sign-off-axi 0.3.1 → 0.3.3

package/README.md

@@ -131,7 +131,7 @@ sign-off-axi post --type explainer --title "<question>" --media <video> [--about
 sign-off-axi init [dir] [--agent auto|<name>]   write the repo setup under <dir>/.sign-off/ (config, board, mocks/ and evidence/ folders)
                                                 and install the skill for each chosen coding agent (auto: each one on PATH)
 sign-off-axi doctor [dir]                       check that setup and each agent's skill; every failure names its fix
-sign-off-axi validate <message.json>... [--kind <kind>] [--expect-invalid]   check ask and report messages against the contract (docs/contract.md) without posting
+sign-off-axi validate <message.json>... [--kind <kind>] [--expect-invalid]   check ask, report, evidence, gate and finding messages against the contract (docs/contract.md) without posting
 sign-off-axi open  [--port 4410] [--bind <address>] [--evidence-root <dir>]   start the board in the background; prints its URL and pid
 sign-off-axi status                             is the board open started for this file running? its URL and pid
 sign-off-axi stop                               stop that board
@@ -145,12 +145,12 @@ sign-off-axi export [--out <file.html>]          write a frozen read-only copy o
 
 - The board is the one you name right after the command (`sign-off-axi answers ./decisions.json`). With none, it is the nearest `.sign-off/` board that `init` set up, found by the walk described in [Test runs never touch your board](#test-runs-never-touch-your-board); otherwise the default board there (`~/.sign-off/decisions.json`, or under `SIGN_OFF_HOME`). Answers are saved next to it.
 - Next-step commands in the output name paths under the working folder relative to it, and say `npx -y sign-off-axi` when sign-off-axi runs through `npx`.
-- `post --type design` asks for a pick between up to 6 mock options, each with an optional `--mock <value>=<path>` file (`.html`, `.svg`, `.png`, `.jpg`, `.jpeg`, `.webp`) shown as a tall phone frame above its button (the recommended one first; on a phone the frames swipe sideways, the next one peeking in, and a tap opens one full size), plus a `--tradeoff` line and a `--recommend` badge. Mock paths are relative to the board file's folder and never escape it. One `.html` page can hold every variant: `--mock a=mocks/<key>/index.html?variant=a` loads the page with `?variant=a`. An `.html` mock or view loads the css, scripts, images and fonts beside it by relative name (`style.css`, `img/dot.png`), from its own folder only, never anything above it. The board adds a small pointing script to each `.html` mock: once the board turns it on for that frame, a tap on a part of the mock is kept from the mock and named back to the board as a path to that element, its tag and its words; it passes only text and gives the mock no reach into the board. With **Comment on the mocks** on, a tap opens a comment on that element: one per element, listed under the mocks with Edit and Delete, kept on the board and shown only on the exact mock file it was made on. An option with no mock, or whose file is gone, says "No mock for this option". `post --type decision` (the default) is exactly `raise`, and `raise` stays as its alias.
+- `post --type design` asks for a pick between up to 6 mock options, each with an optional `--mock <value>=<path>` file (`.html`, `.svg`, `.png`, `.jpg`, `.jpeg`, `.webp`) shown as a tall phone frame above its button (the recommended one first; on a phone the frames swipe sideways, the next one peeking in, and a tap opens one full size), plus a `--tradeoff` line and a `--recommend` badge. Mock paths are relative to the board file's folder and never escape it. One `.html` page can hold every variant: `--mock a=mocks/<key>/index.html?variant=a` loads the page with `?variant=a`. An `.html` mock or view loads the css, scripts, images and fonts beside it by relative name (`style.css`, `img/dot.png`), from its own folder only, never anything above it. The board adds a small pointing script to each `.html` mock: once the board turns it on for that frame, a tap on a part of the mock is kept from the mock and named back to the board as a path to that element, its tag and its words; it passes only text and gives the mock no reach into the board. With **Comment on the mocks** on, a tap opens a comment on that element: one per element, listed under the mocks with Edit and Delete (words typed but not yet saved stay with their element while the page is open, so tapping another element and back keeps them; a reload drops them), kept on the board and shown, until it is sent, only on the exact mock file it was made on. The comments go to the agent with the next answer on that card (a pick, Other answer or **Another round**, which may then have no note), each with its element, in `wait` and `answers` (`comments`); once sent they are listed as sent and can no longer change. An option with no mock, or whose file is gone, says "No mock for this option". `post --type decision` (the default) is exactly `raise`, and `raise` stays as its alias.
 - `post --type evidence` posts the next numbered update (`update-1`, `update-2`, ...) with 1 to 12 screenshots or recordings (`.png`, `.jpg`, `.jpeg`, `.webp`, `.mp4`, `.webm`, up to 50 MB each), a short note and an optional commit or PR link. The files are copied into `evidence/<number>/` next to the board, so the board is the store: no hosted service. The page shows the updates newest first; each file is served only while its size and SHA-256 still match what was posted, and recordings play inline on a phone. The person gives a verdict, **Pass**, **Fail** or **Needs work**, with an optional note, read back with `answers` or `wait --key update-<number>`.
 - `post --type diagram` and `post --type interactive` show a question with a picture: `--view <path>` names one board-relative file, an image (`.svg`, `.png`, `.jpg`, `.jpeg`, `.webp`) drawn at card width for a diagram, or one self-contained `.html` page that runs in a sandboxed frame for interactive. Every mock and view is served under a Content-Security-Policy with no `fetch`, no remote files and no access to the dashboard or its tab. They answer like a decision.
 - `post --type explainer` shows a question with a narrated video the agent made itself (stills plus speech from a free local engine such as piper or espeak-ng, joined with ffmpeg; the skill has the recipe). `--media` names one `.mp4` or `.webm`, copied into `evidence/<number>/` and served hash-checked like evidence media; it plays on the card with its own controls, at phone width too. `--about` is a short summary and each `--chapter m:ss=<title>` is a button that plays the video from there. sign-off itself never makes the video: it calls no speech engine, no ffmpeg and no network service.
-- The person can also tap **Another round** inside **Other answer** (with the typed note), which wakes a waiting agent the same way an answer does; the agent reads it back in `answers --json` under `rounds`.
-- **Dismiss** (the × on an item in a list, **Dismiss** under Needs you first and beside **Skip for now** in Triage, or **Clear all done** on Answered) hides items from the board, Today included; **Undo** in the toast brings them back, and so does **Restore** under **Dismissed (N)** at the end of Needs you first and Triage. The agent is not told, so an ask it waits on keeps waiting. The storage is in [docs/file-formats.md](docs/file-formats.md).
+- The person can also tap **Another round** inside **Other answer** (with the typed note), which wakes a waiting agent the same way an answer does; the agent reads it back in `answers --json` under `rounds`, with any comments on mock elements it carried.
+- **Dismiss** (the × on an item in a list, **Dismiss** under Needs you first and beside **Skip for now** in Triage, or **Clear all done** on Answered) hides items from the board, Today included; **Undo** in the toast brings them back, and so does **Restore** under **Dismissed (N)** at the end of Needs you first and Triage. `list` counts a dismissed item as neither waiting nor answered, as the board does (`list --full` says `dismissed` for an unanswered one and still its answer for an answered one), and `answers` does not count it as waiting; the agent is not told, so an ask it waits on keeps waiting, and `answers` still returns a dismissed answer. The storage is in [docs/file-formats.md](docs/file-formats.md).
 - The person can comment on any item (**Send as a comment**, also inside **Other answer**: each card has that one place to type) and queue a free-text prompt for the agent (**Ask the agent**). `poll` blocks until one arrives and prints every new one once (`--json` prints `{"messages":[{"id","kind","key"?,"text","at"}]}`); the page then shows it as read by the agent. Typed notes that are not sent yet stay in the browser across reloads; everything sent is saved next to the board and survives a restart.
 - The board runs on your own machine only: no hosted service, no recurring cost. It listens on `127.0.0.1` unless `--bind <address>` (or `bind:` in the `config.yaml` that `init` writes) names one private address of this machine, such as its VPN address, so a phone or tablet on your own network can open it. A `hosts:` line in that config names private DNS names that lead to the bind address, such as its mesh VPN name (commas between them), so the board also opens by name; `doctor` checks each one resolves to the bind address. All interfaces and public addresses are refused. Beyond `127.0.0.1` the board makes an access token once (`decisions.token`, mode 600, next to the board), `open` prints it in the link, and every request without it is refused; the link sets a cookie, so the page and its media work after the first load. Delete the token file to shut old links out at once, then `stop` and `open` for a new one.
 - `export` writes one self-contained HTML file (`decisions.export.html` by default): every item, answer, note and another-round request with its local mocks and media inlined; comments and queued prompts are left out. `--out` must end in `.html`, so a wrong path never overwrites the board. It opens from disk with no server, is read-only, and makes no network request. A mock page is inlined on its own, so the css and images beside it show only on the running board.
@@ -159,10 +159,10 @@ sign-off-axi export [--out <file.html>]          write a frozen read-only copy o
 - Raising a question that is already on the board is a no-op that reports its status, so an agent can re-run it safely. `--key` defaults to a slug of the title.
 - Each raised or posted item records when it was filed (`filed`), so Triage shows `Waiting since 09:15` and the Waiting on you tile `Oldest 09:15`; `post --replace` keeps an item's first time.
 - `open` is a no-op when the same board is already open on the same address, and fails with `CONFLICT` when it runs on another one. `--evidence-root` is the folder holding `.done-done/`, for decisions that link run evidence.
-- `--filer <id>` on `post` and `raise` saves who filed the item (an agent session id or any 1-128 of `A-Z a-z 0-9 . _ -`; `SIGN_OFF_FILER` sets it for every command, and a post with neither saves `CLAUDE_CODE_SESSION_ID` when it is set). `wait --filer <id>` then returns only answers to that filer's items it has not taken yet, marks each taken (`decisions.seen.jsonl`) and the card shows **Seen by agent**; it fails with `NOT_FOUND` when none of that filer's items is answered or waiting. The page never shows the filer id.
-- `on_answer: <command> [args]` in the `config.yaml` beside the board runs that command for every saved answer, read when the board starts. It runs with no shell, in the board's folder, and gets the answer as one JSON line on stdin (`{"key","answer","label","close","at","note"?,"title"?,"filer"?}`); the answer is never put into its arguments, so a typed note cannot inject a command. A failure is logged and never blocks the answer. With no shell, `|`, `>` and `&&` are passed as plain arguments, so put a pipeline in a script and name the script; a relative path such as `./hook.sh` is found from the board's folder. `doctor` checks that the command can run.
+- `--filer <id>` on `post` and `raise` saves who filed the item (an agent session id or any 1-128 of `A-Z a-z 0-9 . _ -`; `SIGN_OFF_FILER` sets it for every command, and a post with neither saves `CLAUDE_CODE_SESSION_ID` when it is set). `wait --filer <id>` then returns only answers to that filer's items it has not taken yet, marks each taken (`decisions.seen.jsonl`) and the card shows **Seen by agent**; it fails with `NOT_FOUND` when none of that filer's items still needs an answer. The page never shows the filer id.
+- `on_answer: <command> [args]` in the `config.yaml` beside the board runs that command for every saved answer, read when the board starts. It runs with no shell, in the board's folder, and gets the answer as one JSON line on stdin (`{"key","answer","label","close","at","note"?,"title"?,"filer"?,"comments"?}`, where `comments`, present when the answer carried comments on mock elements, lists each as `id`, `mock`, `hash`, `ref`, `tag`, `words` and `text`); the answer is never put into its arguments, so a typed note cannot inject a command. A failure is logged and never blocks the answer. With no shell, `|`, `>` and `&&` are passed as plain arguments, so put a pipeline in a script and name the script; a relative path such as `./hook.sh` is found from the board's folder. `doctor` checks that the command can run.
 - `post --from <file> --replace --filer <id>` lets several programs feed one board: it replaces only that filer's items (and items with no filer that the file names by key), keeps every other item, the board's other top-level fields and all answers, and an empty items list removes that filer's items.
-- `wait` replaces a polling loop. With `--key` it returns at once if that decision is already answered, and waits for a key that is not raised yet; without it, it waits for the next answer to any decision still waiting and fails with `NOT_FOUND` when nothing is. It wakes on each save, gives up after `--timeout` seconds (600, ten minutes, by default) with code `TIMEOUT` and exit 1, and takes `--full` and `--json` like `answers`. Ctrl-C stops it without changing anything.
+- `wait` replaces a polling loop. With `--key` it returns at once if that decision is already answered, and waits for a key that is not raised yet; without it, it waits for the next answer to any decision that still needs an answer and fails with `NOT_FOUND` when nothing needs one. It wakes on each save, gives up after `--timeout` seconds (600, ten minutes, by default) with code `TIMEOUT` and exit 1, and takes `--full` and `--json` like `answers`. Ctrl-C stops it without changing anything.
 - `open` records the board's pid, port and address next to the board file (`decisions.board.pid`). `status` and `stop` read it and only act on a pid that really serves that board, so no one has to guess a pid to kill. `open` on a board already served by `serve` records that server, so `stop` can close it too.
 
 ```

package/dist/cli.js

@@ -10,9 +10,9 @@ import { basename, delimiter, dirname, extname, isAbsolute, join, relative, reso
 import { parseArgs } from 'node:util';
 import { encode } from '@toon-format/toon';
 import { AxiError, runAxiCli } from 'axi-sdk-js';
-import { CHAPTERS_MAX, CLEARED, InputError, MEDIA_MAX, NOTE_MAX, REPLY, answersPath, appendAnnotation, appendAnswer, appendDismissed, appendMessage, appendRound, isKey, loadDecisions, markDelivered, markSeen, messagesPath, readAnnotations, readAnswers, readDismissed, readItems, readMessages, readRounds, roundsPath, seenBy, seenPath, writeItems } from './store.js';
-import { ContractError, KINDS, checkMessage, parseMessage } from './contract.js';
-import { sweepVault } from './vault.js';
+import { CHAPTERS_MAX, CLEARED, InputError, MEDIA_MAX, NOTE_MAX, REPLY, answersPath, appendAnnotation, appendAnswer, appendDismissed, appendMessage, appendRound, isKey, loadDecisions, markDelivered, markSeen, messagesPath, readAnnotations, readAnswers, readDismissed, readItems, readMessages, readRounds, roundsPath, seenBy, seenPath, sentIds, writeItems } from './store.js';
+import { ContractError, KINDS, MEDIA_BYTES, checkMessage, mediaFiles, parseMessage } from './contract.js';
+import { deliverVault, errors, readVaultExpiry, sweepVault, takeVaultExpiries, VaultError } from './vault.js';
 const FORMAT = 'https://github.com/umeranjum17/sign-off/blob/main/docs/file-formats.md';
 const CONTRACT = 'https://github.com/umeranjum17/sign-off/blob/main/docs/contract.md';
 /** Coding agents init installs the skill for: the `npx skills add -a` name, the command that shows it is installed,
@@ -74,10 +74,13 @@ examples:
 `,
     validate: `usage: sign-off-axi validate <message.json>... [--kind <kind>] [--expect-invalid]
 Checks message files against the communication contract without posting them: ${CONTRACT}
-A message is one JSON object with "contract": 1, its "kind" and its "schema". This build checks kinds ask and report, schema 1 each.
+A message is one JSON object with "contract": 1, its "kind" and its "schema". This build checks kinds ask, report, evidence, gate and finding, schema 1 each.
+An evidence message's media paths read from the message file's folder: each file must be there, inside it, and 50 MB or less.
+A gate names its done-done run (run_id and commit) and offers 2 or 3 of approve (Approve), skip (Skip the judge) and fix (Fix first).
+A finding gives a repeated cause, its counts, record ids (never record text) and a proposed change, and offers apply (Apply) and skip (Skip).
 Post one with \`sign-off-axi post --kind <kind> --from <message.json>\`, or --from - to read stdin.
 A board file given to raise --from or post --from may hold such messages as items: each is checked the same way before it is stored, and a report shows under Reports with no answer.
-In such a file a new item of a contract kind (a decision, the default, an ask, evidence or a report) must carry contract, kind and schema.
+In such a file a new item of a contract kind (a decision, the default, an ask or a report) must carry contract, kind and schema; new evidence is posted with post --kind evidence, one at a time.
 Each file gets a row with ok, or the error and one help line that names the fix. A field written twice, an unknown field or a broken limit refuses the file.
   --kind            each file must be this kind, so the wrong file is refused
   --expect-invalid  every file must be refused: exits 0 only then, 2 when any passes (the conformance check of invalid fixtures)
@@ -88,6 +91,9 @@ examples:
   sign-off-axi validate ask.json
   sign-off-axi validate --kind ask messages/*.json
   sign-off-axi validate --kind report report.json
+  sign-off-axi validate --kind evidence proof/evidence.json
+  sign-off-axi validate --kind gate gate.json
+  sign-off-axi validate --kind finding finding.json
   sign-off-axi validate --expect-invalid node_modules/sign-off-axi/fixtures/contract/*/invalid-*.json
 `,
     answers: `usage: sign-off-axi answers [board.json] [--key <key>] [--full] [--json]
@@ -104,10 +110,10 @@ examples:
 Blocks until the user answers, then prints the answer the way answers does. Use it instead of a polling loop.
   --filer    only the items posted with this --filer (or SIGN_OFF_FILER): returns every answer to them this filer has not taken yet,
              even one saved before wait started, and marks it taken, so the board shows "Seen by agent" on that card;
-             NOT_FOUND when none of them is answered or waiting. Without --filer or SIGN_OFF_FILER, wait takes no filer
+             NOT_FOUND when none of them still needs an answer. Without --filer or SIGN_OFF_FILER, wait takes no filer
   --key      wait for that decision; an answer saved before wait starts returns at once
              and a key not raised yet is waited for too
-             without --key, wait for the next answer to any decision still waiting; NOT_FOUND when nothing is
+             without --key, wait for the next answer to any decision that still needs an answer; NOT_FOUND when nothing needs one
   --timeout  seconds to wait, 600 (10 minutes) by default; then exits 1 with code TIMEOUT
   --full     adds the button label, close and title
   --json     {"<key>":{"answer","label","close","at","note"?}} for the new answers; note only when the user wrote one
@@ -156,6 +162,10 @@ examples:
 Posts an item for the user. --type decision (the default) is a yes/no or pick-one question, exactly like raise.
 --kind posts one contract message (${CONTRACT}), read from a file or from stdin with --from -: it must be that kind and pass every rule,
 else it is refused with one fix line and nothing is written. A key already on the board takes only the same message again; anything else exits 2.
+--kind evidence copies its media, read from the message file's folder (the current folder for stdin), into evidence/<number>/ like --type evidence;
+a "run" is shown as the update's proof record. With no key it posts the next update-<number>.
+--kind gate holds a done-done run for the user: it waits like an ask; run done-done respond --action <the picked value>.
+--kind finding asks the user to apply or skip a retro's proposed change: it waits like an ask.
 Listing --option needs --recommend <value>, on every type: the option you would pick, shown first and marked. --from --replace feeds are not held to it.
 --filer names who posts (your agent session or any id of 1-128 of A-Z a-z 0-9 . _ -), saved on the item; then \`wait --filer <id>\` gets the answer.
 SIGN_OFF_FILER sets it for every command; with neither, the Claude Code session id is saved when there is one.
@@ -180,6 +190,9 @@ examples:
   sign-off-axi post .sign-off/decisions.json --type design --key sign-in --title "Pick the sign-in layout" --option a=A --option b=B --option c=C --mock a=mocks/sign-in/index.html?variant=a --mock b=mocks/sign-in/index.html?variant=b --mock c=mocks/sign-in/index.html?variant=c --tradeoff "..." --recommend b
   sign-off-axi post --type decision --title "Keep the weekly digest?" --recommend yes
   sign-off-axi post --kind ask --from ask.json --filer agent-41
+  sign-off-axi post --kind evidence --from proof/evidence.json --filer done-done
+  sign-off-axi post --kind gate --from gate.json --filer done-done
+  sign-off-axi post --kind finding --from finding.json --filer learn-from-mistakes
   sign-off-axi post .sign-off/decisions.json --type interactive --title "Does the sign-in flow feel right?" --view mocks/sign-in/demo.html --option yes=Yes --option no="Needs work" --recommend yes
   sign-off-axi post --type evidence --title "Sign-in screen on a phone" --about "The new screen loads in 1 second." --media phone.png --media flow.mp4 --link https://github.com/acme/app/pull/12
   sign-off-axi post --type explainer --title "Is the new sign-in clear?" --about "The new sign-in has 2 steps." --media explainer.mp4 --chapter 0:00=Start --chapter 0:12="Step 2"
@@ -252,9 +265,15 @@ const CONTRACT_TYPES = ['decision', 'ask', 'evidence', 'report'];
 /** Items of a --from file that carry contract or kind are contract messages: each is checked against its kind's rules before anything is stored.
  * A new item of a contract kind must carry them (contract section 2); one already on the board is not checked again. */
 function contractItems(items, from, file) {
-    const had = new Set(existsSync(file) ? readItems(file).items.map((i) => i?.key) : []);
+    const on = new Map((existsSync(file) ? readItems(file).items : []).map((i) => [i?.key, i]));
     items.forEach((m, i) => {
-        if (had.has(m?.key))
+        // Evidence in message form (no type) never comes in a feed, even under a key on the board: its media must be copied and numbered.
+        // A stored board-format evidence item passes through a feed unchanged; any other evidence under a key is refused.
+        const kept = on.get(m?.key)?.type === 'evidence';
+        if ((m?.kind === 'evidence' && m?.type === undefined) || (!kept && (m?.kind ?? m?.type) === 'evidence')) {
+            throw fail(`${from}: items[${i}]${isKey(m?.key) ? ` key ${m.key}` : ''}: evidence is posted one at a time, not in a --from file`, 'VALIDATION_ERROR', 'Post it with sign-off-axi post --kind evidence --from <message.json>');
+        }
+        if (on.has(m?.key))
             return;
         if (m?.contract === undefined && m?.kind === undefined) {
             if (!CONTRACT_TYPES.includes(m?.type ?? 'decision'))
@@ -351,17 +370,19 @@ function filerOf(values, session = false) {
 }
 const waitFor = (on, filer, key) => (filer ? `Run \`sign-off-axi wait${on} --filer ${filer}\` to block until the user answers`
     : `Run \`sign-off-axi wait${on}${key ? ` --key ${key}` : ''}\` to block until the user answers`);
-/** Still waiting on the user: not answered, and something to answer (an item with no options and no reply is only shown). */
-const waits = (d) => !d.answer && (d.options.length > 0 || !!d.reply);
-/** The board's decisions with their latest answer; a missing board file is an empty board. */
+/** Still waiting on the user: not answered, not dismissed, and something to answer (an item with no options and no reply is only shown). */
+const waits = (d) => !d.dismissed && !d.answer && (d.options.length > 0 || !!d.reply);
+/** The board's decisions with their latest answer; a missing board file is an empty board.
+ *  A dismissal hides an item from the board and is not waiting here either, checked against the same dismissed log the board reads. */
 function board(file, say = warn) {
     if (!existsSync(file))
         return [];
     const decisions = loadDecisions(file), answers = readAnswers(file, say);
+    const hidden = new Set(readDismissed(file, answers, readRounds(file), say));
     for (const key of Object.keys(answers))
         if (!decisions.some((d) => d.key === key))
             say(`left out the answer for ${key}: that question is no longer in ${basename(file)}`);
-    return decisions.map((d) => ({ ...d, answer: Object.hasOwn(answers, d.key) ? answers[d.key] : undefined }));
+    return decisions.map((d) => ({ ...d, answer: Object.hasOwn(answers, d.key) ? answers[d.key] : undefined, dismissed: hidden.has(d.key) }));
 }
 function ready(file, on, root) {
     if (!existsSync(file))
@@ -372,9 +393,9 @@ function ready(file, on, root) {
 }
 function list(args) {
     const { file, values, on } = parse('list', args, TIERS);
-    const rows = board(file), waiting = rows.filter(waits), answered = rows.filter((d) => d.answer).length;
+    const rows = board(file), waiting = rows.filter(waits), answered = rows.filter((d) => d.answer && !d.dismissed).length;
     if (values.json)
-        return JSON.stringify({ board: file, decisions: rows });
+        return JSON.stringify({ board: file, decisions: rows.map(({ dismissed, ...d }) => (dismissed ? { ...d, dismissed } : d)) });
     const help = [
         ...(waiting.length ? [`Run \`sign-off-axi open${on}\` to show the board to the user`] : []),
         ...(answered ? [`Run \`sign-off-axi answers${on}\` to read the ${answered} saved answers`] : []),
@@ -382,7 +403,7 @@ function list(args) {
     ];
     const where = tilde(file) + (existsSync(file) ? '' : ' (no file yet; raise creates it)');
     if (values.full) {
-        return toon({ board: where, decisions: rows.map((d) => ({ key: d.key, status: d.answer?.answer ?? 'waiting', title: d.title, about: d.about ?? '', detail: d.detail ?? '',
+        return toon({ board: where, decisions: rows.map((d) => ({ key: d.key, status: d.answer?.answer ?? (d.dismissed ? 'dismissed' : 'waiting'), title: d.title, about: d.about ?? '', detail: d.detail ?? '',
                 recommend: d.recommend_value ?? '', default_if_silent: d.default_if_silent ?? '', close: d.close })) }, help);
     }
     return toon({
@@ -396,20 +417,20 @@ function printAnswers(file, rows, waiting, values, help) {
     const done = rows.flatMap((d) => (d.answer ? [{ ...d.answer, title: d.title }] : []));
     const rounds = readRounds(file).filter((r) => rows.some((d) => d.key === r.key));
     if (values.json) {
-        const out = Object.fromEntries(done.map(({ key, answer, label, close, at, note }) => {
-            const asked = rounds.filter((r) => r.key === key).map(({ note, at }) => ({ note, at }));
-            return [key, { answer, label, close, at, note, ...(asked.length && { rounds: asked }) }];
-        }));
+        const asked = (key) => rounds.filter((r) => r.key === key).map(({ note, at, comments }) => ({ note, at, comments }));
+        const out = Object.fromEntries(done.map(({ key, answer, label, close, at, note, comments }) => [key, { answer, label, close, at, note, comments, ...(asked(key).length && { rounds: asked(key) }) }]));
         for (const r of rounds)
             if (!out[r.key])
-                out[r.key] = { rounds: rounds.filter((q) => q.key === r.key).map(({ note, at }) => ({ note, at })) };
+                out[r.key] = { rounds: asked(r.key) };
         return JSON.stringify(out);
     }
-    const notes = done.some((a) => a.note);
+    const notes = done.some((a) => a.note), sent = [...done, ...rounds].flatMap(({ key, comments = [] }) => comments.map(({ mock, ref, tag, words, text }) => ({ key, mock, ref, tag, words, text })));
     return toon({
         board: tilde(file),
         answers: done.length ? done.map(({ key, answer, at, label, close, title, note = '' }) => ({ key, answer, at, ...(values.full && { label, close, title }), ...(notes && { note }) })) : '0 saved yet',
         ...(rounds.length && { rounds: rounds.map(({ key, note, at }) => ({ key, note, at })) }),
+        // Comments on mock elements that went with an answer or a round, each with the element it points at.
+        ...(sent.length && { comments: sent }),
         waiting,
     }, help);
 }
@@ -422,10 +443,13 @@ function answers(args) {
     return printAnswers(file, rows, waiting, values, waiting ? [`Run \`sign-off-axi open${on}\` so the user can answer the ${waiting} waiting`, `Run \`sign-off-axi wait${on}${key}\` to block until they answer`] : []);
 }
 async function wait(args) {
-    const { file, values, on: onBoard } = parse('wait', args, { ...TIERS, filer: { type: 'string' }, key: { type: 'string' }, timeout: { type: 'string', default: '600' } });
+    const { file, values, on: onBoard } = parse('wait', args, { ...TIERS, filer: { type: 'string' }, key: { type: 'string' }, timeout: { type: 'string', default: '600' }, into: { type: 'string' } });
     if (!/^\d{1,7}$/.test(values.timeout))
         throw fail('--timeout must be whole seconds, 0 or more', 'VALIDATION_ERROR', `Run \`sign-off-axi wait --help\``);
     const filer = filerOf(values), on = onBoard + (filer ? ` --filer ${filer}` : '');
+    // Vault Give delivery: its own loop, before any board read, so no ordinary wait changes. Undocumented while the vault is OFF.
+    if (values.into !== undefined)
+        return waitInto(file, values, onBoard);
     if (values.key === undefined)
         ready(file, onBoard);
     const seconds = Number(values.timeout), deadline = Date.now() + seconds * 1000, key = values.key === undefined ? '' : ` --key ${values.key}`;
@@ -437,7 +461,7 @@ async function wait(args) {
     for (const r of readRounds(file))
         seenRounds.set(r.key, (seenRounds.get(r.key) ?? 0) + 1);
     // A save wakes the loop at once; the 1 second timer is the fallback where file events are unavailable.
-    let wake = () => { }, watcher;
+    let wake = () => { }, watcher, vaultWarned = false;
     const name = basename(answersPath(file));
     try {
         try {
@@ -466,7 +490,36 @@ async function wait(args) {
             if (found.length) {
                 return printAnswers(file, found, waiting, values, [waiting ? `Run \`sign-off-axi wait${on}\` for the next of the ${waiting} waiting` : `Run \`sign-off-axi stop${onBoard}\` to close the board`]);
             }
-            if (values.key === undefined && !waiting) {
+            // Private vault expiries and refusals reach a filer wait only once its ordinary answers are out; each is taken once.
+            let live = 0, unknown = false;
+            if (filer !== undefined && values.key === undefined) {
+                const vault = await takeVaultExpiries(file, filer).catch(() => undefined);
+                unknown = !vault;
+                if ((!vault || !vault.clean) && !vaultWarned) {
+                    vaultWarned = true;
+                    warn('Vault expiry status unavailable; ordinary answers still arrive.');
+                }
+                if (vault?.events.length)
+                    return vaultEvent(file, vault.events, values);
+                live = vault?.live ?? 0;
+            }
+            // A keyed filer wait reads its own item's expiry or refusal, unless one of its board rows already holds the key.
+            if (filer !== undefined && values.key !== undefined && isKey(values.key) && !rows.some((d) => d.key === values.key)) {
+                let event;
+                try {
+                    event = await readVaultExpiry(file, values.key, filer, true);
+                }
+                catch (e) {
+                    if (e?.code !== 'READER_MISMATCH' && !vaultWarned) {
+                        vaultWarned = true;
+                        warn('Vault expiry status unavailable; ordinary answers still arrive.');
+                    }
+                }
+                if (event)
+                    return vaultEvent(file, [{ key: values.key, at: event.at, status: event.status }], values);
+            }
+            // A dismissed ask is hidden from the board, not withdrawn: it is not counted as waiting, but the agent still waits on it.
+            if (values.key === undefined && !rows.some((d) => waits({ ...d, dismissed: false })) && !live && !unknown) {
                 throw fail(`nothing${filer ? ` posted by ${filer}` : ''} is waiting on ${tilde(file)}`, 'NOT_FOUND', `Run \`sign-off-axi answers${onBoard}\` to read the saved answers`, `Run \`sign-off-axi raise${on} --title "<question>"\` to ask a new one`);
             }
             const left = deadline - Date.now();
@@ -485,6 +538,55 @@ async function wait(args) {
         watcher?.close();
     }
 }
+/** Metadata only: a fixed sentence, never a value, URL, path or filer. Failures exit 1; a delivery exits 0 with a label.
+ * One poll takes one kind, so all events share a status. */
+const VAULT_EVENTS = {
+    expired: { sentence: errors.EXPIRED, code: 'EXPIRED' },
+    refused: { sentence: errors.REFUSED, code: 'REFUSED' },
+    'delivery-uncertain': { sentence: errors.DELIVERY_UNCERTAIN, code: 'DELIVERY_UNCERTAIN' },
+    delivered: { sentence: 'Saved to the approved destination file.' },
+};
+function vaultEvent(file, events, values) {
+    const status = events[0].status, { sentence, code } = VAULT_EVENTS[status], at = (ms) => new Date(ms).toISOString().slice(0, 19) + 'Z';
+    if (code)
+        process.exitCode = 1;
+    if (values.json)
+        return JSON.stringify(Object.fromEntries(events.map((e) => [e.key, { answer: status, label: sentence, close: 'done', at: at(e.at) }])));
+    return toon({ board: tilde(file), [status]: events.map((e) => ({ key: e.key, at: at(e.at) })), ...(code ? { error: sentence, code } : { label: sentence }) }, code ? ['Ask for a fresh item under a new key'] : []);
+}
+// Only these leave the item deliverable later; every other vault code is final for this wait.
+const INTO_RETRY = ['BUSY', 'NOT_FOUND', 'VAULT_KEY_UNAVAILABLE'];
+const INTO_HELP = { DESTINATION_DENIED: 'Fix the destination folder locally, then run the same wait again', DESTINATION_EXISTS: 'Fix the destination folder locally, then run the same wait again',
+    READER_MISMATCH: 'Check --key, --filer and --into against the item', VALIDATION_ERROR: 'Check --key, --filer and --into against the item' };
+/** `wait --into`: delivers one Give once into its bound file, polling while it is pending. The destination is never printed. */
+async function waitInto(file, values, onBoard) {
+    const { key, filer, into } = values, seconds = Number(values.timeout), deadline = Date.now() + seconds * 1000;
+    // An explicit --filer: an inherited SIGN_OFF_FILER must not route a secret write.
+    if (key === undefined || filer === undefined)
+        throw fail('wait --into needs --key and --filer', 'VALIDATION_ERROR', 'Pass the Give item\'s --key and your own --filer');
+    let warned = false;
+    for (;;) {
+        let done;
+        try {
+            done = await deliverVault(file, key, filer, into);
+        }
+        catch (e) {
+            const code = e instanceof VaultError ? e.code : 'BUSY';
+            if (!INTO_RETRY.includes(code))
+                throw fail(errors[code], code, INTO_HELP[code] ?? 'Ask for a fresh item under a new key');
+            if (code !== 'NOT_FOUND' && !warned) {
+                warned = true;
+                warn('Vault delivery status unavailable; still waiting.');
+            }
+        }
+        if (done)
+            return vaultEvent(file, [done], values);
+        const left = deadline - Date.now();
+        if (left <= 0)
+            throw fail(`no vault item with key ${key} was ready to deliver within ${seconds}s`, 'TIMEOUT', `Run \`sign-off-axi wait${onBoard} --key ${key} --filer ${filer} --into <file> --timeout ${seconds}\` to keep waiting`);
+        await new Promise((ok) => setTimeout(ok, Math.min(1000, left)));
+    }
+}
 const slug = (title) => title.toLowerCase().replace(/[^a-z0-9]+/g, '-').slice(0, 64).replace(/^-+|-+$/g, '') || 'decision';
 /** Runs fn while holding an exclusive lock file that names its pid, so two agents raising at once never drop a decision,
  * and a lock a crash left behind can be told apart from one in use. */
@@ -597,7 +699,13 @@ function replace(file, on, from, filer) {
                 fits(i?.title, i?.key);
         const feed = fed.items.map((i) => ({ filed: first.get(i?.key)?.filed ?? now, ...i, ...(filer && { filer }) }));
         // An answer belongs to its question: an answered key may not come back asking something else.
-        const question = (d) => JSON.stringify([d.title, [...d.options].sort((a, b) => a.value.localeCompare(b.value)), !!d.reply]);
+        const question = (d) => JSON.stringify([d.title, [...d.options].sort((a, b) => a.value.localeCompare(b.value)), !!d.reply, d.run, d.finding]);
+        // A gate's answer is the action for its run, and a finding's the verdict on its proposal, so a dropped answered one cannot come back.
+        const saved = readAnswers(file);
+        for (const i of fed.items)
+            if ((i?.kind === 'gate' || i?.kind === 'finding') && !first.has(i?.key) && Object.hasOwn(saved, i?.key)) {
+                throw fail(`key ${i.key} was answered on ${tilde(file)} and is no longer there`, 'CONFLICT', 'Post it under a new key');
+            }
         for (const had of board(file)) {
             const d = incoming.find((x) => x.key === had.key);
             if (filer && d && had.filer && had.filer !== filer)
@@ -633,9 +741,9 @@ function replace(file, on, from, filer) {
         return toon({ board: tilde(file), items: items.length, changed }, [`Run \`sign-off-axi answers${on}\` to read the answers`]);
     });
 }
-const MEDIA_BYTES = 50_000_000;
-/** Copies the media into evidence/<n>/ next to the board and adds the item, numbered under the board lock: update-<n>, or an explainer under its own key. */
-function postMedia(file, on, values, type, filer) {
+/** Copies the media into evidence/<n>/ next to the board and adds the item, numbered under the board lock: update-<n>, or an explainer under its own key.
+ * `message` is a checked contract evidence message (post --kind evidence): its key, if any, takes only the same message again, and its run is stored as `evidence`. */
+function postMedia(file, on, values, type, filer, message) {
     fits(values.title);
     const explainer = type === 'explainer';
     const extra = (explainer ? ['mock', 'tradeoff', 'view', 'link'] : ['key', 'option', 'recommend', 'default', 'mock', 'tradeoff', 'view', 'chapter']).find((f) => values[f] !== undefined);
@@ -647,7 +755,7 @@ function postMedia(file, on, values, type, filer) {
         throw fail('--about is required for --type evidence: the short note', 'VALIDATION_ERROR', example);
     if (explainer && values.media?.length !== 1)
         throw fail('--type explainer needs one --media video (.mp4 or .webm)', 'VALIDATION_ERROR', example);
-    if (!values.media?.length || values.media.length > MEDIA_MAX)
+    if ((!message && !values.media?.length) || values.media.length > MEDIA_MAX)
         throw fail(`--type evidence needs 1 to ${MEDIA_MAX} --media files`, 'VALIDATION_ERROR', example);
     const kinds = explainer ? ['.mp4', '.webm'] : Object.keys(mediaTypes), options = optionsOf(values);
     recommended([{ options, recommend_value: values.recommend }], true);
@@ -672,7 +780,15 @@ function postMedia(file, on, values, type, filer) {
         const { items, extra } = existsSync(file) ? readItems(file) : { items: [], extra: {} };
         // Boards in one folder share evidence/, so a number is taken only by creating its folder; one in use is never written into.
         const current = board(file), store = join(dirname(file), 'evidence'), taken = current.map((d) => Number(/^update-(\d+)$/.exec(d.key)?.[1] ?? 0));
-        const own = explainer && (values.key ?? slug(values.title));
+        const own = message ? message.key : explainer && (values.key ?? slug(values.title)), had = message && own && items.find((x) => x?.key === own);
+        if (had) {
+            // The stored item, read back as the message it came from: its run, and each media file by hash.
+            const asMessage = ({ type: _t, number: _n, filed: _f, evidence: run, media: kept, ...rest }) => canon({ ...rest, run, media: kept?.map((x) => x.sha256) });
+            if (asMessage(had) !== canon({ ...message, media: sources.length ? sources.map((src) => sha256(readFileSync(src))) : undefined })) {
+                throw fail(`key ${own} already holds a different message on ${tilde(file)}`, 'CONFLICT', 'Post it under a new key');
+            }
+            return toon({ board: tilde(file), posted: [{ key: own, number: had.number, media: sources.length, title: had.title, status: 'already posted' }] }, [`Run \`sign-off-axi open${on}\` so the user can give a verdict`]);
+        }
         if (own && current.some((d) => d.key === own))
             throw fail(`key ${own} is already used on ${tilde(file)}`, 'CONFLICT', 'Post it under a new --key');
         mkdirSync(store, { recursive: true, mode: 0o700 });
@@ -688,14 +804,24 @@ function postMedia(file, on, values, type, filer) {
             }
         }
         const key = own || `update-${number}`, dir = join(store, String(number));
-        const media = sources.map((src, i) => {
-            const bytes = readFileSync(src), path = `evidence/${number}/${i + 1}${extname(src).toLowerCase()}`;
-            writeFileSync(join(dir, `${i + 1}${extname(src).toLowerCase()}`), bytes, { mode: 0o600 });
-            return { path, sha256: sha256(bytes), bytes: bytes.length };
-        });
+        let media;
+        try {
+            media = sources.map((src, i) => {
+                const bytes = readFileSync(src), path = `evidence/${number}/${i + 1}${extname(src).toLowerCase()}`;
+                writeFileSync(join(dir, `${i + 1}${extname(src).toLowerCase()}`), bytes, { mode: 0o600 });
+                return { path, sha256: sha256(bytes), bytes: bytes.length };
+            });
+        }
+        catch (e) {
+            // A file that cannot be read after all leaves no copies behind.
+            rmSync(dir, { recursive: true, force: true });
+            throw e;
+        }
         const { title, about, detail, close, link, recommend: recommend_value, default: default_if_silent } = values, filed = new Date().toISOString();
+        const { run, media: _paths, ...fields } = message ?? {};
         items.push(explainer ? { key, type, title, about, detail, options, recommend_value, default_if_silent, close, chapters, media, filer, filed }
-            : { key, type, number, title, about, detail, close, link, media, filer, filed });
+            : message ? { ...fields, key, type, number, ...(media.length ? { media } : {}), ...(run && { evidence: run }), filed }
+                : { key, type, number, title, about, detail, close, link, media, filer, filed });
         // The whole board is checked before it is written, so a bad post leaves the board and evidence/ as they were.
         const check = `${file}.${process.pid}.check`;
         writeFileSync(check, JSON.stringify({ ...extra, schema: 2, items }), { mode: 0o600 });
@@ -712,7 +838,7 @@ function postMedia(file, on, values, type, filer) {
         writeItems(file, items);
         if (explainer)
             return toon({ board: tilde(file), raised: [{ key, status: 'raised', title }] }, [`Run \`sign-off-axi open${on}\` so the user can watch and answer`, waitFor(on, filer, key)]);
-        return toon({ board: tilde(file), posted: [{ key, number, media: media.length, title }] }, [`Run \`sign-off-axi open${on}\` so the user can give a verdict`, waitFor(on, filer, key)]);
+        return toon({ board: tilde(file), posted: [{ key, number, media: media.length, title, ...(message && { status: 'posted' }) }] }, [`Run \`sign-off-axi open${on}\` so the user can give a verdict`, waitFor(on, filer, key)]);
     });
 }
 /** Posts one contract message (docs/contract.md), from a file or from stdin with --from -: checked against --kind, then stored like a raised item. */
@@ -730,9 +856,13 @@ async function postKind(file, on, values) {
     catch (e) {
         throw fail(`${name}: cannot read: ${e.code}`, 'NOT_FOUND', 'Check the path names a readable file');
     }
+    let sources = [];
     try {
         m = parseMessage(bytes);
         checkMessage(m, kind);
+        // Media paths read from the message file's folder, or from the current folder for stdin.
+        if (m.kind === 'evidence')
+            sources = mediaFiles(m, from === '-' ? process.cwd() : dirname(resolve(from)));
     }
     catch (e) {
         throw e instanceof ContractError ? fail(`${name}: ${e.message}`, 'VALIDATION_ERROR', e.help) : e;
@@ -742,6 +872,8 @@ async function postKind(file, on, values) {
     }
     const filer = m.filer ?? filerOf(values, true), scratch = mkdtempSync(join(tmpdir(), 'sign-off-')), source = join(scratch, basename(name));
     try {
+        if (m.kind === 'evidence')
+            return await postMedia(file, on, { title: m.title, about: m.about, media: sources }, 'evidence', filer, { ...m, ...(filer && { filer }) });
         writeFileSync(source, JSON.stringify({ schema: 2, items: [{ ...m, ...(filer && { filer }) }] }));
         return await storeIncoming(file, on, buildIncoming({ from: source }, {}, filer, file), filer, true);
     }
@@ -782,7 +914,10 @@ function validate(args) {
         }
         try {
             m = parseMessage(raw);
-            return { file, ...checkMessage(m, want), ok: true, error: '', help: '' };
+            const kind = checkMessage(m, want);
+            if (m.kind === 'evidence')
+                mediaFiles(m, dirname(resolve(file)));
+            return { file, ...kind, ok: true, error: '', help: '' };
         }
         catch (e) {
             if (!(e instanceof ContractError))
@@ -843,22 +978,28 @@ function storeIncoming(file, on, { incoming, raw }, filer, exact = false) {
         const current = board(file), items = existsSync(file) ? readItems(file).items : [], saved = readAnswers(file), now = new Date().toISOString();
         const raised = incoming.map((d, i) => {
             const had = current.find((c) => c.key === d.key);
+            // A contract message refused for its key exits 2 like any other refusal (contract section 4); raise --title keeps exit 1.
+            const contract = exact || raw[i]?.contract !== undefined || raw[i]?.kind !== undefined;
+            const refuse = (why) => {
+                if (contract)
+                    process.once('exit', () => { process.exitCode = 2; });
+                return fail(`key ${d.key} ${why}`, 'CONFLICT', contract ? 'Post it under a new key' : 'Raise it under a new --key');
+            };
             // An answer outlives its item: a new question under that key would inherit it.
             if (!had && Object.hasOwn(saved, d.key))
-                throw fail(`key ${d.key} already has a saved answer on ${tilde(file)} from an item no longer there`, 'CONFLICT', 'Raise it under a new --key');
+                throw refuse(`already has a saved answer on ${tilde(file)} from an item no longer there`);
             // The same question from another filer, or at another time, is the same question: it keeps its first filer and time.
-            const same = (x) => JSON.stringify({ ...x, answer: undefined, filer: undefined, filed: undefined, options: [...x.options].sort((a, b) => a.value.localeCompare(b.value)) });
+            const same = (x) => JSON.stringify({ ...x, answer: undefined, dismissed: undefined, filer: undefined, filed: undefined, options: [...x.options].sort((a, b) => a.value.localeCompare(b.value)) });
             // A message that names no filed time matches the one the board stamped.
             const differs = () => exact ? canon({ ...items.find((x) => x?.key === d.key), ...(raw[i].filed === undefined && { filed: undefined }) }) !== canon(raw[i]) : same(had) !== same(d);
-            if (had && differs()) {
-                throw fail(`key ${d.key} already holds a different ${exact ? 'message' : 'question'} on ${tilde(file)}`, 'CONFLICT', 'Raise it under a new --key');
-            }
+            if (had && differs())
+                throw refuse(`already holds a different ${contract ? 'message' : 'question'} on ${tilde(file)}`);
             // Each new item records when it was raised, unless it names its own time.
             if (!had) {
                 fits(d.title, d.key);
                 items.push({ filed: now, ...raw[i] });
             }
-            return { key: d.key, status: !had ? 'raised' : had.answer ? `already answered ${had.answer.answer}` : waits(had) ? 'already waiting' : 'already posted', title: d.title };
+            return { key: d.key, status: !had ? 'raised' : had.answer ? `already answered ${had.answer.answer}` : waits({ ...had, dismissed: false }) ? 'already waiting' : 'already posted', title: d.title };
         });
         if (raised.some((r) => r.status === 'raised'))
             writeItems(file, items);
@@ -1474,7 +1615,9 @@ const page = readFileSync(new URL('../web/index.html', import.meta.url));
 const pointer = Buffer.from(`<script>${readFileSync(new URL('../web/point.js', import.meta.url), 'utf8')}</script>`);
 const sha256 = (bytes) => createHash('sha256').update(bytes).digest('hex');
 const state = () => {
-    const answers = readAnswers(file, warn), taken = seenBy(file), rounds = readRounds(file, warn);
+    // The page marks sent comments in annotations, so answers and rounds go without theirs: a read-only board or an export carries none.
+    const answers = Object.fromEntries(Object.entries(readAnswers(file, warn)).map(([k, { comments: _, ...a }]) => [k, a])), taken = seenBy(file);
+    const rounds = readRounds(file, warn).map(({ comments: _, ...r }) => r);
     return {
         file,
         mockBase: `/mock/${loopback(bind) ? 'local' : mockPass(tokenOf(file))}/`,
@@ -1487,7 +1630,7 @@ const state = () => {
         seen: Object.values(answers).filter(taken).map((a) => a.key),
         rounds,
         messages: readMessages(file, warn),
-        annotations: readOnly() || answersOnly() ? [] : readAnnotations(file, warn),
+        annotations: readOnly() || answersOnly() ? [] : ((sent) => readAnnotations(file, warn).map((a) => (sent.has(a.id) ? { ...a, sent: true } : a)))(sentIds(file)),
         dismissed: readDismissed(file, answers, rounds, warn),
     };
 };
@@ -1499,6 +1642,12 @@ const mockHash = (path) => { try {
 catch {
     return null;
 } };
+/** The comments that go with a card's next answer or round: not sent yet, and made on the mock file the card shows now. */
+const unsent = (d) => {
+    const sent = sentIds(file), now = new Map((d.mocks ?? []).map((m) => [m.value, mockHash(m.path)]));
+    return answersOnly() ? [] : readAnnotations(file).filter((a) => a.key === d.key && !sent.has(a.id) && now.get(a.mock) === a.hash)
+        .map(({ id, mock, hash, ref, tag, words, text }) => ({ id, mock, hash, ref, tag, words, text }));
+};
 /** A board whose file says `"readonly": true` shows its items and takes no answers, rounds or comments: another program feeds it. */
 const readOnly = () => readItems(file).extra.readonly === true;
 /** A board whose file says `"answers_only": true` takes answers and replies but no rounds, comments or prompts: another program feeds it. */
@@ -1657,7 +1806,10 @@ async function route(req) {
         return [200, state()];
     }
     if (req.url === '/api/annotations') {
-        const { id, deleted, key, mock, ref, tag, words, text, hash: shown } = JSON.parse(body) ?? {}, live = readAnnotations(file);
+        const { id, deleted, key, mock, ref, tag, words, text, hash: shown } = JSON.parse(body) ?? {}, live = readAnnotations(file), sent = sentIds(file);
+        // A comment that went with an answer or a round is the agent's now: it stays as it was sent.
+        if (id !== undefined && sent.has(id))
+            return [409, { error: 'This comment was sent' }];
         if (deleted === true) {
             if (!live.some((a) => a.id === id))
                 return [404, { error: 'This comment is gone' }];
@@ -1679,7 +1831,7 @@ async function route(req) {
         if (id !== undefined && !live.some((a) => a.id === id))
             return [404, { error: 'This comment is gone' }];
         // One comment per element: another on the same element of the same file edits the first.
-        const same = live.find((a) => a.key === key && a.mock === mock && a.hash === hash && a.ref === ref);
+        const same = live.find((a) => a.key === key && a.mock === mock && a.hash === hash && a.ref === ref && !sent.has(a.id));
         appendAnnotation(file, { id: same?.id, key, mock, hash, ref, tag, words, text: text.trim() });
         return [200, state()];
     }
@@ -1697,11 +1849,14 @@ async function route(req) {
         const { key, note = '' } = JSON.parse(body) ?? {};
         if (typeof note !== 'string' || [...note.trim()].length > NOTE_MAX)
             return [400, { error: `The note must be text of ${NOTE_MAX} characters or fewer` }];
-        if (!note.trim())
-            return [400, { error: 'Write a note first: another round needs your comment' }];
-        if (!loadDecisions(file).some((x) => x.key === key))
+        const d = loadDecisions(file).find((x) => x.key === key);
+        if (!d)
             return [404, { error: 'This question is no longer in the file' }];
-        appendRound(file, key, note.trim());
+        // Comments on the mocks are enough for a round; with none, the round needs a note.
+        const comments = unsent(d);
+        if (!note.trim() && !comments.length)
+            return [400, { error: 'Write a note first: another round needs your comment' }];
+        appendRound(file, key, note.trim(), comments);
         return [200, state()];
     }
     const { key, answer, note = '' } = JSON.parse(body) ?? {};
@@ -1728,7 +1883,7 @@ async function route(req) {
     const other = d.reply || d.options.length ? [REPLY] : [], option = d.options.find((o) => o.value === answer) ?? other.find((o) => o.value === answer);
     if (!option)
         return [400, { error: `The answer must be one of: ${[...d.options, ...other].map((o) => o.label).join(', ') || 'none, this item is only shown'}` }];
-    answered(appendAnswer(file, d, option, note.trim()), d);
+    answered(appendAnswer(file, d, option, note.trim(), unsent(d)), d);
     return [200, state()];
 }
 /** Runs the config's on_answer command for a saved answer, with no shell: the answer goes in as one JSON line on its stdin, never in its arguments. */