nils-desk v1.0.0-beta.1

The first beta (record 55, ruling 31 (g)).

Added

• Install from a file beside Try again where Install dcm2niix failed because the engine could not reach the releases (gate T31, walkthrough step 15.7; record 55, ruling 35 (c)). A line under the engine's reason names the archive to fetch, linked to its release, with its sha256. The person picks the archive they fetched on another machine; the engine checks it against the pinned sha256 and installs it, and the place says the version as after the button. A file the engine refuses says why, with Try again and Install from a file still offered, and a file larger than the door takes is refused before it is sent. This works beside a failed run, a refused pre-flight or run, and on Settings, Parts. It needs an engine that serves POST /api/tools/dcm2niix/install-file and the install's grant; anyone else still reads "Ask an admin to install dcm2niix."

Changed

• Where the supervisor makes a setup step and a person may not work on the install, the desk says who does it in one plain line, with no command and no "at the machine" (gate T31, G2): an administrator changes how people sign in, gives the engine a folder, starts Kvasir again or names a model server, or puts an archive back. A person with install work keeps the command, under the line that says why, only where no supervisor makes the step. A supervisor that is configured but did not answer is said as such, and "This desk reaches no supervisor" is said only where none is configured. On Backups, Back up now and Rehearse a restore are engine jobs that need no supervisor, so their commands are printed only where the engine queues no jobs. The side walk opens Clinical.
• nils tools install dcm2niix is no longer printed under a failed install where the engine serves the install from a file, since it failed the same way as the button. A desk on an older engine keeps the line.
• A running sort reads Sorting: since engine 1.0.0-beta.1 a sort judges the scans and ends, and the previews of what it judged are a job of their own on the pictures lane (Preparing pictures).

Fixed

• The Data page reads each thing once at a time. A large dataset's summary that took tens of seconds was asked again every 5 s while one of its steps ran, whether or not the last read had answered, so many of the same request were out at once, the page lagged and its cards came in slowly, and an older answer could land after a newer one. Now nothing the page or a dataset's detail reads has two reads out at once: a read asked while one is out waits for its answer, a thing followed while a step runs is read again 5 s after its last answer, and the answer to a read the page let go of (a dataset gone from the list, the page closed) is let go too. This covers the lists of datasets and cohorts, each dataset's summary, a dataset's log, picks and held IDs, a cohort's own page and picks while its step runs, and the failed jobs.
• No guess is drawn as a fact while a dataset's summary is read. After a run, the originals less the copy are the files the run refused as not DICOM, and before the summary answered, the pseudonymise step offered to pseudonymise exactly those again, the card said "Waits to be pseudonymised" and the IDs box said 0 subjects. Where a run ran and no summary says what it left, the step shows the counts it has, offers no button, says no next step and says "Counting what is left…" (or that it could not be counted, where the summary's read failed). The IDs box shows "…" until the held IDs answer, never 0, and a card whose summary is on its way draws the steps the list does not show as not known yet. A dataset never run is as before.

nils-desk v1.0.0-alpha.69

Added

• Settings has a Teaching page under the assistant (Wave 5 section 9.5, walkthrough step 17.4), for a person holding assistant-settings:work where the assistant answers. Four screens, one list and one action each: Corrections (the proposals people rejected and the review decisions that overturned a station or the pack; choose some and Make a set), Sets (Fine-tune one with a LoRA recipe: base model, steps, rank and learning rate, the base offered from Kvasir's models and a recipe the assistant would refuse refused in words), Jobs (every fine-tune job, read again every few seconds while one runs; an assistant before alpha.30 gives the person's own from the inbox) and Models (each candidate with its admission and bench side by side and its one next step: Admit, Bench, Promote once both gates are green, or Roll back for the promoted one). Promote and Roll back say what they change before they are done; rolling back retires the promoted model so its backend routes to its configured model again, and the model it replaced stays retired. Making a set needs review:work and the model steps kvasir:work; a button a person may not press says which grant it needs. Rolling back and the full job list need the assistant of the same wave (POST /teaching/candidates/{id}/retire, GET /teaching/jobs).

Changed

• Body part and post-contrast are runs a person starts (record 55, ruling 35 (b)): the engine scores a dataset's arrival with System 1 alone, which needs no button. While either step waits, the dataset's rail says what its Run would add instead of "not run yet": "6 with no body part", "12 T1 brain, contrast unknown", or "none needs it", from the step's hint on the dataset's summary. An engine from before says "not run yet" as it did.
• The raters are named to the campaign's maker and a Review worker alone. Anyone else reads each other person as "rater 1", "adjudicator 1" and so on, their own answers by their own name, on the Items table as in the Results view. The Items table now trusts the answers door's own word on whether it answered blind.
• The setup steps the desk printed as nils setup are buttons where the supervisor makes them (gate T31, record 55 ruling 35 (c)); each needs an engine whose supervisor serves the step (changes on the install door) and a person with work on the install. People and Setup: Change how people sign in, a dialog that moves the desk to passwords it keeps (with the first person where it keeps nobody yet) or to a provider it is registered at already (issuer, client id, secret, entitlements claim); every part starts again and the page loads again signed out, to sign in the new way. Backups and Setup: Give the engine a folder where it has none, and Another folder beside the one it has. Backups: Restore an archive is one button, Put it back, whose dialog says that the registry as it stands is archived first and the engine stops until it is done; the supervisor stops the engine, puts the archive back and starts it again. Setup, where the desk does not reach Kvasir: Start Kvasir again, and Use a model server (address, key, model), which starts every part again with Kvasir holding the server. Where the supervisor does not make a step (none is reached, it is older than the button, its helper waits to be written again, the install runs no services, or the person may not work on the install), the command stays under one line that says why.
• The desk names the person it acts for to the supervisor, in X-Nils-Person, as the engine names them, so the supervisor audits a change under them; a browser's own header of that name is dropped.
• The by-hand twins beside working buttons are gone where a supervisor does the work (gate T31, step 19.3): the update and restart commands on Parts and on each part's page, the reapply command on the Engine page, and the backup and rehearsal commands on Backups. They stay where the install runs no services (run setup again at the machine) and, for the backup and the rehearsal, where the desk reaches no supervisor.
• Expert options on the release form (gate T31, walkthrough step 13.8), folded under one line below the form: where localizers, a vendor's synthetic contrasts and the DICOM copies go in a BIDS tree, the converter, uncompressed NIfTI, the authors, the categories of element removed, the UID root, only the picked scans and only some roles. Each starts at the engine's own default and is sent only once changed; the fold says how many are changed. A field the engine would refuse (a converter not named dcm2niix, no category, a UID root that is not numbers joined by dots) holds Release with the reason. Only the options the engine names in capabilities.releases.expert are drawn, so an older engine shows no fold (engine [Unreleased], 2026-10-16).
• The pipeline runtime and the starter catalog on Pipelines > Catalog (gate T31, walkthrough step 15.8), each a line beside Where they run: Runtime says what runs pipelines and which runtime is chosen, with Change (the runtime, and how apptainer keeps an image); Starters says whether the engine seeds its starter catalog at its start and how many it holds, with Seed now where one is lacking and the seeding turned off or on. A run that suggested scans to curate says so on its page, Suggested to curate, with the values by axis and Save as a selection, which a campaign starts from. Changing is install work; the lines are read with Pipelines: See (engine [Unreleased], 2026-10-16).
• Clinical, a page of Data (gate T31, walkthrough step 22.8; record 55, ruling 35 (c), which brings into Wave 7a the page ruling 20 had left for 7b): the vocabulary of diseases and kinds of observation the registry holds, Load a vocabulary (the pack's own, or a file), and Import a file, a CSV of clinical rows under a mapping, previewed first and imported only from the preview, with the rows refused counted by reason. A mapping that names subjects by an ID is held back for a person who does not see every detail. Loading and importing are Data work (engine [Unreleased], 2026-10-16).
• Uninstall NILS, at the foot of Settings > Setup (gate T31, walkthrough step 1.9), only where a supervisor keeps this install and for a person with install work: NILS alone with the data kept for the next setup, or everything, the registry's key with it, which the dialog warns cannot be undone. It shows what goes and what stays, as nils uninstall --print says it, and asks the install directory's name typed either way; the supervisor checks it again and goes on after the desk is gone. The desk names the person it forwards for to the supervisor (X-Nils-Person, from the session; a browser's own is dropped), and the supervisor records who asked (engine [Unreleased], 2026-10-16).

Fixed

• A dataset whose pseudonymise run finished no longer reads as never pseudonymised. The engine counts a folder for at most two seconds or 200,000 entries, so after a run over tens of millions of files the step showed a copy of 0 files, said "not yet" on the rail and offered to pseudonymise every file again. Once the summary names a run of the step, the step is never read as never run. Where the step counts the copy whole, the files still to do are the engine's own count, which leaves out the files a run refused as not DICOM, so a run that wrote every copy it could is done: no button, and the rail says the copy. Where a count stopped short or a run was cut short, the step offers "Pseudonymise and sort the rest" instead of "at least 0 files". The Originals box takes the run's whole count where the folder's count stopped short, and no size measured from part of the folder; a copy whose count stopped before it reached a file shows "?", and its rules keep what PatientID holds. The dataset's card, its state word and its next step read the same counts: a dataset that is done goes on to its read, and one that ran before says "The rest waits to be pseudonymised". For engine 1.0.0-alpha.89, which counts the step from its newest whole run; with alpha.88 the step offers the rest.
• A dataset whose newest read was cancelled or failed part way offers Read again as its next step, where it offered Sort over the stacks the cut read had made. Read again queues a bring-in's chain from its read on, in the engine's own words: the read, which skips the files read already, the sort, the pick run where a bring-in names one, and System 1's score at arrival. The read and the score take the stopped read's name, so the score takes the stacks of both reads. It never queues a pseudonymise step, which a bring-in of an identified dataset puts first. The card says "The last read stopped part way", and the rail draws the read stopped and next, though the engine's summary counts a cancelled read among its reads. A dataset whose pseudonymise step waits does that first.
• A count of files that stopped short of a large folder says "at least" wherever it is shown, and a whole count says the number alone. The engine's probes are bounded and say where they stopped (more, partial); the pseudonymise step (the originals' box, "Pseudonymise and sort", "to go" and "can go now"), the summary's pseudonymised step (its new partial and waiting_partial), a dataset's tree lines, Do all steps' new files and estimate, the folder picker's look and the setup folder listing now read them. Where the copy's count stopped short, no count of files still to pseudonymise is given, since it is not known.
• A campaign's page has a Results view beside its Items (record 55, ruling 35 (d)), read from the engine's GET /api/campaigns/{id}/results: the counts settled, adjudicated and written, exact agreement and kappa, the unsure count; a table by value (answers given and items settled, per axis on an axes question); a table by rater; a table by item with each rater's answer in a column of its own (marked ? where unsure), the adjudication, the settled value and the decision or pick the close wrote; and the c...

nils-desk v1.0.0-alpha.68

The map dialog shows no identifier's value, and never-kept ID types say they keep lookups only.

Changed

• The Pseudonyms page's ID types table shows a type NILS never keeps (the ID that is the same everywhere, and a hospital's reserve number) with a "never kept" tag beside its name, and its count as lookups ("4,836 lookups"), with the reason on hover: no number is stored, only a keyed one-way lookup that recognises it when it arrives again. A count of kept IDs reads as before. The engine's types door names no flag for this, so the two built-in names are matched; a never_kept field is read where an engine gives one.

Fixed

• The map dialog no longer shows any value of the file. Under each column's header it listed up to three of its cells beside the shape ("999999999999, 157 rows, 151 distinct"), so a column of personnummer put real numbers on the screen. A column is now its header, its shape and its counts, and nothing of a cell is kept for the screen. A header that is itself a number (a file with no header row has its first row read as one) is shown as "column 3" and makes no type name. The shape reads letters and digits of any script, where an accented letter was shown as it was. A number standing on its own in the engine's conflict words or an error is hidden in the dialog and in the pseudonymise step's conflict hint; row numbers stay.

nils-desk v1.0.0-alpha.67

For engine 1.0.0-alpha.87: a hospital's reserve number goes to the engine's own never-kept type in the map dialog.

Changed

• A map's column headed for a hospital's reserve number (reservnummer, reserve number, reserv_nr, reserve id and the like) is read as the engine's reserve-number type, where the engine has it, instead of a new type named after the header: a type made that way would keep the numbers, sealed, and the engine keeps nothing of a reserve number but its keyed lookup (engine [Unreleased], 2026-10-16). A map whose column standing for the person is a reserve number is refused before it is sent, in the engine's words: no code is made from a reserve number, so the person's code or their personnummer goes beside it. The IDs and Rules dialogs never offer the type for what PatientID holds or what the copy's PatientID gets, which the engine refuses: a reserve number is read beside an ID that is the same everywhere. An engine without the type is read as before.

nils-desk v1.0.0-alpha.66

Wave 7a's last desk, for engine 1.0.0-alpha.87 (older engines fall back): the assistant's drafts become cards when a person keeps them, the Parts page says when it looked at the releases and can look again, and six tasks gain a place (sort again after a rules update, raters on an open campaign, BIDS naming, a query from a selection, a kept result or a list of IDs, rebuild visits, a new label set).

Added

• Review settings say why a dataset's headers are flagged: by its signs (names missing, words the rules do not know, a maker never seen), each share beside its threshold, or by a person, with what the signs say beneath their word (record 55, rulings 31 (c) and 33).
• The Parts page says when the supervisor last looked at the releases, and asks it to look again. The supervisor keeps what it looked at for a quarter of an hour, and the page said "checked just now" beside offers made from that look, which is only when the page itself was read: on 2026-10-16 it named 1.0.0-alpha.84 as the release to take a minute after 1.0.0-alpha.85 was published. With an engine that says release.looked_at, the page says "releases looked up 14 minutes ago" beside "checked just now", and Look again, for a person who may work on the install, asks the supervisor's door for a fresh look (?fresh=1, honoured once the look is a minute old) and reads the page once more. With an engine that says nothing of when it looked, the page reads as it did.
• Keep and Unkeep: a draft the assistant proposed is a card on the Cards list once a person keeps it (record 55, K6, round 5 of the desk's layout). On the Assistant's panel, Keep records the version with the assistant, joins it to its card's line as before, and keeps the card on the engine (PUT /api/ask/documents/{id}/kept), so the cards in the thread and on the panel say kept as the engine does and not as the conversation decided; a kept version has Unkeep, which puts the card back among the drafts and deletes nothing (DELETE), and Keep again marks it anew without the assistant being told twice. A card's page says draft or kept in its head, with Keep or Unkeep for a person with work on the Query page. Where the engine has no such mark, none of it shows and Keep works as it did.
• BIDS names in the release form (record 55 C4; gate T31, walkthrough step 13.7). The engine's release door takes naming, full or minimal, and the form never sent it, so the desk always released full. Beside the BIDS layout, New release now asks for full or minimal names, full as the engine has it; only minimal is sent, and never beside the descriptive layout, which is v0's grammar whatever is asked and which the engine refuses minimal for. The releases table says which were written under minimal names.
• Start a query from a saved selection, a kept result or a list of IDs (gate T31, step 14.7). The dialog started from everyone or typed cohorts, and its text promised the rest. A saved selection and a kept result are chosen from their lists (a result that was cut off, dropped or withdrawn is not offered), and a list of IDs is pasted with its ID type, for a person with work on the Query page at detail quasi, as the engine's start door needs; the list goes to the upload door, which keeps its shape and never a value, and the dialog says how many IDs matched no subject before the card is opened. A start the engine refuses says what it found wrong with the opening document, not only that it refused. The IDs live in the dialog alone: in no address and in no call but the upload. Where a person may not use a list of IDs the choice is shown, disabled, with what it needs; where the engine has no door for a choice it is not shown. The upload's client now takes the answer the engine sends (upload_id, a text, and the ID type it needs) and no longer promises a number.
• Raters on an open campaign (record 48; gate T31, step 11.8). A campaign that names its raters has Change beside them on its page, for its maker or a holder of work on Review who also works on Campaigns. The people who rate and the people the desk names are chips, on while they rate; one press of Change raters adds and takes off together (POST /api/campaigns/{id}/raters). Before it, the dialog says what it will do, including that a rater taken off keeps every answer given and what they hold goes back to the pool; after it, the page says who rates now and, in the engine's words, any rater added who already read those stacks in another campaign. Where the desk names no people, a principal is typed. A campaign that names no raters offers nothing, as the engine refuses it: anyone with work on Campaigns rates it, and naming one would shut out the rest.
• Sort again, on a rules row of the Parts page (gate T31, step 9.5). A rules release changes what the engine sorts from now on, and the scans already sorted keep their answers until they are sorted again, which the desk offered no way to do. A person with work on Pipelines presses Sort again on a rules row; the dialog says what the sort will judge (all the registry's scans, under that pack's rules in force, and how many were last sorted under other rules, from the summary's counts by pack version) and queues nothing until it is pressed. Then the engine's classify --pack is queued at the jobs door with no scope, as Read new files queues it, named for the pack and its version. What people decided stays, and Review is asked where the rules now answer a scan differently from what the person saw. The update panel says it beside a rules release: scans already sorted keep their answers until Sort again. The Rules page has no button of its own: adopting a proposal there already re-sorts, through the engine's decide door.
• Rebuild visits, on Release's Session schemes page (gate T31, step 22.7), for a person with work on Pipelines: the visits are built again under the registry's own scheme or a kept one, as a job (POST /api/sessions/rebuild). The dialog says first what a rebuild does to picks: one on a visit that moves follows it, and one on a visit that goes is withdrawn and asked about in Review.
• New label set, on Review's Label sets page (record 42 S7; gate T31, step 21.3): the decisions in force on one axis, one row for each scan, written as a label set into an export place (POST /api/label-sets), for a person who reads Review and works on Campaigns or Review. The axis is chosen from the pack, the name is the axis unless given, and the export place is chosen where there are several; a name taken gets its next version. The engine's other options (the authors, a selection or a campaign to keep, staged decisions, development labels for training) stay at the keyboard. A sealed sample's decisions are left out, and the page says how many.

Changed

• The desk's tests name no cohort of the group (record 55, ruling 18): the assistant's question fixture offered one by its name, and offers a made-up one now.
• The Cards list shows the kept cards, with a Drafts tab beside it that counts the cards nobody kept (record 55, K6): what the assistant proposes waits there, each draft opening on its card, where Keep is. The tab shows with a count of zero and says what would fill it. The list reads a page at a time and More reads the next. A card named with @ in the chat is a kept one.
• Start a query no longer ends in a paragraph pointing to New card from here for a saved card, a kept result and a list of identifiers: the dialog offers the last two itself. A card's page no longer says, under its steps, that a list of identifiers asks to see sex and age in records; the dialog says it beside that choice.

Fixed

• The scheme choice in the release form read "the registry's own, [object Object]": the engine sends the registry's own scheme as its definition, not its name. It reads "the registry's own: named by date; studies within the same day are one session" now, and the Session schemes page marks a kept scheme as the registry's own only where the engine names it. Rebuild visits reads it the same way.
• A checkbox or a radio stood above its words on the Admit panel of a model (passed), on a cohort's Add or remove (which way), on the Places panels (what a storage guarantees), on Review's Decide (no value here) and on the commit panel of a model's proposals (commit anyway), instead of beside them. The stylesheet had two rules for .choice: the row's, with the box and its words on one line, and one left from the first chat, which the chat stopped using when it got its own classes (ask-choice, ask-option) and which came later in the file, so it won and laid every row out as a grid. The leftover is gone, and the chat's question card is styled by its own classes as before. A layout check in chromium (choice.pw.ts) measures the box beside its words, level with them, on all five at a laptop's width and at a phone's; it failed on every one before the fix.

nils-desk v1.0.0-alpha.65

Wave 7a's desk after the beta, for engine 1.0.0-alpha.82 (and older engines, which fall back): layers on the Main scans map, Record a certificate, plain admin access and standing grants, a visit's page of scans that carries where each picture is, and standing workers shown apart as ready.

Added

• The Rules page (record 56, 6.4 and 6.5): the pack decides every answer, and a fix goes into the rules, not scan by scan. Four tabs, each in the address (#review/rules/proposals, quality, change, words), the page opening on the proposals while one waits for a person, else on the quality; ?dataset= narrows it to one dataset. Proposals: each proposed rule change on the one approval card, its effect in a line ("Moves 50 scans · base T2w → FLAIR, 47 · fixes 47, breaks 3"), where it lands (the pack's next version for everyone, or one site, dataset, scanner or batch), and every answer it breaks with its scans in the caution colour's frame before any button; Adopt is one press, then one line follows the re-sort until it ends and says what it did, the stored answers per axis before and after; a proposal rehearsed on an older pack is rehearsed again first; Reject asks why; Details opens the stored effect report; Change it puts a one-operation proposal back in the form. Quality: the pairs of rules the pack cannot rank, the overrides by rule pair, and System 1's disagreements, said as not served yet until it is, each row with its count, pictures and the change that would mend it, filled in. Change a rule: a form for each of the patch contract's fourteen typed operations, built from the contract's schema (copied beside it), with where it applies and why; Show the effect replays the registry with the change and writes nothing, and the report shows the moves per axis with their datasets, sites, makes and pictures, the answers we know (right to wrong, wrong to right, the net), the names, the main scans by role, Review's questions and the pack's own cases, before Propose it. Words: record 27's page, as it was. With an engine that serves GET /api/packs/{name}/quality, the proposals doors and the rehearse door; an engine before them shows the ties and the words.
• The Rules page follows the engine's review of the rules (record 56, 5.4 to 6.5): a proposal can be retired (a later version of its overlay replaced it, or the overlay was refused) and says why, with no action; a proposal made from an overlay says which overlay and version; a proposal rehearsed before the pack or the changes in force moved on shows as "rehearse again" with that one action, and an adoption the engine refuses for that reason shows the same; an overlay is adopted on its proposal's approval card (the Words page and the assistant's tune send the person there with Review) and never at the overlays door where the engine keeps the proposal; the card's breaks are the engine's count, not the length of the list it sent.
• A dataset's detail says its proposed rule fixes in one line ("3 proposed rule fixes from this read"), with the way to them on the Rules page, from the dataset summary's proposals.
• A rule change the assistant proposed is the Rules page's own approval card in the one chat: an approval part of change rule_change names the engine's proposal (ref.proposal, ref.pack), the card is read from the engine, Change it hands the words back to the person, and only a person adopts it, through the engine's decide door, never the assistant's.
• Record a certificate (record 55, ruling 22 b). A model's page under Pipelines, Models, offers Record a certificate to a person with models:work where the engine serves POST /api/certificates: the graded run that measured the model (the run, the sha256 of its manifest, the commit that registered the plan, the bar, how many stacks it graded and how many were wrong, with the bound, the coverage, the test and the claim where known), for the model's own artifact digest. It is the person's own act under their sign-in and unseals nothing, so no second person is needed; the engine works the bound out again from the counts and its refusal shows in its words. A model's card says what certified it, the graded run or the sealed sample with its numbers, or that no certificate names it, and its page shows the certificate: the run, its manifest, the plan's commit, the artifact, the run that showed a repackaged artifact answers the same, and what it found. On an engine that does not say, the card leaves the line out.
• Body part and post-contrast as layers on the Main scans map, for a dataset and for a cohort (record 55, decision 6 of 2026-10-10: "The data map (v0's heatmap, for datasets and cohorts, with layers such as body part and post-contrast) is where the trade-off is seen"; ruled in on 2026-10-13). A Layer box over the subjects offers Kinds, Body region, Body part and Post-contrast, only the chosen key in colour, kept in the tab. With a layer on, its values are drawn over the visits as the kinds are, each framed in its own colour (post-contrast as Data's grid colours contrast): faint the visits that hold a scan of it, solid those whose scan taken carries it, and under a draft how many the saved rules take beside it; one line says what carries none, and for post-contrast how many visits follow contrast given in the 72 hours before. Each card's visit shows the value of the scan taken under its kind, or, outlined, what most of its scans are where none is taken, with its scans by value on hover and a 72 h flag where it is up; every subject's strip takes the layer's colours the same way; and a visit's pick shows each candidate's value beside its kind. One line says whether the step that answers the layer (body part for both body layers) has run over the dataset or cohort, as its own page says it, with a Run where it has not, as the Data page offers it, held with the engine's reason where a run would be refused; while it waits or runs the map is read again every 15 seconds. Asks the map doors with layer; where an engine from before answers without one, the box says this engine draws no layers yet. The cohort's own heatmap (its page's Main scans, visit by visit) takes the same layers: keys beside the role's, Picks first; a cell in the colour of the value of the scan picked, or outlined in what most of the session's scans are; the values under the rows; and the step's line with its Run.

Changed

• An admin has full access to anything (record 55, ruling 24). Whoever may change people and groups (People at work) is resolved to every grant and every detail, campaigns and models included, whatever the group that made them an admin was made with, with nothing to grant to themselves; a sealed sample stays sealed, since its grant is in no set. The person's form draws an admin with every page at its top and every detail, nothing to choose, and says so in one line; People at work reads "admin: everything, every detail".
• Every page, every setting or everything is given at once from a person's or a group's form. None of them makes an admin: People is raised to see, and work on People is chosen on its own line, where the form says it makes an admin.
• Standing grants speak plain words, grouped by page (record 55, ruling 24): each says what it lets the assistant do ("Bring in identifier maps", "Change places", "Run pipelines on datasets"), under the page it belongs to, campaigns among them, with Give and Revoke per action, Give all per page and Give everything. No engine door reaches the screen, on Standing grants or on Plans waiting, where a held step's reason names no door either. An admin is told the assistant may do everything they may, with nothing to give. Against an assistant that sends no offer, its ladder's rung-two actions the person's own grants open are offered in words the desk knows, so grants can still be given, with no Give all or Give everything, which such an assistant cannot take.
• Add an ID type asks what one leads to: a study's subject, or a person anywhere (a hospital's record number), which marks the type identifying, so looking a subject up by one needs every detail (record 55, ruling 24). The ID types list marks such a type "Leads to a person". The choice is sent only when the person makes it, so naming a type that exists again never changes what it is; the engine refuses taking the flag away without being told so, and a built-in type keeps it.
• A visit's page of scans carries no pictures, only where each is (the Data page's speed). With an engine that answers links=1, each scan's picture is the preview door's middle plane, named by its version and held state so the browser keeps it for good, or the door's first picture while the scan's preview is made; the page answers in tens of milliseconds and the pictures arrive beside it, each fetched once. With an older engine the pictures come inline, as before.
• Review's questions are the few the rules leave open, in plain words, each answered as a grid of its scans (record 56 section 6.3, Review round 1). With an engine that gathers its questions (GET /api/review/questions), Review's Questions lists each one with its distinct scans and why it is asked ("Which base? 7 scans · The rules found no base for these scans."), its staged answers, what is answered on another page and what a campaign holds, and the Questions chip counts the scans. One click opens the question's grid (#review/questions/<key>): a page of fifty scans' pictures, each framed in the colour of NILS's answer, the colour a value keeps everywhere, with System 1's answer as a second small mark (the scans it agrees on step back) and a staged answer marked; a blind-first scan shows none of NILS's answers. Keys 1 and 2 give the question's two answers, 0 the axis's whole list, - no value; space sets the focused scan apart, where it takes the other key's answer or one of its own, and Enter answers the page in one move with the scans set apart as exceptions. The scans are sorted again ...

nils-desk v1.0.0-alpha.64

Fixes found on the first dataset read on a site after the beta, for engine 1.0.0-alpha.81 (and older engines, which fall back): an acquisition's own images sit in its family's box, and a file count that stopped short says so.

Fixed

• A dataset's file count that stopped short reads "at least N files", on its card, its found step and its detail, until a read counts the tree whole. The engine counts a tree a page's worth of entries at a time and stops short of a large one, and the desk showed that count as final: so a large dataset's card showed a small part of its files as the whole. With an engine that says found_partial (and the found step's partial), or the sources door's partial on a tree, the count is said as a lower bound, and its size, counted part of the way too, is not said; once a read has counted the tree, its count is the read's.

• A visit's families hold an acquisition's own images. With an engine that says each scan's acquisition_family, the family its route recognised, the SyMRI box holds SyMRI's acquisition, first, beside its maps and synthetic images, where it sat in Scouts and other, and the SWI box holds the magnitude, phase, processed image and minIP of one acquisition, where the magnitude and phase sat among the plain scans and the minIP among the derived ones; a projection or a reformat of SyMRI, an SWI or STAGE stays in its acquisition's box. On an older engine a scan is grouped by what made it, as before. The family labels are unchanged.

• A visit's perf folder reads Perfusion (ASL), since BIDS keeps ASL in perf/ and func/ holds BOLD alone, and a field map's reverse phase-encoding reference says on its card what it is for: "reverse phase encoding, used to correct the DWI's distortion".

nils-desk v1.0.0-alpha.63

Wave 7a's desk, the beta candidate, for engine 1.0.0-alpha.80. The desk is redesigned around its map; Data has one safe way in, pseudonymises in place and says how sure each sort is; the chat is one chat; Review and Campaigns are one list of work, with both suggestions, blind first, rounds and the audit; Models sit under Pipelines with the model chosen per task; a result is checked over its scan; the reader shows the rules' evidence beside the picture at a fixed size; Settings lists each rules pack as a part that updates on its own; and one pattern of words, sides and empty states runs across the desk, with no command line inside a flow.

Added

• One pattern across the desk (record 55 H2, round 4; spec 13.1). One word per thing: the query section is Query with Cards, Selections and Exports, the kept results saved as CSV files; Settings' Database, Identity and Kvasir pages are Backups, People and Language models (their old addresses lead to the new ones), and a grant is named by its page's word. Every section's pages are in the side: Pipelines lists Jobs, Catalog, Runs, Logs and Models, Release lists Releases, New release and Session schemes, and the tabs that repeated the side inside Review, Pipelines and Query are gone. Nothing hidden while empty: Picks, Proposals and Asked show with their count, zero too, and an empty page says in one line what fills it. Home's tiles are links to where the person acts. On a phone, tapping Home in the panel closes it.
• No command line inside a flow (record 55 H2, rounds 3 and 4). The Catalog adds a pipeline from its nils.job.yml (POST /api/pipelines), shows where pipelines run and changes it (/api/pipelines/lane), and sets or unsets the secret files pipelines declare, such as a licence, whose contents never show (/api/pipelines/secrets), each with work on the install. The release form chooses a kept session scheme or makes one in place, and Release's Session schemes page lists them (/api/session-schemes).
• The dark theme's marks and bars (record 55 K5b): spinners, a bar's fill, the step now, a chosen card's band, checkboxes and sliders take --n-brand-mark and --n-progress, which stand out on the dark ground as on the light, and a selected row is lighter there; a theme test holds every mark to 3:1 against the page.
• A walk of the side in a real browser (gate T31): every section of the map opens, and every page under it opens from its line and draws, at 1440 and at 390 pixels, in chromium and Firefox (test/layout/side-walk.pw.ts).
• The reader, next level (record 55 H5, spec 13.4). Why the rules decided stands beside the picture, open, in the rate reader's panel: one line per asked axis, the value in force, then the flags, the rule, the header values its clause read and the words it matched; an axis where the rules and System 1 differ is framed in the caution colour. A blind item still shows the file and no line of the rules' answer. The picture box is of a fixed size per screen class (from 1400 by 760, 1880 by 940 and 2520 by 1280, the panel and head grown by 1, 1.25 and 1.5), so a screen shows the same layout every time; below a laptop's class the picture takes what is left, as before. The whole reader is compact or expanded, kept per person and turned by H: compact gives the picture the room, the file's key lines, the evidence a line per axis and every axis a find box, and holds an open item with its candidates on one screen; expanded widens the panel, draws the file and the short rows whole, and puts the clause, the votes, the words, System 1's word and the confidence under each line that needs a look. A Review queue item looked at reads GET /api/stacks/{stack}/why and shows the same lines beside its picture. H no longer opens the evidence in a drawer, and h without the whole-header door does nothing.
• System 1 in the review rule, blind first, and the audit (record 55 D3, D6, D7; spec 11). Deciding a question about an axis shows both suggestions and both reasons side by side: the rules' answer with the rule and clause that decided, the fields it read with their values and the words it matched, and System 1's answer with its probability, the rules' reliability on that header, the fields that mattered with their effects and up to five settled scans like it, said to be for display, never votes; its column says "not confirmed" with why until a recorded certificate names the model, and "no model" where none is chosen (GET /api/review/{id}/suggestions). A question drawn blind first (one in five by default, marked in the queue and the dialog) is answered from the scan and its header with nothing of NILS's shown and no value filled in; the answer posts as provisional (POST /api/review/{id}/provisional), then both sides show and the person keeps or changes it and decides; the engine times it and says whether the decision was given blind. Review gains Rounds (#review/rounds, where the engine serves it): each rules version and System 1 version with the share accepted and sent to a person, the questions by kind, the check that none was sent for a conflict, a low confidence, body part or post-contrast, System 1's coverage, the answers given blind and not, and its audit draws with their grade (wrong of read, the error and its exact bound); Draw the audit and Grade are its acts. Audit campaigns are a family of their own in Work, said never to train; a campaign is made for decide, train, measure or audit, and an audit suggests nothing and closes into nothing. Database settings hold the share of questions answered blind first, and a dataset's detail its headers flag, by its signs or a person, which a person sets or clears with why.
• The gate's T4 in CI for the desk's three ways a source comes in (Wave 7a section 17): a folder of loose DICOM added on Data, in Setup's step and on the Places page asks the engine for no job before the person's answer, with the door that would queue one offered.
• A saved selection is named with @ in the chat like a kept result (record 55 K6). Typing @ offers the person's saved selections beside their query cards, cohorts and kept results, where the engine lists selections to them (GET /api/ask/selections, query:see): each by its name, the version current now and its size, a size held back at plain said as held back. A selection picked is written into the words as @[name](selection:name%40version), the shape the assistant reads, and drawn in the message as a chip that opens the Query page's selections.
• A person's password is changed in the desk, and a person removed (record 55 H2, round 5, B12). POST /desk/people/{name}/password {password, current}, where the desk keeps the people: a person changes their own with the one they have (403 when it is not right), and a person holding identity:work resets anyone else's without it; eight characters at least, as when a person is added. An admin's reset ends every session of that person, and one's own change ends one's other sessions and keeps this one; the answer says how many ended, {username, sessions_ended}. DELETE /desk/people/{name}?to=<subject> (identity:work, from the desk's own origin, wherever people sign in): the person's groups, own grants and sessions go, and in local mode the user with its password; under oidc the desk forgets them, so a later sign-in at the provider holds only what a group that follows a provider group gives. The results and lineage they kept go to to where it names another person the desk knows (400 otherwise), {removed, sessions_ended, handed: {results, lineage}, to}. Never oneself (409, ask another admin), and never the last holder of identity:work (409), the rule every change to people keeps.
• A finished pipeline run can be found and what it made seen (2026-10-13; Nima, after a SAMSEG run: "there is no way for me to see the samseg result! why?"). A pipeline run's job, in Now and in All jobs, opens its run's page on a click anywhere on its card, and by Open run from the keyboard. Each Catalog row says its newest run on one line, last run 4 · 4 of 4 made · 12 Oct, its border in the run's colour, and the line opens the run; a Runs table row opens its run wherever it is clicked but its links. On a run's page each unit with a mask offers View, which opens the scan the mask's grid is on with the mask drawn over it, read only, as the check reader draws it (the engine's layer of the mask on that scan, built on demand): one chip a part set (Lesions 8, Structures 36, a label map in its structures' colours), the mask's keys (o, f, [, ]), the stack or the three planes, Previous and Next through the units with a mask, and the unit's files. The Files list reads by unit, each file by its short name, kind and size. View needs Pipelines: See, detail quasi and an engine that serves a mask's layer.
• The missing controls of round 5 (record 55 H2, spec 13.1). An admin resets another person's password from their form, typed twice, which signs them out, and removes a person, whose sessions end and whose kept results go to the person chosen, or stay under their name; neither is offered on the admin's own row, and a reset only where the desk keeps the people. A person changes their own password on their profile with the current one, which signs out their other sessions. Both go through the desk's new people doors.
• Hand over and withdraw a release from its row. Hand over packs the newest version of a name into encrypted archives in an exchange place, under a key named by the person, and prints the command that gives the receiver its password; Withdraw queues the release verb's withdrawal with its reason, and the row reads withdrawn once it has run.
• Logs, under Pipelines: the jobs, newest first, beside the log of the one opened, its end first and followed while the job runs, Earlier reading back; a pipeline run's job lists its units, each opening its own log, and a log the engine will not show says why (none kept, another ho...

nils-desk v1.0.0-alpha.62

The comparison reader (pair mode and anchored reading) after a rater's first long session on it. Moving to the next item draws from memory: the page warms the next five items in the view the rater chose while the current one is read, with engine 1.0.0-alpha.72's ahead on the claim. The view (the stack, the three planes, or one plane alone) is kept for every item and the next visit, for every panel or one. A plane paged in the three planes stays where it was paged. The controls are grouped by what they do, every one shows its key, and nothing wraps from a laptop up. Against an engine before alpha.72 nothing is warmed ahead and the rest works the same. The desk still speaks the engine's HTTP contract 7 and suite contract 3, and starts against HTTP contract 5 and suite contract 2 or newer.

Added

• The next items warmed: once the item on the screen is drawn, the reader reads ahead the next five items the claim names (manifests, the first pictures, the slabs of their opening planes and beside them, their reference tissue, and in the three planes their volumes' slabs, with the next item's volume filled), two reads at a time, called off when the rater jumps and paused while an answer and the next claim go out. The two items read last stay in memory for Previous.
• The view as the rater's choice: the stack, the three planes, or the axial, coronal or sagittal plane alone (the stack itself where that is its own plane), kept per campaign and rater in this browser, for every panel (z, t, a, c, x, v to cycle) or for the panel under the pointer (Shift and the key, or the panel's own menu).
• Send on key (u): an answer's key sends it and the next item comes, with no Enter. The last answer is said with Undo (b), which opens it again to correct.
• ? opens every key grouped by what it does: answer, view, compare, pictures.
• A progress bar with what is read and left, and the item's clock, at the head of the page.

Changed

• The page is three bands: where the campaign stands; the panels; then a quiet toolbar of the view and the comparison, apart from the answer keys, which are large, equal and on one line with Answer, Give back and Stop. The toolbar and the answers give room as they narrow and never wrap from 1280 pixels up, and grow with the screen.
• The panels keep their place while the next item comes, dimmed, so nothing shifts.
• Pair mode and anchored reading are one page told by a spec each.
• The slabs a page reads are kept across stacks under one budget and read once; the viewer's decode pool grows to eight workers and decodes for later behind the pictures on the screen.

Fixed

• In the three planes a plane paged with the wheel or the arrows jumped back to its middle: every render turned the planes to their cameras again. They are turned only when the cut changes.
• The view chosen in the anchored reader went back to the stack on every item.

nils-desk v1.0.0-alpha.61

The desk follows engine 1.0.0-alpha.63. Review's queue filters by axis and by reason, kept in the page's address; a model that disagrees with a person's decision carries a badge and Decide starts from the person's value; Keep on a pick border writes the run's pick as the person's, and the Picks page names the six new border reasons and offers the served pack's roles. A campaign that names its raters is claimed only by them, and accepting a batch of like stacks works again. The disagreement items, the new border reasons, the pack's roles and Keep as a decision come from engine 1.0.0-alpha.63; against an older engine the queue shows none of them, the maker takes a role typed by name, and Keep closes the item as before without writing a pick. The desk still speaks the engine's HTTP contract 7 and suite contract 3, and starts against HTTP contract 5 and suite contract 2 or newer.

Added

• Review's queue filters by axis and by reason (no value, rules conflict, not confident, vote split, a decision disagrees, a model proposes, and a pick run's borders by their reasons), from the kinds the engine lists. The filter is kept in the page's address (#review?axis=base&reason=conflict), so a reload or a link keeps it, and one axis's kind is read whole from the engine. "Ask people about these" carries it to the campaign maker as a kind or a prefix.
• A model that disagrees with a person's decision carries a badge, "a model disagrees with this person's decision", in the queue and in Look, with what the model proposes and how sure it is; Decide starts from the person's value, to confirm or change it. It reads the engine's <axis>:decision items whose evidence says source: model.
• The Picks page names the six border reasons the pack gains (a retake, an unknown dimension, an odd number of slices, a twin before or after contrast, an EPIMix standing in, a plain stack close behind the Dixon) in words, and offers the served pack's roles as chips with their open borders. The campaign maker offers the pack's roles for a pick question, where the engine lists them.

Changed

• The desk asks the engine's question of who rates a campaign: the maker, a person it names as a rater or an adjudicator, a person it assigned an item, or a holder of work on the Review page; a campaign that names its raters is claimed only by them. A campaign that names no raters is rated by reviewers, and the maker says so under the raters it names.
• Keep on a pick border writes a person's pick of the run's stacks, and says so ("Keep the run's pick as yours"); where nothing was eligible it says no stack stands for the role here. A kept pick stands through later pick runs until withdrawn, with the engine that writes it.

Fixed

• Accepting a batch of like stacks was refused ("hold_back is not the caller's to say"): the desk sent the share held back, which the engine keeps as the campaign's own. It now names only the items shown.
• The campaign and reader walks were brought to the engine they test: the campaigns name their raters, and the batch walk makes its campaign with the rules' suggestion.