@zq-silk/yui 0.15.7 → 0.15.9

package/dist/web/assets/client/view.js

@@ -2,6 +2,7 @@ export const VIEW_SCRIPT = `
 // Page composition: sidebar lists, overview, and the task detail scaffold.
 // All reusable widgets and cards come from components.js.
 import { clear, node } from "/assets/js/dom.js";
+import { renderTaskSurface } from "/assets/js/task-surface.js";
 import { byNewest, formatDateTime } from "/assets/js/format.js";
 import {
   anchorSection,
@@ -23,14 +24,14 @@ import {
   reviewCard,
   richText,
   roleCard,
-  turnCard,
+  runCard,
   sectionHead,
   taskCard,
   translatedStatus,
   workItemCard
 } from "/assets/js/components.js";
 
-const statuses = ["all", "active", "draft", "completed", "retired", "archived"];
+const statuses = ["all", "active", "draft", "completed", "cancelled", "archived"];
 
 export function renderFilters(container, state, t, onFilter) {
   const counts = state.counts || {};
@@ -83,7 +84,7 @@ function taskGroupOf(task, attentionIds) {
   if (attentionIds.has(task.id)) return "attention";
   if (task.status === "active") return "active";
   if (task.status === "draft") return "draft";
-  if (task.status === "retired") return "retired";
+  if (task.status === "cancelled") return "cancelled";
   if (task.status === "archived") return "archived";
   return "finished";
 }
@@ -102,7 +103,7 @@ export function renderTasks(container, state, t, locale, onSelect) {
   clear(container);
   const query = state.query.trim().toLocaleLowerCase(locale);
   const attentionIds = new Set((state.attention || []).map(function (item) { return item.taskId; }));
-  const groups = { attention: [], active: [], draft: [], finished: [], retired: [], archived: [] };
+  const groups = { attention: [], active: [], draft: [], finished: [], cancelled: [], archived: [] };
   (state.tasks || []).forEach(function (task) {
     if (state.filter !== "all" && task.status !== state.filter) return;
     if (!taskMatchesQuery(task, query, locale)) return;
@@ -114,7 +115,7 @@ export function renderTasks(container, state, t, locale, onSelect) {
     ["active", t("group.active")],
     ["draft", t("group.draft")],
     ["finished", t("group.finished")],
-    ["retired", t("group.retired")],
+    ["cancelled", t("group.cancelled")],
     ["archived", t("group.archived")]
   ];
   const firstGroup = order.find(function (entry) { return groups[entry[0]].length > 0; });
@@ -182,7 +183,7 @@ export function renderOverview(detail, state, t, locale, onSelect) {
   wrap.append(inbox);
 
   // Tasks whose Task-first projection says they need attention: blocked,
-  // recovering, or in an attention state. This replaces the raw stalled-Turn
+  // recovering, or in an attention state. This replaces the raw stalled-AgentRun
   // count with the derived execution status.
   const attentionTasks = (state.tasks || []).filter(function (task) {
     const status = task.executionStatus;
@@ -232,23 +233,23 @@ export function renderError(container, message) {
   container.append(node("div", "error", message));
 }
 
-const TURN_PAGE_SIZE = 12;
+const RUN_PAGE_SIZE = 12;
 const LIST_PAGE_SIZE = 10;
-const TURN_FILTERS = ["all", "active", "completed", "failed"];
+const RUN_FILTERS = ["all", "active", "completed", "failed"];
 
-function turnFilterRow(sortedTurns, t, onChange) {
-  const row = node("div", "filter-row turn-filter");
+function runFilterRow(sortedRuns, t, onChange) {
+  const row = node("div", "filter-row run-filter");
   const buttons = [];
-  TURN_FILTERS.forEach(function (status) {
+  RUN_FILTERS.forEach(function (status) {
     const count = status === "all"
-      ? sortedTurns.length
-      : sortedTurns.filter(function (turn) { return turn.status === status; }).length;
+      ? sortedRuns.length
+      : sortedRuns.filter(function (run) { return run.status === status; }).length;
     if (status !== "all" && count === 0) return;
     const btn = node("button", "filter-chip");
     btn.type = "button";
     btn.dataset.status = status;
     if (status !== "all") btn.append(node("span", "filter-dot " + status));
-    btn.append(document.createTextNode(status === "all" ? t("status.all") : t("turn." + status)));
+    btn.append(document.createTextNode(status === "all" ? t("status.all") : t("run." + status)));
     btn.append(node("span", "filter-count", String(count)));
     btn.addEventListener("click", function () { onChange(status); });
     buttons.push({ status: status, element: btn });
@@ -265,6 +266,7 @@ function turnFilterRow(sortedTurns, t, onChange) {
 }
 
 export function renderTaskDetail(detail, data, t, locale, actions) {
+  if (data.core) return renderTaskSurface(detail, data, t, locale, actions);
   actions = actions || {};
   clear(detail);
   const task = data.task;
@@ -346,14 +348,14 @@ export function renderTaskDetail(detail, data, t, locale, actions) {
     conclusion.append(richText(null, task.completionSummary, t));
     conclusion.append(conclusionMeta(task, t, locale, "completed"));
     summaryBody.append(conclusion);
-  } else if (task.status === "retired" || task.retirementSummary) {
+  } else if (task.status === "cancelled" || task.retirementSummary) {
     const conclusion = node("div", "conclusion archived");
-    conclusion.append(node("h3", "", t("detail.retired")));
+    conclusion.append(node("h3", "", t("detail.cancelled")));
     if (task.retirementSummary) conclusion.append(richText(null, task.retirementSummary, t));
     if (task.replacementTaskId) {
       conclusion.append(node("p", "muted", t("detail.replacement") + " · " + task.replacementTaskId));
     }
-    conclusion.append(conclusionMeta(task, t, locale, "retired"));
+    conclusion.append(conclusionMeta(task, t, locale, "cancelled"));
     summaryBody.append(conclusion);
   } else if (task.status === "archived" || task.archiveSummary || task.archiveReason) {
     const conclusion = node("div", "conclusion archived");
@@ -377,23 +379,23 @@ export function renderTaskDetail(detail, data, t, locale, actions) {
       attentionBody));
   }
 
-  const stalledTurns = data.runtimeHealth && data.runtimeHealth.needsAttentionTurns
-    ? data.runtimeHealth.needsAttentionTurns
+  const stalledRuns = data.runtimeHealth && data.runtimeHealth.needsAttentionRuns
+    ? data.runtimeHealth.needsAttentionRuns
     : [];
-  if (stalledTurns.length) {
+  if (stalledRuns.length) {
     const runtimeHealthBody = node("div", "section-body");
-    stalledTurns.forEach(function (turn) {
+    stalledRuns.forEach(function (run) {
       const card = node("article", "record-card");
       card.append(
-        node("strong", "", turn.roleName + " · " + turn.turnId),
-        node("p", "record-copy", (turn.kind || "workflow-not-progressing") + " · " + (turn.classification || "truly-stalled")),
-        node("small", "", t("detail.lastProgress") + " · " + formatDateTime(turn.progressAt, locale))
+        node("strong", "", run.roleName + " · " + run.runId),
+        node("p", "record-copy", (run.kind || "workflow-not-progressing") + " · " + (run.classification || "truly-stalled")),
+        node("small", "", t("detail.lastProgress") + " · " + formatDateTime(run.progressAt, locale))
       );
       runtimeHealthBody.append(card);
     });
     scaffold.append(anchorSection(
       "detail-health",
-      sectionHead(t("detail.runtimeHealth"), { count: stalledTurns.length }),
+      sectionHead(t("detail.runtimeHealth"), { count: stalledRuns.length }),
       runtimeHealthBody
     ));
   }
@@ -438,35 +440,35 @@ export function renderTaskDetail(detail, data, t, locale, actions) {
     sectionHead(t("detail.workItems"), { count: data.workItems.length }),
     workBody));
 
-  // 5. Turns (anchor #detail-exec) — execution grid with status filter + paging
+  // 5. AgentRuns (anchor #detail-exec) — execution grid with status filter + paging
   const execWrap = node("div", "section-body");
-  const execBody = node("div", "turn-grid");
-  const sortedTurns = data.turns.slice().sort(byNewest);
-  if (!sortedTurns.length) {
-    execBody.append(emptyRow(t, "empty.turns"));
+  const execBody = node("div", "run-grid");
+  const sortedRuns = data.runs.slice().sort(byNewest);
+  if (!sortedRuns.length) {
+    execBody.append(emptyRow(t, "empty.runs"));
     execWrap.append(execBody);
   } else {
-    let activeTurnFilter = "all";
-    const filter = turnFilterRow(sortedTurns, t, function (status) {
-      activeTurnFilter = status;
+    let activeRunFilter = "all";
+    const filter = runFilterRow(sortedRuns, t, function (status) {
+      activeRunFilter = status;
       filter.sync(status);
-      renderTurnGrid();
+      renderRunGrid();
     });
-    function renderTurnGrid() {
+    function renderRunGrid() {
       clear(execBody);
-      const visible = activeTurnFilter === "all"
-        ? sortedTurns
-        : sortedTurns.filter(function (turn) { return turn.status === activeTurnFilter; });
-      pagedList(execBody, visible, TURN_PAGE_SIZE, function (turn) {
-        return turnCard(turn, t, locale);
+      const visible = activeRunFilter === "all"
+        ? sortedRuns
+        : sortedRuns.filter(function (run) { return run.status === activeRunFilter; });
+      pagedList(execBody, visible, RUN_PAGE_SIZE, function (run) {
+        return runCard(run, t, locale);
       }, t);
     }
-    filter.sync(activeTurnFilter);
+    filter.sync(activeRunFilter);
     execWrap.append(filter.row, execBody);
-    renderTurnGrid();
+    renderRunGrid();
   }
   scaffold.append(anchorSection("detail-exec",
-    sectionHead(t("detail.execution"), { count: data.turns.length }),
+    sectionHead(t("detail.execution"), { count: data.runs.length }),
     execWrap));
 
   // 5b. Reviews (anchor #detail-reviews) — review rounds for completed candidates
@@ -522,7 +524,10 @@ export function renderTaskDetail(detail, data, t, locale, actions) {
     messagesBody.append(emptyRow(t));
   } else {
     pagedList(messagesBody, data.messages.slice().sort(byNewest), LIST_PAGE_SIZE, function (message) {
-      return messageCard(message, t, locale);
+      const source = message.resultRef && data.runs.find(function (run) {
+        return run.id === message.resultRef.runId && run.roleName === message.author.roleName;
+      });
+      return messageCard(message, t, locale, source && source.result);
     }, t);
   }
   scaffold.append(anchorSection("detail-messages",

package/dist/web/assets/shell.js

@@ -83,7 +83,7 @@ export const DASHBOARD_HTML = `<!doctype html>
         <button class="tab" type="button" data-target="detail-top" data-i18n="tabs.summary">Summary</button>
         <button class="tab" type="button" data-target="detail-focus" data-i18n="tabs.focus">Focus</button>
         <button class="tab" type="button" data-target="detail-work" data-i18n="tabs.work">Work items</button>
-        <button class="tab" type="button" data-target="detail-exec" data-i18n="tabs.exec">Turns</button>
+        <button class="tab" type="button" data-target="detail-exec" data-i18n="tabs.exec">AgentRuns</button>
         <button class="tab" type="button" data-target="detail-reviews" data-i18n="tabs.reviews">Reviews</button>
         <button class="tab" type="button" data-target="detail-roles" data-i18n="tabs.roles">Roles</button>
         <button class="tab" type="button" data-target="detail-history" data-i18n="tabs.history">History</button>

package/dist/web/assets/styles/cards.js

@@ -1,10 +1,28 @@
 /*
  * CARDS — content-bearing surfaces.
  * Overview blocks, detail head / conclusion band, sections, record cards,
- * input cards, Turn cards, criteria lists. Widgets (pills, chips, metrics)
+ * input cards, AgentRun cards, criteria lists. Widgets (pills, chips, metrics)
  * live in widgets.ts; markdown typography lives in markdown.ts.
  */
 export const CARD_STYLES = `
+.surface-json { white-space: pre-wrap; overflow-wrap: anywhere; max-height: 36rem; overflow: auto; }
+.task-surface .section-body { display:grid; gap:12px; min-width:0; }
+.task-surface { grid-template-columns:minmax(0,1fr); }
+.task-surface .detail-section,.task-surface .record-card,.task-surface .execute-card { min-width:0; max-width:100%; }
+.task-surface .record-meta { min-width:0; overflow-wrap:anywhere; }
+@media(max-width:620px){
+  .task-surface .record-head{flex-wrap:wrap}
+  .task-surface .record-title-row{flex-basis:100%}
+}
+.task-surface .section-body > .pill { width:max-content; }
+.task-surface form,.task-surface label { display:grid; gap:10px; min-width:0; }
+.task-surface label { font-size:13px; font-weight:500; }
+.task-surface input,.task-surface textarea { box-sizing:border-box; width:100%; min-width:0; padding:12px; border:1px solid var(--border-strong); border-radius:var(--radius); background:var(--bg-1); color:var(--text); font:inherit; }
+.task-surface textarea { min-height:96px; resize:vertical; }
+.task-surface input:focus-visible,.task-surface textarea:focus-visible,.task-surface summary:focus-visible { outline:2px solid var(--accent); outline-offset:3px; }
+.task-surface button { min-height:40px; }
+.task-surface summary { cursor:pointer; padding:8px 0; font-weight:600; }
+.task-surface [role=status] { overflow-wrap:anywhere; }
 /* Overview scaffolding */
 .overview{display:grid;gap:14px;padding-top:2px}
 .overview-duo{display:grid;grid-template-columns:1fr 1fr;gap:14px;align-items:start}
@@ -109,9 +127,9 @@ details.work-item-card>summary.record-head~*{margin-top:0}
 .input-answer:hover{border-color:var(--accent-line);color:var(--accent);background:var(--accent-soft)}
 .input-form{display:flex;gap:8px;flex:1}
 .input-form input{min-width:0;flex:1;padding:8px 12px;color:var(--text);background:var(--bg-2);border:1px solid var(--border);border-radius:var(--radius);font-family:var(--font-body);font-size:12.5px}
-/* Execution Turns */
-.turn-grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(min(320px,100%),1fr));gap:9px}
-.turn-filter{margin-bottom:3px}
+/* Execution AgentRuns */
+.run-grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(min(320px,100%),1fr));gap:9px}
+.run-filter{margin-bottom:3px}
 .execute-card{background:var(--bg-2);border:1px solid var(--border);border-left:2px solid var(--border);border-radius:var(--radius);padding:9px 12px;display:grid;gap:6px;box-shadow:var(--shadow-card);transition:border-color var(--motion-fast)}
 .execute-card:hover{border-left-color:var(--border-strong)}
 .execute-card[data-status=active]{border-left-color:var(--accent)}

package/dist/web/controllerWeb.js

@@ -0,0 +1,60 @@
+import { parseWebCommandOptions, startYuiWebServer } from "./webServer.js";
+/** HTTP listener ownership only, alongside the Controller's one Kernel Host.
+ * The authenticated Controller control socket starts/stops the exact listener;
+ * no capability identity is accepted through this lifecycle API. */
+export function createControllerWeb(store, dependencies) {
+    let current;
+    let starting = false;
+    const close = async () => {
+        const owned = current;
+        if (!owned)
+            return;
+        current = undefined;
+        owned.server.closeTerminals();
+        await new Promise((resolve, reject) => {
+            owned.server.close((error) => error ? reject(error) : resolve());
+            owned.server.closeAllConnections();
+        });
+    };
+    return {
+        close,
+        async dispatch(method, value) {
+            if (!value || typeof value !== "object" || Array.isArray(value))
+                throw new Error("Invalid Web listener request.");
+            const params = value;
+            if (method === "web.status") {
+                if (Object.keys(params).length)
+                    throw new Error("Web status takes no arguments.");
+                return current ? { id: current.id, url: current.url } : null;
+            }
+            if (method === "web.stop") {
+                if (Object.keys(params).some((key) => key !== "id") || typeof params.id !== "string")
+                    throw new Error("Expected Web listener id.");
+                if (!current)
+                    return { stopped: false };
+                if (current.id !== params.id)
+                    throw new Error("Web listener identity changed.");
+                await close();
+                return { stopped: true };
+            }
+            if (method !== "web.start" || Object.keys(params).some((key) => !["id", "host", "port"].includes(key))
+                || typeof params.id !== "string" || !params.id.trim()
+                || typeof params.host !== "string" || typeof params.port !== "number") {
+                throw new Error("Expected id, host and port for Web start.");
+            }
+            const options = parseWebCommandOptions(["--host", params.host, "--port", String(params.port)]);
+            if (starting || current)
+                throw new Error("A Web listener is already starting or running in this Controller.");
+            starting = true;
+            try {
+                const server = await startYuiWebServer(store, options, dependencies);
+                const url = `http://${options.host === "::1" ? "[::1]" : options.host}:${options.port}`;
+                current = { id: params.id, server, url };
+                return { id: params.id, url };
+            }
+            finally {
+                starting = false;
+            }
+        }
+    };
+}

package/dist/web/webMutation.js

@@ -0,0 +1,28 @@
+export class WebRequestRejected extends Error {
+    disposition = "not-submitted";
+}
+/** For Store-only mutations with notifications excluded: an exception from
+ * the callback, propagated unchanged after rollback, proves non-submission.
+ * Commit/rollback failures and post-commit notifications remain unknown. */
+export function webLocalMutation(store, apply) {
+    let rejected = false;
+    let callbackError;
+    try {
+        return store.transaction((tx) => {
+            try {
+                return apply(tx);
+            }
+            catch (error) {
+                rejected = true;
+                callbackError = error;
+                throw error;
+            }
+        });
+    }
+    catch (error) {
+        if (rejected && error === callbackError) {
+            throw new WebRequestRejected(error instanceof Error ? error.message : "Mutation rejected.");
+        }
+        throw error;
+    }
+}

package/dist/web/webServer.js

@@ -2,6 +2,8 @@ import { randomBytes, timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";
 import WebSocket, { WebSocketServer } from "ws";
 import { usageError } from "../errors/cliError.js";
+import { WebRequestRejected } from "./webMutation.js";
+import { TASK_SUBMISSION_INTENTS } from "../message/message.js";
 import { DASHBOARD_HTML, findWebAsset } from "./assets/assetManifest.js";
 import { buildWebDashboardSnapshot, buildWebTaskDetail } from "./webSnapshot.js";
 const MAX_JSON_BODY_BYTES = 16 * 1024;
@@ -53,12 +55,17 @@ export function createYuiWebServer(store, dependencies = {}) {
     server.on("upgrade", (request, socket, head) => {
         void handleTerminalUpgrade(request, socket, head, webSocketServer, dependencies.terminal, token);
     });
-    server.on("close", () => {
+    let terminalsClosed = false;
+    const closeTerminals = () => {
+        if (terminalsClosed)
+            return;
+        terminalsClosed = true;
         for (const socket of webSocketServer.clients)
             socket.terminate();
         webSocketServer.close();
-    });
-    return server;
+    };
+    server.on("close", closeTerminals);
+    return Object.assign(server, { closeTerminals });
 }
 export async function startYuiWebServer(store, options, dependencies = {}) {
     const server = createYuiWebServer(store, dependencies);
@@ -75,7 +82,7 @@ async function handleHttpRequest(request, response, store, dependencies, token,
     setSecurityHeaders(response);
     const method = request.method ?? "GET";
     if (!isLoopbackHost(headerValue(request, "host"))) {
-        sendJson(response, 403, { error: "Invalid Host." }, method === "HEAD");
+        sendJson(response, 403, { error: "Invalid Host.", disposition: "not-submitted" }, method === "HEAD");
         return;
     }
     let pathname;
@@ -83,7 +90,104 @@ async function handleHttpRequest(request, response, store, dependencies, token,
         pathname = new URL(request.url ?? "/", "http://localhost").pathname;
     }
     catch {
-        sendJson(response, 400, { error: "Invalid URL." }, method === "HEAD");
+        sendJson(response, 400, { error: "Invalid URL.", disposition: "not-submitted" }, method === "HEAD");
+        return;
+    }
+    // The loopback page token is the actual user ingress. A request body cannot
+    // select Operator/Leader authority; all API reads use this boundary too.
+    if (pathname.startsWith("/api/") && !tokenMatches(headerValue(request, "x-yui-web-token"), token)) {
+        sendJson(response, 403, { error: "Invalid Yui web token.", disposition: "not-submitted" }, method === "HEAD");
+        return;
+    }
+    const panelTarget = /^\/api\/tasks\/([^/]+)\/panels$/.exec(pathname);
+    if (panelTarget && dependencies.panels) {
+        try {
+            const taskId = decodeURIComponent(panelTarget[1]);
+            if (method === "GET") {
+                sendJson(response, 200, { panels: dependencies.panels.list(taskId), observedAt: now().toISOString() }, false);
+            }
+            else if (method === "POST") {
+                const body = await readMutationBody(request);
+                if (!body || typeof body !== "object" || Array.isArray(body)
+                    || Object.keys(body).some((key) => !["ref", "input"].includes(key))
+                    || !("ref" in body) || !("input" in body))
+                    throw new WebRequestRejected("Expected panel ref and input.");
+                const ref = body.ref;
+                if (!ref || typeof ref !== "object" || typeof ref.capability !== "string"
+                    || typeof ref.contractVersion !== "string" || !ref.provider
+                    || typeof ref.provider.id !== "string" || typeof ref.provider.generation !== "string") {
+                    throw new WebRequestRejected("Invalid panel reference.");
+                }
+                const result = await dependencies.panels.read(taskId, ref, body.input);
+                sendJson(response, 200, { result, observedAt: now().toISOString() }, false);
+            }
+            else
+                sendJson(response, 405, { error: "Method not allowed.", disposition: "not-submitted" }, false);
+        }
+        catch (error) {
+            sendJson(response, 409, { error: error instanceof Error ? error.message : "Panel unavailable.",
+                disposition: "not-submitted" }, false);
+        }
+        return;
+    }
+    const surfaceTarget = /^\/api\/tasks\/([^/]+)\/(context|delta|inspect|metadata|messages)$/.exec(pathname);
+    if (surfaceTarget && dependencies.surface) {
+        try {
+            let taskId;
+            try {
+                taskId = decodeURIComponent(surfaceTarget[1]);
+            }
+            catch {
+                throw new WebRequestRejected("Invalid Task URL encoding.");
+            }
+            const action = surfaceTarget[2];
+            const query = new URL(request.url, "http://localhost").searchParams;
+            let value;
+            if (method === "GET" && action === "context") {
+                value = await dependencies.surface.read(taskId);
+            }
+            else if (method === "GET" && action === "delta") {
+                value = dependencies.surface.delta(taskId, {
+                    after: query.get("after") ?? "",
+                    ...(query.has("continuation") ? { continuation: query.get("continuation") } : {})
+                });
+            }
+            else if (method === "GET" && action === "inspect") {
+                value = dependencies.surface.inspect(taskId, {
+                    store: query.get("store") ?? "", refId: query.get("ref") ?? "",
+                    ...(query.has("digest") ? { digest: query.get("digest") } : {})
+                });
+            }
+            else if (method === "POST" && action === "messages") {
+                const body = await readMutationBody(request);
+                if (typeof body !== "object" || body === null || Array.isArray(body)
+                    || Object.keys(body).some((key) => !["body", "requestId", "intent"].includes(key))
+                    || !("requestId" in body) || typeof body.requestId !== "string" || !body.requestId.trim()
+                    || !("body" in body) || typeof body.body !== "string")
+                    throw new WebRequestRejected("Expected body, requestId and optional intent.");
+                const intent = webSubmissionIntent(body);
+                // requestId is threaded as the submission key (§2.3) and echoed back on the receipt.
+                value = { ...dependencies.surface.message(taskId, body.body, intent, body.requestId), requestId: body.requestId };
+            }
+            else if (method === "POST" && action === "metadata") {
+                const body = await readMutationBody(request);
+                if (typeof body !== "object" || body === null || Array.isArray(body)
+                    || Object.keys(body).some((key) => !["patch", "requestId"].includes(key))
+                    || !("requestId" in body) || typeof body.requestId !== "string" || !body.requestId.trim()
+                    || !("patch" in body))
+                    throw new WebRequestRejected("Expected patch and requestId only.");
+                value = { ...dependencies.surface.update(taskId, body.patch), requestId: body.requestId };
+            }
+            else {
+                sendJson(response, 405, { error: "Method not allowed.", disposition: "not-submitted" }, false);
+                return;
+            }
+            sendJson(response, 200, value, false);
+        }
+        catch (error) {
+            sendJson(response, 409, { error: error instanceof Error ? error.message : "Surface unavailable.",
+                disposition: error instanceof WebRequestRejected ? "not-submitted" : "unknown" }, false);
+        }
         return;
     }
     if (method === "GET" || method === "HEAD") {
@@ -130,7 +234,7 @@ async function handleHttpRequest(request, response, store, dependencies, token,
         }
         catch (error) {
             sendJson(response, 400, {
-                error: error instanceof Error ? error.message : "Invalid input answer."
+                error: error instanceof Error ? error.message : "Invalid input answer.", disposition: "not-submitted"
             }, false);
             return;
         }
@@ -143,13 +247,14 @@ async function handleHttpRequest(request, response, store, dependencies, token,
         }
         catch (error) {
             sendJson(response, 409, {
-                error: error instanceof Error ? error.message : "Unable to answer input request."
+                error: error instanceof Error ? error.message : "Unable to answer input request.",
+                disposition: error instanceof WebRequestRejected ? "not-submitted" : "unknown"
             }, false);
         }
         return;
     }
     response.setHeader("allow", "GET, HEAD");
-    sendJson(response, 405, { error: "Method not allowed." }, method === "HEAD");
+    sendJson(response, 405, { error: "Method not allowed.", disposition: "not-submitted" }, method === "HEAD");
 }
 async function handleTerminalUpgrade(request, socket, head, webSocketServer, terminalPort, token) {
     try {
@@ -340,6 +445,26 @@ function parseWebInputAnswer(value) {
     }
     throw new Error("Exactly one non-empty choiceKey or text is required.");
 }
+async function readMutationBody(request) {
+    try {
+        return await readJsonBody(request);
+    }
+    catch (error) {
+        throw new WebRequestRejected(error instanceof Error ? error.message : "Invalid request body.");
+    }
+}
+/** Validate an optional submission intent from a Web message body. Absent leaves
+ *  it undefined so the shared service applies the discuss default (task-32 §2.5).
+ *  A present-but-invalid value is rejected rather than silently downgraded. */
+function webSubmissionIntent(body) {
+    if (!("intent" in body) || body.intent === undefined)
+        return undefined;
+    if (typeof body.intent === "string"
+        && TASK_SUBMISSION_INTENTS.includes(body.intent)) {
+        return body.intent;
+    }
+    throw new WebRequestRejected(`intent must be one of ${TASK_SUBMISSION_INTENTS.join(", ")}.`);
+}
 async function readJsonBody(request) {
     const chunks = [];
     let size = 0;