toolroll 0.9.103 → 0.9.105

package/dist/serve.js

@@ -20,10 +20,6 @@ import { html, htmlString, jsonScript, textHtml } from "./html.js";
 import { browserAssetsAvailable, browserWorkspaceDocument } from './browser-shell.js';
 import { accessKey, countsKey, indexKey, projectSummaryOf, RevisionCache, summaryKey } from './console-chrome.js';
 import { usageChipOf } from './limits-ui.js';
-/** Any header a proxy adds: a request carrying one is never "from this computer" (password freshness, one-time links). */
-const PROXY_HEADER = /^(forwarded|via|x-forwarded-.+|x-real-ip|x-client-ip|x-original-.+|x-cluster-client-ip|true-client-ip|cf-connecting-ip|fastly-client-ip|x-proxyuser-ip)$/i;
-/** How often the background checks look at what is due (docs/plans/get-side-effects.md), and how often this
- * computer's agent sign-ins are asked again. */
 const BACKGROUND_CHECKS_MS = 30_000;
 const LOCAL_AGENTS_EVERY_MS = 2 * 60_000;
 import { browserCrewFromIndex, browserCrewOf, browserNavigationOf, browserProjectsOf, needsYouLabelOf } from './browser-workspace.js';
@@ -63,48 +59,6 @@ import {} from "./tools-ui.js";
 import { WORK_INDEX_MAX_LIMIT, workCountsByProject, workIndexPage } from "./work-index.js";
 import { WORKSPACE_MOTION_SCRIPT } from "./workspace-motion.js";
 import { prepareWorkspaceRevision, WorkspaceValidatorCache } from "./workspace-revision.js";
-/**
- * The web console (§7, grown per the console review): the whole built-in
- * queue, visible and operable from a phone. `toolroll serve` — node:http,
- * no dependencies, no JavaScript in the page. TLS is a proxy's job and the
- * docs say so; what is not delegated is everything else:
- *
- * **Authentication is required on every bind, localhost included.** The
- * credential is the approver's — the same name-and-token that approves a
- * scope and answers in the CLI — because `answered_by` must be an identity
- * somebody proved, not a string a request asserted. A browser logs in once
- * (POST /login) and carries an HttpOnly SameSite=Strict session cookie; an
- * API caller sends `Authorization: Bearer <name>:<token>` per request. The
- * token never travels in a URL, where it would land in history and logs.
- *
- * **Every request proves its Host** against the names this server was told
- * it answers as. Cookie-authenticated mutations additionally pass one
- * centralized gate — `authorizeMutation` — that proves content type, an
- * allowed Origin, and the per-session CSRF nonce, and refuses duplicated
- * security fields; a mutation route cannot forget a check it never wrote.
- * Bearer mutations carry no cookie for a hostile page to ride, so they skip CSRF.
- * Step-up ceremonies still require a cookie session; repeating a bearer password cannot approve.
- *
- * **Approval is step-up.** A session alone never approves a scope: the
- * approval form restates the goal, the exclusions, and the touches — the
- * three fields the digest binds — and requires the approver token typed
- * again, plus (for browsers) a single-use nonce minted when the form was
- * rendered, bound server-side to who saw which digest of which task. A
- * stolen cookie can read; it cannot agree to work.
- *
- * **GET never mutates.** Overdue-ness is derived at render time from the
- * deadline on the row; the durable expiry sweep belongs to the CLI's
- * surfaces and the loop, not to a crawler hitting a page.
- *
- * **Everything rendered is escaped at the sink**, and every identifier in an
- * href is URL-encoded first — HTML escaping does not make `a/b?x=1` a valid
- * path segment. The CSP is belt to those suspenders.
- *
- * **Evidence goes through one verified reader** (`readVerifiedArtifact`) and
- * membership is enforced by the lookup — a decision serves only its linked
- * artifacts, a run only its own rows, and when this server was scoped to a
- * repo, only runs whose task belongs to that repo (or to no repo yet).
- */
 import { createHash, randomBytes } from "node:crypto";
 import { keepSlowRequest, Timeline } from "./latency-timeline.js";
 import { readFileSync } from "node:fs";
@@ -137,7 +91,7 @@ import { canonicalProject, projectName, resolveCeiling, rowVisible } from "./pro
 import { noteSignInProbe, signInNotices } from "./provider-auth.js";
 import { createConnectionChecker } from "./provider-connection.js";
 import { ALL_CREDENTIAL_ENV } from "./provider.js";
-import { hstsFor, LOOPBACK_PEERS, plainHttpRefusal, transportOf } from "./public-access.js";
+import { hstsFor, LOOPBACK_PEERS, plainHttpRefusal, requestFromThisComputer, transportOf } from "./public-access.js";
 import { attachReadExecutor, defaultReadWorkers, ReadExecutor } from "./read-executor.js";
 import { cachedRelease, isNewer, runnerVersions, updateChecksOff } from "./releases.js";
 import { limitWords, FLUSH_MS as REQUEST_BUDGET_FLUSH_MS, RequestBudget, SOURCE_BUDGET_DEFAULTS, SourceAdmission } from "./request-budget.js";
@@ -158,8 +112,9 @@ import { createPeopleHandlers } from './server/people-tokens.js';
 import { createSettingsHandlers } from './server/settings.js';
 import { readPurpose, requestContext } from "./server/request-context.js";
 import { inPlaceRoute, prefetchRoute } from "./server/in-place.js";
-import { asLocalOwner, localModeOn, localOwnerRefusal, localOwnerStandsNow } from "./local-owner.js";
-import { defaultAgentOf, fillDefaultRouting } from "./model-choices.js";
+import { advancedShownFor } from "./advanced.js";
+import { LOCAL_OWNER_ELSEWHERE, asLocalOwner, localModeOn, localOwnerRefusal, localOwnerStandsNow } from "./local-owner.js";
+import { defaultAgentOf, fillDefaultRouting, fillRoutingOnSignIn } from "./model-choices.js";
 import { chromeScript, DEMO_BANNER, DEMO_BANNER_SHORT, focusDocument, KBD_HELP, pinnedTheme, QUEUE_VIEW, refuse, screen, SENSITIVE_INPUT, shell, sidebarScript } from "./server/chrome.js";
 import { BODY_CAP, form, loginHref, passwordSetNext, refusalNext, matchTaskPath, page, projectChatHref, redactedPath, redirect, respond, safeReturn, SHUTDOWN_WAIT_MS, taskChatHref } from "./server/http.js";
 import { decisionsFor, LEAD_BY_DEFAULT_FACT, leadBrowserMessages, leadChatVersion, NOT_STARTED_SESSION, TASK_COMPOSER_MODES, teamProposalCardParts } from "./server/render-chat.js";
@@ -180,8 +135,6 @@ import { loadConsoleUrl } from "./webhooks.js";
 import { reviewFactsOf } from "./workspace-ui.js";
 import { WorktreePool } from "./worktree.js";
 export function createDecisionServer(options) {
-    // Identities come from what the console's start resolved off its thread (startConsole); a path that didn't answer
-    // stays unresolved, kept restrictive. Without them (embedders, tests) the old synchronous reads apply.
     const identities = options.identities ?? syncProjectIdentities();
     const { projectFamilyPeek, familiesInView, familyTasksInView, revisionDestination, runIsLive, runIsTaskResult, revisionViewOf, taskViewData, routeViewOf, taskChatFocus, pullRequestTargetOf, failureOf, explainAttempt, taskScreen, armTaskResume, planViewOf, planContractViewOf, revisionDocOf, revisionLedgerOf, resultDetailOf } = createTaskViews({
         get store() { return store; },
@@ -234,18 +187,14 @@ export function createDecisionServer(options) {
             }
         }
     }
-    // Live terminals (docs/plans/live-terminal.md): on a machine that runs agents, when this install has a pty library.
     const terminals = terminalHostFor(store, options);
     const clock = options.clock ?? (() => new Date());
-    // Heavy reads (the work index behind `task list`) run on read-only worker connections, off the request loop.
     const readFile = store.isDemo() ? null : store.databaseFile();
     const readWorkers = options.readWorkers ?? (process.env["VITEST"] !== undefined ? 0 : defaultReadWorkers());
     const reads = readFile === null || readWorkers < 1 ? null : new ReadExecutor(readFile, readWorkers);
     const detachReads = reads === null ? () => { } : attachReadExecutor(store, reads);
-    /** Task checkouts, for Settings → Storage: the pool's own root, or the folder beside the database. */
     const storagePool = (databaseFile) => new WorktreePool(store, { root: options.poolRoot ?? join(dirname(databaseFile), "worktrees") });
     const install = installMethod(options.installBin);
-    /** What the last daily check found (the cache only, never the network), or nothing while checks are off. */
     const updateFacts = () => {
         if (options.configDir === undefined)
             return null;
@@ -253,7 +202,6 @@ export function createDecisionServer(options) {
         const release = switched.off ? null : cachedRelease(options.configDir);
         return { release, newer: release !== null && isNewer(release.version, PACKAGE_VERSION), on: !switched.off, byEnv: switched.byEnv };
     };
-    /** Settings → Updates, for everyone who can open Settings; only an operator may flip the switch. */
     const settingsUpdates = (actor, csrf) => {
         const facts = updateFacts();
         if (facts === null)
@@ -271,29 +219,20 @@ export function createDecisionServer(options) {
         };
     };
     const workspaceRevision = prepareWorkspaceRevision(store);
-    // The sidebar, the Tasks count and the crew: read at most once per workspace revision per reader's exact access
-    // (console-chrome.ts), and filled from a read worker before a page renders when one is attached.
     const chromeReads = new RevisionCache(workspaceRevision, clock);
     const workspaceIncarnation = randomBytes(16).toString('hex');
     const workspaceValidators = new WorkspaceValidatorCache();
     const providerHome = options.connectionHome ?? homedir();
     const checkConnection = createConnectionChecker({ home: providerHome, clock, ...(options.connectionProbe === undefined ? {} : { probe: options.connectionProbe }) });
-    // Every sign-in check the console makes also answers a sign-in pause.
-    // Whether this computer can fence agents: asked once as the console starts (a sandbox running /usr/bin/true), so
-    // Settings → Project never starts a process (docs/plans/get-side-effects.md).
     const fenceHere = options.fenceAvailable === undefined ? macosFenceAvailable() || linuxFenceAvailable() : false;
-    // Phone notifications' signing pair, made once as the console starts so /push/key only reads it.
     if (options.telegramTokenFile !== undefined) {
         try {
             loadOrCreateVapidKeys(dirname(options.telegramTokenFile));
         }
-        catch { /* /push/key says push is not set up */ }
+        catch { }
     }
-    // The last answer of every other check a page shows (docs/plans/get-side-effects.md).
     const lastChecks = new LastChecks();
-    /** The newest release, asked of npm (Settings → Updates shows the last answer). */
     const checkRelease = () => lastChecks.run("release", () => latestReleaseFor(options.updates?.latest));
-    // What each sign-in check said last: what a page shows (docs/plans/get-side-effects.md). A page never checks.
     const knownConnections = new Map();
     const connectionKnown = (provider) => knownConnections.get(provider) ?? null;
     const connectionCheck = async (provider, fresh) => {
@@ -302,10 +241,9 @@ export function createDecisionServer(options) {
         try {
             noteSignInProbe(store, provider, value.state, clock());
         }
-        catch { /* the pause keeps its own state */ }
+        catch { }
         return value;
     };
-    // Settings → Integrations: checked in the background with a short cache, as the first-run suggestions are.
     const integrations = createIntegrationMonitor(() => ({
         store,
         dir: options.configDir ?? null,
@@ -326,24 +264,10 @@ export function createDecisionServer(options) {
         ...(options.modelPath === undefined ? {} : { path: options.modelPath }),
     };
     const sessions = new PersistentSessions(store);
-    // Sessions from before a restart that ran out, or whose account changed since, go now.
     store.sweepWebSessions(Date.now(), SESSION_IDLE_MS, SESSION_ABSOLUTE_MS);
-    /** Where a new session signs in from: the browser (its user agent, short) and the address. */
     const arrival = (request) => ({ agent: (request.headers["user-agent"] ?? "").slice(0, 300) || null, address: forwardedSourceOf(request).replace(/^fwd:/, "") });
-    /** Wrong setup codes left before the first-account road closes. */
     let setupAttemptsLeft = 5;
-    // The /join road's limiter (D6; Codex people round 1, finding 4):
-    // PER-SOURCE buckets so one stranger cannot drain sign-up capacity for
-    // everyone, under a global ceiling that bounds total KDF work. Spent
-    // only by WELL-FORMED submissions — malformed requests are refused by
-    // the shape guards for free. The per-invite attempt counter remains the
-    // durable meter; these buckets only price the trying.
     const joinBySource = new Map();
-    /** The per-source key (round 2, finding 4): the direct peer — except
-     * behind the documented same-host TLS proxy, where every client would
-     * share the proxy's one bucket. A LOOPBACK peer is that proxy, and only
-     * then is the forwarded chain believed, taking the LAST hop (the one
-     * the trusted proxy itself appended; earlier entries are client-typed). */
     function forwardedSourceOf(request) {
         const peer = request.socket.remoteAddress ?? "unknown";
         const loopback = LOOPBACK_PEERS.has(peer);
@@ -354,52 +278,27 @@ export function createDecisionServer(options) {
         const lastHop = chain.split(",").pop()?.trim() ?? "";
         return lastHop === "" ? peer : `fwd:${lastHop.slice(0, 64)}`;
     }
-    /** That source as every per-source budget counts it: a native IPv6 caller by its /64 (source-key.ts). */
     function joinSourceOf(request) { return sourceKey(forwardedSourceOf(request)); }
     const signInBudget = new SourceBudget();
-    // A re-check or a link is the session that started it: its kept hash and credential generation ride the visit and the
-    // hand-off, and finish refuses any other session (a sign-out and a new sign-in in between never inherit it).
     const ssoVisits = new Map();
     const ssoHandoffs = new Map();
     let ssoProvider = null;
     const ssoSettings = () => readSsoSettings(options.configDir);
     const ssoOffer = () => { const settings = ssoSettings(); return settings === null ? null : { label: settings.label, operatorsOnly: settings.passwords === "operators" }; };
-    /** A step-up within this long of the provider checking someone needs no password. */
-    // The one-time sign-in link `up` opens in the browser: single use, ten minutes, from this computer only. Only a hash
-    // of the code is kept, in memory; the code itself is never written to a log or the ledger.
     const signInLinks = new Map();
     const linkKey = (code) => createHash("sha256").update(code).digest("hex");
     function mintSignInLink(account) {
         const known = store.accountOf(account);
-        // A full link is for an account with a password: a local owner without one gets only mintLocalLink's.
         if (known === null || known.role !== "approver" || known.revokedAt !== null || !known.passwordSet)
             return null;
         return holdSignInLink({ kind: "full", account, expires: Date.now() + SIGN_IN_LINK_MS });
     }
-    /** v147: this console start's key epoch (easy-start C2): the browser-key wave binds each session's mutation key to it. */
     const keyEpoch = options.keyEpoch ?? randomBytes(16).toString("hex");
-    /** This computer, and nothing in front of it: a loopback peer that names a loopback address, with no sign of a proxy —
-     * any forwarding header at all (Forwarded, X-Forwarded-*, X-Real-IP, Via, …) disqualifies the request. */
-    const fromThisComputer = (request) => {
-        const peer = request.socket.remoteAddress ?? "";
-        if (!LOOPBACK_PEERS.has(peer))
-            return false;
-        for (const name of Object.keys(request.headers))
-            if (PROXY_HEADER.test(name))
-                return false;
-        return /^(localhost|127\.0\.0\.1|\[::1\]):[0-9]{1,5}$/.test(request.headers.host ?? "");
-    };
-    /**
-     * Cockpit B2: a request's password-freshness facts — the one place they are made (scope.ts honours them). Every
-     * reader looks at the session as it is at the moment of the act, never a snapshot taken before the body arrived:
-     * still signed in here, under the account's current credential generation, after any Forget.
-     */
+    const fromThisComputer = (request) => requestFromThisComputer(request);
     function freshFactsOf(request, who, allowlisted = false) {
         if (who?.via !== 'cookie')
             return null;
         const session = who.session, local = fromThisComputer(request);
-        // The same validity lookupSession applies, read again at the act: held here, within its idle and absolute
-        // lifetimes, under the account's current credential generation, not revoked.
         const live = () => {
             const now = Date.now(), account = store.accountOf(who.name);
             return sessions.holds(session) && sessions.savedNow(session) && sessionWithinLifetime(session, now)
@@ -411,14 +310,12 @@ export function createDecisionServer(options) {
             consumeSsoNow: () => {
                 const was = session.ssoNowAt;
                 delete session.ssoNowAt;
-                // A refund puts back only what this spend took, once, and only if nothing newer arrived (Forget still floors it).
                 let refunded = false;
                 return () => { if (refunded)
                     return; refunded = true; if (was !== undefined && session.ssoNowAt === undefined)
                     session.ssoNowAt = was; };
             },
             floor: () => session.freshFloor ?? 0,
-            // Only a direct local request may start a password window (a typed password elsewhere proves now, nothing more).
             stamp: at => { if (local && live())
                 session.passwordAt = at; } };
     }
@@ -430,9 +327,6 @@ export function createDecisionServer(options) {
             ssoProvider = { issuer, provider: found.provider, at: Date.now() };
         return found;
     }
-    /** The identity provider as last discovered: what starting a sign-in uses (a GET, so it fetches nothing,
-     * docs/plans/get-side-effects.md). Discovered as the console starts, by the background checks every ten minutes, and
-     * when sign-in settings are saved or tested. */
     function providerKnown(issuer) {
         return ssoProvider !== null && ssoProvider.issuer === issuer ? ssoProvider.provider : null;
     }
@@ -441,10 +335,8 @@ export function createDecisionServer(options) {
         if (settings !== null)
             void providerFor(settings.issuer).catch(() => undefined);
     }
-    /** Password sign-in is only for instance operators when the provider says so (a way in if it's down). */
     const passwordAllowed = (name) => { const settings = ssoSettings(); return settings === null || settings.passwords === "everyone" || store.isInstanceOperator(name); };
     const minutesWords = (ms) => { const minutes = Math.max(1, Math.ceil(ms / 60_000)); return minutes >= 120 ? `${Math.round(minutes / 60)} hours` : `${minutes} minute${minutes === 1 ? "" : "s"}`; };
-    /** A sign-in event names the account only when it exists: what someone typed into the name box stays out of history. */
     const signInActor = (name) => name !== null && store.accountOf(name) !== null ? name : "unknown account";
     const recordSignIn = (actor, action, outcome, detail = null) => {
         try {
@@ -461,28 +353,14 @@ export function createDecisionServer(options) {
     };
     let joinGlobal = { tokens: 30, refilledAt: Date.now() };
     const approvalNonces = new Map();
-    // Startup authority: the configured repos and roots as their identities say (startupCeiling). Missing or unresolved
-    // paths remain restrictive. Native additions come only from the controller after its admission checks.
     const { ceiling, unresolved: unresolvedRepos, defaultProject, configured, configuredPaths } = startupCeiling([...(options.repo === undefined ? [] : [options.repo]), ...(options.repos ?? [])], options.projectRoots ?? [], options.identities === undefined ? undefined : identities, identities.strict);
-    /** No ceiling configured at all: the legacy trust-everything mode, named. */
-    // An `up` console (it is handed its admitted set) is never unscoped: with every saved project away it is empty.
-    // Judged by what was configured, never by what has resolved so far: a console whose folders haven't answered yet is
-    // scoped and empty, not unscoped.
     const unscopedMode = !configured && options.admittedRepos === undefined;
-    /** Per-row visibility under the ceiling — the authorization question for reads. */
-    /** The exact repositories this console serves now: `up`'s live admitted set when it supplies one, else startup's. */
     const exactRepos = () => options.admittedRepos?.() ?? ceiling.repos;
     const liveCeiling = () => {
         const repos = [...exactRepos(), ...(options.additionalProjectRepos?.() ?? [])];
-        // An admitted set that is empty for now is an empty ceiling, never the legacy unscoped mode.
         return { repos: repos.length === 0 && ceiling.roots.length === 0 && !unscopedMode ? [NO_PROJECT] : repos, roots: ceiling.roots, canon: identities.strict };
     };
-    /** The explicit, currently proved project list. The callback is supplied
-     * only by `up`, after it has independently checked git-ness and the root
-     * ceiling; this server still filters every row through its own ceiling. */
-    /** Projects deleted while this console runs: gone from its lists though a builder started with them still watches. */
     const deletedRepos = new Set();
-    /** Those still gone: a project added again (from here, `repos add`, or the lead) has its row back and shows again. */
     const goneRepos = () => {
         if (deletedRepos.size === 0)
             return deletedRepos;
@@ -503,7 +381,6 @@ export function createDecisionServer(options) {
         }
         return repos;
     };
-    /** Settings → Project's view of a project: what's held for it, what's running, and whether this person may delete it. */
     const projectViewOf = (repo, who) => ({
         repo, name: projectName(repo), holdings: projectHoldings(store, repo), running: projectRunning(store, repo, clock()),
         canDelete: who.via === "cookie" && store.isInstanceOperator(who.name),
@@ -523,18 +400,15 @@ export function createDecisionServer(options) {
         liveView: (() => {
             const commands = liveCommandsShown(store, repo);
             const canChange = who.via === "cookie" && who.role === "approver" && !store.isDemo() && store.accountCanAccess(who.name, repo);
-            // Showing commands is consent to one exact change: a single-use nonce for this person, project and terms.
             return { commands, canChange, ...(canChange && !commands ? { nonce: mintApprovalNonce(who.name, LIVE_VIEW_CONSENT, liveViewConsentDigest(repo)) } : {}) };
         })(),
     });
-    /** Settings → Project → Build access: the project's named tools and whether each loads for its builds. */
     const projectAccessOf = (repo) => {
         try {
             const policy = store.orgPolicy();
             return { tools: projectToolsOf(store, repo).map(tool => {
                     const refused = toolRefusal(policy, tool.name);
                     const set = secretsSetFor(repo, tool.spec, toolHome);
-                    // As a launch decides (toolLaunchFor): a tool the organisation doesn't allow, or missing a secret, is left out.
                     return refused !== null ? { name: tool.name, loads: false, words: refused }
                         : { name: tool.name, loads: tool.spec.secrets.every(one => one.optional || set.includes(one.name)), words: toolStanding(tool, set).words };
                 }) };
@@ -543,7 +417,6 @@ export function createDecisionServer(options) {
             return { problem: "Couldn't read this project's tools right now." };
         }
     };
-    /** Settings → Project → Builds at once: the saved number, its workers' capacity, and what builds now. */
     const projectBuildsOf = (repo, who) => {
         const capacities = store.listRunners().filter(one => one.retiredAt === null && one.repos.includes(repo)).map(one => one.capacity);
         return {
@@ -553,7 +426,6 @@ export function createDecisionServer(options) {
             canChange: who.via === "cookie" && who.role === "approver" && store.accountCanAccess(who.name, repo),
         };
     };
-    /** Codex's own MCP servers for a project (`codex mcp list --json`), for "Found on this computer"; null when Codex can't say. */
     const codexServers = async (repo) => {
         try {
             const listed = await (options.codexToolList ?? (async (cwd) => {
@@ -567,38 +439,28 @@ export function createDecisionServer(options) {
             return null;
         }
     };
-    /** One project's Tools page: its tools with which secrets are set (never values), the common tools not yet added, and what this computer already has. */
-    // A test's own folder for tool secrets and found tools; Toolroll's own (beside its database, and this home) otherwise.
     const toolHome = options.toolHome;
     const toolsViewOf = (repo, codex, kit = null, wanted = null) => {
         const tools = projectToolsOf(store, repo);
         const names = new Set(tools.map(one => one.name));
         return {
             repo, project: repo.split(/[\\/]/).filter(Boolean).at(-1) ?? repo,
-            // Secrets that can't be read (a refused folder, a locked keychain) read as none set: the page says why once (storage).
             tools: tools.map(tool => { let secretsSet = []; try {
                 secretsSet = secretsSetFor(repo, tool.spec, toolHome);
             }
             catch {
                 secretsSet = [];
             } return { tool, secretsSet }; }),
-            // A service that connects by signing in (or an app's own Connect) is offered only that way.
             catalog: TOOL_CATALOG.filter(one => !names.has(one.name) && oneClickOf(one.name) === null && localConnectOf(one.name) === null),
             connections: connectionsOf(store, repo, toolHome), kit, wanted,
-            // The project's own .mcp.json as the background pass last read it off the console's thread (never read here).
             found: discoverTools(repo, codex, toolHome, process.env, options.identities === undefined ? undefined : savedProjectMcp.get(repo) ?? null).filter(one => !names.has(one.spec.name)),
             storage: toolSecretStorage(),
         };
     };
     const codingProjects = () => [...new Set([...managedRepos(), ...store.listProjects().map(project => project.path)])].filter(repo => rowVisible(liveCeiling(), repo));
-    /** Open chat streams (live replies), ended when the server closes. */
     let liveTurnStarted = () => { };
-    /** Google sign-ins in progress (v89): each consent visit's state, for 10 minutes. */
     const googleVisits = new Map();
-    /** One-click connections on their way: the service's sign-in page and back, 15 minutes at most. */
     const connectVisits = new Map();
-    /** Flows open in a browser (v88): who's here, and a nudge when one changes. */
-    // Live views push on write (live-bus.ts): each commit moves the workspace revision, the rooms hear it.
     const liveBus = createLiveBus();
     const liveFollower = followWorkspace(store, () => workspaceRevision.current(), liveBus, { file: store.databaseFile() });
     const flowRooms = createFlowRooms(flow => flowFingerprint(store, flow), { bus: liveBus });
@@ -609,9 +471,6 @@ export function createDecisionServer(options) {
         provider: teamChatProvider,
         ...(options.subscriptionChatRunner ? { subscriptionRunner: options.subscriptionChatRunner } : {}),
     });
-    // The personal lead queue (docs/plans/lead-message-queue.md). Projects and a message's task are re-proved AS the
-    // person (never from a live request's context), and its live reply display is the console's own (chat handlers below,
-    // reached only once the server is listening).
     const asActor = (account, work) => requestContext.run({ csrf: "", returnTo: "/", actor: account }, work);
     const admittedReposFor = (account) => asActor(account, () => managedRepos());
     const personalQueue = createPersonalQueueRuntime({
@@ -631,12 +490,10 @@ export function createDecisionServer(options) {
             return run !== null && family.versions.some(one => one.refId === run.taskRef);
         }),
         names: { project: projectName, modes: TASK_COMPOSER_MODES },
-        // A queued message's partials are shaped as its final reply will be: for its words, with this console's own addresses.
         live: { begin: (thread, asked) => chatHandlers.beginLiveTurn(thread, { asked, appOrigin: [publicOrigin?.origin ?? null, options.configDir === undefined ? null : loadConsoleUrl(process.env, options.configDir)] }), end: (thread, ok, progress) => chatHandlers.endLiveTurn(thread, ok, progress) },
         ...(options.chatFetcher ? { fetcher: options.chatFetcher } : {}),
         ...(options.subscriptionChatRunner ? { subscriptionRunner: options.subscriptionChatRunner } : {}),
     });
-    // Only browser sessions receive HTML cards. The CLI keeps its summary contract.
     const teamBrowserReply = (reply, actor, csrf) => {
         const snapshot = reply.snapshot;
         if (!snapshot?.selected || !snapshot.proposals)
@@ -649,9 +506,7 @@ export function createDecisionServer(options) {
                     return { ...summary, card: teamProposalCardParts(store, actor, proposal, snapshot, csrf, decision, clock(), teamChatProvider).card };
                 }) } };
     };
-    // v112: one request budget per server for person API tokens, shared by every route a token signs in at (request-budget.ts).
     const requestBudget = new RequestBudget({ store, ...(options.requestBudgetClock === undefined ? {} : { clock: options.requestBudgetClock }) });
-    // Unproved password attempts share a source budget. Only successful proof spends an account budget.
     const sourceClock = options.requestBudgetClock === undefined ? {} : { clock: options.requestBudgetClock };
     const passwordSourceBudget = new SourceAdmission({ perMinute: SOURCE_BUDGET_DEFAULTS.password, ...sourceClock });
     const passwordAccountBudget = new SourceAdmission({ perMinute: SOURCE_BUDGET_DEFAULTS.password, keyMode: "exact", ...sourceClock });
@@ -660,27 +515,19 @@ export function createDecisionServer(options) {
     const oauthTokenBudget = new SourceAdmission({ perMinute: SOURCE_BUDGET_DEFAULTS.oauthToken, ...sourceClock });
     const presentsPassword = (request) => /^Bearer (.+):(.+)$/.test(request.headers.authorization ?? "");
     const admitPasswordSource = (request) => presentsPassword(request) ? passwordSourceBudget.admit(joinSourceOf(request)) : { ok: true };
-    /** Called only with a proved identity; cookies spend neither bearer budget. */
     const admitBearer = (request, actor) => {
         if (actor.principal !== undefined)
             return requestBudget.admit(actor.principal.tokenId, "api");
         return presentsPassword(request) ? passwordAccountBudget.admit(actor.name) : { ok: true };
     };
-    /** Every project this person may pick in the console — the switcher, Projects, Settings, Tools and Flows read this
-     * one list: the live admitted set (taskless projects included) and every project with saved work, each through
-     * the ceiling and this account's project grants. A project removed or deleted here is gone from it. */
     const consoleProjects = () => {
         const gone = goneRepos();
         return [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(one => visible(one) && !gone.has(one));
     };
     const server = createServer((request, response) => {
         instrumentRequest(store.telemetry, request, response);
-        // Every password checked while answering counts against where this request came from (sign-in-guard.ts).
-        // A GET or HEAD only reads (docs/plans/get-side-effects.md): store reads that would tidy up as they go don't.
         const answer = () => consoleFolders(options, identities, () => handle(request, response));
         void withPasswordSource(joinSourceOf(request), () => request.method === "GET" || request.method === "HEAD" ? asReadOnlyRequest(answer) : answer()).catch(error => {
-            // Every unhandled error is logged (v99): the path and the message, never the request's body or query. The reference
-            // is what a person's error page shows, so the log line can be found from it.
             const reference = `err_${randomBytes(4).toString("hex")}`;
             logEvent("error", "serve.error", { method: request.method, path: redactedPath(new URL(request.url ?? "/", "http://placeholder").pathname), error: error instanceof Error ? error.message : String(error), reference });
             if (envValue(process.env, "SERVE_DEBUG") === "1")
@@ -689,15 +536,13 @@ export function createDecisionServer(options) {
                 const updating = error instanceof Error && error.message.includes(UPDATE_PAUSED);
                 if (updating)
                     response.setHeader("Retry-After", "5");
-                // A browser asking for a page gets a page (Wave E): what happened, whether anything changed, the reference. It
-                // holds no error text. Everything else keeps the plain answer.
                 if (/\btext\/html\b/.test(String(request.headers.accept ?? "")) && (request.method === "GET" || request.method === "POST")) {
                     const read = request.method === "GET";
                     const at = new URL(request.url ?? "/", "http://placeholder");
                     try {
                         return page(response, updating ? 503 : 500, serverErrorPage({ updating, read, reference, at: new Date(), retry: read ? at.pathname + at.search : null }));
                     }
-                    catch { /* the plain answer below */ }
+                    catch { }
                 }
                 respond(response, updating ? 503 : 500, "text/plain; charset=utf-8", updating ? UPDATE_PAUSED : "something broke");
             }
@@ -708,9 +553,6 @@ export function createDecisionServer(options) {
     });
     server.once('listening', () => store.telemetry.start());
     server.once('close', () => store.telemetry.stop());
-    // --public-url (arc 3): validated to EXACTLY an https origin. Its host
-    // joins the allowed set, its origin authorizes POSTs, and cookies turn
-    // Secure. Anything malformed refuses at startup, loudly.
     const publicOrigin = (() => {
         if (options.publicUrl === undefined)
             return null;
@@ -727,9 +569,7 @@ export function createDecisionServer(options) {
         return parsed;
     })();
     const cookieSecure = publicOrigin === null ? "" : "; Secure";
-    /** Where Google may send someone back to (v89): the public https address, or this computer's own. */
     const consoleOrigin = (host) => host === undefined ? null : publicOrigin !== null && host === publicOrigin.host ? publicOrigin.origin : /^(localhost|127\.0\.0\.1|\[::1\]):[0-9]{1,5}$/.test(host) ? `http://${host}` : null;
-    /** This computer's tailnet names, the last ones read (onboarding). */
     let tailnet = [];
     if (options.tailnetNames !== undefined) {
         const readTailnet = options.tailnetNames;
@@ -743,7 +583,7 @@ export function createDecisionServer(options) {
         const flushBudget = () => { try {
             requestBudget.flush();
         }
-        catch { /* the next admit refuses if the database is unwell */ } };
+        catch { } };
         const timer = setInterval(flushBudget, REQUEST_BUDGET_FLUSH_MS);
         timer.unref?.();
         server.on("close", () => { clearInterval(timer); flushBudget(); });
@@ -752,7 +592,6 @@ export function createDecisionServer(options) {
         const address = server.address();
         return typeof address === "object" && address !== null ? address.port : null;
     };
-    /** The names this server answers as. Anything else is a rebind, refused. */
     const allowedHost = (host) => {
         if (host === undefined)
             return false;
@@ -760,8 +599,6 @@ export function createDecisionServer(options) {
         const locals = port === null ? [] : [`localhost:${port}`, `127.0.0.1:${port}`, `[::1]:${port}`, ...tailnet.map(name => `${name}:${port}`)];
         return [...locals, ...(options.allowedHosts ?? []), ...(publicOrigin === null ? [] : [publicOrigin.host])].includes(host);
     };
-    /** Easy-start C2: a protected loopback install (bound to loopback only, no --allow-host, no public URL, no tailnet
-     * names) has one browser host, and there every browser mutation also presents the session's key (mutation-key.ts). */
     const browserKeys = createBrowserKeys({
         enabled: options.browserKey === true,
         epoch: keyEpoch,
@@ -774,7 +611,6 @@ export function createDecisionServer(options) {
             return address.address === "127.0.0.1" ? `127.0.0.1:${port}` : address.address === "::1" ? `[::1]:${port}` : null;
         },
     });
-    /** The exact command that starts this console again as it runs now, plus a listening address or one more allowed host. */
     const consoleCommand = (change) => {
         const port = servedPort() ?? 4180;
         const address = server.address();
@@ -784,7 +620,6 @@ export function createDecisionServer(options) {
         return [`toolroll ${options.upConsole === true ? "up" : "serve"}`, ...(host === null ? [] : [`--host ${host}`]), ...(port === 4180 ? [] : [`--port ${port}`]),
             ...(allowed.length === 0 ? [] : [`--allow-host ${allowed.join(",")}`])].join(" ");
     };
-    /** The wrong-host page's facts: the address opened, where the console answers, and the exact command that admits it. */
     const wrongHost = (host) => {
         const opened = host !== undefined && /^[A-Za-z0-9.-]{1,253}(:[0-9]{1,5})?$|^\[[0-9A-Fa-f:.]{2,45}\](:[0-9]{1,5})?$/.test(host) ? host : null;
         return { opened, served: `127.0.0.1:${servedPort() ?? 4180}`, command: opened === null ? null : consoleCommand({ allow: opened }) };
@@ -799,7 +634,6 @@ export function createDecisionServer(options) {
         approvalNonces.set(nonce, { name, taskId, digest, expiresAt: Date.now() + NONCE_TTL_MS });
         return nonce;
     }
-    /** Single use, bound to who saw which digest of which task, and young. */
     function consumeApprovalNonce(nonce, name, taskId, digest) {
         const held = approvalNonces.get(nonce);
         if (held === undefined)
@@ -812,22 +646,13 @@ export function createDecisionServer(options) {
     }
     const hookContext = { store, clock, options };
     async function handle(request, response) {
-        // Webhooks come through a public relay (Tailscale Funnel, a reverse
-        // proxy) that forwards its own host name. The host check guards pages a
-        // signed-in browser reads; a delivery carries no session and its answer
-        // reveals nothing, so /hooks/ is answered before it, and only there.
         const hook = new URL(request.url ?? "/", "http://placeholder");
-        // v99: a liveness probe for a load balancer or orchestrator. It answers before the host check (a probe
-        // uses the address it reached), reads one row, and says nothing else about the installation.
         const method = request.method ?? "GET";
         const matchedRoute = matchRoute(method, hook.pathname);
-        // Where a slow answer's time went (latency-timeline.ts): milestones by route id only, kept when it took a second.
         const timeline = new Timeline();
         timeline.mark("route matched");
         const edgeRoute = matchedRoute?.stage === 'edge' ? matchedRoute : null;
         const wrongMethodEdge = edgeRoute === null ? ROUTES.find(row => row.stage === 'edge' && new RegExp(row.pattern).test(hook.pathname)) ?? null : null;
-        // D7: a password on a request still signs in this release, announced on every answer and named in every refusal;
-        // from the release that removes it, it is refused here before anything checks it.
         if (isPasswordBearer(request.headers.authorization)) {
             if (!(options.passwordBearerAccepted ?? passwordBearerAccepted())) {
                 request.resume();
@@ -844,9 +669,6 @@ export function createDecisionServer(options) {
         if (!allowedHost(request.headers.host)) {
             return respond(response, 421, "text/html; charset=utf-8", wrongHostPage(wrongHost(request.headers.host)));
         }
-        // Easy-start C2: a protected loopback install has one browser origin, whose storage holds the session's mutation key.
-        // A browser's page read at another loopback name (localhost, [::1]) moves there; machine callers and protocol
-        // adapters (an API token, MCP's own addresses) are left where they are.
         const canonical = browserKeys.canonicalHost();
         if (canonical !== null && request.headers.host !== canonical && (method === "GET" || method === "HEAD") && request.headers.authorization === undefined
             && (edgeRoute === null || edgeRoute.domain === "people")) {
@@ -855,8 +677,6 @@ export function createDecisionServer(options) {
             response.end();
             return;
         }
-        // A real domain (public-access.ts): HSTS for the public https host reached over HTTPS, and no API token over
-        // plain HTTP from outside this computer and the tailnet — refused before anything reads or checks it.
         const transport = transportOf({ peer: request.socket.remoteAddress, joinSource: forwardedSourceOf(request), forwardedProto: request.headers["x-forwarded-proto"], forwarded: request.headers["forwarded"] });
         const hsts = hstsFor(publicOrigin?.host ?? null, request.headers.host, transport);
         if (hsts !== null)
@@ -867,31 +687,19 @@ export function createDecisionServer(options) {
             return respond(response, 403, "text/plain; charset=utf-8", insecure);
         }
         const url = new URL(request.url ?? "/", "http://placeholder");
-        // A token in a URL is a token in history, logs, and referers. Refused
-        // outright rather than ignored, so nobody learns the habit works.
         if (url.searchParams.has("token")) {
             return respond(response, 400, "text/plain; charset=utf-8", "credentials never travel in URLs");
         }
         if (edgeRoute === null && isEdgeAddress(url.pathname))
             return refuseEdge(request, response, url.pathname, wrongMethodEdge);
-        // Live rooms share the browser identity/context below; their adapter carries token limits into each room.
         if (edgeRoute !== null && edgeRoute.domain !== 'people' && edgeRoute.domain !== 'live')
             return dispatchEdge(edgeRoute, { url, who: null, request, response, method });
-        // Passive polls authenticate without extending the browser session.
         const fragmentName = url.searchParams.get("fragment");
         const workspaceRead = method === "GET" && url.searchParams.get('format') === 'workspace';
-        // A workspace read's purpose (live-pages-and-home.md A1.4): bookkeeping only. Read on workspace GETs alone; on any other
-        // request the header means nothing. No authorisation decision below reads it.
         const purpose = workspaceRead ? readPurpose(request.headers['x-toolroll-read']) : 'poll';
-        // The reads that never extend the session, whatever their header says.
         const noTouch = edgeRoute?.domain === 'live' || (fragmentName !== null && NO_TOUCH_FRAGMENTS.has(fragmentName)) || /^\/code\/[a-f0-9]{32}\/state$/.test(url.pathname) || url.pathname === '/term/state'
-            // The Agents view's Live grid only watches: its polls never extend or write the session.
             || url.pathname === '/agents/live' || /^\/agents\/live\/[0-9]{1,15}$/.test(url.pathname) || (url.pathname === '/agents' && url.searchParams.get('view') === 'live');
-        // A followed link (`navigate`) extends the session exactly as the HTML GET of the same address would; every other
-        // workspace read (a re-read, a prefetch) does not.
         const touch = !(method === "GET" && (noTouch || (workspaceRead && purpose !== 'navigate')));
-        // A read ahead is answered only for a browser session, only for the prefetch allowlist (in-place.ts): anything else
-        // hears 204 before any sign-in bookkeeping (a token's last use, a sign-in charge) is written.
         if (purpose === 'prefetch' && (request.headers.authorization !== undefined || !prefetchRoute(matchedRoute?.id, url))) {
             request.resume();
             return respond(response, 204, "text/plain; charset=utf-8", "");
@@ -905,12 +713,16 @@ export function createDecisionServer(options) {
             respond(response, admitted.status, "text/plain; charset=utf-8", admitted.status === 429 ? limitWords(admitted.limit, admitted.retryAfter) : "Request limits could not be checked; nothing ran. Try again shortly.");
             return true;
         };
-        // One source charge before password proof and one account/token charge after it, including GET /login.
         if (refuseBudget(admitPasswordSource(request)))
             return;
         const refusedToken = {};
         const who = identify(request, touch, edgeRoute?.domain === 'live', refusedToken);
         timeline.mark("signed in");
+        if (refusedToken.elsewhere === true && edgeRoute?.domain !== 'people') {
+            request.resume();
+            response.setHeader("x-toolroll-refused", "local-owner-elsewhere");
+            return respond(response, 403, "text/plain; charset=utf-8", LOCAL_OWNER_ELSEWHERE);
+        }
         if (refusedToken.principal !== undefined) {
             if (refuseBudget(requestBudget.admit(refusedToken.principal.tokenId, "api")))
                 return;
@@ -921,7 +733,6 @@ export function createDecisionServer(options) {
         }
         if (who?.via === "bearer" && refuseBudget(admitBearer(request, who)))
             return;
-        // A read ahead from anything but a signed-in browser session (signed out, a token): 204, never the sign-in page.
         if (purpose === 'prefetch' && who?.via !== 'cookie') {
             request.resume();
             return respond(response, 204, "text/plain; charset=utf-8", "");
@@ -931,11 +742,8 @@ export function createDecisionServer(options) {
         if (edgeRoute?.domain === 'people')
             return freshFacts.run(fresh, () => provenPasswordAccount.run(passwordProof, () => dispatchEdge(edgeRoute, { url, who, request, response, method })));
         if (who === null) {
-            // A password on a request that did not sign in is a machine's refusal, never a login page.
             if (isPasswordBearer(request.headers.authorization))
                 return respond(response, 401, "text/plain; charset=utf-8", "authenticate first");
-            // A GET to an exact task or result (a phone's deep link) signs in and
-            // comes back to it — the destination is a same-site path only.
             return method === "GET"
                 ? redirect(response, loginHref(url.pathname + url.search))
                 : respond(response, 401, "text/plain; charset=utf-8", "authenticate first");
@@ -947,15 +755,11 @@ export function createDecisionServer(options) {
             actor: who.name,
             csrf: who.via === "cookie" ? who.session.csrf : "",
             returnTo: safeReturn(url.pathname + url.search),
-            // This console's own addresses: a lead reply's links there read as "the task", "the result", "Settings → Lead".
             appOrigins: [consoleOrigin(request.headers.host), publicOrigin?.origin ?? null, options.configDir === undefined ? null : loadConsoleUrl(process.env, options.configDir)],
-            // Every signed-in page shares the workspace shell; pages showing a one-time secret opt out (forceSensitive).
             browser: who.via === 'cookie',
-            // Passwordless (read once for rendering; every act proves it again at the act): ceremony fields render as nothing.
             passwordless: who.via === 'cookie' && passwordlessOn(store),
+            advanced: advancedShownFor(store, who.name),
             openProject: who.via === 'cookie' ? who.session.project : null,
-            // v100: signed in with the identity provider: its label, and whether it checked them recently enough to stand in for a password.
-            // Cockpit B2: "fresh" is an explicit re-check made on request and not yet spent (read live; one step-up uses it).
             sso: who.via === 'cookie' && who.session.sso !== undefined ? { label: ssoSettings()?.label ?? "your identity provider",
                 get fresh() { return freshFacts.getStore() != null && ssoNowAvailable(who.name); } } : undefined,
             refusal: (answer, status, body) => sendScreen(answer, status, screen(status === 404 ? "Not found" : "Request refused", body, { chrome: chromeFor(who.via === "cookie" ? who.session.project : null, "work") })),
@@ -967,15 +771,11 @@ export function createDecisionServer(options) {
             ...(workspaceRead && typeof request.headers['if-none-match'] === 'string' ? { workspaceIfNoneMatch: request.headers['if-none-match'] } : {}),
             workspaceRequest: url.searchParams.get('request'),
             timeline,
-            // Easy-start C2: every page that posts carries the key fill while the key is required; a session whose key is from
-            // an earlier start (or has none) is told to reconnect.
             keyFill: browserKeys.required(),
-            // Easy start: a local owner with no password sees "Set a password to do this." where a step-up field would be.
             ...(who.via === "cookie" && who.authority === "local-owner" && store.accountOf(who.name)?.passwordSet === false
                 ? { localStepUp: localOwnerRefusal(false, method === "GET" ? passwordSetNext(pagePathOf(url)) : "/").href } : {}),
             reconnect: browserKeys.stale(who, method === "GET" ? safeReturn(pagePathOf(url)) : "/"),
         };
-        // A read ahead writes nothing, not even a slow request's record.
         if (purpose !== 'prefetch')
             response.once("finish", () => keepSlowRequest(store, timeline, matchedRoute?.id ?? "unmatched", response.statusCode, clock()));
         if (method === "GET" || method === "POST")
@@ -985,16 +785,11 @@ export function createDecisionServer(options) {
                 const body = method === "POST" ? await form(request, (matchedRoute?.stage === "console" ? matchedRoute.bodyCap : undefined) ?? BODY_CAP) : null;
                 const target = actionTarget(url, who, request, body === null ? null : readForm(body, CONSOLE_FORMS.ledgerTarget));
                 const execute = async () => {
-                    // THE ROUTE TABLE (server/route-table.ts): nothing reaches a handler unless a row declares this method and
-                    // path and admits this kind of caller. Undeclared addresses retain the legacy instance-access refusal
-                    // for project-limited accounts, before the unrestricted router's not-found response.
                     const route = matchedRoute?.stage === "console" ? matchedRoute : null;
                     if (route === null)
                         return restricted()
                             ? refuse(response, who, 403, "This area requires instance access. Your account operates within its assigned projects.", "/projects")
                             : refuse(response, who, 404, "There's no page at this address.", "/chat");
-                    // Easy-start C1: a local owner's session reaches only the rows marked for it (route-table.ts `local`), decided
-                    // first, before the route's policy reads anything and before any handler runs, GET and POST alike.
                     if (who.via === "cookie" && who.authority !== "full" && (route.local !== "allow" || localPrincipalOf(who, route) === null)) {
                         request.resume();
                         return refuseLocalOwner(response, who, method, url, request.headers.accept);
@@ -1006,8 +801,6 @@ export function createDecisionServer(options) {
                         request.resume();
                         if (method === "POST" && who.via === "bearer" && who.principal?.scope === "read")
                             return refuse(response, who, 403, REMOTE_MESSAGES.read);
-                        // A viewer's act stays refused even when the table rejects their caller first (for example a
-                        // password bearer at a step-up route). Preserve the viewer wording and explicit protocol refusals.
                         if (policy.reason === "scope" || (method === "POST" && who.role === "viewer" && !route.viewer && route.callerRefusal === undefined)) {
                             return refuse(response, who, 403, route.scopeRefusal ?? "your login can watch, not act — ask an approver to upgrade you");
                         }
@@ -1016,8 +809,6 @@ export function createDecisionServer(options) {
                             : respond(response, route.callerRefusal.status, route.callerRefusal.type, route.callerRefusal.body);
                     }
                     if (method === "GET") {
-                        // Authorize every read before considering a conditional response.
-                        // Task/result opening and receipt reconciliation always re-read work.
                         const facts = requestContext.getStore();
                         if (facts?.workspaceRead && who.via === 'cookie' && route.id === 'chat.page' &&
                             !url.searchParams.has('task') && !url.searchParams.has('result') && !url.searchParams.has('request')) {
@@ -1031,15 +822,11 @@ export function createDecisionServer(options) {
                                 return respond(response, 304, 'application/json; charset=utf-8', '');
                             }
                             const expiresAt = workspaceRevision.expiresAt(now);
-                            // A clock-bound refresh receives a different validator even when
-                            // no database row changed (for example an expired worker lease).
                             facts.workspaceValidator = { key, revision, expiresAt,
                                 etag: '"' + createHash('sha256').update(`${key}:${revision}:${expiresAt}`).digest('hex') + '"' };
                         }
                         await prefetchChrome(route, url, who);
                         timeline.mark("chrome and worker reads");
-                        // The worker wait lets a sign-out, credential/access change or console ceiling change land. Prove the
-                        // cookie and route again before rendering protected content or answering with a content validator.
                         if (who.via === 'cookie') {
                             const current = identify(request, false);
                             if (current?.via !== 'cookie' || current.session !== who.session)
@@ -1051,16 +838,12 @@ export function createDecisionServer(options) {
                     }
                     return handlePost(route, url, who, request, response, body);
                 };
-                // Easy-start C1: an allowed row runs as the local owner, in the act the row is (execute refuses every other): the
-                // prover answers "local-owner" only for that act, and every write it makes re-proves it still stands.
                 const local = who.via === "cookie" && who.authority !== "full" && matchedRoute?.stage === "console" && matchedRoute.local === "allow" ? localPrincipalOf(who, matchedRoute) : null;
                 if (local !== null)
                     response.once("close", () => { local.request.ended = true; });
                 const run = () => local === null ? execute() : asLocalOwner(local, execute);
                 if (method === "GET")
                     return projectAuthority.run({ actor: who.name, repo: target.repo }, run);
-                // Request acceptance is separate from durable work completion. Never
-                // persist a body, query string, token, password, or arbitrary URL.
                 const entry = { at: clock().toISOString(), actor: who.name, ...target, source: "request", ...(who.via === "bearer" && who.token !== undefined ? { detail: `API token: ${who.token}` } : {}) };
                 store.recordAction({ ...entry, outcome: "requested" });
                 try {
@@ -1084,7 +867,7 @@ export function createDecisionServer(options) {
                 try {
                     repo = coding.get(match[1], { name: who.name, generation: who.session.generation }).repo;
                 }
-                catch { /* The route refuses unknown/foreign sessions. */ }
+                catch { }
             }
             return { repo, taskId: null, runId: null, action: `coding ${body ? url.pathname.split('/').at(-1) : 'view'}` };
         }
@@ -1135,9 +918,6 @@ export function createDecisionServer(options) {
         if (project === undefined) {
             return refuse(response, who, 403, "that project is outside what this server was configured to show");
         }
-        // A project link is a read context, not a session-changing operation.
-        // Prove it against both admission and the known project catalog before
-        // collection queries; unknown/foreign paths reveal no work.
         if ((route.id === 'tasks' || route.id === 'work' || route.id === 'system') && url.searchParams.has('project')) {
             const wanted = url.searchParams.get('project') ?? '';
             if (url.searchParams.getAll('project').length !== 1 || !visible(wanted) ||
@@ -1146,8 +926,6 @@ export function createDecisionServer(options) {
             }
             project = wanted;
         }
-        // Home (UI revamp wave B) shows every project unless its address names one (proved the same way), and the rail's
-        // and the dock's Needs-you count follow that same one scope.
         if (route.id === 'home') {
             const wanted = url.searchParams.get('project');
             if (wanted !== null && (url.searchParams.getAll('project').length !== 1 || !visible(wanted) ||
@@ -1156,19 +934,12 @@ export function createDecisionServer(options) {
             }
             project = wanted;
         }
-        // All projects, asked for by name on Tasks (its project filter): the rolled-up list, admission-bound as ever.
-        // Tasks (P1.4) says every project as scope=all; an old link's all=1 still reads so.
         if (route.id === 'tasks' && !url.searchParams.has('project') && ((url.searchParams.get('scope') === 'all' && url.searchParams.getAll('scope').length === 1)
             || (url.searchParams.get('all') === '1' && url.searchParams.getAll('all').length === 1)))
             project = null;
-        // Every page's Tasks count covers this one project view, whatever project the page itself shows.
         const facts = requestContext.getStore();
         if (facts !== undefined)
             facts.lens = project;
-        // Exact result links carry their own read context. Check the stored
-        // placement against both account and instance access before using it;
-        // viewing a result never changes the session's selected project, and
-        // the page's project switch keeps showing the person's own choice.
         const chosenProject = project;
         if (route.id === "review" && url.searchParams.has("result")) {
             const wanted = url.searchParams.get("result") ?? "";
@@ -1181,24 +952,6 @@ export function createDecisionServer(options) {
             if (who.via === "cookie" && ref !== null && visible(ref.repo))
                 project = ref.repo;
         }
-        // Nothing open and more than one thing to choose: land on the opener.
-        // Decisions and their evidence stay reachable — answering must never be
-        // blocked by project state — and the opener itself must not loop.
-        // A run's page and its evidence (workspace package 1): a bookmarked
-        // `/r/<id>` from All projects used to bounce to the opener until a
-        // project was chosen. The handler below re-proves the run's repo
-        // against the ceiling and the account (`runVisible`) before a byte
-        // renders, so letting the path through widens nothing.
-        // The chat's two read-only refresh routes (package 2 revision): the
-        // page itself is allowed from All projects, so its status poll and
-        // task fragment must be too — a 303 to the opener answered the poll
-        // with HTML and the page wrongly said the sign-in was lost. Each
-        // route keeps its own cookie, role, session, ceiling, and task
-        // admission checks. Shared action links likewise recheck the saved
-        // owner and project in their handler, so they stay reachable from All
-        // projects without changing the selected project or granting access.
-        // Which reads first need an open project is the route table's `needsProject` column; an exact result link
-        // and the all-projects board carry their own read context.
         const needsProject = who.via === "cookie" && project === null && !unscopedMode &&
             route.needsProject &&
             !(route.id === "review" && url.searchParams.has("result")) &&
@@ -1207,32 +960,15 @@ export function createDecisionServer(options) {
             return redirect(response, `/projects?return=${encodeURIComponent(safeReturn(url.pathname + url.search))}`);
         return dispatchConsole(route, { url, who, request, response, route, now, project, chosenProject, posted: new URLSearchParams() });
     }
-    /**
-     * The first run (adoption track, step 3): three plain steps derived from
-     * live state on every render, never a stored cursor, and retired
-     * PERMANENTLY by the first-success installation fact (Codex adoption
-     * review, finding 14). Each step is either something this console can do,
-     * or the exact command where only the CLI can (finding e).
-     */
     function firstRunStepsNow(now) {
         if (restricted() || store.isDemo() || store.firstSuccessAt(now) !== null)
             return null;
         return firstRunSteps({ agentSignedIn: agentSignedIn(now), projects: managedRepos().length, hasTask: store.hasAnyWork(), firstResultAt: null, signInCommand: agentSignInCommand() });
     }
-    /**
-     * Whether a coding agent is signed in where the work runs. This machine's
-     * own checks (the ones Settings makes) speak only for a worker on this
-     * machine, or for the first one while none is registered yet (it is started
-     * here); a worker elsewhere speaks through its own readiness report, and
-     * the console never claims to have checked that machine (finding 15).
-     * Nothing here waits on a probe: this machine's answer is the last one
-     * seen, refreshed in the background, and null until the first one is in.
-     */
     function agentSignedIn(now) {
         const here = hostname();
         const registered = store.listRunners().filter(one => one.retiredAt === null);
         const workers = registered.filter(one => runnerAlive(one, now));
-        // This machine under any of its own names (machine-identity.ts): a hostname that moved with the network is still here.
         if (workers.some(one => !sameMachineHost(one.host, here) && store.providerReadiness(one.name).some(seen => seen.state === "ready")))
             return true;
         return options.localRunner !== undefined || registered.length === 0 || workers.some(one => sameMachineHost(one.host, here)) ? localAgentSignedIn() : false;
@@ -1240,7 +976,6 @@ export function createDecisionServer(options) {
     let localSignIn = null;
     let localSignInChecking = null;
     let leadRecheckedAt = 0;
-    /** Ask this computer's agent CLIs again (no model, nothing spent); `fresh` skips their 30-second cache. */
     function checkLocalAgents(fresh = false) {
         if (localSignInChecking !== null)
             return localSignInChecking;
@@ -1248,22 +983,16 @@ export function createDecisionServer(options) {
             .then(([claude, codex]) => {
             localSignIn = { at: Date.now(), signedIn: [claude, codex].some(state => state === "connected" || state === "key-works" || state === "key-present"), states: { claude: claude, codex: codex } };
             leadByDefault();
+            if (options.leadByDefault === true && !store.isDemo())
+                fillRoutingOnSignIn(store, localSignIn.states, clock());
         })
             .catch(() => { })
             .finally(() => { localSignInChecking = null; });
         return localSignInChecking;
     }
-    /** The last answer only (docs/plans/get-side-effects.md): this computer is asked again by the background checks or a
-     * person's Check now, never because a page was opened. */
     function localAgentSignedIn() {
         return localSignIn?.signedIn ?? null;
     }
-    /**
-     * The lead on by default (onboarding): with no lead set up yet, the agent CLI signed in on this computer runs it
-     * (Claude Code first, else Codex) on its membership with today's safe defaults: the CLI's own default model, 50 turns
-     * a day, no dollar spend, and every action it proposes still a card a person confirms. Once only, ever: a lead
-     * someone turned off stays off, and Settings → Lead changes it.
-     */
     function leadByDefault() {
         if (options.leadByDefault !== true || store.isDemo() || store.getChatConfig() !== null || store.installationFact(LEAD_BY_DEFAULT_FACT) !== null)
             return;
@@ -1274,29 +1003,21 @@ export function createDecisionServer(options) {
         store.transact(() => {
             store.setChatConfig({ provider, model: "default", dailyTurns: 50, weeklyCeilingMicrousd: 0, priceInMicrousd: 0, priceOutMicrousd: 0 }, "toolroll", now);
             store.recordInstallationFact(LEAD_BY_DEFAULT_FACT, provider, now);
-            // A laptop install (local mode on): the agent chosen here also starts the models, on its default preset, while
-            // nothing is chosen yet, so the owner's first task plans without a password (model-choices.ts fillDefaultRouting).
             const agent = defaultAgentOf(provider);
             if (agent !== null && localModeOn(store))
                 fillDefaultRouting(store, agent, "toolroll", { kind: "first-start" }, now);
         });
     }
-    // Look once at start, so the lead is on by the time the browser opens.
     if (options.leadByDefault === true && !store.isDemo() && store.getChatConfig() === null)
         void checkLocalAgents();
-    /** What the lead runs on, in words for one line ("your Claude Code sign-in"); null for a direct API or no lead. */
     function leadWords() {
         const config = store.getChatConfig();
         return config?.provider === "claude-subscription" ? "your Claude Code sign-in" : config?.provider === "codex-subscription" ? "your Codex sign-in" : null;
     }
-    /** The one command that gets an agent signed in here, for this operating system: sign in when its CLI is installed, else install Claude Code and sign in. */
     function agentSignInCommand() {
         return signInCommandFor(localSignIn?.states ?? null, options.platform ?? process.platform);
     }
-    /** First tasks per project: the last ones found (safe generic ones until then), re-read in the background at most
-     * every ten minutes. A render never waits on `gh` or `git grep`. */
     const firstTasks = new Map();
-    /** The phone setup itself (Settings → Chat apps): a chat app, or this console over Tailscale. */
     function phoneSetup(who) {
         if (who.role !== "approver" || store.isDemo())
             return undefined;
@@ -1311,49 +1032,27 @@ export function createDecisionServer(options) {
             dismissHref: "/onboarding/phone/dismiss",
         };
     }
-    // ---- fleet chat (v13) ----------------------------------------------------
     const chatFetcher = options.chatFetcher ?? fetch;
     const chatEnv = options.chatEnv ?? process.env;
-    /** The lead's last non-answer per BROWSER session (keyed by its csrf —
-     * never by name, so two browsers on one account do not read each other's
-     * notes), bound to the mate turn it came from so a note from a session
-     * that has since ended never shows; bounded; read once. */
     const leadSaid = new Map();
-    /** The unified conversation's rows for one reader (package 2): the SAME
-     * rows the page renders and the status poll's fragments re-render, so a
-     * live update can never show a card the page would not. A task lens
-     * keeps only that task's coordinator cards; the lead's own thread is one
-     * thread regardless of lens. */
     function leadConversationRows(who, principal, focusTask, now, chatProject = null) {
         const allCoordinatorRows = store.listCoordinatorProposals({ repos: managedRepos(), states: ["pending", "confirmed", "refused"], limit: 30 });
         const coordinatorProposals = focusTask !== null ? allCoordinatorRows.filter(one => focusTask.family.versions.some(version => version.id === one.payload["task"]))
             : chatProject !== null ? allCoordinatorRows.filter(one => one.repo === chatProject) : allCoordinatorRows;
-        // A visit only reads (quiet page visits): this opens no thread. The first message opens it (chatSend), and a
-        // live thread kept under another ceiling is what that message replaces, so it reads here as the earlier one.
         const found = store.liveLeadThreadFor(who.name, chatScopeOf(focusTask, chatProject));
         const thread = found !== null && found.ceilingDigest === principal.ceilingDigest ? found : null;
         const proposals = thread === null ? [] : store.listLeadProposals(thread.id);
-        // One reply runs at a time per person; this thread shows it only when
-        // the reply is its own.
         const live = store.liveLeadTurnFor(who.name);
         const messages = thread === null ? [] : store.listLeadMessages(thread.id, 40);
-        // The lead's question with buttons, while its reply is the last word in the thread.
         const last = messages.at(-1);
         const asking = last?.role === "assistant" && last.turn !== null && store.getLeadTurn(last.turn)?.approver === who.name ? store.leadAskOpen(last.turn, now) : null;
-        // A question about this task loses its buttons once the version shown moved after it was asked (its plan
-        // rewritten or approved, a new attempt started): its options answered a state that is gone. Its words stay, marked so.
         const staleAsk = asking !== null && focusTask !== null && taskMovedSince(store, focusTask.executionId, asking.createdAt) ? asking.turn : null;
         const ask = staleAsk === null ? asking : null;
-        // Answered questions stay readable above the answer; only their buttons go.
         const asks = new Map(messages.flatMap(one => { const asked = one.role === "assistant" && one.turn !== null ? store.leadAsk(one.turn) : null; return asked === null ? [] : [[asked.turn, asked]]; }));
-        // The person's queued messages in this thread: each shows waiting (with Remove) or why it was not sent.
         const queue = new Map(thread === null ? [] : personalQueue.queue.forThread(thread.id).map(row => [row.message, row]));
-        // The thread a ceiling change replaced (ruling 9), display only: closed already, or still live under the old ceiling.
         const replaced = thread !== null ? store.replacedLeadThread(thread)
             : found !== null && found.scope.kind === "lead" && store.listLeadMessages(found.id, 1).length > 0 ? found : null;
         const previousProposals = replaced === null ? [] : store.listLeadProposals(replaced.id);
-        // How this thread's last reply ended, read from its saved turn (never process memory, which a restart loses): a
-        // failed turn that saved no message of its own says why in the thread, until the next reply starts.
         const lastTurn = thread === null ? null : latestLeadTurnOfThread(store, thread.id);
         const failure = lastTurn !== null && lastTurn.state === "failed" && !messages.some(one => one.role === "assistant" && one.turn === lastTurn.id)
             ? leadFailureText(lastTurn.failureReason, store.leadTurnCostUnconfirmed(lastTurn.id), lastTurn.failureDetail ?? null) : null;
@@ -1372,18 +1071,10 @@ export function createDecisionServer(options) {
             recent: store.recentLeadTurns(who.name, 5),
         };
     }
-    /** The thread a chat surface speaks in (v77): the task's own thread, the
-     * project's, or the lead conversation across every project. */
     function chatScopeOf(focusTask, chatProject) {
         return focusTask !== null ? { kind: "task", key: focusTask.id } : chatProject !== null ? { kind: "project", key: chatProject } : LEAD_THREAD;
     }
     const liveTurns = new Map();
-    /** The Ask panel (v77): the conversation a task, result or project page
-     * docks beside itself — that page's own thread, the same session and
-     * cards as /chat. Null when this person has no lead chat here. A page
-     * view starts nothing (quiet page visits): with no membership
-     * conversation yet, the panel binds its sends to NOT_STARTED_SESSION and
-     * the first message starts one (chatSend). */
     function dockedConversation(who, focusTask, chatProject, now, back, resultRunId = null) {
         if (who.via !== "cookie" || who.role !== "approver" || (focusTask === null && chatProject === null))
             return null;
@@ -1404,21 +1095,13 @@ export function createDecisionServer(options) {
             taskId: focusTask?.id ?? null, resultRunId, project: focusTask === null ? chatProject : null, failure: rows.pending === null ? rows.failure : null,
         };
     }
-    /** The session-layer principal (ruling 3): cookie, csrf, and role were
-     * proved at the edge; the row and the generation are re-proved here. */
-    /** Start the person's lead conversation: the session every later turn
-     * debits (a membership spends nothing; direct API gets a per-conversation
-     * ceiling) and its thread. Starting ends any older session. */
     function startLeadConversation(who, principal, enabled, ceilingUsd, follow, now, scope = LEAD_THREAD, request) {
-        // A page's first send (quiet page visits) starts it under that send's request: the start and its record are one
-        // write, so a retry of the same request finds the conversation it started and never starts another.
         if (request !== undefined) {
             return store.transact(() => store.replay({ idempotencyKey: `mate-start:${who.name}:${request}`, actor: who.name, at: now }, "mate-start", () => ({ session: startLeadConversation(who, principal, enabled, ceilingUsd, follow, now, scope) })).session);
         }
         const ceilingMicrousd = enabled.billing === "subscription" ? 0 : Math.round(ceilingUsd * 1_000_000);
         const termsDigest = createHash("sha256").update(`${ceilingMicrousd}\n${principal.ceilingDigest}`).digest("hex");
         const sessionId = store.mintLeadSession({ approver: who.name, approverGeneration: principal.generation, credentialKey: enabled.credentialKey, ceilingMicrousd, ceilingDigest: principal.ceilingDigest, termsDigest }, now);
-        // The thread the first message goes to (quiet page visits: a task's first message opens only the task's thread).
         const thread = store.openLeadThread(who.name, principal.ceilingDigest, now, scope).thread;
         if (follow)
             configureLeadFollow(store, principal, store.getLeadSession(sessionId), thread, true, now);
@@ -1431,15 +1114,10 @@ export function createDecisionServer(options) {
     }
     const CHAT_CANDIDATES_PER_APPROVER = 9;
     const CHAT_CANDIDATE_TTL_MS = 30 * 60_000;
-    /** The frozen explicit repo list, digested canonically (sorted) — every
-     * candidate binds to it and filing re-proves it (v2 new finding 5). */
     const chatCeilingDigest = (repos = managedRepos()) => createHash("sha256").update([...repos].sort().join("\n")).digest("hex");
-    /** The scripted lead answers only inside a demo database. */
     function demoLeadHere() {
         return options.demoLead !== undefined && store.isDemo() ? options.demoLead : null;
     }
-    /** Every condition re-proved per request — the render and the POST each
-     * ask again; nothing is cached into authority. */
     function chatEnablement() {
         if (store.isDemo())
             return { ok: false, code: "demo", why: "this is a demo database — chat cannot contact an external model" };
@@ -1472,13 +1150,6 @@ export function createDecisionServer(options) {
             return { ok: false, code: "no-key", why: `no ${config.provider} key — paste one below (stored 0600 beside the database, never in it), or export ${CHAT_KEY_ENV[config.provider]} in the serve environment` };
         return { ok: true, billing: "metered", config: config, key: key.key, keySource: key.source, price, credentialKey: credentialKeyOf(config.provider, key.key) };
     }
-    /**
-     * Where a chat key comes from, in priority order: the serve process
-     * environment, then the 0600 key file under the config directory (the
-     * Telegram bot-token precedent — settable from the console, never the
-     * database, never echoed whole). The file exists so onboarding lives
-     * in the UI; the environment exists so operators who prefer it keep it.
-     */
     function chatKeyFor(provider) {
         const fromEnv = chatEnv[CHAT_KEY_ENV[provider]];
         if (fromEnv !== undefined && fromEnv !== "")
@@ -1493,13 +1164,7 @@ export function createDecisionServer(options) {
             return null;
         }
     }
-    /** OpenRouter's live catalog, cached briefly: every selectable model
-     * arrives WITH the price the config will pin (operator request — the
-     * whole catalog, not a hand-pinned shortlist). null = no key or the
-     * catalog is unreachable; callers fall back to the compiled table. */
     let catalogCache = null;
-    /** The catalog as last fetched, for a page to show (docs/plans/get-side-effects.md): a page never fetches it. The
-     * background checks keep it current while an OpenRouter key is saved; saving a choice fetches it (chatCatalog). */
     function chatCatalogKnown() {
         return chatKeyFor("openrouter-api") === null ? null : catalogCache?.models ?? null;
     }
@@ -1525,11 +1190,6 @@ export function createDecisionServer(options) {
             clearTimeout(timer);
         }
     }
-    /**
-     * The palette's server-rendered index (attended review, finding 4): a
-     * non-executable JSON block on an already-authorized page — the same
-     * titles the page itself may render, bounded, saturation declared.
-     */
     function paletteIndexTag(project) {
         const admitted = project === null ? admissionList() : null;
         const entries = [
@@ -1559,15 +1219,6 @@ export function createDecisionServer(options) {
         const safeEntries = restricted() ? entries.filter(one => ["/tasks", "/tasks?view=needs-you", "/", "/tasks?view=board", "/flows", "/tasks?view=done", "/tasks?view=ready", "/runs", "/projects", "/ledger"].includes(one.href) || one.href.startsWith("/t/")) : entries;
         return jsonScript(saturated ? [...safeEntries, { label: "… more in Tasks", href: "/tasks" }] : safeEntries, { id: "palette-index" });
     }
-    /**
-     * The palette cache (arc 4, finding 6), and its honest contract: a
-     * render may be up to five seconds stale after OUT-OF-PROCESS changes;
-     * an accepted in-process mutation invalidates immediately (bustBadge),
-     * so "one query per five seconds" holds only between invalidations;
-     * and an OPEN page keeps its navigation-time snapshot until the next
-     * navigation — no refresh mechanism exists or is promised. The key
-     * carries the one configuration bit the entries vary by.
-     */
     const paletteCache = new Map();
     function paletteTagCached(project) {
         const actor = requestContext.getStore()?.actor;
@@ -1579,44 +1230,26 @@ export function createDecisionServer(options) {
         paletteCache.set(key, { at: Date.now(), tag });
         return tag;
     }
-    /**
-     * Every chromed HTML response leaves through here (arc 4, findings
-     * 5/18): one place owns the sensitivity call, the nonce, the palette
-     * index, the shortcuts overlay, script composition, and the CSP —
-     * at most one nonce-bearing script per response, connect-src only when
-     * that script fetches. The named exception: /fleet and /settings keep
-     * their FUNCTIONAL scripts beside credential fields (a poller and the
-     * push enrollment — neither reads the fields); the chrome additions
-     * are what sensitivity strips.
-     */
     function sendScreen(response, status, s) {
         requestContext.getStore()?.timeline?.mark("handler done; rendering");
-        // Sensitivity is the page as authored (cockpit §2, R14): its own explicit word, else a password field it was written
-        // with — judged before an identity-provider sign-in replaces that field, so an SSO step-up page stays sensitive.
         const authored = s.sensitive ?? (s.forceSensitive === true ||
             SENSITIVE_INPUT.test(htmlString(s.body)) ||
             (s.workspace?.pageHtml != null && SENSITIVE_INPUT.test(htmlString(s.workspace.pageHtml))) ||
             (s.chrome?.listPane !== undefined && SENSITIVE_INPUT.test(htmlString(s.chrome.listPane))));
-        // v100: signed in with the identity provider, a step-up's password field is that sign-in instead.
         const ssoFacts = requestContext.getStore()?.sso;
         if (ssoFacts !== undefined) {
             const back = requestContext.getStore()?.returnTo ?? "/";
-            // A typed-only proof (settings-kit.ts) stays a password field: its handler takes nothing else.
             s = { ...s, body: keepTypedFields(s.body, ssoStepUps, ssoFacts, back), ...(s.workspace?.pageHtml == null ? {} : { workspace: { ...s.workspace, pageHtml: keepTypedFields(s.workspace.pageHtml, ssoStepUps, ssoFacts, back) } }) };
             if (s.workspace?.view?.kind === "flow")
                 s = { ...s, workspace: { ...s.workspace, view: { ...s.workspace.view, stepUp: { label: ssoFacts.label, fresh: ssoFacts.fresh, confirmHref: `/login/sso?reauth=1&return=${encodeURIComponent(back)}` } } } };
         }
-        // Easy start: a local owner with no password has none to type: each step-up field says how to set one instead.
         const localStepUp = requestContext.getStore()?.localStepUp;
         if (localStepUp !== undefined) {
             s = { ...s, body: localOwnerStepUps(s.body, localStepUp), ...(s.workspace?.pageHtml == null ? {} : { workspace: { ...s.workspace, pageHtml: localOwnerStepUps(s.workspace.pageHtml, localStepUp) } }) };
         }
-        // D5: team chat (the central team service) is deprecated; /chat?team=1 still opens this release, but nothing links to it.
         const sensitive = authored || s.forceSensitive === true;
         const requestFacts = requestContext.getStore();
-        // Easy-start C2: while the browser mutation key is required, every page's one nonce'd script also fills the key.
         const keyFill = requestFacts?.keyFill === true ? KEY_FILL_SCRIPT : "";
-        // The settings frame (settings-kit.ts): its breadcrumb, for the shell and the workspace alike.
         if (s.chrome !== undefined && s.chrome.crumbs === undefined) {
             const crumbs = settingsCrumbs(new URL(requestFacts?.returnTo ?? '/', 'http://standing-orders.local').pathname, s.title, htmlString(s.body));
             if (crumbs !== undefined)
@@ -1628,8 +1261,6 @@ export function createDecisionServer(options) {
             path.searchParams.delete('request');
             const currentPath = path.pathname + path.search;
             path.searchParams.set('format', 'workspace');
-            // The legacy list pane (every task or build as links) duplicates the
-            // Crew panel and Tasks page; inside the workspace the page stands alone.
             const pageHtml = htmlString(s.body);
             const extras = s.workspace ?? {};
             const notices = [...(extras.notices ?? [])];
@@ -1643,7 +1274,6 @@ export function createDecisionServer(options) {
             try {
                 const project = s.chrome.active === 'chat' ? null : s.chrome.project;
                 crew = extras.team?.tasks ? browserCrewFromIndex(extras.team.tasks, extras.team.selected?.id) : requestFacts.workCrew?.project === project ? browserCrewFromIndex(requestFacts.workCrew.page)
-                    // The reader's own lead's claims read "<name> is on it" here too.
                     : (() => {
                         const access = { principal: 'operator', repos: managedRepos(), includeUnplaced: false, viewer: requestFacts.actor ?? null };
                         return chromeRead(`crew\u0000${accessKey(access)}\u0000${project ?? ''}`, () => browserCrewOf(store, clock(), access, { evidenceRoot, project }));
@@ -1652,7 +1282,6 @@ export function createDecisionServer(options) {
             catch {
                 notices.push('Crew updates are unavailable. Open Tasks to inspect saved work.');
             }
-            // A running row says what its agent did last, and when (the task page's own line).
             try {
                 const now = clock(), live = new Map();
                 if (crew.crew.length > 0)
@@ -1664,14 +1293,9 @@ export function createDecisionServer(options) {
                 if (live.size > 0)
                     crew = { ...crew, crew: crew.crew.map(item => { const activity = live.get(item.id); return activity === undefined ? item : { ...item, activity }; }) };
             }
-            catch { /* the rows keep their status; the line returns on the next read */ }
-            // "Wake me only for these": the navigation carries the sidebar's own
-            // Tasks count (chromeFor) and links to the project view it covers, so
-            // it matches that page's Needs you tab on every screen.
+            catch { }
             const needsYou = s.chrome.inboxCount;
             const tasksProject = s.chrome.inboxProject === undefined ? s.chrome.project : s.chrome.inboxProject;
-            // The person's own project and task conversations (v77), for the
-            // sidebar's chat list; a thread whose project is out of view is left out.
             let chats = [];
             try {
                 const actor = requestFacts.actor ?? '';
@@ -1694,31 +1318,18 @@ export function createDecisionServer(options) {
             }
             const conversation = extras.conversation ?? null;
             const request = requestFacts.workspaceRequest;
-            // React owns the conversation and its refresh/draft lifecycle. Native
-            // guarded forms keep their current behavior after React inserts them.
-            // A page with its own view keeps its script; the chat page runs the result script.
-            // The exact page script the document would run: the JSON arm and the document arm read this one value.
             const ownScript = conversation === null || extras.view;
             const pageScript = ownScript ? (s.functional?.script ?? '') : RESULT_REVIEW_SCRIPT;
             const routeInPlace = inPlaceRoute(requestFacts.routeId, path);
-            // The app runs the page's behaviour itself (docs/plans/task-page-in-app.md §2) only when all of these hold: the
-            // app covers the WHOLE script, no password field (a password page keeps its string path), an in-place route, and a
-            // reader that can run it: a document load (its bundle is this server's, served no-store) or a workspace read that
-            // says so. Anything else is the page exactly as before: the string, no work, a document.
             const covered = ownScript ? s.functional?.app : undefined;
             const work = pageScript !== '' && covered !== undefined && covered.length > 0 && !sensitive && routeInPlace
                 && (!requestFacts.workspaceRead || requestFacts.appWork === true) ? covered : null;
             const functional = work === null ? pageScript : '';
-            // May replace another page without a document load (live-pages-and-home.md A1.1): an allowlisted route, no password
-            // field, no page script (a page script runs once per document, so its page always loads as one).
             const inPlace = routeInPlace && !sensitive && functional === '';
             const workspace = {
                 version: 1, path: currentPath, title: s.title, user: requestFacts.actor ?? '', csrf: requestFacts.csrf, sensitive, inPlace,
                 ...(work === null ? {} : { work }),
-                // Said on the document that ships it: this document's page script listens for as long as the document lives.
                 ...(functional !== '' && !requestFacts.workspaceRead ? { scripted: true } : {}),
-                // The project picker names the open project; the settings frame carries its breadcrumb.
-                // Only a project this person may see now: never the raw saved path (settings-kit.ts openProjectFor).
                 openProject: openProjectFor(requestFacts.openProject ?? null, s.chrome.project, s.chrome.projects ?? []),
                 ...(s.chrome.crumbs === undefined ? {} : { crumbs: s.chrome.crumbs }),
                 ...(requestFacts.passwordless === true ? { passwordless: true } : {}),
@@ -1727,7 +1338,6 @@ export function createDecisionServer(options) {
                 receipt: conversation !== null && request && REQUEST_TOKEN.test(request)
                     ? { request, received: store.leadRequestReceived(conversation.sessionId, request) } : null,
                 projects: browserProjectsOf(s.chrome.projects ?? []), ...crew,
-                // The sidebar's project states: never on a sensitive page (no rail, no summary stream there).
                 ...(() => { if (sensitive)
                     return {}; try {
                     return { projectStates: projectSummary() };
@@ -1735,7 +1345,6 @@ export function createDecisionServer(options) {
                 catch {
                     return {};
                 } })(),
-                // Cockpit B2: the remembered password's chip, only where it could be used (a direct local request).
                 ...(() => {
                     const facts = freshFacts.getStore();
                     if (sensitive || facts == null || !facts.local || !facts.live())
@@ -1746,10 +1355,9 @@ export function createDecisionServer(options) {
                     const left = FRESH_WINDOW_MS - (Date.now() - at);
                     return left <= 0 ? {} : { fresh: { minutes: Math.max(1, Math.ceil(left / 60_000)), forget: '/session/forget-password' } };
                 })(),
-                // The usage chip: the Limits view's own audience (an operator on a browser session), never a sensitive page.
                 ...(() => {
                     const actor = requestFacts.actor;
-                    if (sensitive || !actor || requestFacts.csrf === '' || !store.isInstanceOperator(actor))
+                    if (sensitive || !actor || requestFacts.csrf === '' || requestFacts.advanced === false || !store.isInstanceOperator(actor))
                         return {};
                     try {
                         const usage = usageChipOf(store.providerLimits(), clock());
@@ -1763,15 +1371,12 @@ export function createDecisionServer(options) {
                 catchUpHtml: extras.catchUpHtml === undefined ? '' : htmlString(extras.catchUpHtml), controlsHtml: extras.controlsHtml === undefined ? '' : htmlString(extras.controlsHtml), notices, view: extras.view ?? null,
                 ...(s.chrome.demo ? { demo: { text: DEMO_BANNER, short: DEMO_BANNER_SHORT } } : {}),
                 pageHtml: extras.pageHtml === undefined ? (conversation === null ? pageHtml : null) : extras.pageHtml === null ? null : htmlString(extras.pageHtml),
-                navigation: browserNavigationOf(currentPath, s.chrome.project, needsYou, tasksProject, s.chrome.inboxLabel),
-                // The one Needs-you count (tasks only), with the scope it covers: the Tasks list's own count for this project
-                // view (or every project), so the rail, the phone header and Home all read the same number.
+                navigation: browserNavigationOf(currentPath, s.chrome.project, needsYou, tasksProject, s.chrome.inboxLabel, requestFacts.advanced !== false),
+                ...(requestFacts.advanced === false ? { advanced: false } : {}),
                 needsYou: { count: needsYou, saturated: s.chrome.inboxSaturated === true, scope: tasksProject ?? null,
                     label: s.chrome.inboxLabel ?? `${needsYou} ${needsYou === 1 ? 'needs' : 'need'} you`,
-                    // Every project, said by name (all=1), so a session's own open project never narrows the list the count opens.
                     href: tasksProject === null ? '/tasks?scope=all&view=needs-you' : `/tasks?project=${encodeURIComponent(tasksProject)}&view=needs-you` },
                 chats,
-                // The same count per project (the rail's project rows), read from the same work index totals.
                 ...(() => { if (sensitive)
                     return {}; try {
                     return { needsYouByProject: projectCounts(clock()).map(one => ({ path: one.repo, count: one.totals['needs-you'] })) };
@@ -1785,7 +1390,6 @@ export function createDecisionServer(options) {
                 ...(extras.firstRun === undefined ? {} : { firstRun: extras.firstRun }),
                 ...(extras.phone === undefined ? {} : { phone: extras.phone }),
                 ...(extras.home == null ? {} : { home: extras.home }),
-                // Easy-start C2: this tab's key is from an earlier start (or it has none): one way to reconnect.
                 ...(requestFacts.reconnect == null ? {} : { reconnect: requestFacts.reconnect }),
             };
             if (requestFacts.workspaceRead) {
@@ -1795,9 +1399,6 @@ export function createDecisionServer(options) {
                     response.setHeader('ETag', validator.etag);
                 }
                 const body = JSON.stringify(workspace);
-                // Every other page's re-read after a live `change` (chat keeps its own validator, and its receipt, task and
-                // result reads none): when what it renders now is exactly what the page holds, it hears 304 and keeps its view
-                // (no transfer, no re-render).
                 if (status === 200 && validator === undefined && path.pathname !== '/chat') {
                     const etag = '"w' + createHash('sha256').update(body).digest('base64url') + '"';
                     response.setHeader('ETag', etag);
@@ -1808,14 +1409,8 @@ export function createDecisionServer(options) {
             }
             const nonce = randomBytes(16).toString('base64');
             const document = shell(s.title, s.body, { chrome: s.chrome, sensitive });
-            // The keys and their list (keymap.ts) work here as on every chromed page; the list sits beside the app React owns.
-            // A sensitive page keeps to its own script.
             return page(response, status, browserWorkspaceDocument(document, workspace, nonce, functional + MOBILE_VIEWPORT_SCRIPT + keyFill + (sensitive ? '' : chromeScript()), sensitive ? html `` : KBD_HELP), nonce, true);
         }
-        // A one-time secret on screen (a token, an invite link, a pairing code): the
-        // page carries no script of any kind, so it leaves the workspace for a
-        // focused page in the same look: the brand, the one card, and the way back.
-        // Easy-start C2: but for the key fill when it has a form that posts (the fill reads nothing on the page).
         if (s.forceSensitive === true) {
             if (keyFill === "" || !/<form\b[^>]*method="post"/i.test(htmlString(s.body)))
                 return page(response, status, focusDocument(s.title, s.body));
@@ -1824,10 +1419,7 @@ export function createDecisionServer(options) {
         }
         const chromeLayer = !sensitive && s.chrome !== undefined;
         const functional = s.functional?.script ?? "";
-        // Sensitive pages strip the palette and keys but keep the sidebar toggle.
         const sensitiveChrome = sensitive && s.chrome !== undefined ? sidebarScript() : "";
-        // Kit markup the workspace bundle would have wired (a composer, an overlay, a switch, an idea) gets the kit's own small
-        // behaviour here (kit-standalone.ts); never on a sensitive page, which carries no chrome additions.
         const kitBehavior = chromeLayer && KIT_BEHAVIOR_MARKUP.test(htmlString(s.body)) ? KIT_STANDALONE_SCRIPT : "";
         const script = functional + (chromeLayer ? chromeScript() + WORKSPACE_MOTION_SCRIPT + kitBehavior : sensitiveChrome) + keyFill;
         const nonce = script === "" ? undefined : randomBytes(16).toString("base64");
@@ -1841,23 +1433,14 @@ export function createDecisionServer(options) {
             ...(s.refreshSeconds === undefined ? {} : { refreshSeconds: s.refreshSeconds }),
             ...(nonce === undefined ? {} : { live: { nonce, script, fallbackRefresh: s.functional?.fetches === true } }),
         });
-        // Pages that ship the chrome layer keep connect-src (v28 granted it for
-        // the since-removed watched-session beat), beside pages whose own
-        // functional script polls.
         return page(response, status, document, nonce, s.functional?.fetches === true || chromeLayer || sensitiveChrome !== "");
     }
-    /** The needs-you count every surface wears, read from this request's own
-     * Work counts (one read per request, kept only while the workspace revision
-     * it was read at stands), so a live page's badge and its Needs you tab
-     * always agree. */
     function needsYouBadge(project) {
         return needsYouCount(project);
     }
     const bustBadge = () => {
         paletteCache.clear();
     };
-    /** Enrolled projects first (most recently opened), then the repos this server was told to serve that nobody has
-     * opened yet — the switcher lists every project it is allowed to show, each exactly once. */
     function sidebarProjects() {
         const seen = new Set();
         const rows = [];
@@ -1872,33 +1455,21 @@ export function createDecisionServer(options) {
         }
         return rows;
     }
-    /** The sidebar's projects with their states (agent-state.ts), for the request's own reader: the page's first read
-     * and the summary room's snapshots are this one function, so the two never disagree. Never marks anything seen.
-     * Work with no project yet is its own entry when this reader may see it and something counts there. */
     function projectSummary() {
         const projects = sidebarProjects();
         const actor = requestContext.getStore()?.actor ?? '';
         const access = workAccess();
         return chromeRead(summaryKey(actor, access, projects), () => projectSummaryOf(store, clock(), access, actor, projects, evidenceRoot));
     }
-    /** What one account may see now, as the summary room keys it: a narrowed ceiling or grant is a different key, so a
-     * snapshot read for the wider scope never reaches it. Null: no such account. */
     const projectScopeFor = (account) => store.accountOf(account) === null ? null : requestContext.run({ csrf: '', returnTo: '/', actor: account }, () => {
-        // Canonical: what may be seen, never the order it was last opened in.
         const access = workAccess();
         return JSON.stringify({ projects: sidebarProjects().map(one => one.path).sort(), access: { ...access, repos: access.repos === null ? null : [...access.repos].sort() } });
     });
-    /** One account's summary snapshot, read as that account for this exact scope (the summary room's fingerprint): null
-     * when the account is gone or its scope moved. */
     const projectSummaryFor = (account, scope) => projectScopeFor(account) !== scope ? null : requestContext.run({ csrf: '', returnTo: '/', actor: account }, () => JSON.stringify(projectSummary()));
-    /** The sidebar's facts for this request. */
     function chromeFor(project, active, listPane, scope) {
         if (restricted() && !visible(project))
             project = null;
         const actor = requestContext.getStore()?.actor;
-        // One Tasks count per request: Needs you in the request's project view
-        // (the open project, else every admitted project), never the page's own
-        // project — a flow or task in another project shows the same number.
         const lens = requestContext.getStore()?.lens;
         const inboxProject = lens !== undefined && (!restricted() || visible(lens)) ? lens : project;
         const badge = needsYouBadge(inboxProject);
@@ -1910,7 +1481,6 @@ export function createDecisionServer(options) {
                 projectPeek = projectFamilyPeek(project, clock());
             }
             catch {
-                // Chrome is orientation, never a reason to fail the actual screen.
                 projectPeek = undefined;
             }
         }
@@ -1921,9 +1491,6 @@ export function createDecisionServer(options) {
             project,
             projectScoped: restricted(),
             ...(projectPeek === undefined ? {} : { projectPeek }),
-            // Enrolled projects first (most recently opened), then the repos this
-            // server was told to serve that nobody has opened yet — the switcher
-            // lists every project it is allowed to show, each exactly once.
             projects: sidebarProjects(),
             ...(facts === undefined ? {} : { csrf: facts.csrf, returnTo: facts.returnTo }),
             inboxCount: badge.count,
@@ -1935,7 +1502,6 @@ export function createDecisionServer(options) {
             ...(store.isDemo() ? { demo: true } : {}),
             ...(() => { const signIn = signInNotices(store); return signIn.length === 0 ? {} : { signIn }; })(),
             ...(() => {
-                // Operators only (only someone at this computer can update it), and gone once this version is dismissed.
                 if (!facts?.csrf || !actor || !store.isInstanceOperator(actor))
                     return {};
                 const update = updateFacts();
@@ -1945,7 +1511,6 @@ export function createDecisionServer(options) {
             })(),
             ...(() => {
                 const databaseFile = store.databaseFile();
-                // Settings → Updates says a `toolroll update` in full; every other page (and the app's update everywhere) names it once.
                 if (!actor || databaseFile === null || !store.isInstanceOperator(actor))
                     return {};
                 const waiting = waitingUpdate(databaseFile, run => store.stopQuiescenceProblem(run) !== null, clock());
@@ -1960,15 +1525,11 @@ export function createDecisionServer(options) {
                     },
                 }),
             ...(!restricted() && !unscopedMode && managedRepos().length > 0 ? { chat: true } : {}),
-            // Live terminals: offered to an installation-wide operator (the routes prove it again).
             ...(actor !== undefined && !store.isDemo() && store.isInstanceOperator(actor) ? { code: true } : {}),
             ...(listPane === undefined ? {} : { listPane }),
             ...(scope === undefined ? {} : { scope }),
         };
     }
-    // All project counts are read together, at most once per workspace revision
-    // for this reader's access. No task artifacts or processes are inspected to
-    // paint a badge or a project switcher.
     function projectCounts(now) {
         const facts = requestContext.getStore();
         if (facts?.workCounts !== undefined)
@@ -1984,16 +1545,11 @@ export function createDecisionServer(options) {
             .reduce((sum, one) => sum + one.totals['needs-you'], 0);
         return { count, saturated: false };
     }
-    /** One work index page for an already-admitted reader, through the chrome cache: a whole view the chat landing reads
-     * on every refresh. */
     function sharedIndexPage(access, options) {
-        // Receipt reconciliation, task and result reads always read work afresh (disk state included).
         if (requestContext.getStore()?.freshWork === true)
             return workIndexPage(store, clock(), access, options);
         return chromeRead(indexKey(access, options), () => workIndexPage(store, clock(), access, options));
     }
-    /** A chrome read for this request: what it already read (its prefetch included) stands for the whole request, else
-     * the revision cache's value, else `compute()` now. */
     function chromeRead(key, compute) {
         const facts = requestContext.getStore();
         const held = facts?.chromeReads?.get(key);
@@ -2004,23 +1560,16 @@ export function createDecisionServer(options) {
             (facts.chromeReads ??= new Map()).set(key, value);
         return value;
     }
-    /** The chat landing's three whole views (chat.ts chatHomeOf), as it asks for them. */
     const chatHomeViews = () => ["all", "needs-you", "completed"]
         .map(view => ({ view, limit: WORK_INDEX_MAX_LIMIT, ...(evidenceRoot === undefined ? {} : { root: evidenceRoot }) }));
-    /** Pages that wear the chrome (the sidebar's states and the Tasks count). */
     const CHROME_PAGES = new Set(["home", "work", "board", "agents", "agents.live", "task.page", "run.page", "chat.page", "review", "tasks", "inbox",
         "next", "done", "projects.page", "flows.page", "flow.page", "settings.page", "decision.page", "menu"]);
-    /** Before a chromed page renders: its chrome reads (and the chat landing's views) run on a read worker, so the
-     * request thread finds them cached instead of computing them. The reader is the one this request admitted; the keys
-     * carry its exact access (console-chrome.ts). Without a worker, or when one fails, the page computes them as before. */
     async function prefetchChrome(route, url, who) {
         if (reads === null || who.via !== "cookie" || !CHROME_PAGES.has(route.id))
             return;
         try {
             const actor = requestContext.getStore()?.actor ?? "";
             const access = workAccess(), projects = sidebarProjects(), now = clock();
-            // Populate only the revision cache. Each answer must still pass its revision/expiry check when rendering:
-            // another job can remain pending while an earlier answer's approval or Needs-you state changes.
             const fill = async (key, read) => { await chromeReads.fill(key, read); };
             const jobs = [
                 fill(countsKey(access), () => reads.workCounts(now, access)),
@@ -2030,7 +1579,6 @@ export function createDecisionServer(options) {
                 if (!["project", "room", "team"].some(name => url.searchParams.has(name)) && requestContext.getStore()?.freshWork !== true)
                     for (const options of chatHomeViews())
                         jobs.push(fill(indexKey(access, options), () => reads.workIndexPage(now, access, options)));
-                // The conversation's briefing (chat.ts: the fleet snapshot's states), read as chat reads it.
                 const repos = managedRepos();
                 if (repos.length > 0 && requestContext.getStore()?.freshWork !== true) {
                     const fleet = { principal: "operator", repos, includeUnplaced: false, viewer: who.name };
@@ -2040,26 +1588,15 @@ export function createDecisionServer(options) {
             }
             await Promise.all(jobs);
         }
-        catch { /* the page computes what is missing */ }
+        catch { }
     }
-    /** A live page's own beat without a docked chat: 10 s while any admitted task is building, else 30 s. */
     function liveRefreshSeconds() {
         return projectCounts(clock()).some(one => one.totals.running > 0) ? 10 : 30;
     }
-    /** This exact run's review facts for the shared projection (review
-     * fixes, finding 4): the store's bounded retry projection plus the live
-     * reviewer's own liveness — read per run, so an older selected result
-     * never wears a newer run's review. */
     const reviewFactsFor = (runId) => reviewFactsOf(store.reviewRetryStateOf(runId), runner => {
         const one = store.getRunner(runner)?.runner;
         return one !== undefined && runnerAlive(one, clock());
     }, buildReviewOf(store, runId)?.state === "pending");
-    // ---- the live peek (A2; three review rounds' findings are the spec) ----
-    //
-    // Names and counts only, never content; nothing durable, ever. The cache
-    // holds finished ESCAPED fragments keyed by run:base:epoch — the epoch
-    // rotates with every lease AND release, so a stale entry's key can never
-    // be asked for again; hits still re-prove the whole guard list.
     const peekCache = new Map();
     let peekCacheBytes = 0;
     const peekInFlight = new Map();
@@ -2078,39 +1615,24 @@ export function createDecisionServer(options) {
             peekCacheBytes -= entry.bytes;
         }
     };
-    /** One typed sentence inside the region — plain words, no raw errors.
-     * `final` marks conditions that cannot heal for this run (finished,
-     * superseded, wrong machine): the region poller reads the marker and
-     * stops, instead of refetching a dead build every beat forever. */
     const peekSay = (message, final = false) => html `<p class="meta"${final ? html ` data-region-stop` : ""}>${message}</p>`;
-    /** The sanitize pipeline (finding 30/35): normalize → mask → escape. */
     const peekName = (path) => {
         const normalized = path.replace(/[\u0000-\u001f\u007f]/g, "");
         const masked = scanForSecrets(normalized).length > 0 ? "[redacted: a credential-shaped name]" : normalized;
         return textHtml(masked);
     };
     async function handlePost(route, url, who, request, response, posted) {
-        // Every POST passes the shared mutation guard. Caller, scope, project (including a limited account's posted repo)
-        // and role were admitted by the route table.
         const denied = authorizeMutation(request, who, readForm(posted, CONSOLE_FORMS.mutationGuard));
         if (denied !== null)
             return refuse(response, who, denied.status, denied.message, "/", denied.reconnect?.kind === "password" ? { label: "Reconnect", href: denied.reconnect.href } : undefined);
-        // Standing can change after a token was minted: a viewer's act stays refused, cookie and bearer alike, except
-        // the row's session-local acts.
         if (who.role === "viewer" && !route.viewer)
             return refuse(response, who, 403, "your login can watch, not act — ask an approver to upgrade you");
         const now = clock();
-        // Any accepted mutation may change what the inbox owes; the badge
-        // re-counts within five seconds either way, this just makes it exact.
         bustBadge();
         return dispatchConsole(route, { url, who, request, response, route, now, project: projectOf(who, request) ?? null, chosenProject: projectOf(who, request) ?? null, posted });
     }
-    // Only explicitly authorized conversations receive automatic turns. The
-    // deterministic scan is idle without new meaningful work; shutdown drains it.
     let leadMaintenance = null;
     let leadClosing = false;
-    // Started in the console's folder scope (folder-gate.ts), so their own timers and the personal queue's kick (which
-    // restores the context it was started in, never a request's) read folders as the console's work does.
     server.once('listening', () => consoleFolders(options, identities, () => {
         team.start();
         personalQueue.start();
@@ -2118,23 +1640,17 @@ export function createDecisionServer(options) {
             run: () => runLeadFollowPass({ store, repos: managedRepos, evidenceRoot, clock,
                 provider: () => { const enabled = chatEnablement(); return enabled.ok ? { config: enabled.config, key: enabled.key } : null; },
                 fetcher: chatFetcher, ...(options.subscriptionChatRunner ? { subscriptionRunner: options.subscriptionChatRunner } : {}) }),
-            // Pending delivery is durable and is read again on the next pass; a failure is said where follow status is read.
             onError: error => recordLeadFollowFailure(store, error, clock()),
         });
     }));
-    // Background checks (docs/plans/get-side-effects.md): what pages show about this computer's agent sign-ins and the
-    // services Toolroll uses is asked here, on a timer, and a page reads the last answer. A page visit never starts a
-    // process or a network call, and never acts on what a check finds: lifting a sign-in pause and the lead-by-default
-    // rule run from this pass (or a person's Check now), not from a GET.
     let backgroundChecks = null;
     let agentsCheckedAt = 0;
     if (options.backgroundChecks === true)
         server.once('listening', () => {
-            // This Toolroll's folder for secrets, checked once now, so a page can read which are set without preparing it.
             try {
                 secretFolder();
             }
-            catch { /* a page says secrets can't be read; the next action reports why */ }
+            catch { }
             backgroundChecks = startMaintenance({ intervalMs: options.backgroundChecksMs ?? BACKGROUND_CHECKS_MS, shouldStop: () => leadClosing,
                 run: () => consoleFolders(options, identities, async () => {
                     const now = Date.now();
@@ -2142,11 +1658,9 @@ export function createDecisionServer(options) {
                     if (now - agentsCheckedAt >= (options.backgroundChecksMs ?? LOCAL_AGENTS_EVERY_MS)) {
                         agentsCheckedAt = now;
                         waits.push(checkLocalAgents());
-                        // The other agents Settings lists: their last answer is what the page shows.
                         for (const provider of PROVIDER_IDS.filter(isKeyedProvider).filter(one => one !== "claude" && one !== "codex"))
                             waits.push(connectionCheck(provider).catch(() => undefined));
                     }
-                    // Project identities, resolved off the thread: what pages asked about, and answers gone stale.
                     waits.push(identities.refresh([...configuredPaths, ...exactRepos(), ...(options.currentRepos?.() ?? []), ...store.listProjects().map(one => one.path), ...store.knownRepos()]));
                     integrations.refreshIfDue();
                     const sso = ssoSettings();
@@ -2155,28 +1669,22 @@ export function createDecisionServer(options) {
                     if (chatKeyFor("openrouter-api") !== null)
                         waits.push(chatCatalog());
                     const openrouter = readProviderKey("openrouter", providerHome);
-                    // The cache answers until its list is due again (ten minutes, or 30 s after a failure), then fetches.
                     if (openrouter !== null)
                         waits.push(modelCatalog(openrouter));
-                    // What used to be closed by whichever page read it first: an operating mode or a flow's "runs on its own"
-                    // grant past its expiry, a stalled update, old coordinator proposals. (Lead turns past their deadline are the
-                    // follow pass's, which settles them even while an update drains.)
                     const at = clock();
                     store.closeExpiredModes(at);
                     closeExpiredUnattendedGrants(store, at);
                     store.sweepCoordinatorProposals(at);
-                    // The demo's scripted story, if a beat timer missed (its pages only read it).
                     try {
                         options.demoLead?.advance(at);
                     }
-                    catch { /* the next pass tries again */ }
+                    catch { }
                     const databaseFile = store.databaseFile();
                     if (databaseFile !== null && !updateChecksOff(process.env, options.configDir ?? dirname(databaseFile)).off) {
                         const last = lastChecks.known("release");
                         if (lastChecks.due("release", last !== null && "problem" in last.value ? 60_000 : 15 * 60_000))
                             waits.push(checkRelease());
                     }
-                    // Chat's first tasks (issues and TODOs) while the first run is open and nothing is filed yet.
                     if (firstRunStepsNow(clock()) !== null && !store.hasAnyWork()) {
                         for (const repo of managedRepos()) {
                             const entry = firstTasks.get(repo);
@@ -2184,18 +1692,11 @@ export function createDecisionServer(options) {
                                 continue;
                             const reading = { until: Date.now() + 10 * 60_000, found: entry?.found ?? null, reading: true };
                             firstTasks.set(repo, reading);
-                            // A test's runner reads in-process; otherwise in a process of its own (learning-look.ts), so the hardened
-                            // git's synchronous reads of the project's folder never hold the console's thread.
                             waits.push((options.firstTaskRunner !== undefined ? findFirstTasks(repo, options.firstTaskRunner) : firstTasksOffThread(repo)).then(found => { reading.found = found; }, () => { }).finally(() => { reading.reading = false; }));
                         }
                     }
-                    // Learning recovered from reviewed runs (and a project's saved rows carried to its current identity), which
-                    // Settings → Learning and Knowledge used to do as they opened.
                     if (lastChecks.due("learning", 10 * 60_000)) {
                         waits.push(lastChecks.run("learning", async () => {
-                            // Its reads of each project's Git folder are synchronous, so with a database file they run in a process of
-                            // their own (learning-look.ts): a folder that doesn't answer costs its own recovery, never the console. An
-                            // in-memory database (a test) can't be shared, so it is read here.
                             if (databaseFile !== null) {
                                 await recoverLearningOffThread({ databaseFile, evidenceRoot, repos: managedRepos() }, options.learningRunner === undefined ? {} : { runner: options.learningRunner });
                                 return;
@@ -2204,17 +1705,15 @@ export function createDecisionServer(options) {
                                 try {
                                     acceptedIdentities(store, repo);
                                 }
-                                catch { /* the next pass tries again */ }
+                                catch { }
                                 try {
                                     recoverLearning(store, evidenceRoot, repo);
                                 }
-                                catch { /* the next pass tries again */ }
+                                catch { }
                             }
                         }));
                     }
-                    // What Codex has configured, per project, for Settings → Tools to offer.
                     for (const repo of managedRepos()) {
-                        // The project's own .mcp.json, read off the console's thread (folder-look.ts) for the Tools page and the lead.
                         if (options.identities !== undefined && lastChecks.due(`project-mcp:${repo}`, 10 * 60_000)) {
                             waits.push(lastChecks.run(`project-mcp:${repo}`, async () => { const looked = await lookProjectMcp(repo); if (looked.ok)
                                 savedProjectMcp.set(repo, looked.value); return looked.ok; }));
@@ -2225,25 +1724,17 @@ export function createDecisionServer(options) {
                     if (databaseFile !== null && lastChecks.due("storage", 30 * 60_000)) {
                         waits.push(lastChecks.run("storage", () => checkoutPlan(store, storagePool(databaseFile), clock(), { manual: true })));
                     }
-                    // The same reading the chrome does, outside a page visit, so it releases a stalled `toolroll update` and a stalled
-                    // desktop update in every folder the chrome looks in.
                     if (databaseFile !== null) {
                         try {
                             waitingUpdate(databaseFile, run => store.stopQuiescenceProblem(run) !== null, at);
                         }
-                        catch { /* shown as last saved */ }
+                        catch { }
                     }
                     await Promise.all(waits);
                 }),
                 onError: () => { }, });
             void backgroundChecks.runNow();
         });
-    // Keep native process custody until shutdown has verified agent/tool exit.
-    // Coding custody does not depend on subagents or the lead's follow pass, so
-    // it closes at once and never waits behind a model turn: a stop must release
-    // the owner record well inside the service's exit window (Oct 2: deploys
-    // over 0.9.11 found it still held by a killed process).
-    /** Set once the terminal handlers exist (below): drops every socket and ends every program. */
     const terminalClosing = {};
     let codingClosing = null;
     const closeCoding = () => {
@@ -2260,14 +1751,13 @@ export function createDecisionServer(options) {
         try {
             requestBudget.flush();
         }
-        catch { /* saved again on the close event when it can be */ }
+        catch { }
         flowRooms.close();
         taskRooms.close();
         liveHandlers.close();
         detachReads();
         liveFollower.close();
         void Promise.all([closeCoding(), terminalClosing.close?.().then(problem => { terminalClosing.problem = problem; }), bounded(team.close()), bounded(personalQueue.close()), bounded(leadMaintenance?.stop()), bounded(backgroundChecks?.stop()), bounded(reads?.close())])
-            // The server always closes; a terminal whose processes couldn't be proved stopped is the close's error.
             .then(() => closeServer(error => callback?.(error ?? terminalClosing.problem ?? undefined))).catch(error => {
             if (callback)
                 callback(error instanceof Error ? error : Error('Coding session shutdown failed.'));
@@ -2465,7 +1955,6 @@ export function createDecisionServer(options) {
     };
     const liveHandlers = createLiveHandlers(handlerRuntime, { bus: liveBus, workspaceRevision, chatProjectOf: chatHandlers.chatProjectOf, projectSummaryFor, projectScopeFor });
     liveTurnStarted = liveHandlers.turnStarted;
-    // The one upgrade this server takes is a terminal's socket (terminals.ts listens); anything else is dropped.
     const terminalHandlers = createTerminalHandlers(handlerRuntime, { ...terminals, bus: liveBus, allowedHost, publicOrigin, forwardedSourceOf, server });
     terminalClosing.close = terminalHandlers.close;
     const remoteHandlers = createRemoteHandlers(remoteRuntime);
@@ -2475,7 +1964,6 @@ export function createDecisionServer(options) {
         ...remoteHandlers.registrations, ...liveHandlers.registrations, ...terminalHandlers.registrations, ...createSweepHandlers(handlerRuntime).registrations,
         ...createWelcomeHandlers(handlerRuntime).registrations,
     ]);
-    /** The row's role, after admission and before its one handler. */
     function dispatchConsole(route, ctx) {
         const { who, response } = ctx;
         const held = route.role === "any" || ((!route.roleBrowser || who.via === "cookie") &&
@@ -2498,8 +1986,6 @@ export function createDecisionServer(options) {
         }
         return withEdgePolicy(route, () => registry.edge(route, { ...ctx, route }));
     }
-    /** Easy-start C1: the local owner a browser session acts as on an allowed row, bound to its session's saved row and
-     * the generations it was made under; null when it no longer stands (refused like any other row). */
     function localPrincipalOf(who, route) {
         const sessionHash = sessions.hashOf(who.session);
         if (route.localAct === null || who.session.localGeneration === null || sessionHash === null)
@@ -2508,17 +1994,13 @@ export function createDecisionServer(options) {
             transport: "browser", act: route.localAct, sessionHash, request: { ended: false } };
         return localOwnerStandsNow(store, principal) ? principal : null;
     }
-    /** What a local owner hears on a row not marked for it: set a first password, or sign in with the one set. */
     function refuseLocalOwner(response, who, method, url, accept) {
-        // The page it was refused on, built here from the request (never from a header): a form's nearest page above it.
         const words = localOwnerRefusal(store.accountOf(who.name)?.passwordSet === true, refusalNext(method, url));
-        // Which refusal this was, for the shell (it offers the same way on) and the route inventory's rule table.
         response.setHeader("x-toolroll-refused", "local-owner");
         if (String(accept ?? "").includes("application/json"))
             return respond(response, 403, "application/json", JSON.stringify({ ok: false, said: words.message, href: words.href }));
         return refuse(response, who, 403, words.message, words.href, { label: words.action, href: words.href });
     }
-    // Defined last, so the reviewed functions above keep their places (password-freshness.test.ts).
     function holdSignInLink(link) {
         for (const [key, one] of signInLinks)
             if (one.expires < Date.now())
@@ -2529,8 +2011,6 @@ export function createDecisionServer(options) {
         signInLinks.set(linkKey(code), link);
         return `${SIGN_IN_LINK_PATH}${code}`;
     }
-    /** Easy-start C4: a local owner's one-time link. It names no account: local mode's own owner, read now, while local
-     * mode is on and the owner is active. Redemption reads local mode again and issues only a local-owner session. */
     function mintLocalLink() {
         const binding = localOwnerBinding(store);
         if (binding === null)
@@ -2547,12 +2027,6 @@ export { ssoStepUps, wrongHostPage } from "./server/render-people.js";
 export { diffFileAnchor, editorFileHref, needActionOf, orderChangedFiles, plainConclusionOf, rankReviewQueue, reviewFilePriority, reviewPriorityOf, runFactsFragment, withinSignedTouches } from "./server/render-results.js";
 export { decisionAnswerScript, earlierVersionsWords, revisionLineageWords } from "./server/render-tasks.js";
 export { SIGN_IN_LINK_MS, SIGN_IN_LINK_PATH } from "./server/session.js";
-/**
- * The console's configured repos and roots. Without identities (embedders and tests) they resolve once, synchronously,
- * as before. With them, the console resolves them in the background after it listens (operate.ts startConsole), so
- * each is read from the last answer: a configured path counts by its real path from the moment its folder answers,
- * and until then only by its spelling, which the strict `canon` never matches for an unresolved row.
- */
 function startupCeiling(repos, roots, identities, canon) {
     const configured = repos.length > 0 || roots.length > 0;
     const configuredPaths = [...repos, ...roots];
@@ -2566,8 +2040,6 @@ function startupCeiling(repos, roots, identities, canon) {
             configuredPaths,
         };
     }
-    // Only resolved entries authorize: an unresolved configured path is in no list, so it matches nothing (not even its
-    // own spelling) and is no session's default until its folder answers.
     const resolved = (paths) => [...new Set(paths.flatMap(path => { const real = identities.known(path); return typeof real === "string" ? [real] : []; }))];
     const ceiling = {
         get repos() { return resolved(repos); },
@@ -2582,14 +2054,7 @@ function startupCeiling(repos, roots, identities, canon) {
         configuredPaths,
     };
 }
-/** Each console's folder gate (folder-gate.ts), made once for its options. */
 const consoleGates = new WeakMap();
-/**
- * Runs the console's own work (a request, a background pass) in its folder scope: with identities resolved off its
- * thread (up and serve), it reads a person's folder synchronously only while that folder answered a look lately; its
- * own data (the database's folder, evidence, build checkouts) is read freely. Without identities (embedders, tests):
- * as before. Work that isn't the console's (a worker in the same process) never runs in it.
- */
 function consoleFolders(options, identities, work) {
     if (options.identities === undefined)
         return work();