wicked-crew 0.11.0 → 0.12.1

package/dist/api/routes.js

@@ -48,7 +48,8 @@ import { isSteeringAuthorRun, landSteeringProposal } from './steering-landing.js
 import { inventoryComplete, parseInventoryClaims } from '../core/inventory-claim.js';
 import { ApproveEditSchema, approveEdited, captureLaunchRoots, editInFlight, FileProposalSchema, registerCaptureRoutes } from './capture.js';
 import { registerTestingRoutes } from './testing.js';
-import { DEMO_PRESET, demoLaunchRoots, registerDemoRoutes, registerWalkthroughRoutes, walkthroughAcceptance } from './recording.js';
+import { DEMO_PRESET, demoLaunchRoots, registerDemoDocumentRoute, registerDemoRoutes, registerWalkthroughRoutes, walkthroughAcceptance } from './recording.js';
+import { projectDocsRoot } from '../interactive/project-root.js';
 import { registerSkillsRoutes } from './skills.js';
 import { registerMcpRoutes } from './mcp.js';
 import { McpPolicies } from '../mcp/policies.js';
@@ -59,7 +60,8 @@ import { BASE_SKILL_POLICIES, BASE_SKILL_REF_SHAPE, baseSkillRemedy } from '../s
 import { REQUIRED_GARDEN_VERSION } from '../skills/plugin-source.js';
 import { engineRosterJson, noEligibleSeatBody, parseNoEligibleSeat } from '../core/engine-roster.js';
 import { launchAssuranceNotice } from '../core/assurance.js';
-import { QE_ACCEPTANCE, QE_PRESETS, aggregateReceipt, postHocDeliveryAssurance, qeAcceptanceFromView, qeAcceptanceRefusal, receiptOf, qeAcceptanceNotRequired, qeDecisionBypasses, qeDecisionOf, unreadableQeAcceptance, } from './delivery-assurance.js';
+import { launchRequiresQe, mayRequireQe, qeAcceptanceMode, qeSettingSkipReason } from '../core/qe-acceptance-setting.js';
+import { aggregateReceipt, postHocDeliveryAssurance, qeAcceptanceFromView, qeAcceptanceRefusal, QE_ACCEPTANCE_REQUIRED_CODE, receiptOf, qeAcceptanceNotRequired, qeDecisionBypasses, qeDecisionOf, unreadableQeAcceptance, } from './delivery-assurance.js';
 import { ProjectSettingsStore } from '../projects/settings.js';
 import { isHumanOperator } from './watch-routes.js';
 import { boundOrigin, InteractiveBridgePool } from '../interactive/bridge-pool.js';
@@ -1079,6 +1081,9 @@ runtime = {}) {
     // spellings where the contract has no name, statusCodes list every code the route answers on
     // purpose. Declared on the highest-traffic run-lifecycle routes first; the manifest records
     // null / [] for the rest ("where declared", never invented). See src/api/endpoint-manifest.ts.
+    // The daemon's QE acceptance setting as read now ('required' when the settings cannot be read:
+    // fail closed, never off by accident).
+    const qeAcceptanceNow = async () => qeAcceptanceMode(await Promise.resolve().then(() => adapter.getSettings()).catch(() => null));
     app.get(`${V}/health`, { config: { manifest: { statusCodes: [200] } } }, async () => {
         const ping = await enginePing();
         // F-E2E-030: what this deployment can keep. A composer reads `capabilities.deliverGate`
@@ -1105,6 +1110,9 @@ runtime = {}) {
             // QE-IN-APP-WORKFLOWS: `LaunchRunBody.skipQeAcceptance` / `forceQeAcceptance` reach an addon
             // that carries the QE decision; never an invented capability.
             qeAcceptanceOverride: typeof adapter.engineCapabilities === 'function' && addonSupportsQeOverride(),
+            // api-types 0.120.0: the daemon's QE acceptance setting, read per probe ('off' = every launch
+            // that requires QE acceptance skips it, labelled with the setting).
+            qeAcceptance: await qeAcceptanceNow(),
         };
         // wicked-core#411 / crew#497: the state-home blocker rides the health probe as a WARNING. The
         // daemon still SERVES (status stays ok — studio must load and show the blocker) but refuses to
@@ -1657,6 +1665,11 @@ runtime = {}) {
         }
         return null;
     };
+    /**
+     * crew#1019: registration is durable even when onboarding cannot launch (core has no unregister).
+     * A landed local repo returns 201 with `onboardRunId: null` and `onboardError` on launch failure, so
+     * callers can still attach it to their project and retry onboarding separately.
+     */
     app.post(`${V}/repos`, async (req, reply) => {
         const parsed = RegisterRepoSchema.safeParse(req.body);
         if (!parsed.success) {
@@ -1672,6 +1685,8 @@ runtime = {}) {
             if (gitUrl) {
                 // Remote: clone to rootPath (if provided) or default ~/.wicked/repos/<name>,
                 // register, and launch onboarding run.
+                // cloneAndRegisterRepo registers and launches in one call. Distinguishing a landed
+                // registration from a failed clone requires splitting that adapter call (follow-up).
                 const cloned = await adapter.cloneAndRegisterRepo(name, gitUrl, rootPath);
                 runId = cloned.runId;
                 const repos = await adapter.listRepos();
@@ -1686,7 +1701,11 @@ runtime = {}) {
             }
         }
         catch (err) {
-            return reply.code(400).send({ error: message(err) });
+            if (repo === undefined)
+                return reply.code(400).send({ error: message(err) });
+            req.log.warn({ repoId: repo.id }, `repo registered but onboarding launch failed: ${message(err)}`);
+            // No run exists to record or file, even when projectId was supplied (crew#1019).
+            return reply.code(201).send({ repo, onboardRunId: null, onboardError: message(err) });
         }
         const projectAttachError = await recordOnboardingLaunch(req, runId, repo.id, { projectId, channel, actor, autoCapture });
         return reply.code(201).send({ repo, onboardRunId: runId, ...(projectAttachError !== undefined ? { projectAttachError } : {}) });
@@ -1823,16 +1842,27 @@ runtime = {}) {
         // F-E2E-030: only the explicit `'auto'` opts out of the engine's deliver gate. `'human'` and
         // an omitted field both leave `autoDeliver` off the input — the gate is the engine's default,
         // so the wire never has to say "gate me" to be gated.
+        // The daemon's QE acceptance setting, read ONCE for this launch: the deliverGate check below and
+        // the skip handed to the engine come from the same reading (core/qe-acceptance-setting.ts).
+        // An addon without the QE decision enforces none, so the setting has nothing to skip on it.
+        const qeMode = addonSupportsQeOverride() ? await qeAcceptanceNow() : 'required';
+        const qeRequired = b.deliverGate === 'auto' || qeMode === 'off' ? await launchRequiresQe(adapter, b.workflow, b.projectId) : false;
+        const settingSkip = qeSettingSkipReason(qeMode, { skipQeAcceptanceReason: b.skipQeAcceptance?.reason, forceQeAcceptance: b.forceQeAcceptance }, qeRequired);
         if (b.deliverGate === 'auto') {
             // wicked-core#850 EX-03: a workflow that requires QE acceptance delivers only through the deliver
             // gate, where crew checks the verdict. Unattended delivery would push before anyone could.
             // QE-IN-APP-WORKFLOWS: an explicit operator skip leaves no verdict to check, so it may. A name
             // the engine resolves to a built-in preset that requires QE acceptance is judged by that preset
             // (the engine resolves a preset before any def, so a def of the same name never speaks for it).
-            const required = b.workflow !== undefined ? adapter.getWorkflow(b.workflow)?.required_instruments : undefined;
-            const qeRequired = required?.includes(QE_ACCEPTANCE) === true || (b.workflow !== undefined && QE_PRESETS.has(b.workflow));
-            if (qeRequired && b.skipQeAcceptance === undefined) {
+            // The daemon's `qeAcceptance: 'off'` setting skips it the same way (resolved once, above, and
+            // handed to the engine with this launch), unless this launch forces QE acceptance.
+            // Refused on the CONSERVATIVE reading (a built-in QE name or a QE def counts even when a project
+            // preset shadows it now): only an explicit or setting skip lets QE work deliver unattended.
+            if (mayRequireQe(adapter, b.workflow, qeRequired) && b.skipQeAcceptance === undefined && settingSkip === undefined) {
+                // `code` is the same stable token a refused delivery carries (QeAcceptanceRefusal.code), so a
+                // client can say "this failed because QE acceptance is required" without parsing the sentence.
                 return reply.code(400).send({
+                    code: QE_ACCEPTANCE_REQUIRED_CODE,
                     error: `workflow ${b.workflow} requires QE acceptance (required_instruments: qe_acceptance), so it delivers only ` +
                         'through the deliver gate, where the verdict is checked — deliverGate: "auto" cannot apply to it ' +
                         '(unless the launch explicitly skips QE acceptance with a reason: skipQeAcceptance)',
@@ -1913,6 +1943,8 @@ runtime = {}) {
         // when sent, never inferred.
         if (b.skipQeAcceptance !== undefined)
             input.skipQeAcceptanceReason = b.skipQeAcceptance.reason;
+        else if (settingSkip !== undefined)
+            input.skipQeAcceptanceReason = settingSkip;
         if (b.forceQeAcceptance === true)
             input.forceQeAcceptance = true;
         // DES-L9 / crew#550 — REVISION: `revisesPr` names an OPEN same-repository pull request whose
@@ -2096,7 +2128,7 @@ runtime = {}) {
             const freeText = input.workflow === undefined && input.plan === undefined ? { freeText: { notice: FREE_TEXT_NOTICE } } : {};
             // crew#874: the run uses the PUBLISHED generation; when the installed garden is not the one it
             // was built from, the launch answer says so (a recorded proof can disclose which garden ran).
-            const skillsAhead = runtime.skills?.installedAheadFinding({ fresh: true }) ?? null; // fresh: an upgrade just before Send counts (codex r1)
+            const skillsAhead = await runtime.skills?.installedAheadFinding({ fresh: true }) ?? null; // fresh: an upgrade just before Send counts (codex r1)
             const skillsWarning = skillsAhead === null ? {} : { skillsWarning: { kind: skillsAhead.kind, severity: skillsAhead.severity, message: skillsAhead.message } };
             // wicked-core#850: a full-assurance run on a one-CLI roster will wait at a gate for a seat that
             // can evaluate or judge it; the answer names the explicit opt-in to relaunch with.
@@ -2669,6 +2701,14 @@ runtime = {}) {
     // READ-ONLY estate MCP over it (the grounding governed runs get). The scope is resolved and
     // validated BEFORE any seat warms, stated to the seats in the scratch root's AGENTS.md /
     // CLAUDE.md, and returned as `scope` (see `chat-scope.ts`).
+    // crew#1020: open and refresh use the same registry, graph, liveness and checkout dependencies.
+    const resolveScope = (request, req) => resolveChatScope(request, {
+        ...chatScopeDeps(adapter),
+        scratchBase: chatScopes.base,
+        log: (m) => req.log.warn(m),
+        ...(runtime.entityCount !== undefined ? { entityCount: runtime.entityCount } : {}),
+        ...(runtime.freshenCheckout !== undefined ? { freshen: runtime.freshenCheckout } : {}),
+    });
     app.post(`${V}/chats`, {
         config: {
             manifest: {
@@ -2731,18 +2771,13 @@ runtime = {}) {
             // The scope (crew#502): explicit repos (`repoRefs`, the legacy `repoRef` merged in) or the
             // project's members — each ref checked against the registry, EVERY missing one named — else
             // none. Resolved before any seat warms: a 404 here warmed nothing.
-            const resolution = await resolveChatScope({
+            const scopeRequest = {
                 chatId,
                 ...(b.projectId !== undefined ? { projectId: b.projectId } : {}),
                 repoRefs: requestedRefs,
                 ...(b.scopeKind !== undefined ? { kind: b.scopeKind } : {}),
-            }, {
-                ...chatScopeDeps(adapter),
-                scratchBase: chatScopes.base,
-                log: (m) => req.log.warn(m),
-                ...(runtime.entityCount !== undefined ? { entityCount: runtime.entityCount } : {}),
-                ...(runtime.freshenCheckout !== undefined ? { freshen: runtime.freshenCheckout } : {}),
-            });
+            };
+            const resolution = await resolveScope(scopeRequest, req);
             if (!resolution.ok) {
                 chatScopes.release(chatId, token);
                 return reply.code(resolution.status).send({
@@ -2871,7 +2906,7 @@ runtime = {}) {
                         projectAttachError = message(err);
                     }
                 }
-                if (!chatScopes.set(chatId, scope, token, refused, engine)) {
+                if (!chatScopes.set(chatId, scope, token, refused, engine, scopeRequest)) {
                     // The reservation was cancelled while the open was in flight — an engine `chatClosed` or a
                     // `DELETE` for this id (Copilot, #518). Nothing was recorded; tear the chat down (scratch
                     // root and the filing just made) instead of returning a stale 201. No path record exists
@@ -2983,24 +3018,20 @@ runtime = {}) {
         // later message CONTINUES the same path: `propose_plan(answer-N)` then `confirm_gate(Approve)`
         // at the turn gate the previous answer paused on. Nothing is fanned out: the PA is the one
         // voice, helpers talk to the PA, the reviewer raises quiet findings — all on the bus.
-        const path = askPaths.get(id);
-        if (path === undefined) {
+        const openedPath = askPaths.get(id);
+        if (openedPath === undefined) {
             return reply.code(409).send({ error: `chat '${id}' is not open on this daemon — open it first (POST /chats)` });
         }
+        const path = openedPath;
         if (path.eligible.length === 0) {
             return reply.code(409).send({ error: `chat '${id}' has no eligible seat — sign a seat in and re-seat it (POST /chats/:id/seats)` });
         }
         const text = parsed.data.text;
-        const scope = chatScopes.get(id);
-        // A repo-bound path: exactly one repo in scope grounds the run (`repoRef`) and makes it
-        // deliverable; a project or a multi-repo scope binds the project graph only (§5.1 Grounding).
-        const repoRef = scope !== undefined && scope.kind === 'repos' && scope.repos.length === 1 ? scope.repos[0].id : undefined;
-        const projectId = scope?.projectId;
-        const voice = path.pa !== null ? [path.pa] : [];
-        // The turn is reserved for the voice — or, for a random pick (no PA yet), for the whole
-        // eligible roster: the relay narrows it to the PA when `path.started` names one (ASK-C2), so
-        // the PA's frames are stamped with this turn and a second message is refused meanwhile.
-        const audience = voice.length > 0 ? voice : path.eligible;
+        let scope = chatScopes.get(id);
+        const storedScope = scope;
+        let engine = chatScopes.engineOf(id);
+        let voice = [];
+        let audience = [];
         // crew#641/#650 re-stated for a path: ONE eligible seat means no distinct reviewer and no
         // helper — said on every turn (the engine's `member.joined{seat:null}` says it on the bus).
         const singleSeat202 = path.eligible.length === 1
@@ -3026,8 +3057,8 @@ runtime = {}) {
             });
         }
         // crew#826: the turn lives as long as its answer step may (`budget_secs`), not 3× the pool knob.
-        const turn = chatTurns.begin(id, audience, text, ASK_TURN_BUDGET_SECS);
-        const turnId = turn?.turnId ?? randomUUID();
+        let turn = null;
+        let turnId = randomUUID();
         // What an ACCEPTED message records — the engine has it, so a persistence failure here is
         // logged, never a retraction of a turn that is already being answered (codex on #808 r2, 9).
         const persistAccepted = (preface, after) => {
@@ -3055,12 +3086,97 @@ runtime = {}) {
         // preface rode a pool send; told only once the send is accepted (`commit`).
         const withPreface = (preface) => (preface !== null ? `${preface}\n\n${text}` : text);
         try {
+            const rules = (await considerations.inForceFor(scope?.projectId ?? null)).rules;
+            // crew#1020: a project/everything chat must see repos attached since open. Admission was
+            // under this scope KIND and the kind stays the same, so do not re-run seat admission.
+            const scopeRequest = chatScopes.requestOf(id);
+            if (scope !== undefined && (scope.kind === 'project' || scope.kind === 'everything') && scopeRequest !== undefined) {
+                try {
+                    if (scopeRequest.projectId !== undefined && await adapter.projectGet(scopeRequest.projectId) === null) {
+                        throw new Error(`Project ${scopeRequest.projectId} not found`);
+                    }
+                    const resolution = await resolveScope(scopeRequest, req);
+                    if (!resolution.ok)
+                        throw new Error(resolution.error);
+                    // Retain this chat's scratch root even if the resolver's defaults change (crew#1020).
+                    // Resolve only: a refused message must leave the stored scope, executing seats' files
+                    // and transcript roots untouched. Publish after every refusal check, just before send.
+                    engine = { ...resolution.engine, cwd: scope.cwd };
+                    scope = { ...resolution.scope, cwd: scope.cwd };
+                }
+                catch (err) {
+                    req.log.warn({ chatId: id }, `chat scope refresh failed; keeping stored scope: ${message(err)}`);
+                }
+            }
+            if (askPaths.get(id)?.generation !== lease) {
+                return reply.code(409).send({ error: `chat '${id}' was closed while the message was in flight; nothing was sent` });
+            }
+            if (path.runId !== undefined) {
+                const view = (await adapter.sessionsDetail()).find((v) => v.session.id === path.runId);
+                if (view === undefined) {
+                    askPaths.release(id, lease);
+                    return reply.code(409).send({ error: `chat '${id}': its path ${path.runId} is gone — open a new chat` });
+                }
+                const status = String(view.session.status);
+                if (status !== 'awaiting_human') {
+                    askPaths.release(id, lease);
+                    const who = path.pa ?? 'the primary agent';
+                    return reply.code(409).send({
+                        code: 'turn_in_flight',
+                        error: status === 'executing' || status === 'running'
+                            ? `${who} is still answering the previous message in this chat — wait for the reply. Nothing was sent.`
+                            : `chat '${id}': its path ${path.runId} is ${status}, not waiting for your turn — nothing was sent`,
+                        chatId: id,
+                        runId: path.runId,
+                        status,
+                    });
+                }
+                // The status read awaited: the chat may have been closed (and its id reopened) meanwhile —
+                // nothing of this message may land on the newcomer (codex on #808 r3, 2).
+                if (askPaths.get(id)?.generation !== lease) {
+                    return reply.code(409).send({ error: `chat '${id}' was closed while the message was in flight; nothing was sent` });
+                }
+            }
+            const codeGraphDb = engine?.codeGraphDb ?? null;
+            // Only project scopes refresh a project graph; fixed repo scopes may use the engine's
+            // own repo graph instead of input.projectGraph, and everything scopes have no graph.
+            if (scope?.kind === 'project' && path.runId !== undefined && codeGraphDb !== path.launchGraphBinding) {
+                askPaths.release(id, lease);
+                return reply.code(409).send({
+                    code: 'chat_scope_changed',
+                    error: `This chat's repositories or their code graph changed since it started (${scope?.repos.length ?? 0} now in scope). Start a new chat to read them — this one keeps its original scope.`,
+                });
+            }
+            // Sort repository identities so membership order alone does not trigger another statement.
+            const scopeKey = JSON.stringify([
+                scope?.repos.map((repo) => [repo.id, repo.name, repo.rootPath]).sort((a, b) => a[0].localeCompare(b[0])) ?? [],
+                codeGraphDb,
+            ]);
+            const pending = await considerations.pendingPreface(id, { inForce: rules });
+            // The last await before delivery may also have closed/reopened the chat. From this check
+            // through publication and the send there is no await, so no executing turn's files change.
+            if (askPaths.get(id)?.generation !== lease || chatScopes.get(id) !== storedScope) {
+                return reply.code(409).send({ error: `chat '${id}' was closed while the message was in flight; nothing was sent` });
+            }
+            if (storedScope !== undefined && scope !== undefined && engine !== undefined &&
+                (JSON.stringify(scope) !== JSON.stringify(storedScope) || JSON.stringify(engine) !== JSON.stringify(chatScopes.engineOf(id)))) {
+                prepareChatScratch(id, scope, rules);
+                if (chatScopes.refresh(id, storedScope, scope, engine)) {
+                    chatTranscripts?.registerRoots(id, scope.repos.map((r) => ({ absRoot: resolve(r.rootPath), name: r.name })));
+                }
+            }
+            voice = path.pa !== null ? [path.pa] : [];
+            // A random pick reserves every eligible seat until the relay names the PA.
+            audience = voice.length > 0 ? voice : path.eligible;
+            turn = chatTurns.begin(id, audience, text, ASK_TURN_BUDGET_SECS);
+            turnId = turn?.turnId ?? turnId;
+            // A repo-bound path can deliver; project and multi-repo scopes remain read-only asks.
+            const repoRef = scope?.kind === 'repos' && scope.repos.length === 1 ? scope.repos[0].id : undefined;
+            const projectId = scope?.projectId;
             if (path.runId === undefined) {
                 const stepId = 'answer-1';
                 const generation = path.generation;
                 const roster = rosterWithStanding().filter((seat) => path.eligible.includes(String(seat.key)));
-                const rules = (await considerations.inForceFor(scope?.projectId ?? null)).rules;
-                const pending = await considerations.pendingPreface(id, { inForce: rules });
                 // crew#823: the run is titled by the operator's question (every reader titles a run from
                 // `problem`); the scope statement grounds the seats from the first answer step's
                 // instructions instead of standing in as the run's title.
@@ -3073,15 +3189,17 @@ runtime = {}) {
                     ...(path.primary !== undefined ? { primary: path.primary } : {}),
                     ...(repoRef !== undefined ? { repoRef, deliver: 'pr' } : {}),
                     ...(projectId !== undefined ? { projectId } : {}),
+                    ...(scope?.kind === 'project' && codeGraphDb !== null ? { projectGraph: { dbPath: codeGraphDb } } : {}),
                 };
                 const runId = await adapter.launchRun(input);
-                if (!askPaths.started(id, generation, runId, stepId)) {
+                if (!askPaths.started(id, generation, runId, stepId, input.projectGraph?.dbPath ?? null)) {
                     // The chat was closed (End) while the launch was in flight: the run must not outlive it.
                     await adapter.cancelRun(runId).catch(() => undefined);
                     if (turn !== null)
                         chatTurns.abort(id, turn.turnId);
                     return reply.code(409).send({ error: `chat '${id}' was closed while its path was launching; the run was cancelled` });
                 }
+                path.lastToldScopeKey = scopeKey;
                 pending.commit();
                 persistAccepted(pending.preface, () => {
                     runtime.linkChatRun?.(id, runId);
@@ -3100,47 +3218,24 @@ runtime = {}) {
                         deliver: repoRef !== undefined ? 'pr' : 'none',
                     });
                 });
-                return reply.code(202).send({ seats: voice, turnId, runId, stepId, ...singleSeat202 });
-            }
-            const view = (await adapter.sessionsDetail()).find((v) => v.session.id === path.runId);
-            if (view === undefined) {
-                askPaths.release(id, lease);
-                if (turn !== null)
-                    chatTurns.abort(id, turn.turnId);
-                return reply.code(409).send({ error: `chat '${id}': its path ${path.runId} is gone — open a new chat` });
-            }
-            const status = String(view.session.status);
-            if (status !== 'awaiting_human') {
-                askPaths.release(id, lease);
-                if (turn !== null)
-                    chatTurns.abort(id, turn.turnId);
-                const who = path.pa ?? 'the primary agent';
-                return reply.code(409).send({
-                    code: 'turn_in_flight',
-                    error: status === 'executing' || status === 'running'
-                        ? `${who} is still answering the previous message in this chat — wait for the reply. Nothing was sent.`
-                        : `chat '${id}': its path ${path.runId} is ${status}, not waiting for your turn — nothing was sent`,
-                    chatId: id,
-                    runId: path.runId,
-                    status,
+                return reply.code(202).send({
+                    seats: voice, turnId, runId, stepId, ...singleSeat202,
                 });
             }
-            // The status read awaited: the chat may have been closed (and its id reopened) meanwhile —
-            // nothing of this message may land on the newcomer (codex on #808 r3, 2).
-            if (askPaths.get(id)?.generation !== lease) {
-                if (turn !== null)
-                    chatTurns.abort(id, turn.turnId);
-                return reply.code(409).send({ error: `chat '${id}' was closed while the message was in flight; nothing was sent` });
-            }
             const stepId = askPaths.nextStep(id);
-            const pending = await considerations.pendingPreface(id);
-            await adapter.proposePlan(path.runId, { steps: [answerStep(stepId, withPreface(pending.preface))] }, turnId);
+            // crew#1020: tell the run about a refreshed scope until a continuation accepts it.
+            let instructions = withPreface(pending.preface);
+            if (scope !== undefined && scopeKey !== path.lastToldScopeKey) {
+                instructions = `${chatScopeStatement(id, scope, rules)}\n\n${instructions}`;
+            }
+            await adapter.proposePlan(path.runId, { steps: [answerStep(stepId, instructions)] }, turnId);
             await adapter.confirmGate(path.runId, true);
             askPaths.release(id, lease);
             if (!askPaths.continued(id, lease, stepId)) {
                 // Closed between the proposal and here: the DELETE cancelled the run this was accepted on.
                 return reply.code(409).send({ error: `chat '${id}' was closed while the message was in flight; its path was cancelled` });
             }
+            path.lastToldScopeKey = scopeKey;
             pending.commit();
             persistAccepted(pending.preface, () => undefined);
             return reply.code(202).send({ seats: voice, turnId, runId: path.runId, stepId, ...singleSeat202 });
@@ -5438,6 +5533,19 @@ runtime = {}) {
                     .send({ error: "deliverDefault must be 'pr' or 'none'" });
             }
         }
+        // qeAcceptance (api-types 0.120.0): 'required' | 'off' only. 'off' skips QE acceptance on every
+        // launch that requires it (labelled with the setting), so a typo must be a 400, never a dropped key.
+        // Turning it off waives an assurance instrument on every launch after it, so only a PERSON may
+        // change it (the predicate the watch switches use); a worker's bearer gets 403.
+        if (Object.hasOwn(patch, 'qeAcceptance')) {
+            const q = patch.qeAcceptance;
+            if (q !== 'required' && q !== 'off') {
+                return reply.code(400).send({ error: "qeAcceptance must be 'required' or 'off'" });
+            }
+            if (!isHumanOperator(actorOf(req))) {
+                return reply.code(403).send({ error: 'Only a person can change QE acceptance (qeAcceptance); a worker or system actor cannot' });
+            }
+        }
         // onboardingAutoCapture (crew#552): whether a completed onboarding chains capture-learnings.
         if (Object.hasOwn(patch, 'onboardingAutoCapture') && typeof patch.onboardingAutoCapture !== 'boolean') {
             return reply.code(400).send({ error: 'onboardingAutoCapture must be true or false' });
@@ -5522,6 +5630,7 @@ runtime = {}) {
             'workerStallEscalateAction',
             'workerStallMaxEscalations',
             'deliverDefault',
+            'qeAcceptance',
             'onboardingAutoCapture',
             'deliverIdentityLogin',
             'deliverIdentityByRepo',
@@ -6195,6 +6304,35 @@ runtime = {}) {
         dropDocLedgerRows: runtime.dropDocLedgerRows ?? (() => ({ ok: true, removed_keys: [] })),
         log: (m) => app.log.warn(m),
     });
+    // ── A demo run's video as an editable document (the video editor re-cuts it through E1's per-doc API) ──
+    registerDemoDocumentRoute(app, adapter, {
+        bridgeFor: async (projectId) => {
+            const root = await projectDocsRoot(adapter, projectSettings, projectId);
+            if (root === null)
+                return null;
+            const bridge = await interactiveBridges.ensure(root);
+            return async (method, path, body) => {
+                const raw = Buffer.isBuffer(body);
+                const res = await fetch(`http://${bridge.host}:${bridge.port}${path}`, {
+                    method,
+                    headers: { 'content-type': raw ? 'application/octet-stream' : 'application/json' },
+                    body: raw ? new Uint8Array(body) : JSON.stringify(body),
+                    // A segment upload or the import's render (ffmpeg) can take minutes on a loaded host.
+                    signal: AbortSignal.timeout(600_000),
+                });
+                let parsed = {};
+                try {
+                    const j = await res.json();
+                    if (j !== null && typeof j === 'object' && !Array.isArray(j))
+                        parsed = j;
+                }
+                catch {
+                    parsed = {};
+                }
+                return { status: res.status, body: parsed };
+            };
+        },
+    });
     // ── Project-attributed docs list (crew#472) ──
     // `GET /projects/:id/interactive/api/docs` relays the bridge's list and stamps each row with
     // the mount's `projectId` — the attribution the bridge cannot know. Same static-over-wildcard