate model review and automatic correction loops have been removed; finished work goes to the lead or user.", EXIT.refused);
+    if (["review-auto", "review-retry-auto"].some(name => flags.has(name)))
+        return fail(write, json, "mode set", "invalid", "Separate model review has been removed; finished work goes to the lead or user.", EXIT.refused);
+    // Repairing failed checks by themselves: never a preset default, only these flags, with a limit you sign.
+    if (flags.has("repair-max-attempts") && !flag(flags, "repair-auto"))
+        return fail(write, json, "mode set", "invalid", "--repair-max-attempts needs --repair-auto", EXIT.refused);
+    if (flag(flags, "repair-auto")) {
+        const limit = Number(text(flags, "repair-max-attempts") ?? 2);
+        if (!Number.isInteger(limit) || limit < 1 || limit > 3)
+            return fail(write, json, "mode set", "invalid", "--repair-max-attempts is 1, 2 or 3", EXIT.refused);
+        terms.repairAuto = true;
+        terms.repairMaxAttempts = limit;
+    }
     if (terms.planAuto && !terms.autoApproveFiling)
         return fail(write, json, "mode set", "invalid", "--plan-auto requires automatic filing approval", EXIT.refused);
     // Approving plans and merges from the signer's paired chat: never a preset default, only this flag.
@@ -6466,6 +6556,13 @@ async function runWatchLoop(args) {
             const batched = await runBatchChecks(store, context.evidenceRoot, { now: context.clock, shouldStop: stopping });
             if (batched > 0)
                 progress(`watch: settled ${batched} batch-checked result(s)`);
+            // A held release a person let go on resumes by itself, in the background of this pass (release-next.ts).
+            if (context.agentRunner === undefined)
+                void resumeHeldReleases(store, dirname(context.databaseFile), context.clock());
+            // A result whose verdict went missing asks for its one automatic recheck (check-only.ts).
+            requestMissingRechecks(store, context.evidenceRoot, context.clock());
+            // A failed check that was parked takes its next step once its task is free again (check-repair.ts).
+            resumeParkedRepairs(store, context.evidenceRoot, context.clock());
             const ran = await runWaitingChecks(store, context.evidenceRoot, { now: context.clock, shouldStop: stopping });
             if (ran > 0)
                 progress(`watch: ran ${ran} follow-up check(s)`);
@@ -6478,11 +6575,27 @@ async function runWatchLoop(args) {
             // all. A test's injected agent runner means a test: no real gh.
             if (context.agentRunner === undefined)
                 await refreshGithubNightlies(store, context.clock);
+            // The flaky tests list's GitHub rows (flaky-ci.ts): read-only, each project at most every 30 minutes.
+            if (context.agentRunner === undefined)
+                await refreshLearning(store, context.clock);
             // A finished check may send a build's card down its failure path: now, not on the next beat.
             if (ran + batched > 0)
                 moveCards(store, repo, context.clock(), context.evidenceRoot);
         },
     });
+    // The code map (docs/plans/code-map.md §2): its own beat, so a slow remote holds nothing else. A test's injected agent
+    // runner means a test: no real fetch.
+    const codeMapChecks = startMaintenance({
+        intervalMs: 60_000,
+        shouldStop: stopping,
+        onError: error => progress(`watch: a code map check failed — ${describe(error)}; it tries again`),
+        run: async () => {
+            if (store.isDemo() || context.agentRunner !== undefined)
+                return;
+            await refreshCodeMaps(store, { scratch: join(context.evidenceRoot, ".code-map"), clock: context.clock });
+            sweepDeliveries(store);
+        },
+    });
     // Flows on their own cadence (flow-cadence.ts), not between builds: while builds hold every slot of this
     // project, a card whose step finished still moves within one beat. Moves run apart from triggers, replies
     // and steps, so a long check script doesn't hold them either. Neither starts a build: a card entering a
@@ -6762,6 +6875,7 @@ async function runWatchLoop(args) {
         await Promise.all(lanes);
         await maintenance.stop();
         await followUpChecks.stop();
+        await codeMapChecks.stop();
         await flowMoves.stop();
         await flowSteps.stop();
         await modelWatch.stop();
@@ -7436,6 +7550,8 @@ async function upCommand(flags, context) {
                     retireRunnerIfCurrent(store, runnerName, runnerToken, clock());
                     return fail(write, json, "up", "runner-alive", "The worker process record could not be saved; nothing started", EXIT.refused);
                 }
+                // What a person asked for, and what ran: an automatic restart acts on exactly this (builder-restart.ts).
+                recordBuilderWish(store, "running", "up", packageVersion(), clock());
                 doorAnswer = answer;
                 break;
             }
@@ -8608,6 +8724,9 @@ async function statusCommand(positional, flags, context) {
     // This installation's console and background service (easy-start D), beside its updates and integrations: a person
     // limited to some projects returned above without it; an all-project caller reads what a local one does.
     const laptop = { laptop: await laptopStatus(context.store, context.databaseFile, context.laptopSeams) };
+    // Nothing else on this computer is left to notice a builder that died: a look at status brings it back when it may.
+    if (!laptop.laptop.running && laptop.laptop.background === "on" && !machineActing())
+        await restartOwnBuilder(context.store, context.databaseFile, context.laptopSeams, context.clock()).catch(() => null);
     return succeed(context.write, context.json, command, { ...status, projects, ...laptop, ...update, ...integrations, ...updateWaiting, ...unsentReplies, ...(legacyWebhookWarning === null ? {} : { legacyWebhookWarning }) }, () => [...(waiting === null ? [] : [waiting.words]), ...(unsentLine === null ? [] : [unsentLine]), ...renderInstallationStatus(status), ...(projectsLine === null ? [] : [projectsLine]), ...(line === null ? [] : [line]), ...(brokenLine === null ? [] : [brokenLine]), ...(legacyWebhookWarning === null ? [] : [legacyWebhookWarning])]);
 }
 function unsentRepliesLine(unsent) {
@@ -8752,10 +8871,16 @@ function taskAction(action, rest, flags, context) {
                 demo: context.store.isDemo(), credentials: () => askCredentials(flags, context), ...(context.publishExec === undefined ? {} : { exec: context.publishExec }) });
         case "add":
             return addTask(rest, flags, context);
+        case "new":
+            return newTaskCommand(rest, flags, context);
+        case "keep":
+            return keepGrownCommand(rest, flags, context);
         case "checks":
             return runTaskChecks(rest, flags, context);
         case "ship":
             return taskShipCommand(rest, context);
+        case "ready":
+            return taskReadyCommand(rest, context);
         case "add-tests":
             return addTestsTask(rest, flags, context);
         case "list":
@@ -8810,6 +8935,12 @@ function taskAction(action, rest, flags, context) {
             return requeueTask(rest, flags, context);
         case "regate":
             return regateTaskCommand(rest, flags, context);
+        case "handover":
+            return handoverCommand(rest, followThroughContext(context, flags));
+        case "before-after":
+            return evidenceCommand(rest, flags, followThroughContext(context, flags));
+        case "failing-first":
+            return failingFirstCommand(rest, followThroughContext(context, flags));
         case "plan":
             return planTaskCommand(rest, flags, context);
         case "review":
@@ -9332,8 +9463,8 @@ function showTask(positional, context) {
         ...(task.state !== "done" || detail.proofVerdict === null
             ? []
             : [
-                `  proof: ${proofVerdictWords(current?.receipt?.runId === latestFinished?.id ? current?.readiness?.verdict ?? detail.proofVerdict : detail.proofVerdict, detail.proofReasons).word}${detail.proofAccepted ? " (accepted)" : ""}`,
-                ...(detail.proofReasons.length > 0 ? [`    ${detail.proofReasons.join("; ")}`] : []),
+                `  checked: ${proofVerdictWords(current?.receipt?.runId === latestFinished?.id ? current?.readiness?.verdict ?? detail.proofVerdict : detail.proofVerdict, detail.proofReasons).word}${detail.proofAccepted ? " (accepted)" : ""}`,
+                ...(detail.proofReasons.length > 0 ? [`    ${detail.proofReasons.map(plainReasonWords).join(" ")}`] : []),
                 ...matrixWords(detail.proofMatrix),
                 ...(detail.semanticCoverage === null ? [] : coverageWords(detail.semanticCoverage).map(line => `  ${line}`)),
             ]),
@@ -9341,11 +9472,11 @@ function showTask(positional, context) {
             ? []
             : detail.report.ok
                 ? [
-                    `  report: ${detail.report.report.title} (run ${detail.report.run})`,
+                    `  report: ${detail.report.report.title} (build #${detail.report.run})`,
                     `    ${detail.report.report.summary}`,
                     ...detail.report.report.followUps.map((one, index) => `    follow-up ${index + 1}: ${one.title}`),
                 ]
-                : [`  report: ${detail.report.problem} (run ${detail.report.run})`]),
+                : [`  report: ${detail.report.problem} (build #${detail.report.run})`]),
         ...pullRequestLines(detail.pullRequest),
         ...(base === null ? [] : [`  base: ${baseStandingWords(base)}`]),
         ...(detail.blockedBy.length > 0 ? [`  waits for ${detail.blockedBy.join(", ")}`] : []),
@@ -9378,7 +9509,7 @@ function showTask(positional, context) {
         ...detail.runs
             .filter(one => one.route !== null)
             .slice(0, 8)
-            .map(one => `  run #${one.id}  ${one.role.padEnd(8)} ${one.route.provider}${one.route.model === null ? "" : ` · ${one.route.model}`}  [${one.route.chosen}] route ${one.route.routeDigest}`),
+            .map(one => `  build #${one.id}  ${one.role.padEnd(8)} ${one.route.provider}${one.route.model === null ? "" : ` · ${one.route.model}`}  [${one.route.chosen}]`),
     ]);
 }
 /** The review status lines `task show` prints (v50): the state word, the
@@ -9418,47 +9549,72 @@ function taskRouteStandingLines(id, routed) {
     if (routed === null)
         return [];
     if (routed.kind === "route") {
-        return [`  agents       ${routed.source === "approved" ? "sealed by the approval — configuration changes cannot reroute it" : routed.source === "proposed" ? "proposed — the next approval seals them" : "recommended live — no scope filed yet"}`];
+        return [`  agents       ${routed.source === "approved" ? "approved with the plan — a configuration change never moves them" : routed.source === "proposed" ? "proposed — approving the plan approves them" : "recommended now — no plan filed yet"}`];
     }
     if (routed.kind === "legacy") {
         return [`  agents       approved before agent routing existed — ${routed.profile.provider} · ${routed.profile.model} builds and repairs (repair model ${routed.profile.repairModel === "inherit" ? routed.profile.model : routed.profile.repairModel}); the planner and reviewer resolve from configuration at run time`];
     }
-    return [`  agents       UNREADABLE — ${routed.problem}`, `               nothing runs for ${id} until its scope is re-filed and approved again`];
+    return [`  agents       UNREADABLE — ${routed.problem}`, `               nothing runs for ${id} until its plan is saved again and approved`];
 }
 /**
- * `task accept <id>` (Priority 2): the operator's explicit acceptance of a
- * short or refuted proof verdict — the one act that lets the task read
- * done despite incomplete evidence. Credentialed like approving a scope:
- * accepting bad news is still authority.
+ * `task accept <id>`: every call names what it means (docs/plans/plain-toolroll.md P1.1), so the same words never
+ * quietly start meaning something else.
+ * - `--finish` or `--digest <receipt>` is the person's Accept: exactly `task complete`'s exact-receipt completion, with
+ *   the same rule that `--json` and scoped credentials must pass `--digest`.
+ * - `--despite "<reason>"` (`--note` is its alias) is acceptance only: an explicit acceptance of a short or refuted
+ *   result with a reason, credentialed like approving a plan. It never completes, and never combines with the above.
+ * - A bare `task accept <id>` refuses, for good, naming both.
  */
 async function acceptTaskProof(positional, flags, context) {
     const { store, write, json, now } = context;
+    const finishing = flags.has("finish") || flags.has("digest");
+    const despiteFlag = flags.has("despite") ? flags.get("despite") : flags.get("note");
+    const despiting = flags.has("despite") || flags.has("note");
+    if (flags.has("despite") && flags.has("note"))
+        return fail(write, json, "task accept", "usage", "Use --despite \"<reason>\" once (--note is the same flag).", EXIT.usage);
+    if (finishing && despiting) {
+        return fail(write, json, "task accept", "usage", "--despite accepts a result with a reason and never finishes the task; --finish and --digest finish it. Use one: first accept with --despite, then finish with --finish.", EXIT.usage);
+    }
+    if (!finishing && !despiting) {
+        return fail(write, json, "task accept", "usage", "Say what accepting means: `toolroll task accept <id> --finish` accepts the result and finishes the task, or `--despite \"<reason>\"` accepts it with a reason without finishing.", EXIT.usage);
+    }
+    if (finishing) {
+        // The person's Accept: `task complete`, unchanged, under this command's name.
+        if (flags.get("finish") !== undefined && flags.get("finish") !== true)
+            return fail(write, json, "task accept", "usage", "--finish takes no value.", EXIT.usage);
+        const rest = new Map(flags);
+        rest.delete("finish");
+        return runTaskOutcomeCommand("complete", positional, rest, { ...context, command: "task accept", operator: async () => {
+                const acting = await askCredentials(flags, context);
+                if (acting === null)
+                    return null;
+                const authenticated = verifyApproverByPassword(context.store, acting.name, acting.token, context.store.knownRepos().filter(repo => context.store.accountCanAccess(acting.name, repo)));
+                return authenticated.ok ? authenticated.who : null;
+            } });
+    }
     const id = positional[0];
     if (id === undefined)
-        return fail(write, json, "task accept", "usage", "`toolroll task accept <id> [--note <text>] --as <you> --token <t>`", EXIT.usage);
+        return fail(write, json, "task accept", "usage", "`toolroll task accept <id> --despite \"<reason>\" --as <you> --token <t>`", EXIT.usage);
+    if (typeof despiteFlag !== "string" || despiteFlag.trim() === "")
+        return fail(write, json, "task accept", "usage", "--despite needs the reason you accept it anyway: `--despite \"<reason>\"`.", EXIT.usage);
+    const validated = validateNote(despiteFlag);
+    if (!validated.ok)
+        return fail(write, json, "task accept", "invalid", validated.problem, EXIT.usage);
     const task = store.getTask(id);
     if (task === null)
         return fail(write, json, "task accept", "unknown-task", `no task \`${id}\``, EXIT.refused);
     const acting = await askCredentials(flags, context);
     const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
     if (acting === null || !verified?.ok)
-        return refuseApprover(context, "task accept", verified, "accepting incomplete proof is a person's act — it takes `--as <you> --token <t>`", id);
+        return refuseApprover(context, "task accept", verified, "accepting a result with a reason is a person's act — it takes `--as <you> --token <t>`", id);
     const ref = store.refFor(BUILT_IN, id);
     // v40 fix: a reviewer run is never the attempt whose proof is accepted.
     const latest = store.runsFor(ref.id).find(one => one.finishedAt !== null && (one.role === "builder" || one.role === "scout"));
     if (latest === undefined)
         return fail(write, json, "task accept", "no-run", `${id} has no finished attempt to accept`, EXIT.refused);
-    const rawNote = text(flags, "note");
-    let note = null;
-    if (rawNote !== undefined && rawNote.trim() !== "") {
-        const validated = validateNote(rawNote);
-        if (!validated.ok)
-            return fail(write, json, "task accept", "invalid", validated.problem, EXIT.usage);
-        note = validated.note;
-    }
-    store.acceptProof(latest.id, acting.name, note, now);
+    store.acceptProof(latest.id, acting.name, validated.note, now);
     return succeed(write, json, "task accept", { id, run: latest.id, acceptedBy: acting.name }, () => [
-        `Accepted: ${id}'s build #${latest.id} reads done despite its proof, on ${acting.name}'s say-so.`,
+        `Accepted ${id}'s build #${latest.id} with your reason, ${acting.name}. It isn't finished: \`toolroll task accept ${id} --finish\` finishes it.`,
     ]);
 }
 /**
@@ -9479,9 +9635,18 @@ async function repairTaskCommand(positional, flags, context) {
         const acting = await askCredentials(flags, context);
         if (acting === null)
             return fail(write, json, "task repair", "usage", "Evidence collection requires --as and --token.", EXIT.usage);
-        const authenticated = authenticateApprover(store, acting.name, acting.token);
+        // A failed check names its project: the password proves the person, and their access to the run they named.
+        const failed = checkRepairOfRun(store, runId);
+        const authenticated = authenticateApprover(store, acting.name, acting.token, failed?.repo);
         if (!authenticated.ok)
             return fail(write, json, "task repair", authenticated.reason, describeApproveFailure(authenticated.reason, String(runId)), EXIT.refused);
+        // A failed check waiting for a person: this draft is what they asked for, and its approval below is the normal one.
+        if (failed !== null) {
+            const started = startCheckRepair(store, context.evidenceRoot, runId, clock());
+            if (!started.ok)
+                return fail(write, json, "task repair", "refused", started.message, EXIT.refused);
+            chain = store.repairChainFor(runId);
+        }
         const run = store.getRun(runId), proof = store.proofVerdictFor(runId);
         const repo = run && store.refById(run.taskRef)?.repo;
         if (repo && repo === repoFrom(flags) && proof?.matrix.some(row => row.assessment && row.review?.judgement === "cannot-tell") &&
@@ -9730,7 +9895,7 @@ async function pauseTask(positional, flags, context) {
         return fail(write, json, "task pause", "usage", "`toolroll task pause <id> [--run <run-id>] --as <you> --token <t>`", EXIT.usage);
     const acting = await askCredentials(flags, context);
     if (acting === null)
-        return fail(write, json, "task pause", "usage", "pausing takes `--as <you> --token <t>` — it is an operator's act and is recorded against your name", EXIT.usage);
+        return fail(write, json, "task pause", "usage", "pausing takes `--as <you> --token <t>` — it is an approver's act and is recorded against your name", EXIT.usage);
     const authed = authenticateApprover(store, acting.name, acting.token);
     if (!authed.ok)
         return fail(write, json, "task pause", "not-an-approver", "that is not an approver, or the token does not match", EXIT.refused);
@@ -9748,7 +9913,7 @@ async function continueTask(positional, flags, context) {
         return fail(write, json, "task continue", "usage", "`toolroll task continue <id> [--run <run-id>] --as <you> --token <t>`", EXIT.usage);
     const acting = await askCredentials(flags, context);
     if (acting === null)
-        return fail(write, json, "task continue", "usage", "resuming takes `--as <you> --token <t>` — it is an operator's act and is recorded against your name", EXIT.usage);
+        return fail(write, json, "task continue", "usage", "resuming takes `--as <you> --token <t>` — it is an approver's act and is recorded against your name", EXIT.usage);
     const authed = authenticateApprover(store, acting.name, acting.token);
     if (!authed.ok)
         return fail(write, json, "task continue", "not-an-approver", "that is not an approver, or the token does not match", EXIT.refused);
@@ -10283,6 +10448,11 @@ async function approveTask(positional, flags, context) {
         interactive() && !json) {
         write(`Approving lets a builder work on ${id}, within exactly this:`);
         write("");
+        const changed = routeChangeOf(store, id);
+        if (changed !== null) {
+            write(changed);
+            write("");
+        }
         for (const line of describeScope(scope))
             write(line);
         for (const line of planContractLines(store, context.evidenceRoot, id))
@@ -10310,6 +10480,11 @@ async function approveTask(positional, flags, context) {
         }
         write(`Would approve this, and let a builder work on ${id}:`);
         write("");
+        const changed = routeChangeOf(store, id);
+        if (changed !== null) {
+            write(changed);
+            write("");
+        }
         for (const line of describeScope(scope))
             write(line);
         for (const line of planContractLines(store, context.evidenceRoot, id))
@@ -10746,7 +10921,7 @@ async function stopTaskCommand(positional, flags, context) {
     const acting = await askCredentials(flags, context);
     const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
     if (acting === null || !verified?.ok)
-        return refuseApprover(context, "task stop", verified, "stopping takes `--as <you> --token <t>` — it is an operator's act and is recorded against your name", id);
+        return refuseApprover(context, "task stop", verified, "stopping takes `--as <you> --token <t>` — it is an approver's act and is recorded against your name", id);
     const asked = requestTaskStop(store, { taskId: id, runId, by: acting.name, via: "cli" }, clock());
     if (!asked.ok)
         return fail(write, json, "task stop", asked.reason, asked.detail, EXIT.refused, { run: runId });
@@ -11435,9 +11610,11 @@ async function storageCommand(positional, flags, context) {
     };
     const refused = (what) => fail(context.write, context.json, command, "refused", `An instance operator ${what}: pass --as and --token (or use the remembered login).`, EXIT.refused);
     const summary = (plan) => [
-        `Checkouts: ${plan.count}, ${bytesWords(plan.totalBytes)}. ${plan.waitingReview} waiting for review, ${plan.withChanges} kept because they have changes.`,
-        plan.go.length === 0 ? "A clean up now would free nothing." : `A clean up now would free about ${bytesWords(plan.freeBytes)} (${plan.go.length} checkout${plan.go.length === 1 ? "" : "s"}): toolroll storage clean`,
-        `A finished task's clean checkout is removed ${cleanupWords(plan.cleanup)}; its branch stays.`,
+        `Task folders: ${plan.count}, ${bytesWords(plan.totalBytes)}. ${plan.waitingReview} waiting for review, ${plan.withChanges} with uncommitted changes.`,
+        plan.go.length === 0 ? "A clean up now would free nothing." : `A clean up now would free about ${bytesWords(plan.freeBytes)} (${plan.go.length} task folder${plan.go.length === 1 ? "" : "s"}): toolroll storage clean`,
+        `A finished task's clean folder is removed ${cleanupWords(plan.cleanup)}; its branch stays.`,
+        idleCleanupWords(plan),
+        ...uncommittedLines(plan),
     ];
     const itemLine = (one) => `  ${bytesWords(one.bytes).padStart(8)}  ${one.path}${one.why === null ? "" : `  (${whyWords(one)})`}`;
     // Test temp folders the tests, journeys and scripts left (a killed run, an older version): those nothing touched for a day go.
@@ -11490,16 +11667,28 @@ async function storageCommand(positional, flags, context) {
     if (action === "cleanup") {
         if (rest.length === 0) {
             const cleanup = store.checkoutCleanup();
-            return succeed(context.write, context.json, command, { cleanup }, () => [`A finished task's clean checkout is removed ${cleanupWords(cleanup)}; its branch stays.`]);
+            const idle = checkoutIdle(store);
+            return succeed(context.write, context.json, command, { cleanup, idle }, () => [`A finished task's clean folder is removed ${cleanupWords(cleanup)}; its branch stays.`, `A task's clean folder is removed ${idleWords(idle)}; its branch stays.`]);
+        }
+        const usage = `Use storage cleanup <${CLEANUP_CHOICES.map(one => one.value).join("|")}> or storage cleanup idle <7|14|30|never>.`;
+        if (rest[0] === "idle") {
+            const idle = rest.length === 2 ? parseIdle(rest[1]) : undefined;
+            if (idle === undefined)
+                return fail(context.write, context.json, command, "usage", usage, EXIT.usage);
+            const actor = await operator();
+            if (actor === null)
+                return refused("sets idle cleanup");
+            const saved = setCheckoutIdle(store, idle, actor, context.clock());
+            return succeed(context.write, context.json, command, { idle: saved }, () => [`Saved. A task's clean folder is removed ${idleWords(saved)}; its branch stays.`]);
         }
         const cleanup = rest.length === 1 ? parseCleanup(rest[0]) : undefined;
         if (cleanup === undefined)
-            return fail(context.write, context.json, command, "usage", `Use storage cleanup <${CLEANUP_CHOICES.map(one => one.value).join("|")}>.`, EXIT.usage);
+            return fail(context.write, context.json, command, "usage", usage, EXIT.usage);
         const actor = await operator();
         if (actor === null)
             return refused("sets checkout cleanup");
         const saved = store.setCheckoutCleanup(cleanup, actor, context.clock());
-        return succeed(context.write, context.json, command, { cleanup: saved }, () => [`Saved. A finished task's clean checkout is removed ${cleanupWords(saved)}; its branch stays.`]);
+        return succeed(context.write, context.json, command, { cleanup: saved }, () => [`Saved. A finished task's clean folder is removed ${cleanupWords(saved)}; its branch stays.`]);
     }
     if (action === "clean" && flags.has("landed")) {
         if (rest.length > 0 || flags.get("landed") !== true)
@@ -11519,7 +11708,7 @@ async function storageCommand(positional, flags, context) {
             const sharedBytes = sharedGo.reduce((sum, one) => sum + one.bytes, 0);
             const anything = plan.go.length > 0 || temp.stale > 0 || sharedGo.length > 0;
             return succeed(context.write, context.json, command, { preview: true, go: plan.go, stay: plan.stay, freeBytes: plan.freeBytes, testTemp: temp, sharedGo, sharedFreeBytes: sharedBytes }, () => [
-                ...(plan.go.length === 0 ? [anything ? "No checkouts to clean up." : "Nothing to clean up."] : [`Would remove ${plan.go.length} checkout${plan.go.length === 1 ? "" : "s"}, freeing about ${bytesWords(plan.freeBytes)} (their branches stay):`, ...plan.go.map(itemLine)]),
+                ...(plan.go.length === 0 ? [anything ? "No task folders to clean up." : "Nothing to clean up."] : [`Would remove ${plan.go.length} task folder${plan.go.length === 1 ? "" : "s"}, freeing about ${bytesWords(plan.freeBytes)} (their branches stay):`, ...plan.go.map(itemLine)]),
                 ...(sharedGo.length === 0 ? [] : [`Would remove ${sharedGo.length} shared dependency install${sharedGo.length === 1 ? "" : "s"} no checkout uses, about ${bytesWords(sharedBytes)}:`, ...sharedGo.map(sharedLine)]),
                 ...(plan.stay.length === 0 ? [] : [`Stays (${plan.stay.length}):`, ...plan.stay.map(itemLine)]),
                 ...(temp.stale === 0 ? [] : [`Would remove ${temp.stale} test temp folder${temp.stale === 1 ? "" : "s"} older than a day, about ${bytesWords(temp.staleBytes)}.`]),
@@ -11554,7 +11743,7 @@ async function storageCommand(positional, flags, context) {
         ];
         saveSweep(store, { at: context.clock().toISOString(), source: "manual", actor, parts });
         return succeed(context.write, context.json, command, { removed: done.removed, kept: done.kept, freedBytes: done.freed, testTempRemoved: swept.removed.length, testTempFailed: swept.failed, sharedRemoved, sharedFreedBytes: sharedFreed }, () => [
-            done.removed.length === 0 ? (swept.removed.length === 0 && sharedRemoved.length === 0 ? "Nothing to clean up." : "No checkouts to clean up.") : `Removed ${done.removed.length} checkout${done.removed.length === 1 ? "" : "s"}, about ${bytesWords(done.freed)}; their branches stay.`,
+            done.removed.length === 0 ? (swept.removed.length === 0 && sharedRemoved.length === 0 ? "Nothing to clean up." : "No task folders to clean up.") : `Removed ${done.removed.length} task folder${done.removed.length === 1 ? "" : "s"}, about ${bytesWords(done.freed)}; their branches stay.`,
             ...done.removed.map(itemLine),
             ...(sharedRemoved.length === 0 ? [] : [`Removed ${sharedRemoved.length} shared dependency install${sharedRemoved.length === 1 ? "" : "s"} no checkout used, about ${bytesWords(sharedFreed)}.`, ...sharedRemoved.map(sharedLine)]),
             ...done.kept.map(one => `  kept ${one.path} (${whyWords({ why: one.why })})`),
@@ -11632,7 +11821,8 @@ async function landedCommandWith(remotes, yes, operator, refused, pool, context)
     ]);
 }
 function checkoutSummary(plan) {
-    return { count: plan.count, totalBytes: plan.totalBytes, waitingReview: plan.waitingReview, withChanges: plan.withChanges, cleanBytes: plan.freeBytes, cleanCount: plan.go.length, cleanup: plan.cleanup };
+    return { count: plan.count, totalBytes: plan.totalBytes, waitingReview: plan.waitingReview, withChanges: plan.withChanges, cleanBytes: plan.freeBytes, cleanCount: plan.go.length, cleanup: plan.cleanup,
+        idle: plan.idle, idleCount: plan.idleCount, idleBytes: plan.idleBytes, uncommitted: plan.stay.filter(one => one.why === "has changes").map(one => ({ path: one.path, taskId: one.taskId, bytes: one.bytes })) };
 }
 /** `review [show] | on | off --repo <path>`: the project's one automatic review
  * of finished builds. Changing it takes an approver of that project; the
@@ -13311,6 +13501,8 @@ async function backgroundCommand(positional, flags, context) {
         return succeed(write, json, command, off, () => [off.action === "already-off" ? "Toolroll wasn't set to run in the background." : "Toolroll no longer runs in the background. Start it with `toolroll` when you need it."]);
     }
     const on = await backgroundOn(context.store, context.databaseFile, port, seams);
+    if (on.ok)
+        recordBuilderWish(context.store, "running", "background on", packageVersion(), context.clock());
     if (!on.ok) {
         const code = ["agent", "conflict", "declined", "running-elsewhere", "unsupported", "console-unproven", "invalid-unit", "unreadable"].includes(on.reason) ? EXIT.refused : EXIT.failed;
         if (json) {
@@ -13474,7 +13666,7 @@ export function upLaptopPortCandidates(store, fromSeam) {
 }
 /** The memory verbs that change project memory (memory-cli.ts), and `propose`, which files the proposals a person then
  * applies: a person's act, never the lead's. The reads stay as they are. */
-const MEMORY_WRITE_VERBS = new Set(["decide", "retire", "apply", "propose"]);
+const MEMORY_WRITE_VERBS = new Set(["decide", "retire", "apply", "propose", "tidy", "restore", "unmerge"]);
 function memoryWriteVerb(positional) {
     return MEMORY_WRITE_VERBS.has(positional[0] ?? "");
 }
@@ -13586,3 +13778,312 @@ async function releaseApproveCommand(positional, flags, context) {
         ...(shown.stopped === null ? [] : [`The release isn't running: run \`toolroll release ${chosen.branch}\` to go on.`]),
     ]);
 }
+/**
+ * `toolroll task ready <task>` (read-only; docs/plans/plain-toolroll.md P1.6): "Can I merge?" — the task's checklist
+ * from the records the task page reads (merge-checklist.ts), each blocker with the existing act that clears it. A task
+ * outside the caller's projects is no task here.
+ */
+function taskReadyCommand(positional, context) {
+    const { store, write, json } = context;
+    const command = "task ready";
+    const id = positional[0];
+    if (id === undefined || positional.length > 1)
+        return fail(write, json, command, "usage", "`toolroll task ready <task>`", EXIT.usage);
+    const lens = context.principal?.lens ?? null;
+    const ref = store.lookupRef(id);
+    if (ref === null || store.getTask(id) === null || (lens !== null && (ref.repo === null || !lens.includes(ref.repo))))
+        return fail(write, json, command, "unknown-task", `no task \`${id}\``, EXIT.refused);
+    const now = (context.clock ?? (() => context.now))();
+    const list = mergeChecklistOf(store, id, now, { principal: "operator", repos: lens, includeUnplaced: lens === null, dependencyRepos: lens }, context.evidenceRoot);
+    if (list === null)
+        return fail(write, json, command, "unknown-task", `no task \`${id}\``, EXIT.refused);
+    return succeed(write, json, command, list, () => checklistLines(list));
+}
+/** The folders with uncommitted changes: `toolroll storage` lists them so a person can decide. Never removed automatically. */
+function uncommittedLines(plan) {
+    const changed = plan.stay.filter(one => one.why === "has changes");
+    if (changed.length === 0)
+        return [];
+    return [`${changed.length === 1 ? "This folder has" : "These folders have"} uncommitted changes and stay${changed.length === 1 ? "s" : ""} until you decide (toolroll storage discard <path> --yes throws one away):`,
+        ...changed.map(one => `  ${bytesWords(one.bytes).padStart(8)}  ${one.path}${one.taskId === null ? "" : `  (${one.taskId})`}`)];
+}
+/** `toolroll map` (code-map-cli.ts): who is asking, and which projects they can open. A read needs no sign-in on this
+ * computer's own database, as `knowledge search`; a sign-in limits it to that person's projects. */
+async function mapCommand(positional, flags, context) {
+    const { store } = context;
+    const local = currentLocalOwner();
+    const { name, token } = credentialsFrom(flags, context);
+    let actor = null;
+    let repos = null;
+    const all = [...new Set([...store.knownRepos(), ...store.listProjects().map(one => one.path)])];
+    if (local !== null) {
+        actor = local.account;
+        repos = all.filter(repo => store.accountCanAccess(local.account, repo));
+    }
+    else if (name !== undefined && token !== undefined) {
+        if (!authenticateAccount(store, name, token).ok)
+            return fail(context.write, context.json, "map", "unauthenticated", "Sign in again: that login doesn't work here.", EXIT.refused);
+        const remote = activeRemote();
+        actor = name;
+        repos = all.filter(repo => store.accountCanAccess(name, repo) && (remote === null || remote.allows(repo)));
+    }
+    else
+        repos = all;
+    return runMapCommand(positional, flags, { store, write: context.write, json: context.json, now: context.clock(), actor, repos,
+        approver: repo => local === null && name !== undefined && token !== undefined && authenticateApprover(store, name, token, repo).ok,
+        door: repo => {
+            if (local !== null)
+                return { kind: "local-owner", actor: local.account };
+            if (name === undefined || token === undefined)
+                return null;
+            // The credential generation the proof is checked against, read before it, as `models` does.
+            const generation = store.accountOf(name)?.generation ?? -1;
+            const proved = authenticateApprover(store, name, token, repo);
+            return proved.ok ? { kind: "person", person: { actor: name, generation, method: proved.method } } : null;
+        } });
+}
+// ---- `toolroll task new` (docs/plans/plain-toolroll.md P2.4) -----------------------------------------------------------
+/**
+ * Start a task from a person's own terminal: their words become the exact terms, printed; "Build now?" is their yes.
+ * Filing and approving are one step (fast-start.ts), for small work a person approves without typing a password here;
+ * anything else is the ordinary `task add`, then Approve plan. Never for a script or an agent: `--json`, no terminal, a
+ * token or a remote run all refuse. The terminal UI drives it as the local owner, with --preview and --build.
+ */
+async function newTaskCommand(positional, flags, context) {
+    const { store, write, json } = context;
+    const clock = context.clock ?? (() => new Date());
+    const command = "task new";
+    const local = currentLocalOwner();
+    if (context.principal !== undefined || machineActing())
+        return fail(write, json, command, "person-only", "Only a person starts a build this way. File it with `task add`.", EXIT.refused);
+    if (local === null && (json || !personAtTerminal(context)))
+        return fail(write, json, command, "person-only", "`task new` asks a person at a terminal. Use `task add` from a script or an agent.", EXIT.refused);
+    const { name, token } = credentialsFrom(flags, context);
+    const passwordFree = token !== undefined && (local !== null || passwordlessOn(store));
+    const facts = { passwordless: local === null && passwordFree, localOwner: local !== null, freshAt: null, returnTo: "/" };
+    const buildNow = (preview, digest) => fastStartBuild(store, { preview, digest, actor: name ?? "", via: local === null ? "cli" : "terminal-ui", password: facts,
+        approveNow: (taskId, sawDigest, fast) => approve(store, taskId, name ?? "", clock(), sawDigest, token ?? "", {}, fast) }, clock());
+    const answerBuild = (built) => built.ok
+        ? succeed(write, json, command, { task: built.taskId }, () => [`Building ${built.taskId}. A builder starts it next.`])
+        : fail(write, json, command, built.reason, built.message, EXIT.refused);
+    const pressed = text(flags, "build");
+    if (pressed !== undefined) {
+        if (local === null)
+            return fail(write, json, command, "person-only", "--build is the terminal UI's own.", EXIT.refused);
+        return answerBuild(buildNow(pressed, text(flags, "digest") ?? ""));
+    }
+    const fromLink = text(flags, "from");
+    if (fromLink !== undefined)
+        return importTaskCommand(fromLink, flags, context, name);
+    const words = positional.join(" ").trim();
+    const repo = text(flags, "repo");
+    if (words === "" || repo === undefined)
+        return fail(write, json, command, "usage", "`toolroll task new \"<what should change>\" --repo <project>`", EXIT.usage);
+    const placed = canonicalProject(repo) ?? resolve(repo);
+    const prepared = name === undefined || token === undefined ? { eligible: false, reason: "password" }
+        : await prepareFastStart(store, { actor: name, repo: placed, title: words, via: local === null ? "cli" : "terminal-ui", password: facts }, clock());
+    const terms = prepared.eligible ? fastTermsLines(store, prepared.scope, placed) : [];
+    if (flags.has("preview")) {
+        if (local === null)
+            return fail(write, json, command, "person-only", "--preview is the terminal UI's own.", EXIT.refused);
+        return succeed(write, json, command, prepared.eligible ? { eligible: true, preview: prepared.preview, digest: prepared.digest, terms } : { eligible: false, reason: prepared.reason, message: fastRefusalWords(prepared.reason) }, () => []);
+    }
+    if (!prepared.eligible) {
+        write(`${fastRefusalWords(prepared.reason)} Filing it for a plan.`);
+        return addTask([words], flags, context);
+    }
+    write("Build approves exactly this:");
+    write("");
+    for (const line of terms)
+        write(`  ${line.label}: ${line.words}`);
+    write("");
+    if (!(await (context.easySeams?.confirm ?? confirm)("Build now?"))) {
+        write("Nothing started. File it for a plan with `toolroll task add`.");
+        return EXIT.refused;
+    }
+    return answerBuild(buildNow(prepared.preview, prepared.digest));
+}
+/** `toolroll task keep <id>`: "Approve it to keep it", a plan for the exact commit a fast start grew into. Approve it with `task approve`. */
+async function keepGrownCommand(positional, flags, context) {
+    const { store, write, json, clock } = context;
+    const id = positional[0];
+    if (id === undefined)
+        return fail(write, json, "task keep", "usage", "`toolroll task keep <id> --as <you> --token <t>`", EXIT.usage);
+    const acting = await askCredentials(flags, context);
+    const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
+    if (acting === null || !verified?.ok)
+        return refuseApprover(context, "task keep", verified, "keeping a change takes `--as <you> --token <t>`", id);
+    const kept = keepGrownChange(store, id, clock());
+    if (!kept.ok)
+        return fail(write, json, "task keep", "refused", kept.message, EXIT.refused);
+    return succeed(write, json, "task keep", { id, digest: kept.digest }, () => [`Its plan now names the exact commit. Approve it with \`toolroll task approve ${id}\`.`]);
+}
+/** One resume at a time per process; a release's own steps can take many minutes. */
+let resumingReleases = false;
+async function resumeHeldReleases(store, stateDir, now) {
+    if (resumingReleases)
+        return;
+    resumingReleases = true;
+    try {
+        await resumeAllowedReleases(store, stateDir, journal => runRelease({ branch: journal.branch, checkout: journal.checkout, stateDir, limits: {} }, releaseAdapters({ checkout: journal.checkout, say: () => { } })), now);
+    }
+    catch { /* the release's own journal says where it stopped; the next person act tries again */ }
+    finally {
+        resumingReleases = false;
+    }
+}
+/** `task new --from <url>`: read and quote an issue or pull request, then, on a person's yes, file it for the ordinary approval. */
+async function importTaskCommand(url, flags, context, actor) {
+    const { store, write, json } = context;
+    const clock = context.clock ?? (() => new Date());
+    const command = "task new";
+    const repo = text(flags, "repo");
+    if (repo === undefined)
+        return fail(write, json, command, "usage", "`toolroll task new --from <url> --repo <project>`", EXIT.usage);
+    const placed = canonicalProject(repo) ?? resolve(repo);
+    const read = await readGithubItem(store, { url, repo: placed }, context.easySeams?.github ?? {});
+    if (!read.ok)
+        return fail(write, json, command, read.reason, read.message, EXIT.refused);
+    write(`${read.item.kind === "pull" ? "Pull request" : "Issue"} #${read.item.number}, written outside Toolroll:`);
+    write(`  > ${read.item.title}`);
+    for (const line of read.item.body.split(/\r?\n/))
+        write(`  > ${line}`);
+    write("");
+    if (!(await (context.easySeams?.confirm ?? confirm)("Add this task? You approve its plan before anything builds."))) {
+        write("Nothing filed.");
+        return EXIT.refused;
+    }
+    const filed = await fileGithubItem(store, { url, repo: placed, actor: actor ?? "cli", shownHead: read.item.head }, clock(), context.easySeams?.github ?? {});
+    if (!filed.ok)
+        return fail(write, json, command, filed.reason, filed.message, EXIT.refused);
+    return succeed(write, json, command, { task: filed.taskId }, () => [`Filed ${filed.taskId}. Its plan is ready for you to approve.`]);
+}
+/** `toolroll flaky list|show`: reads only, for the remembered local login (or --as/--token) and its projects. */
+async function flakyCommand(positional, flags, context) {
+    const acting = await askCredentials(flags, context);
+    const verified = acting === null || currentLocalOwner() !== null ? null : verifyApproverByPassword(context.store, acting.name, acting.token, context.store.knownRepos().filter(repo => context.store.accountCanAccess(acting.name, repo)));
+    const who = currentLocalOwner() !== null ? localReader(context) : verified !== null && verified.ok ? verified.who : null;
+    return runFlakyCommand(positional, flags, { store: context.store, write: context.write, json: context.json, now: context.clock(), actor: who?.name ?? null, repos: who?.repos ?? [] });
+}
+/** The watch loop's background learning pass (docs/plans/learning-loops.md): advisory reads, each project at most every
+ * 30 minutes through the plane's own gh. A failure here never reaches the loop: it is tried on the next pass. */
+export async function refreshLearning(store, now, reads) {
+    try {
+        backfillMemoryUse(store, now());
+    }
+    catch { /* advisory: the next pass tries again */ }
+    // Project memory's clean-up proposals: deterministic, a quiet project at most weekly. Nothing changes until a person accepts.
+    for (const repo of store.knownRepos()) {
+        try {
+            scheduledTidy(store, repo, now());
+        }
+        catch { /* the next pass tries again */ }
+    }
+    for (const repo of store.knownRepos()) {
+        try {
+            const key = ciCursorKey(repo), at = now();
+            if (at.getTime() - store.serviceCursor(key) < CI_READ_EVERY_MS || ciRepositoriesOf(store, repo).length === 0)
+                continue;
+            store.setServiceCursor(key, at.getTime(), at);
+            await observeCiAttempts(store, repo, reads ?? githubReads(releaseExec, releaseTools().gh, { retry: true }), at);
+        }
+        catch { /* advisory: the next pass tries again */ }
+    }
+}
+/** `toolroll card <source>`: reads only, for the remembered local login (or --as/--token) and its projects. */
+async function cardCommand(positional, flags, context) {
+    const acting = await askCredentials(flags, context);
+    const verified = acting === null || currentLocalOwner() !== null ? null : verifyApproverByPassword(context.store, acting.name, acting.token, context.store.knownRepos().filter(repo => context.store.accountCanAccess(acting.name, repo)));
+    const who = currentLocalOwner() !== null ? localReader(context) : verified !== null && verified.ok ? verified.who : null;
+    return runCardCommand(positional, flags, { store: context.store, write: context.write, json: context.json, now: context.clock(), actor: who?.name ?? null, repos: who?.repos ?? [], evidenceRoot: context.evidenceRoot,
+        ok: (result, lines) => succeed(context.write, context.json, "card", result, lines),
+        no: (reason, message) => fail(context.write, context.json, "card", reason, message, reason === "usage" ? EXIT.usage : EXIT.refused) });
+}
+/** The laptop's local owner as a reader: its name and its projects. Never a proof: every write proves its own act. */
+function localReader(context) {
+    const local = currentLocalOwner();
+    return local === null ? null : { name: local.account, repos: context.store.knownRepos().filter(repo => context.store.accountCanAccess(local.account, repo)) };
+}
+/** What the follow-through commands need from this file: its envelope, and a verified person (follow-through-cli.ts). */
+function followThroughContext(context, flags) {
+    const { store, write, json, clock, evidenceRoot } = context;
+    return {
+        store, evidenceRoot, now: clock(),
+        ok: (command, result, lines) => succeed(write, json, command, result, lines),
+        no: (command, reason, message) => fail(write, json, command, reason, message, reason === "usage" ? EXIT.usage : EXIT.refused),
+        prove: async (command, repo) => {
+            const acting = await askCredentials(flags, context);
+            if (acting === null) {
+                fail(write, json, command, "usage", "this takes `--as <you> --token <t>`", EXIT.usage);
+                return null;
+            }
+            const authed = authenticateApprover(store, acting.name, acting.token, repo);
+            if (!authed.ok) {
+                fail(write, json, command, "not-an-approver", "that is not an approver, or the token does not match", EXIT.refused);
+                return null;
+            }
+            return acting.name;
+        },
+    };
+}
+/**
+ * `project fallback --repo <p> [--agents a,b,c] [--clear] [--allow-paid|--no-paid]`: which agents take over when one runs
+ * out of its plan (fallback.ts). New tasks seal the chain; approved ones keep theirs. Changing it is an approver's act
+ * with a password typed now, in the ledger. A lead's token never gets past the store's own check.
+ */
+async function projectFallbackCommand(positional, flags, context) {
+    const command = "project fallback";
+    const allowed = new Set(["repo", "agents", "clear", "allow-paid", "no-paid", "as", "token", "token-file", "token-env", "db", "json"]);
+    for (const name of flags.keys())
+        if (!allowed.has(name))
+            return fail(context.write, context.json, command, "usage", `--${name} is not a project fallback option.`, EXIT.usage);
+    const repoFlag = text(flags, "repo");
+    const agents = text(flags, "agents");
+    const clearing = flags.has("clear"), allowing = flags.has("allow-paid"), withdrawing = flags.has("no-paid");
+    if (positional.length > 1 || repoFlag === undefined || (clearing && agents !== undefined) || (allowing && withdrawing))
+        return fail(context.write, context.json, command, "usage", "Use project fallback --repo <project path> [--agents provider:model:plan|api-key,…] [--clear] [--allow-paid|--no-paid].", EXIT.usage);
+    const repo = await knownProject(context, repoFlag, { listed: true, canonical: true });
+    if (repo === undefined)
+        return fail(context.write, context.json, command, "not-found", "That isn't a project Toolroll knows.", EXIT.refused);
+    const words = () => {
+        const setting = fallbackSettingOf(context.store, repo);
+        if (setting === null)
+            return [`${repo}: no fallback agents. A task stops when its agent runs out of its plan.`];
+        return [`${repo}: when an agent runs out of its plan, the work moves on to:`,
+            ...setting.entries.map((one, at) => `  ${at + 1}. ${entryWords(one)}. ${entryMovesOnWords(one)}.`),
+            setting.paidGrant === null ? "Paid fallback: not allowed." : `Paid fallback: allowed by ${setting.paidGrant.by}.`];
+    };
+    const shown = () => { const setting = fallbackSettingOf(context.store, repo); return { repo, agents: setting?.entries ?? [], paidAllowed: setting?.paidGrant != null }; };
+    if (agents === undefined && !clearing && !allowing && !withdrawing)
+        return succeed(context.write, context.json, command, shown(), words);
+    const parsed = agents === undefined ? [] : agents.split(",").map(one => parseEntry(one.trim()));
+    const bad = parsed.find((one) => typeof one === "string");
+    if (bad !== undefined)
+        return fail(context.write, context.json, command, "usage", bad, EXIT.usage);
+    const acting = await askCredentials(flags, context);
+    const verified = acting === null ? null : credentialApprover(context.store, acting.name, acting.token, repo);
+    if (acting === null || !verified?.ok || !context.store.accountCanAccess(acting.name, repo))
+        return fail(context.write, context.json, command, "refused", "An approver for this project changes its fallback agents, with their password: pass --as and --token.", EXIT.refused);
+    const now = context.clock();
+    const done = context.store.transact(() => {
+        if (clearing) {
+            const one = clearFallbackChain(context.store, repo, acting.name, now);
+            if (!one.ok)
+                return one;
+        }
+        if (agents !== undefined) {
+            const one = setFallbackChain(context.store, repo, parsed, acting.name, now);
+            if (!one.ok)
+                return one;
+        }
+        if (allowing || withdrawing) {
+            const one = setPaidGrant(context.store, repo, allowing, acting.name, now);
+            if (!one.ok)
+                return one;
+        }
+        return { ok: true };
+    });
+    if (!done.ok)
+        return fail(context.write, context.json, command, "refused", done.problem, EXIT.refused);
+    return succeed(context.write, context.json, command, shown(), () => [...words(), "Tasks scoped from now on use this; tasks already approved keep the chain they were approved with."]);
+}