toolroll 0.9.99 → 0.9.101

package/dist/operate.js

@@ -123,7 +123,7 @@ import { homedir, hostname } from "node:os";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { releaseStalledUpdate, waitingUpdate } from "./toolroll-update.js";
 import { dur } from "./design/kit.js";
-import { checkoutIdle, setCheckoutIdle, leadQuickAnswersOn, setLeadQuickAnswers, openStore, openStoreNoMigrate, initLocalMode, enrollOwnerPassword, installationCreatedBy, laptopPortOf, recordLaptopPort, localModeOf, localOwnerBinding, archiveTaskFamily, restoreTaskFamily, shipChecksForTask, elapsedSeconds, CONCURRENT_WRITER_WAIT_MS, isDatabaseBusy, databasePath, BUILT_IN, parseCapabilityKey, verifiedAuthor, isDigestTime, predecessorWatches, RESULT_SCREENSHOTS, lifecycleOf, reportLifecycle, beatLifecycle, } from "./store.js";
+import { requeueEligibility, checkoutIdle, setCheckoutIdle, leadQuickAnswersOn, setLeadQuickAnswers, openStore, openStoreNoMigrate, initLocalMode, enrollOwnerPassword, installationCreatedBy, laptopPortOf, recordLaptopPort, localModeOf, localOwnerBinding, archiveTaskFamily, restoreTaskFamily, shipChecksForTask, elapsedSeconds, CONCURRENT_WRITER_WAIT_MS, isDatabaseBusy, databasePath, BUILT_IN, parseCapabilityKey, verifiedAuthor, isDigestTime, predecessorWatches, RESULT_SCREENSHOTS, lifecycleOf, reportLifecycle, beatLifecycle, } from "./store.js";
 import { createHash, randomBytes, randomInt, randomUUID } from "node:crypto";
 import { claimInstance, clearInstance, openInstanceSocket } from "./console-instance.js";
 import { backgroundOff, backgroundOn, backgroundShow, laptopStatus, laptopStop, restartOwnBuilder } from "./laptop-background.js";
@@ -220,6 +220,7 @@ import { describePublicationGrant, observeChecks, publishPass, sweepMerges, } fr
 import { checkPublishing, publishingOf, savePublishing, followPullRequests, newestPullRequestOf } from "./pull-request-flow.js";
 import { starterOf, startersFor, switchOnStarter } from "./flow-starters.js";
 import { acquire, acquireIfReady, heartbeat, release, reap, currentClaim, DEFAULT_LEASE_MS, SYNC_MAX_AGE_MS, finalize, } from "./claim.js";
+import { moveTask } from "./task-moves.js";
 import { disposeBuildOutcome, holdStaleApproval, regateTask } from "./dispose.js";
 import { proposeGrant, describeGrant, describeWithheld, permits, MUTATION_CLASSES, DEFAULT_MUTATIONS, } from "./grant.js";
 import { builtIn, guarded } from "./backend.js";
@@ -296,6 +297,7 @@ import { machineActing } from "./scope.js";
 import { reevaluateResultRecords } from "./route-results.js";
 import { holdRuleOff, routeRulesPass, taskEvidenceWords } from "./route-rules.js";
 import { ruleHoldOf } from "./route-store.js";
+import { wasInterrupted } from "./run-ending.js";
 import { loginFileOf, migrateLegacyLogin, savedLoginFile, writableLoginFile } from "./login-secrets.js";
 /**
  * 0 done · 1 broke · 2 bad usage · 3 ran fine, the answer is no.
@@ -1672,12 +1674,9 @@ function claimCommand(positional, flags, context) {
             return fail(write, json, "claim", verdict.reason, verdict.message, EXIT.refused);
     }
     const ref = store.refFor(backend, id);
-    const result = acquire(store, ref.id, runner, {
-        now,
-        token,
-        ttlMs: ttl,
-        mutation: mutationFrom(flags, now),
-    });
+    // The grant and the `running` it makes are one transaction (closed-task-claims.md §3.5): nobody can close the task
+    // between them, and a refusal writes neither.
+    const result = claimAndMarkRunning(store, backend, id, ref.id, runner, { now, token, ttlMs: ttl, mutation: mutationFrom(flags, now) });
     if (!result.ok) {
         // Two distinct refusals: somebody HOLDS it right now, or it is
         // RESERVED for a specific worker whoever asks (queue columns, v19).
@@ -1712,24 +1711,12 @@ function claimCommand(positional, flags, context) {
             return fail(write, json, "claim", "archived", `${id} is put away — restore it with \`toolroll task restore ${id}\` first`, EXIT.refused);
         if (result.reason === "draining")
             return fail(write, json, "claim", "draining", `Toolroll is restarting (draining): ${runner} takes no new work until it is back (by ${result.until})`, EXIT.refused, { until: result.until });
+        if (result.reason === "closed")
+            return fail(write, json, "claim", "closed", closedClaimWords(store, id, result.state, now), EXIT.refused, { state: result.state });
+        if (result.reason === "no-task")
+            return fail(write, json, "claim", "no-task", `no task \`${id}\``, EXIT.refused);
         return fail(write, json, "claim", result.reason, `held by ${result.by} until ${result.until}`, EXIT.refused, { holder: result.by, until: result.until });
     }
-    // Taking a task is what makes it running; leaving that to the caller would
-    // let a claimed task keep showing up as queued to anything reading state.
-    // On an idempotent REPLAY the transition runs only as the ONE narrow
-    // repair (external dispatch, finding 36): the stored claim is still the
-    // live lease and the task never left queued — anything else (cancelled,
-    // done, reopened elsewhere) mutates nothing.
-    if (result.replayed === true) {
-        const task = store.getTask(id);
-        const ref = store.lookupRef(id);
-        const stillMine = ref !== null && store.currentLiveLease(ref.id, now) === result.claim.leaseId;
-        if (task !== null && task.state === "queued" && stillMine)
-            store.setTaskState(id, "running", now);
-    }
-    else {
-        store.setTaskState(id, "running", now);
-    }
     return succeed(write, json, "claim", { lease: result.claim, reclaimed: result.reclaimed }, () => [
         `Claimed ${id} as ${runner}.`,
         `  lease   ${result.claim.leaseId}`,
@@ -1751,20 +1738,18 @@ function leaseCommand(command, positional, flags, context) {
     const ttl = readTtl(flags);
     if (ttl === null)
         return fail(write, json, name, "usage", "--ttl takes whole seconds", EXIT.usage);
-    const result = command === "heartbeat" ? heartbeat(store, lease, now, ttl) : release(store, lease, now);
+    // Releasing says the runner is finished with it, not that it succeeded, so a task left running is put back rather
+    // than marked done, in the release's own transaction (releaseToQueue).
+    const result = command === "heartbeat" ? heartbeat(store, lease, now, ttl) : releaseToQueue(store, lease, now);
     if (!result.ok) {
+        if (result.reason === "closed") {
+            return fail(write, json, name, "closed", `this lease ran out and its task is ${result.state} now, so it can't be renewed; stop rather than retry`, EXIT.refused, { state: result.state });
+        }
         const message = result.reason === "fenced"
             ? "superseded — another runner holds this task now; stop rather than retry"
             : "no such lease";
         return fail(write, json, name, result.reason, message, EXIT.refused);
     }
-    if (command === "release") {
-        const task = store.getTask(String(refExternalId(store, result.claim.taskRef)));
-        // Releasing says the runner is finished with it, not that it succeeded, so
-        // a task left running is put back rather than marked done.
-        if (task !== null && task.state === "running")
-            store.setTaskState(task.id, "queued", now);
-    }
     return succeed(write, json, name, { lease: result.claim }, () => [
         command === "heartbeat"
             ? `Still yours until ${result.claim.expiresAt}.`
@@ -3512,7 +3497,7 @@ async function tickCommand(flags, context) {
                             ? "auth-expired — requeued, sign-in needed"
                             : disposition.disposition === "fallback"
                                 ? `out of plan — moved to the next approved agent`
-                                : `${disposition.failureClass}${disposition.disposition === "backoff" ? ` — retry ${disposition.strikes}/3` : disposition.disposition === "stalled" ? " — stalled" : ""}`
+                                : `${disposition.failureClass}${disposition.disposition === "backoff" ? ` — retry ${disposition.strikes}/3` : disposition.disposition === "stalled" ? " — stalled" : disposition.closedState !== null ? ` — the task was already ${disposition.closedState}, so it stays ${disposition.closedState}` : ""}`
                         : "fenced",
                     ...(result.ok ? {} : { detail: result.message.slice(0, 200) }),
                     worktree: leased.worktree.path,
@@ -9543,7 +9528,7 @@ function reviewStatusLines(review, sourceRun) {
         queued: "legacy request retained; the worker will close it without running a model review",
         running: `running — attempt ${review.live?.attempt ?? review.attempts.length} of ${review.cap}`,
         succeeded: `succeeded on attempt ${review.succeeded?.attempt ?? 1} of ${review.cap}`,
-        retryable: `${review.latest?.outcome === "interrupted" || review.latest?.reason === "interrupted" ? "interrupted" : "failed"} on attempt ${review.latest?.attempt ?? review.attempts.length} of ${review.cap} — inspect the saved result; model reviews no longer retry`,
+        retryable: `${review.latest !== null && wasInterrupted(review.latest) ? "interrupted" : "failed"} on attempt ${review.latest?.attempt ?? review.attempts.length} of ${review.cap} — inspect the saved result; model reviews no longer retry`,
         exhausted: `exhausted — all ${review.cap} attempts ended without a review; nothing retries a fourth time`,
     };
     const first = review.state === "queued" && review.attempts.length === 0 ? "queued — waiting for a worker" : word[review.state];
@@ -10546,6 +10531,8 @@ function describeApproveFailure(reason, id) {
         return "only a person can approve this — approve it on the task page or from your paired chat";
     if (reason === "archived")
         return `${id} is put away — restore it with \`toolroll task restore ${id}\` first`;
+    if (reason === "cancelled")
+        return `${id} was cancelled, so there is nothing to approve`;
     if (reason === "second-approver")
         return `your approval of ${id} is recorded; it is protected work, so a second person needs to approve it (toolroll task approve ${id} as them)`;
     if (reason === "no-approvers") {
@@ -12066,9 +12053,6 @@ function slug(title, now) {
     const stamp = now.toISOString().slice(11, 19).replace(/:/g, "");
     return words === "" ? `task-${stamp}` : `${words}-${stamp}`;
 }
-function refExternalId(store, taskRef) {
-    return store.externalIdFor(taskRef);
-}
 function describe(error) {
     return error instanceof Error ? error.message : String(error);
 }
@@ -14299,3 +14283,60 @@ function startServiceBeats(store) {
     void delivery.runNow();
     return beats;
 }
+/**
+ * The CLI `claim`'s grant and its `running`, one transaction (docs/plans/closed-task-claims.md §3.5). A fresh grant of
+ * a built-in task moves it to running through the narrow `claim` move; a replay of the same key repairs `running` only
+ * when the task is still queued and the replayed lease is still the live one, as before. A task of another backend is
+ * never written in the built-in table.
+ */
+function claimAndMarkRunning(store, backend, id, taskRef, runner, options) {
+    const { now } = options;
+    return store.transact(() => {
+        const result = acquire(store, taskRef, runner, options);
+        if (!result.ok || backend !== BUILT_IN)
+            return result;
+        if (result.replayed === true) {
+            const task = store.getTask(id);
+            const stillMine = store.currentLiveLease(taskRef, now) === result.claim.leaseId;
+            if (task !== null && task.state === "queued" && stillMine)
+                store.setTaskState(id, "running", now);
+            return result;
+        }
+        // The grant just read this row open in this transaction, so the move cannot miss; if it ever did, throwing rolls
+        // the grant back with it.
+        if (!moveTask(store.handle, id, "claim", now))
+            throw new Error(`claim: ${id} could not be marked running`);
+        store.bumpWake();
+        return result;
+    });
+}
+/**
+ * The refusal words for a claim on a closed task: what state it is in, and only a next step that works for this task
+ * (a requeue the store would accept, a cancelled task reopened through the state verb, otherwise the task itself).
+ */
+function closedClaimWords(store, id, state, now) {
+    const head = `${id} is ${state}, so it can't be claimed.`;
+    if (state === "cancelled")
+        return `${head} To run it again, reopen it: \`toolroll task state ${id} queued\``;
+    if (requeueEligibility(store, id, now).ok)
+        return `${head} To run it again: \`toolroll task requeue ${id}\``;
+    return `${head} See its result: \`toolroll task show ${id}\``;
+}
+/**
+ * `worker release`: hand the lease back and, when this release is the one that ended the claim, put a task left
+ * running back in the queue, in one transaction, so no one can claim it in between (closed-task-claims.md §5). A
+ * duplicate release changes nothing: by then another runner may hold the task.
+ */
+function releaseToQueue(store, lease, now) {
+    return store.transact(() => {
+        const result = release(store, lease, now);
+        if (!result.ok || result.duplicate === true)
+            return result;
+        const ref = store.refForId(result.claim.taskRef);
+        if (ref === null || ref.backend !== BUILT_IN)
+            return result;
+        if (store.getTask(ref.externalId)?.state === "running")
+            store.setTaskState(ref.externalId, "queued", now);
+        return result;
+    });
+}

package/dist/plane-review.js

@@ -30,6 +30,7 @@
 import { scanForSecrets } from "./evidence.js";
 import { scrubIntegrationText } from "./integrations.js";
 import { taskWaitSnapshot } from "./lead-status.js";
+import { wasInterrupted } from "./run-ending.js";
 export const REVIEW_HOURS = 24;
 const EVIDENCE_LINES = 5;
 const WAITING_DAYS = 1;
@@ -73,7 +74,7 @@ export function runCause(run) {
         return "timeout";
     if (reason === "no-handoff")
         return "no-handoff";
-    if (reason === "interrupted" || run.outcome === "interrupted")
+    if (wasInterrupted(run))
         return run.stopped ? null : "orphaned";
     if (PROVIDER_REASONS.has(reason) || run.terminalClass === "transient-throttle")
         return "provider";

package/dist/project-knowledge.d.ts

@@ -22,18 +22,17 @@ export type KnowledgeView = ReturnType<typeof knowledgeView>;
 export declare function knowledgeVersion(store: Store, repo: string, actor: string, revision: number): Knowledge;
 /** Chat reads only an admitted project. Keep the full source in the project UI. */
 export declare function conversationKnowledge(store: Store, repo: string, actor: string, reference?: string, decision?: number): {
-    content?: never;
     history?: never;
     revision: number;
     stale: boolean;
     notice: string;
     title?: never;
+    content?: never;
     instructions?: never;
     references?: never;
     decisions?: never;
     waiting?: never;
 } | {
-    content?: never;
     revision?: never;
     history?: never;
     stale?: never;
@@ -54,6 +53,7 @@ export declare function conversationKnowledge(store: Store, repo: string, actor:
     afterwards?: string;
     notice: string;
     title?: never;
+    content?: never;
     instructions?: never;
     references?: never;
     decisions?: never;
@@ -70,9 +70,9 @@ export declare function conversationKnowledge(store: Store, repo: string, actor:
     decisions?: never;
     waiting?: never;
 } | {
-    content?: never;
     stale?: never;
     title?: never;
+    content?: never;
     revision: number;
     history: {
         revision: number;

package/dist/release-authority.d.ts

@@ -7,6 +7,15 @@ import { type ReleasePolicy, type ReleaseTerms } from "./contracts/release-terms
 import type { Store } from "./store.js";
 export type ReleaseState = "open" | "deploying" | "merge-reserved" | "merged" | "revoked" | "expired" | "superseded";
 export declare const LIVE_RELEASE_STATES: readonly ReleaseState[];
+/**
+ * Whether an authority's approval has run out at `now`. Nothing writes the `expired` state: expiry is worked out from
+ * `expires_at` here, and every reader that asks whether an authority is still good asks through this (or
+ * releaseStateAt). The one SQL reader, approval-authority.ts releaseStandsSql, states the same rule in SQL.
+ */
+export declare function releaseExpiredAt(a: Pick<ReleaseAuthority, "state" | "expiresAt">, now: Date): boolean;
+/** An authority's state as read at `now`: a live one (open, deploying, merge-reserved) past its time reads as `expired`;
+ * an ended one keeps the state it ended in. */
+export declare function releaseStateAt(a: Pick<ReleaseAuthority, "state" | "expiresAt">, now: Date): ReleaseState;
 /** One generation of a release a person approved: the single source of truth for it. */
 export type ReleaseAuthority = {
     id: number;

package/dist/release-authority.js

@@ -5,6 +5,19 @@
  */
 import { readReleasePolicy } from "./contracts/release-terms.js";
 export const LIVE_RELEASE_STATES = ["open", "deploying", "merge-reserved"];
+/**
+ * Whether an authority's approval has run out at `now`. Nothing writes the `expired` state: expiry is worked out from
+ * `expires_at` here, and every reader that asks whether an authority is still good asks through this (or
+ * releaseStateAt). The one SQL reader, approval-authority.ts releaseStandsSql, states the same rule in SQL.
+ */
+export function releaseExpiredAt(a, now) {
+    return a.state === "expired" || a.expiresAt <= now.toISOString();
+}
+/** An authority's state as read at `now`: a live one (open, deploying, merge-reserved) past its time reads as `expired`;
+ * an ended one keeps the state it ended in. */
+export function releaseStateAt(a, now) {
+    return LIVE_RELEASE_STATES.includes(a.state) && releaseExpiredAt(a, now) ? "expired" : a.state;
+}
 function readReleaseAuthority(row) {
     const text = (key) => row[key] == null ? null : String(row[key]);
     let policy = null;

package/dist/release-auto.js

@@ -26,7 +26,7 @@ import { releaseCheckStanding } from "./check-failure.js";
 import { CARRY_RULES, rulePath } from "./release-carry.js";
 import { AUTO_EVIDENCE_ACTION, AUTO_WITHDRAWN_ACTION, LIVE_RELEASE_STATES, RELEASE_APPROVAL_ACTION, releaseAuthorityOfTask, releaseAutoApproves, releaseApprovalSetting } from "./release-authority.js";
 import { autoReleaseApprovalOf, personApprovalOf } from "./scope.js";
-import { releaseOperations, revokeRelease } from "./store.js";
+import { releaseOperations, revokeRelease, withdrawApproval } from "./store.js";
 import { RELEASE_CI_HELD_ACTION, RELEASE_CI_PASSED_ACTION, RELEASE_CI_RUNNING_WORDS, releaseCiHoldOf, releaseCiRunningOf } from "./release-ci-hold.js";
 import { verificationEvidence } from "./verification-evidence.js";
 import { nightlyDebtHold } from "./nightly-github.js";
@@ -87,8 +87,7 @@ export function setReleaseApproval(store, repo, auto, by, now) {
  * marked withdrawn, so no later reading — the setting turned on again included — lets it stand. */
 function unseal(store, taskId, now) {
     withdraw(store, taskId, now);
-    store.handle.prepare(`UPDATE task_scope SET approved_at = NULL, approved_by = NULL, approved_digest = NULL, approved_profile_json = NULL,
-      approved_route_json = NULL, approval_basis = NULL, mode_digest = NULL WHERE task_id = ? AND approval_basis IN ('auto-check', 'auto-green')`).run(taskId);
+    withdrawApproval(store, { where: "WHERE task_id = ? AND approval_basis IN ('auto-check', 'auto-green')", args: [taskId] }, { basisAfter: null, clearRoute: true, clearModeDigest: true });
 }
 /** Mark a task's automatic seal's evidence withdrawn for good (its seal row may stay while an issued merge reconciles). */
 function withdraw(store, taskId, now) {

package/dist/release-gate.js

@@ -27,7 +27,7 @@ import { BEFORE_SWAP, RELEASED } from "./deploy-phase.js";
 /** The journal phases a deployment passes before it stops the old service (deploy-phase.ts, the one table). */
 export { BEFORE_SWAP };
 /** Journal fields that only the swap and later phases write. */
-const SWAP_FIELDS = ["stoppingService", "codingBackupBeforeSwap", "migration", "newService", "deployedAt"];
+const SWAP_FIELDS = ["stoppingService", "codingBackupBeforeSwap", "migration", "newService", "deployedAt", "launchd", "newServiceStop"];
 const GATE_ID = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;
 const refuse = (reason, message) => ({ ok: false, reason, message: `${message} The update pause was left as it is.` });
 /** The owner id written into the live pause's triggers, when there is one pause and it names one id. */

package/dist/release-view.js

@@ -6,6 +6,7 @@
 import { liveReleaseOf } from "./scope.js";
 import { nightlyReleaseLines } from "./nightly-github.js";
 import { releaseAuthorityOfTask, releaseCarries } from "./store.js";
+import { releaseStateAt } from "./release-authority.js";
 export function releaseViewOf(store, taskId, now, obligations = () => []) {
     const found = releaseAuthorityOfTask(store, taskId);
     if (found === null)
@@ -18,7 +19,7 @@ export function releaseViewOf(store, taskId, now, obligations = () => []) {
     return {
         kind: found.carry === null ? "anchor" : "carried",
         authority: a.id, version: a.version, pr: a.pr, state: a.state,
-        carrying: a.state === "open" && live.applies && live.ok, why: live.applies && !live.ok ? live.why : null,
+        carrying: releaseStateAt(a, now) === "open" && live.applies && live.ok, why: live.applies && !live.ok ? live.why : null,
         approver: anchor?.approvedBy ?? null, anchorTask: a.anchorTask, tipTask: a.tipTask, expiresAt: a.expiresAt,
         landed: releaseCarries(store, a.id).flatMap(carry => carry.commits.map(commit => ({ sha: commit.sha, task: carry.taskId, files: commit.files }))),
         obligations: obligations(a.id),

package/dist/release.js

@@ -667,6 +667,17 @@ export async function runRelease(options, adapters) {
                 return head !== null && head !== j.candidate.sha ? head : null;
             });
         };
+        /**
+         * Move the release back to an earlier step: write the fields the caller names (and only those), drop the named steps'
+         * intents, set the step, and save the journal. Every step-back goes through here.
+         */
+        const rewindTo = (step, fields, dropIntents = []) => {
+            Object.assign(j, fields);
+            for (const one of dropIntents)
+                delete j.intents[one];
+            j.step = step;
+            save();
+        };
         const restart = async (head, updated = false) => {
             // The step this commit was at ends here: the release goes on with the new commit (and, filed again, a new task).
             mark(j.step, "failed", `${j.branch} moved to ${head.slice(0, 7)}`);
@@ -678,16 +689,10 @@ export async function runRelease(options, adapters) {
                 const carried = await rel.carry(j.authority.id, head, randomUUID(), epoch);
                 if (carried.ok) {
                     const view = await rel.authority(carried.taskId);
+                    // The candidate is written before the gate is read, as it always was: a gate that fails leaves it moved.
                     j.candidate = { sha: head, tree };
-                    j.task = { id: carried.taskId, scopeDigest: (await adapters.toolroll.gate(carried.taskId)).scopeDigest };
-                    j.check = null;
-                    j.completion = null;
-                    j.landed = view?.landed ?? j.landed ?? [];
-                    delete j.intents.check;
-                    delete j.intents.complete;
-                    j.step = "check";
-                    j.stopped = null;
-                    save();
+                    const task = { id: carried.taskId, scopeDigest: (await adapters.toolroll.gate(carried.taskId)).scopeDigest };
+                    rewindTo("check", { task, check: null, completion: null, landed: view?.landed ?? j.landed ?? [], stopped: null }, ["check", "complete"]);
                     say(`  carried the approval to ${head.slice(0, 7)} (task ${carried.taskId})`);
                     return;
                 }
@@ -695,30 +700,16 @@ export async function runRelease(options, adapters) {
             }
             else
                 say(`  ${j.branch} moved to ${head.slice(0, 7)}: filing it for approval`);
-            j.candidate = { sha: head, tree };
-            j.task = { id: gateTaskId(j.packageVersion, head), scopeDigest: null };
-            j.approval = null;
-            j.check = null;
-            j.completion = null;
-            j.authority = null;
-            j.auto = null;
             epoch = null;
-            delete j.intents.gate;
-            delete j.intents.check;
-            delete j.intents.complete;
-            j.step = "gate";
-            j.stopped = null;
-            save();
+            rewindTo("gate", { candidate: { sha: head, tree }, task: { id: gateTaskId(j.packageVersion, head), scopeDigest: null },
+                approval: null, check: null, completion: null, authority: null, auto: null, stopped: null }, ["gate", "check", "complete"]);
         };
         /**
          * The automatic road ended without an approval: the plane takes its `auto-check` back (the task asks a person, its
          * passing check kept) and tells the owner; the release waits at approval for a person, as without the setting.
          */
         const autoRefused = async (why) => {
-            j.auto = { state: "refused", why };
-            j.check = null;
-            j.step = "approval";
-            save();
+            rewindTo("approval", { auto: { state: "refused", why }, check: null });
             await rel?.auto?.giveUp(j.task.id, why);
             throw new Stop("approval", `Not approved automatically: ${why}. A person approves task ${j.task.id} (\`toolroll task approve ${j.task.id} --digest ${j.task.scopeDigest}\`, or the console), then rerun \`${resume}\`.`);
         };
@@ -1053,10 +1044,7 @@ export async function runRelease(options, adapters) {
                                 }
                                 catch (error) {
                                     if (error instanceof Stop && error.reason === "ci-failed") {
-                                        j.auto = { state: "refused", why: error.message };
-                                        j.check = null;
-                                        j.step = "approval";
-                                        save();
+                                        rewindTo("approval", { auto: { state: "refused", why: error.message }, check: null });
                                         await rel?.auto?.giveUp(j.task.id, error.message.replace(/\.$/, ""));
                                     }
                                     throw error;

package/dist/result-shots.js

@@ -169,6 +169,6 @@ export function refuseResultShots(state, store, part, content, app, now) {
     const title = chatTitle(store, content.image?.taskId ?? content.task ?? "");
     const line = { text: `Screenshots for ${title} weren't sent: the ${app} app isn't allowed to upload files here.`,
         ...(content.task === undefined ? {} : { task: content.task }), ...(content.run === undefined ? {} : { run: content.run }) };
-    state.prepare("UPDATE chat_part SET payload=?,state='pending',next_at=NULL,problem=NULL,file=NULL,uploaded=0,uncertain=0,created=? WHERE provider=:provider AND id=?").run(savedChatPart(line), now.toISOString(), part.id);
+    state.prepare("UPDATE chat_part SET payload=?,state='pending',next_at=NULL,problem=NULL,file=NULL,uploaded=0,uncertain=0,created=? WHERE provider=:provider AND id=? AND state<>'dropped'").run(savedChatPart(line), now.toISOString(), part.id);
     state.prepare("UPDATE chat_part SET state='dropped',problem='Uploads are not allowed here' WHERE provider=:provider AND event=? AND id<>? AND state='pending'").run(part.event, part.id);
 }

package/dist/route-results.js

@@ -14,6 +14,7 @@ import { INELIGIBLE_REASONS, REASON_WORDS, selectionSchema, } from "./contracts/
 import { changedFilesOf, COMPLETION_ACTION } from "./result-completion.js";
 import { runAccounting } from "./store.js";
 import { INFRASTRUCTURE_TERMINALS, saveResultRecord } from "./route-store.js";
+import { wasInterrupted } from "./run-ending.js";
 // The execution class and the cohort snapshot live with their writer (route-store.ts), which store.ts imports: kept
 // light so the store's module graph doesn't reach the evaluator's readers.
 export { cohortOf, EXEC_CLASS_OF_REASON, execClassOf } from "./route-store.js";
@@ -49,7 +50,7 @@ function classOfRun(run, kept) {
         return kept;
     if (run.terminalClass != null && INFRASTRUCTURE_TERMINALS.has(run.terminalClass))
         return "infrastructure";
-    if ((run.outcome === "interrupted" || run.reason === "interrupted") && run.providerStartedAt === null)
+    if (wasInterrupted(run) && run.providerStartedAt === null)
         return "infrastructure";
     return "model";
 }

package/dist/run-ending.d.ts

@@ -0,0 +1,21 @@
+/**
+ * How a run ended, asked one way.
+ *
+ * "Interrupted" is stored in two spellings. Every ending written today is the outcome `failed` with the reason
+ * `interrupted`. Rows written between schema 25 and 114 carry the outcome `interrupted` itself (a held session cut
+ * down mid-flight) and still read. A check that knows only one spelling treats the same event two ways, so every check
+ * asks here.
+ */
+export declare function wasInterrupted(run: {
+    outcome: string | null;
+    reason?: string | null;
+}): boolean;
+/**
+ * The spelling written today, and only it. The roads that hand an interrupted attempt's draft to the next attempt
+ * (salvage in the checkout, the recovery grant, the check a run never reached) ask this one: they were built for the
+ * runs that write it, and reading the old spelling there would widen what they recover.
+ */
+export declare function endedInterrupted(run: {
+    outcome: unknown;
+    reason?: unknown;
+}): boolean;

package/dist/run-ending.js

@@ -0,0 +1,19 @@
+/**
+ * How a run ended, asked one way.
+ *
+ * "Interrupted" is stored in two spellings. Every ending written today is the outcome `failed` with the reason
+ * `interrupted`. Rows written between schema 25 and 114 carry the outcome `interrupted` itself (a held session cut
+ * down mid-flight) and still read. A check that knows only one spelling treats the same event two ways, so every check
+ * asks here.
+ */
+export function wasInterrupted(run) {
+    return run.outcome === "interrupted" || (run.outcome === "failed" && run.reason === "interrupted");
+}
+/**
+ * The spelling written today, and only it. The roads that hand an interrupted attempt's draft to the next attempt
+ * (salvage in the checkout, the recovery grant, the check a run never reached) ask this one: they were built for the
+ * runs that write it, and reading the old spelling there would widen what they recover.
+ */
+export function endedInterrupted(run) {
+    return run.outcome === "failed" && run.reason === "interrupted";
+}

package/dist/scope.d.ts

@@ -605,6 +605,11 @@ export type ApproveResult = {
  | {
     ok: false;
     reason: "archived";
+}
+/** The task was cancelled: a cancelled task takes no approval, by any road (a stale page, the CLI). */
+ | {
+    ok: false;
+    reason: "cancelled";
 };
 /**
  * Whether this name-and-token pair is a person the store knows. Shared by

package/dist/scope.js

@@ -52,7 +52,7 @@ import { z } from "zod";
 import {} from "./contracts/acceptance-terms.js";
 import { parseContract } from "./contracts/contract.js";
 import { readAcceptance, readScopeTerms, storedRubricSchema } from "./contracts/scope.js";
-import { taskArchived } from "./task-archive.js";
+import { taskArchived, taskCancelled } from "./task-archive.js";
 import { releaseCiHoldOf, releaseCiHoldWords } from "./release-ci-hold.js";
 import { NO_READINESS, exactModelId, legOf, projectRoute, routeDigestOf, routeFromJson, routeJsonProblem, routeWords, } from "./phase-routing.js";
 /** Same shape as a runner's credential, for the same reasons. */
@@ -1120,6 +1120,10 @@ chat) {
         // A put-away task (v145) is restored first; sealScopeApproval refuses it too, on every road.
         if (taskArchived(store, taskId))
             return { ok: false, reason: "archived" };
+        // A cancelled task takes no yes either — read here, in the seal's transaction, before any vote or proof is
+        // written: an approval page left open while the task was cancelled elsewhere, or the CLI, approves nothing.
+        if (taskCancelled(store, taskId))
+            return { ok: false, reason: "cancelled" };
         // The digest is required, not optional. An operator reads a scope, somebody
         // rewrites it, and an approval that did not name what it saw would agree to
         // the new one in silence — which is the whole failure this guards.
@@ -1443,7 +1447,7 @@ import { permissionPlainWords } from "./chat-terms.js";
 import { limitRecognised } from "./exhaustion.js";
 import { SUBSCRIPTION_CAPABLE } from "./keys.js";
 import { releaseCheckPurposeDigest, releaseTermsDigest } from "./contracts/release-terms.js";
-import { CHECK_ACCESS_WIDTH, autoEvidenceOf, carriesUnsandboxed, newestReleaseGeneration, releaseAuthorityOfTask, releaseAutoApproves, releaseSealProblem } from "./release-authority.js";
+import { CHECK_ACCESS_WIDTH, autoEvidenceOf, carriesUnsandboxed, newestReleaseGeneration, releaseAuthorityOfTask, releaseAutoApproves, releaseSealProblem, releaseStateAt } from "./release-authority.js";
 /** Whether the command running now is a machine's: the lead (its token) or a remote API run. Trusted context only. */
 export const machineActing = () => currentActor()?.lead === true || activeRemote() !== null;
 /** A proof row's detail, either form: the legacy text (`<at> · generation <n> · digest <d>`) or the versioned record
@@ -1550,6 +1554,9 @@ export function liveReleaseOf(store, taskId, action, now = new Date()) {
     // A put-away task (v145, task-tidy.md), or a put-away anchor, deploys, merges and carries nothing: restore it first.
     if (taskArchived(store, taskId) || taskArchived(store, a.anchorTask))
         return refuse("the release task is put away");
+    // A cancelled task, or a cancelled anchor, the same: cancelling ends what its approval allows.
+    if (taskCancelled(store, taskId) || taskCancelled(store, a.anchorTask))
+        return refuse("the release task was cancelled");
     const newest = newestReleaseGeneration(store, a.repo, a.version, a.pr);
     if (newest === null || newest.id !== a.id)
         return refuse("a newer approval of this release replaced this one");
@@ -1558,7 +1565,7 @@ export function liveReleaseOf(store, taskId, action, now = new Date()) {
     if (a.state === "revoked")
         return refuse(`${a.endedBy ?? "an approver"} stopped carrying commits for this release`);
     // Expiry stops every live state (security review): an operation already reserved finishes only through reconciliation.
-    if (a.state === "expired" || ((a.state === "open" || a.state === "deploying" || a.state === "merge-reserved") && a.expiresAt <= now.toISOString()))
+    if (releaseStateAt(a, now) === "expired")
         return refuse("the release approval expired");
     if (a.state === "merged")
         return refuse("the release was already merged");

package/dist/server/chrome.d.ts

@@ -56,7 +56,7 @@ export declare const DEMO_BANNER_SHORT = "Demo: sample projects. Nothing calls a
  * a person's accent (accentHead) still wins over the generated default. */
 export declare const STYLE: string;
 /** Appearance: a three-way segmented switch, one tap per choice. */
-export declare const THEME_CONTROLS_CSS = ".task-repo select{width:100%;min-height:2.75rem;font-size:1rem}.task-repo-add{margin:.35rem .1rem .5rem}.task-repo-add a{display:inline-flex;align-items:center;min-height:2.25rem}details.result-request-open.result-request-form>summary{border:0;background:transparent;padding:.5rem 0;min-height:2.75rem;font-weight:600;display:list-item;list-style:revert}details.result-request-open.result-request-form>summary::-webkit-details-marker{display:revert}form.js-autosave button[type=submit]{display:none}.provider-row{border-bottom:1px solid var(--so-line);padding:.35rem 0}.provider-row:first-of-type{border-top:1px solid var(--so-line)}.provider-head{display:flex;align-items:center;gap:.75rem;margin:.4rem 0 0}.provider-status{display:inline-flex;align-items:center;gap:.4rem;color:var(--so-muted);font-size:.875rem}.provider-status i{width:.5rem;height:.5rem;border-radius:50%;background:var(--so-muted)}.provider-status--ok i{background:var(--so-success)}.provider-status--warn i{background:var(--so-attention)}.provider-status--off i{background:transparent;border:1.5px solid var(--so-muted)}details.provider-manage>summary{cursor:pointer;color:var(--so-accent-text);font-size:.875rem;min-height:2.5rem;display:list-item;padding-block:.5rem}.card.props .row{display:grid;gap:.1rem;margin:0 0 .75rem}.card.props .row>.meta{display:block;font-size:.75rem}.card.props .row>.meta::first-letter{text-transform:uppercase}.card.props .row>.mono{font-family:var(--font-sans);font-size:.875rem}.card.props .row>.mono .seal{font-family:var(--font-mono);font-size:.8125rem}details.evidence-files{margin:1rem 0}details.evidence-files>summary{cursor:pointer;min-height:2.75rem;display:list-item;padding-block:.7rem;font-weight:600}details.evidence-files ul{list-style:none;margin:0;padding:0}details.evidence-files li{display:flex;justify-content:space-between;gap:1rem;padding:.5rem 0;border-bottom:1px solid var(--so-line)}.result-action .result-feedback-link{display:inline-flex;align-items:center;min-height:2.5rem;padding:.5rem 1rem;border:1px solid var(--so-input-line);border-radius:.5rem;background:var(--so-paper);color:var(--so-ink);font-weight:600;text-decoration:none}@media(hover:hover) and (pointer:fine){.result-action .result-feedback-link:hover{background:var(--so-raised)}}.so-sr-only{position:absolute!important;width:1px!important;height:1px!important;padding:0!important;margin:-1px!important;overflow:hidden!important;clip:rect(0,0,0,0)!important;white-space:nowrap!important;border:0!important}.verdict{margin:.5rem 0 .75rem}.verdict-chips{display:flex;flex-wrap:wrap;gap:.4rem;list-style:none;padding:0;margin:0}.verdict-chip{display:inline-flex;align-items:center;gap:.3rem;min-height:1.75rem;padding:.2rem .65rem;border-radius:999px;font-size:.8125rem;font-weight:600;background:var(--so-neutral-soft);color:var(--so-neutral-ink)}.verdict-chip svg{width:.9rem;height:.9rem}.verdict-chip--success{background:var(--so-success-soft);color:var(--so-success)}.verdict-chip--danger{background:var(--so-danger-soft);color:var(--so-danger)}.verdict-chip--warning{background:var(--so-warning-soft);color:var(--so-warning)}.verdict-chip--info{background:var(--so-info-soft);color:var(--so-info)}.verdict-by{margin:.4rem 0 0}details.result-request-open{margin:.5rem 0}details.result-request-open>summary{display:inline-flex;align-items:center;min-height:2.5rem;padding:.5rem 1rem;border:1px solid var(--so-input-line);border-radius:.5rem;background:var(--so-paper);color:var(--so-ink);font-weight:600;cursor:pointer;list-style:none}details.result-request-open>summary::-webkit-details-marker{display:none}details.result-request-open[open]>summary{margin-bottom:.75rem}.settings-tiles{display:grid;gap:1.25rem;margin:0 0 2rem}.settings-tiles h2{margin:0 0 .5rem;font-size:.875rem;font-weight:600;color:var(--so-muted)}.settings-tiles section>div{display:grid;grid-template-columns:repeat(auto-fill,minmax(8.5rem,1fr));gap:.5rem}.settings-tiles a>span{display:grid;gap:.1rem;min-width:0}.settings-tiles .provider-status{font-weight:400;font-size:.8125rem}.settings-tiles a{display:flex;align-items:center;gap:.6rem;min-height:3rem;padding:.65rem .8rem;border:1px solid var(--so-line);border-radius:.625rem;background:var(--so-paper);color:var(--so-ink);text-decoration:none;font-weight:550;font-size:.875rem}@media(hover:hover) and (pointer:fine){.settings-tiles a:hover{border-color:var(--so-input-line);background:var(--so-raised)}}.settings-tiles a>svg{width:1.1rem;height:1.1rem;flex-shrink:0;color:var(--so-accent-text)}details.settings-more{margin:.25rem 0 1.25rem}details.settings-more>summary{cursor:pointer;min-height:2.75rem;display:list-item;padding-block:.7rem;font-weight:550}details.settings-more>summary .meta{font-weight:400;margin-left:.35rem}.settings-changed{margin-top:-.25rem}.appearance{margin:0 0 28px}.appearance h2{margin:0 0 10px}.theme-switch{display:inline-flex;flex-wrap:nowrap;max-width:100%;gap:4px;padding:4px;margin:0;border:1px solid var(--so-line);border-radius:10px;background:var(--so-raised)}.theme-switch .theme-choice,.so-native-region .theme-switch .theme-choice{flex:1 1 0;width:auto;white-space:nowrap;min-height:40px;padding:8px 16px;border:0;border-radius:7px;background:transparent;color:var(--so-muted);font:inherit;font-weight:550;box-shadow:none;cursor:pointer}@media(hover:hover) and (pointer:fine){.theme-switch .theme-choice:hover{color:var(--so-ink)}}.theme-switch .theme-choice[aria-pressed=\"true\"]{background:var(--so-paper);color:var(--so-ink);box-shadow:0 1px 2px rgb(0 0 0 / .1)}.appearance .meta{margin:8px 0 0}@media(max-width:600px){.theme-switch .theme-choice{min-height:44px}}.update-notes{white-space:pre-wrap;overflow-wrap:anywhere;font:inherit;max-height:18rem;overflow:auto}";
+export declare const THEME_CONTROLS_CSS = ".task-repo select{width:100%;min-height:2.75rem;font-size:1rem}.task-repo-add{margin:.35rem .1rem .5rem}.task-repo-add a{display:inline-flex;align-items:center;min-height:2.25rem}details.result-request-open.result-request-form>summary{border:0;background:transparent;padding:.5rem 0;min-height:2.75rem;font-weight:600;display:list-item;list-style:revert}details.result-request-open.result-request-form>summary::-webkit-details-marker{display:revert}form.js-autosave button[type=submit]{display:none}.provider-row{border-bottom:1px solid var(--so-line);padding:.35rem 0}.provider-row:first-of-type{border-top:1px solid var(--so-line)}.provider-head{display:flex;align-items:center;gap:.75rem;margin:.4rem 0 0}.provider-status{display:inline-flex;align-items:center;gap:.4rem;color:var(--so-muted);font-size:.875rem}.provider-status i{width:.5rem;height:.5rem;border-radius:50%;background:var(--so-muted)}.provider-status--ok i{background:var(--so-success)}.provider-status--warn i{background:var(--so-attention)}.provider-status--off i{background:transparent;border:1.5px solid var(--so-muted)}details.provider-manage>summary{cursor:pointer;color:var(--so-accent-text);font-size:.875rem;min-height:2.5rem;display:list-item;padding-block:.5rem}.card.props .row{display:grid;gap:.1rem;margin:0 0 .75rem}.card.props .row>.meta{display:block;font-size:.75rem}.card.props .row>.meta::first-letter{text-transform:uppercase}.card.props .row>.mono{font-family:var(--font-sans);font-size:.875rem}.card.props .row>.mono .seal{font-family:var(--font-mono);font-size:.8125rem}details.evidence-files{margin:1rem 0}details.evidence-files>summary{cursor:pointer;min-height:2.75rem;display:list-item;padding-block:.7rem;font-weight:600}details.evidence-files ul{list-style:none;margin:0;padding:0}details.evidence-files li{display:flex;justify-content:space-between;gap:1rem;padding:.5rem 0;border-bottom:1px solid var(--so-line)}.result-action .result-feedback-link{display:inline-flex;align-items:center;min-height:2.5rem;padding:.5rem 1rem;border:1px solid var(--so-input-line);border-radius:.5rem;background:var(--so-paper);color:var(--so-ink);font-weight:600;text-decoration:none}@media(hover:hover) and (pointer:fine){.result-action .result-feedback-link:hover{background:var(--so-raised)}}.so-sr-only{position:absolute!important;width:1px!important;height:1px!important;padding:0!important;margin:-1px!important;overflow:hidden!important;clip:rect(0,0,0,0)!important;white-space:nowrap!important;border:0!important}.verdict{margin:.5rem 0 .75rem}.verdict-chips{display:flex;flex-wrap:wrap;gap:.4rem;list-style:none;padding:0;margin:0}.verdict-chip{display:inline-flex;align-items:center;gap:.3rem;min-height:1.75rem;padding:.2rem .65rem;border-radius:999px;font-size:.8125rem;font-weight:600;background:var(--so-neutral-soft);color:var(--so-neutral-ink)}.verdict-chip svg{width:.9rem;height:.9rem}.verdict-chip--success{background:var(--so-success-soft);color:var(--so-success)}.verdict-chip--danger{background:var(--so-danger-soft);color:var(--so-danger)}.verdict-chip--warning{background:var(--so-neutral-soft);color:var(--so-ink)}.verdict-chip--info{background:var(--so-info-soft);color:var(--so-info)}.verdict-by{margin:.4rem 0 0}details.result-request-open{margin:.5rem 0}details.result-request-open>summary{display:inline-flex;align-items:center;min-height:2.5rem;padding:.5rem 1rem;border:1px solid var(--so-input-line);border-radius:.5rem;background:var(--so-paper);color:var(--so-ink);font-weight:600;cursor:pointer;list-style:none}details.result-request-open>summary::-webkit-details-marker{display:none}details.result-request-open[open]>summary{margin-bottom:.75rem}.settings-tiles{display:grid;gap:1.25rem;margin:0 0 2rem}.settings-tiles h2{margin:0 0 .5rem;font-size:.875rem;font-weight:600;color:var(--so-muted)}.settings-tiles section>div{display:grid;grid-template-columns:repeat(auto-fill,minmax(8.5rem,1fr));gap:.5rem}.settings-tiles a>span{display:grid;gap:.1rem;min-width:0}.settings-tiles .provider-status{font-weight:400;font-size:.8125rem}.settings-tiles a{display:flex;align-items:center;gap:.6rem;min-height:3rem;padding:.65rem .8rem;border:1px solid var(--so-line);border-radius:.625rem;background:var(--so-paper);color:var(--so-ink);text-decoration:none;font-weight:550;font-size:.875rem}@media(hover:hover) and (pointer:fine){.settings-tiles a:hover{border-color:var(--so-input-line);background:var(--so-raised)}}.settings-tiles a>svg{width:1.1rem;height:1.1rem;flex-shrink:0;color:var(--so-accent-text)}details.settings-more{margin:.25rem 0 1.25rem}details.settings-more>summary{cursor:pointer;min-height:2.75rem;display:list-item;padding-block:.7rem;font-weight:550}details.settings-more>summary .meta{font-weight:400;margin-left:.35rem}.settings-changed{margin-top:-.25rem}.appearance{margin:0 0 28px}.appearance h2{margin:0 0 10px}.theme-switch{display:inline-flex;flex-wrap:nowrap;max-width:100%;gap:4px;padding:4px;margin:0;border:1px solid var(--so-line);border-radius:10px;background:var(--so-raised)}.theme-switch .theme-choice,.so-native-region .theme-switch .theme-choice{flex:1 1 0;width:auto;white-space:nowrap;min-height:40px;padding:8px 16px;border:0;border-radius:7px;background:transparent;color:var(--so-muted);font:inherit;font-weight:550;box-shadow:none;cursor:pointer}@media(hover:hover) and (pointer:fine){.theme-switch .theme-choice:hover{color:var(--so-ink)}}.theme-switch .theme-choice[aria-pressed=\"true\"]{background:var(--so-paper);color:var(--so-ink);box-shadow:0 1px 2px rgb(0 0 0 / .1)}.appearance .meta{margin:8px 0 0}@media(max-width:600px){.theme-switch .theme-choice{min-height:44px}}.update-notes{white-space:pre-wrap;overflow-wrap:anywhere;font:inherit;max-height:18rem;overflow:auto}";
 /** The page CSS this module writes itself (not the imported modules'), for the stylesheet contract tests. */
 export declare const PAGE_CSS: string;
 /** The Inbox tabs (console v2): a segmented track of real links; the dot marks a tab with something new, on phones only. */

package/dist/server/chrome.js

@@ -150,7 +150,7 @@ export const STYLE = readFileSync(join(import.meta.dirname, "..", "design", "tok
     // server pages (server/kit.ts) and React views (browser/kit/) looks the same everywhere.
     readFileSync(join(import.meta.dirname, "..", "design", "kit.css"), "utf8");
 /** Appearance: a three-way segmented switch, one tap per choice. */
-export const THEME_CONTROLS_CSS = `.task-repo select{width:100%;min-height:2.75rem;font-size:1rem}.task-repo-add{margin:.35rem .1rem .5rem}.task-repo-add a{display:inline-flex;align-items:center;min-height:2.25rem}details.result-request-open.result-request-form>summary{border:0;background:transparent;padding:.5rem 0;min-height:2.75rem;font-weight:600;display:list-item;list-style:revert}details.result-request-open.result-request-form>summary::-webkit-details-marker{display:revert}form.js-autosave button[type=submit]{display:none}.provider-row{border-bottom:1px solid var(--so-line);padding:.35rem 0}.provider-row:first-of-type{border-top:1px solid var(--so-line)}.provider-head{display:flex;align-items:center;gap:.75rem;margin:.4rem 0 0}.provider-status{display:inline-flex;align-items:center;gap:.4rem;color:var(--so-muted);font-size:.875rem}.provider-status i{width:.5rem;height:.5rem;border-radius:50%;background:var(--so-muted)}.provider-status--ok i{background:var(--so-success)}.provider-status--warn i{background:var(--so-attention)}.provider-status--off i{background:transparent;border:1.5px solid var(--so-muted)}details.provider-manage>summary{cursor:pointer;color:var(--so-accent-text);font-size:.875rem;min-height:2.5rem;display:list-item;padding-block:.5rem}.card.props .row{display:grid;gap:.1rem;margin:0 0 .75rem}.card.props .row>.meta{display:block;font-size:.75rem}.card.props .row>.meta::first-letter{text-transform:uppercase}.card.props .row>.mono{font-family:var(--font-sans);font-size:.875rem}.card.props .row>.mono .seal{font-family:var(--font-mono);font-size:.8125rem}details.evidence-files{margin:1rem 0}details.evidence-files>summary{cursor:pointer;min-height:2.75rem;display:list-item;padding-block:.7rem;font-weight:600}details.evidence-files ul{list-style:none;margin:0;padding:0}details.evidence-files li{display:flex;justify-content:space-between;gap:1rem;padding:.5rem 0;border-bottom:1px solid var(--so-line)}.result-action .result-feedback-link{display:inline-flex;align-items:center;min-height:2.5rem;padding:.5rem 1rem;border:1px solid var(--so-input-line);border-radius:.5rem;background:var(--so-paper);color:var(--so-ink);font-weight:600;text-decoration:none}@media(hover:hover) and (pointer:fine){.result-action .result-feedback-link:hover{background:var(--so-raised)}}.so-sr-only{position:absolute!important;width:1px!important;height:1px!important;padding:0!important;margin:-1px!important;overflow:hidden!important;clip:rect(0,0,0,0)!important;white-space:nowrap!important;border:0!important}.verdict{margin:.5rem 0 .75rem}.verdict-chips{display:flex;flex-wrap:wrap;gap:.4rem;list-style:none;padding:0;margin:0}.verdict-chip{display:inline-flex;align-items:center;gap:.3rem;min-height:1.75rem;padding:.2rem .65rem;border-radius:999px;font-size:.8125rem;font-weight:600;background:var(--so-neutral-soft);color:var(--so-neutral-ink)}.verdict-chip svg{width:.9rem;height:.9rem}.verdict-chip--success{background:var(--so-success-soft);color:var(--so-success)}.verdict-chip--danger{background:var(--so-danger-soft);color:var(--so-danger)}.verdict-chip--warning{background:var(--so-warning-soft);color:var(--so-warning)}.verdict-chip--info{background:var(--so-info-soft);color:var(--so-info)}.verdict-by{margin:.4rem 0 0}details.result-request-open{margin:.5rem 0}details.result-request-open>summary{display:inline-flex;align-items:center;min-height:2.5rem;padding:.5rem 1rem;border:1px solid var(--so-input-line);border-radius:.5rem;background:var(--so-paper);color:var(--so-ink);font-weight:600;cursor:pointer;list-style:none}details.result-request-open>summary::-webkit-details-marker{display:none}details.result-request-open[open]>summary{margin-bottom:.75rem}.settings-tiles{display:grid;gap:1.25rem;margin:0 0 2rem}.settings-tiles h2{margin:0 0 .5rem;font-size:.875rem;font-weight:600;color:var(--so-muted)}.settings-tiles section>div{display:grid;grid-template-columns:repeat(auto-fill,minmax(8.5rem,1fr));gap:.5rem}.settings-tiles a>span{display:grid;gap:.1rem;min-width:0}.settings-tiles .provider-status{font-weight:400;font-size:.8125rem}.settings-tiles a{display:flex;align-items:center;gap:.6rem;min-height:3rem;padding:.65rem .8rem;border:1px solid var(--so-line);border-radius:.625rem;background:var(--so-paper);color:var(--so-ink);text-decoration:none;font-weight:550;font-size:.875rem}@media(hover:hover) and (pointer:fine){.settings-tiles a:hover{border-color:var(--so-input-line);background:var(--so-raised)}}.settings-tiles a>svg{width:1.1rem;height:1.1rem;flex-shrink:0;color:var(--so-accent-text)}details.settings-more{margin:.25rem 0 1.25rem}details.settings-more>summary{cursor:pointer;min-height:2.75rem;display:list-item;padding-block:.7rem;font-weight:550}details.settings-more>summary .meta{font-weight:400;margin-left:.35rem}.settings-changed{margin-top:-.25rem}.appearance{margin:0 0 28px}.appearance h2{margin:0 0 10px}.theme-switch{display:inline-flex;flex-wrap:nowrap;max-width:100%;gap:4px;padding:4px;margin:0;border:1px solid var(--so-line);border-radius:10px;background:var(--so-raised)}.theme-switch .theme-choice,.so-native-region .theme-switch .theme-choice{flex:1 1 0;width:auto;white-space:nowrap;min-height:40px;padding:8px 16px;border:0;border-radius:7px;background:transparent;color:var(--so-muted);font:inherit;font-weight:550;box-shadow:none;cursor:pointer}@media(hover:hover) and (pointer:fine){.theme-switch .theme-choice:hover{color:var(--so-ink)}}.theme-switch .theme-choice[aria-pressed="true"]{background:var(--so-paper);color:var(--so-ink);box-shadow:0 1px 2px rgb(0 0 0 / .1)}.appearance .meta{margin:8px 0 0}@media(max-width:600px){.theme-switch .theme-choice{min-height:44px}}.update-notes{white-space:pre-wrap;overflow-wrap:anywhere;font:inherit;max-height:18rem;overflow:auto}`;
+export const THEME_CONTROLS_CSS = `.task-repo select{width:100%;min-height:2.75rem;font-size:1rem}.task-repo-add{margin:.35rem .1rem .5rem}.task-repo-add a{display:inline-flex;align-items:center;min-height:2.25rem}details.result-request-open.result-request-form>summary{border:0;background:transparent;padding:.5rem 0;min-height:2.75rem;font-weight:600;display:list-item;list-style:revert}details.result-request-open.result-request-form>summary::-webkit-details-marker{display:revert}form.js-autosave button[type=submit]{display:none}.provider-row{border-bottom:1px solid var(--so-line);padding:.35rem 0}.provider-row:first-of-type{border-top:1px solid var(--so-line)}.provider-head{display:flex;align-items:center;gap:.75rem;margin:.4rem 0 0}.provider-status{display:inline-flex;align-items:center;gap:.4rem;color:var(--so-muted);font-size:.875rem}.provider-status i{width:.5rem;height:.5rem;border-radius:50%;background:var(--so-muted)}.provider-status--ok i{background:var(--so-success)}.provider-status--warn i{background:var(--so-attention)}.provider-status--off i{background:transparent;border:1.5px solid var(--so-muted)}details.provider-manage>summary{cursor:pointer;color:var(--so-accent-text);font-size:.875rem;min-height:2.5rem;display:list-item;padding-block:.5rem}.card.props .row{display:grid;gap:.1rem;margin:0 0 .75rem}.card.props .row>.meta{display:block;font-size:.75rem}.card.props .row>.meta::first-letter{text-transform:uppercase}.card.props .row>.mono{font-family:var(--font-sans);font-size:.875rem}.card.props .row>.mono .seal{font-family:var(--font-mono);font-size:.8125rem}details.evidence-files{margin:1rem 0}details.evidence-files>summary{cursor:pointer;min-height:2.75rem;display:list-item;padding-block:.7rem;font-weight:600}details.evidence-files ul{list-style:none;margin:0;padding:0}details.evidence-files li{display:flex;justify-content:space-between;gap:1rem;padding:.5rem 0;border-bottom:1px solid var(--so-line)}.result-action .result-feedback-link{display:inline-flex;align-items:center;min-height:2.5rem;padding:.5rem 1rem;border:1px solid var(--so-input-line);border-radius:.5rem;background:var(--so-paper);color:var(--so-ink);font-weight:600;text-decoration:none}@media(hover:hover) and (pointer:fine){.result-action .result-feedback-link:hover{background:var(--so-raised)}}.so-sr-only{position:absolute!important;width:1px!important;height:1px!important;padding:0!important;margin:-1px!important;overflow:hidden!important;clip:rect(0,0,0,0)!important;white-space:nowrap!important;border:0!important}.verdict{margin:.5rem 0 .75rem}.verdict-chips{display:flex;flex-wrap:wrap;gap:.4rem;list-style:none;padding:0;margin:0}.verdict-chip{display:inline-flex;align-items:center;gap:.3rem;min-height:1.75rem;padding:.2rem .65rem;border-radius:999px;font-size:.8125rem;font-weight:600;background:var(--so-neutral-soft);color:var(--so-neutral-ink)}.verdict-chip svg{width:.9rem;height:.9rem}.verdict-chip--success{background:var(--so-success-soft);color:var(--so-success)}.verdict-chip--danger{background:var(--so-danger-soft);color:var(--so-danger)}.verdict-chip--warning{background:var(--so-neutral-soft);color:var(--so-ink)}.verdict-chip--info{background:var(--so-info-soft);color:var(--so-info)}.verdict-by{margin:.4rem 0 0}details.result-request-open{margin:.5rem 0}details.result-request-open>summary{display:inline-flex;align-items:center;min-height:2.5rem;padding:.5rem 1rem;border:1px solid var(--so-input-line);border-radius:.5rem;background:var(--so-paper);color:var(--so-ink);font-weight:600;cursor:pointer;list-style:none}details.result-request-open>summary::-webkit-details-marker{display:none}details.result-request-open[open]>summary{margin-bottom:.75rem}.settings-tiles{display:grid;gap:1.25rem;margin:0 0 2rem}.settings-tiles h2{margin:0 0 .5rem;font-size:.875rem;font-weight:600;color:var(--so-muted)}.settings-tiles section>div{display:grid;grid-template-columns:repeat(auto-fill,minmax(8.5rem,1fr));gap:.5rem}.settings-tiles a>span{display:grid;gap:.1rem;min-width:0}.settings-tiles .provider-status{font-weight:400;font-size:.8125rem}.settings-tiles a{display:flex;align-items:center;gap:.6rem;min-height:3rem;padding:.65rem .8rem;border:1px solid var(--so-line);border-radius:.625rem;background:var(--so-paper);color:var(--so-ink);text-decoration:none;font-weight:550;font-size:.875rem}@media(hover:hover) and (pointer:fine){.settings-tiles a:hover{border-color:var(--so-input-line);background:var(--so-raised)}}.settings-tiles a>svg{width:1.1rem;height:1.1rem;flex-shrink:0;color:var(--so-accent-text)}details.settings-more{margin:.25rem 0 1.25rem}details.settings-more>summary{cursor:pointer;min-height:2.75rem;display:list-item;padding-block:.7rem;font-weight:550}details.settings-more>summary .meta{font-weight:400;margin-left:.35rem}.settings-changed{margin-top:-.25rem}.appearance{margin:0 0 28px}.appearance h2{margin:0 0 10px}.theme-switch{display:inline-flex;flex-wrap:nowrap;max-width:100%;gap:4px;padding:4px;margin:0;border:1px solid var(--so-line);border-radius:10px;background:var(--so-raised)}.theme-switch .theme-choice,.so-native-region .theme-switch .theme-choice{flex:1 1 0;width:auto;white-space:nowrap;min-height:40px;padding:8px 16px;border:0;border-radius:7px;background:transparent;color:var(--so-muted);font:inherit;font-weight:550;box-shadow:none;cursor:pointer}@media(hover:hover) and (pointer:fine){.theme-switch .theme-choice:hover{color:var(--so-ink)}}.theme-switch .theme-choice[aria-pressed="true"]{background:var(--so-paper);color:var(--so-ink);box-shadow:0 1px 2px rgb(0 0 0 / .1)}.appearance .meta{margin:8px 0 0}@media(max-width:600px){.theme-switch .theme-choice{min-height:44px}}.update-notes{white-space:pre-wrap;overflow-wrap:anywhere;font:inherit;max-height:18rem;overflow:auto}`;
 /** The page CSS this module writes itself (not the imported modules'), for the stylesheet contract tests. */
 export const PAGE_CSS = STYLE + THEME_CONTROLS_CSS;
 /** The Inbox tabs (console v2): a segmented track of real links; the dot marks a tab with something new, on phones only. */