toolroll 0.9.103 → 0.9.105

package/dist/server/tasks.js

@@ -1,3 +1,4 @@
+import { advancedShownNow } from "../advanced-view.js";
 import { titleWithin } from "../task-text.js";
 import { parseFeedbackImage, sameFeedbackImage } from "../result-review.js";
 import { archiveTaskFamily, dropFeedbackImage, releaseAuthorityOfTask, restoreTaskFamily, revokeRelease, runCheckStamp, runLiveCommands } from "../store.js";
@@ -5,7 +6,6 @@ import { ranWords } from "../check-stamp.js";
 import { applyTidy, approverStandsNow, familyRepoOf, releaseFactsOf, tidyDays, tidyDigest, tidyPreview, TIDY_DEFAULT_DAYS } from "../tidy.js";
 import { steerCapabilityOf } from "../steer-capabilities.js";
 import { canReveal, localCheckoutOf, revealInFinder } from "../checkout-proof.js";
-/** A form's way back to a flow card ("flow:<flow>:<card>"), read strictly: numbers only, never a path. */
 function returnedFlow(value) {
     const match = /^flow:([1-9][0-9]{0,9}):([1-9][0-9]{0,9})$/.exec(value ?? "");
     return match === null ? null : { flow: Number(match[1]), card: Number(match[2]) };
@@ -15,7 +15,6 @@ import { ACP_AGENTS, isAcpProvider } from "../acp-agents.js";
 import { handlersOf } from './handler-registry.js';
 import { closedQuestionWords, LIMITS } from "../decision.js";
 import { DEPRECATED_PAGE } from "../deprecations.js";
-/** tasks handlers, moved without changing their route bodies. */
 import { html, htmlString, joinHtml, postForm, textHtml } from "../html.js";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { existsSync, lstatSync, realpathSync } from "node:fs";
@@ -30,6 +29,7 @@ import { codingShippingHtml } from '../coding-shipping-ui.js';
 import { codingWorkspaceHtml, codingWorkspaceScript } from '../coding-ui.js';
 import { CodingActionError } from '../coding-workspace.js';
 import { checkResponse, CONSOLE_FORMS, readForm } from "../contracts/console-api.js";
+import { LOCAL_TASK_CHANGED, requestPlanAsLocalOwner, retryAsLocalOwner, retryPinsOf } from "../local-owner-acts.js";
 import { hasForbiddenControls, validateNote } from "../decision.js";
 import { builderReadyFor, diagnoseTaskDispatch, firstRunBuilderRepo } from "../dispatch.js";
 import { firstTaskSuggestions, withBuilderStep } from "../first-run.js";
@@ -93,12 +93,9 @@ import { approvalFactsNow } from "./kit.js";
 import { localOwnerRefusal } from "../local-owner.js";
 export function createTasksHandlers(runtime) {
     const { identities, store, peekSay, peekCache, PEEK_CACHE_TTL_MS, peekInFlight, PEEK_GLOBAL_INFLIGHT, peekBySession, PEEK_SESSION_INFLIGHT, clock, peekName, PEEK_FRAGMENT_BYTES, peekEvict, evidenceRoot, sendScreen, chromeFor, visible, consumeApprovalNonce, authenticateApprover, options, mintApprovalNonce, taskScreen, unscopedMode, admissionList, planViewOf, revisionViewOf, runIsTaskResult, leadPrincipal, familyOf, armTaskResume, runIsLive, revisionLedgerOf, resultDetailOf, reviewFactsFor, taskRepoOf, runVisible, restricted, codingActorAllowed, codingProjectAllowed, managedRepos, routeViewOf, workAccess, firstRunStepsNow, revisionDocOf, failureOf, dockedConversation, planContractViewOf, familiesInView, explainAttempt, taskChatFocus, familyTasksInView, liveCeiling, projectOf, ceiling, bustBadge, revisionDestination } = runtime;
-    /** A row admitted the address but its path parameter does not parse: the console's unknown page. */
     function noPage(who, response) {
         return refuse(response, who, 404, "There's no page at this address.", "/chat");
     }
-    // `posted`: the session page's own POST (form token). A GET of changes or the shipping preview runs no git in the
-    // agent's checkout: changes go back to the session page, the preview asks for one click.
     const showCode = (part, posted = false) => async (ctx) => {
         const { url, who, response, project } = ctx;
         if (who.via !== 'cookie' || !codingActorAllowed({ name: who.name, generation: who.session.generation }))
@@ -154,14 +151,7 @@ export function createTasksHandlers(runtime) {
     };
     async function showWork(ctx) {
         const { url, who, response, now, project } = ctx;
-        // The Work destination (workspace package 1): every task in view as
-        // one row wearing the shared status projection, with All, Needs you,
-        // Running, and Completed as shortcuts over the same rows — never a
-        // persisted state. With no project open in scoped mode this rolls
-        // up like the inbox: admission binds the query and every row's repo
-        // is re-proved here.
         const view = parseWorkView(url.searchParams.get("view"));
-        // The stored-state filter the old task list had (`?state=`): an unknown state is refused, as it was there.
         const wantedState = url.searchParams.get("state");
         if (wantedState !== null && !TASK_STATES.includes(wantedState))
             return refuse(response, who, 400, "no such state", "/tasks");
@@ -171,10 +161,7 @@ export function createTasksHandlers(runtime) {
         try {
             work = workIndexPage(store, now, workAccess(), { view, limit: 40, cursor: url.searchParams.get('cursor'), project, root: evidenceRoot, ...(state === null ? {} : { state }) });
             const facts = requestContext.getStore();
-            // A filtered page never stands in for the counts or the Crew: those read the unfiltered work.
             if (facts !== undefined && state === null) {
-                // These counts cover the exact admitted project lens, including
-                // unplaced tasks where permitted. Crew excludes unplaced rows.
                 if (project === null)
                     facts.workCounts = work.projects;
                 const admitted = workAccess().repos;
@@ -188,10 +175,6 @@ export function createTasksHandlers(runtime) {
                 return refuse(response, who, 400, 'This task page has expired. Open the first page.', '/tasks');
             throw error;
         }
-        // A failed row says what its latest attempt missed, as its task page does (a stop reason already reads so), from
-        // the database alone: a row reads no check log. A live build's row says which step it is on, or the step it is
-        // stuck on, from that live attempt's own progress only, never a stopped attempt's; the step's words come from its
-        // current plan (one saved file, for live rows only), and without it the row names the step by number.
         const enrich = (page) => ({ ...page, items: page.items.map((item) => {
                 if (item.liveRunId !== null) {
                     const ref = store.lookupRef(item.activeTaskId);
@@ -213,7 +196,6 @@ export function createTasksHandlers(runtime) {
                 return failure.kind === "reason" ? item : { ...item, status: { ...item.status, detail: failure.line } };
             }) });
         work = enrich(work);
-        // The Board view: the same index as four columns (needs you, queued, running, finished), never a second classifier.
         const board = url.searchParams.get("layout") !== "board" ? null : (() => {
             const column = (view) => enrich(workIndexPage(store, now, workAccess(), { view, limit: BOARD_COLUMN_LIMIT, project, root: evidenceRoot, ...(state === null ? {} : { state }) }));
             return { needs: column("needs-you"), queued: column("queued"), running: column("running"), finished: column("completed") };
@@ -230,69 +212,50 @@ export function createTasksHandlers(runtime) {
             now,
             state,
             canPutAway: who.via === "cookie" && who.role === "approver",
-            // v105: subscription windows and monthly budgets, for whoever runs the installation.
-            limits: store.isInstanceOperator(who.name)
+            limits: store.isInstanceOperator(who.name) && advancedShownNow()
                 ? limitsView(store.providerLimits(), store.budgets().length === 0 ? [] : store.monthSpendCached(now).budgets, { project: projectName, subagent: id => subagentNamesOf(store.handle).get(id) ?? `Subagent ${id}` }, now)
                 : null,
         });
-        // One project's Tasks dock that project's own conversation (v77).
         const projectThread = url.searchParams.has('project') && project !== null && managedRepos().includes(project) ? project : null;
         const docked = projectThread === null ? null : dockedConversation(who, null, projectThread, now, `/tasks?project=${encodeURIComponent(projectThread)}`);
         if (docked !== null)
             page.workspace = { ...page.workspace, conversation: docked, pageHtml: page.body };
-        // Without a docked chat the list reads itself: 10 s while any of its tasks is building, else 30 s.
         page.refreshSeconds = work.totals.running > 0 ? 10 : 30;
         return sendScreen(response, 200, page);
     }
-    /** A completed (or attempted) row as the review list ranks it: its proof reasons, CI standing, and the assignment
-     * when that assignment's receipt is this very row. */
     function reviewRowOf(row, now) {
         const assignment = assignmentOf(store, row.taskId, now, workAccess(), evidenceRoot);
         return { ...row, proofReasons: row.runId === null ? [] : store.proofVerdictFor(row.runId)?.reasons ?? [], ciFailing: ciFailingFor(row.runId, row.prNumber),
             assignment: assignment?.activeTaskId === row.taskId && (assignment.receipt?.runId ?? null) === row.runId ? assignment : null };
     }
-    /** The result a link names (the task's own result, or the exact run `namedRun` of it): its completed row when the
-     * task is done (`inQueue` when the review list already holds it), else that attempt's own result (a failed or stopped
-     * build has a result page too), with what went wrong and Retry / Accept anyway as the review page offers them.
-     * Shared by /review and the task page's Result tab (docs/plans/one-page-task-and-agent.md). */
     function selectResultFor(wantedId, namedRun, project, who, now, inQueue = null) {
         const csrf = who.via === "cookie" ? who.session.csrf : "";
         const beyond = inQueue !== null ? null : completedRowFor(wantedId, project);
         const beyondRow = beyond === null ? null : reviewRowOf(beyond, now);
         const completedChoice = inQueue ?? (beyondRow === null ? null : { ...beyondRow, priority: reviewPriorityOf(beyondRow) });
-        // A build that failed (or stopped) has its own result page too: the run named, or a failed task's latest attempt.
         const attempt = (completedChoice !== null && (namedRun === null || completedChoice.runId === namedRun)) ? null : attemptRowFor(wantedId, namedRun, project);
         const attemptRow = attempt === null ? null : reviewRowOf(attempt, now);
         const chosen = attemptRow !== null ? { ...attemptRow, priority: reviewPriorityOf(attemptRow) } : completedChoice;
         const selected = chosen === null ? null : reviewCockpitViewOf(chosen, who, now);
-        // A build that delivered nothing reads Failed here, and so does a failed task's delivered result: what went wrong
-        // is the card and Retry the ink act. That result may still be accepted, but only in outline, as Accept anyway, with
-        // a reason.
         const delivered = selected?.run?.outcome === "built" || selected?.run?.outcome === "no-change";
         const failedTask = selected === null ? null : store.getTask(selected.taskId);
         if (selected !== null && attemptRow !== null && selected.run !== null && (!delivered || failedTask?.state === "failed")) {
             const attemptRun = store.getRun(selected.run.id);
             const runs = attemptRun === null ? [] : store.runsFor(attemptRun.taskRef);
             const latest = latestFinishedAttempt(runs);
-            // Retry from here only when the task failed, nothing holds it, and this is its latest attempt or a result it delivered.
             const retry = failedTask?.state === "failed" && (latest?.id === selected.run.id || delivered) && csrf !== "" && who.role === "approver" && store.currentLiveLease(attemptRun.taskRef, now) === null
-                ? { action: `${taskHref(selected.taskId)}/requeue` } : null;
-            // Accept anyway: the same acceptance this task's latest result takes, never for an older one or one already accepted.
+                ? { action: `${taskHref(selected.taskId)}/requeue`, pins: retryPinsOf(store, selected.taskId) } : null;
             const family = delivered ? familyOf(selected.taskId) : null;
             const acceptAnyway = delivered && csrf !== "" && who.role === "approver" && family?.current.id === selected.taskId && family.problem === null &&
                 runs.find(runIsTaskResult)?.id === selected.run.id && store.proofAcceptance(selected.run.id) === null
                 ? { action: `${taskHref(selected.taskId)}/accept-proof`, run: selected.run.id } : null;
             if (attemptRun !== null) {
-                // A delivered result didn't fail itself: the task's failure is its latest attempt's.
                 const failure = delivered ? failureOf(runs, null) : explainAttempt(attemptRun, null);
                 selected.failure = { ...failure, retry: retry === null ? null : { ...retry, note: retryNoteOf(failure.suggestion) }, ...(acceptAnyway === null ? {} : { acceptAnyway }) };
             }
         }
         return { chosen, attemptRow, beyond, selected };
     }
-    /** Whether `run` is a result selectResultFor shows for version `taskId`: a finished attempt that didn't deliver (failed,
-     * stopped, refused…), or the delivered one that is the version's own result — its completed row's, or, for a failed
-     * version, its latest finished attempt. An older delivered build is not (its version's result is the newer one). */
     function resultRunAdmissible(taskId, run, project) {
         if ((run.role !== "builder" && run.role !== "scout") || (run.finishedAt === null && run.outcome === null) || runIsLive(run))
             return false;
@@ -303,21 +266,12 @@ export function createTasksHandlers(runtime) {
             return latestFinishedAttempt(store.runsFor(run.taskRef).filter(one => (one.role === "builder" || one.role === "scout") && (one.finishedAt !== null || one.outcome !== null)))?.id === run.id;
         return completedRowFor(taskId, project)?.runId === run.id;
     }
-    /** A run's own task and its family's root: the task pages a result form may return to. */
     function runTasks(taskRef) {
         const task = store.externalIdFor(taskRef);
         return task === null ? [] : [task, familyOf(task)?.root.id ?? task];
     }
     async function showReview(ctx) {
         const { url, who, response, now, project, chosenProject } = ctx;
-        // The review cockpit (Priority 5): every visible COMPLETED task,
-        // ranked by review priority, with one selected result projected
-        // from the records the task, run, and done pages already read —
-        // scope, plan, run, artifacts, verdict, publication. The
-        // ranking is a labeled presentation aid: it never rewrites the
-        // stored verdict, and the sealed patch downloads exactly as stored.
-        // Admission binds BEFORE the SQL limit (the done page's own rule),
-        // and every row is re-proved against the ceiling before ranking.
         const resultRow = (row) => reviewRowOf(row, now);
         const rows = familiesInView(project, { states: ["done"], limit: REVIEW_QUEUE_CAP }).flatMap(family => {
             const row = completedRowFor(family.current.id, project);
@@ -327,34 +281,23 @@ export function createTasksHandlers(runtime) {
         const wanted = url.searchParams.get("result");
         const wantedId = wanted === null || wanted.length === 0 || wanted.length > 64 || hasForbiddenControls(wanted) ? null : wanted;
         const inQueue = wantedId === null ? null : ranked.find(one => one.taskId === wantedId) ?? null;
-        // A stable deep link outlives the queue window (v2 review, comment
-        // 1): a completion older than the newest REVIEW_QUEUE_CAP resolves
-        // directly — re-proved as done, in this project, and inside the
-        // ceiling — so an old receipt never reads as unfinished or foreign.
-        // The ranked queue itself stays bounded and says so.
         const expectedRun = url.searchParams.get("run");
         const namedRun = expectedRun !== null && /^[1-9]\d*$/.test(expectedRun) ? Number(expectedRun) : null;
         const csrf = who.via === "cookie" ? who.session.csrf : "";
         const picked = wantedId === null ? null : selectResultFor(wantedId, namedRun, project, who, now, inQueue);
         const chosen = picked?.chosen ?? null, attemptRow = picked?.attemptRow ?? null, beyond = picked?.beyond ?? null;
         const selectedRow = wantedId === null ? ranked[0] ?? null : chosen;
-        // An exact link to a result this person can't see (or that never existed) reads the same either way.
         if (expectedRun !== null && wantedId !== null && chosen === null)
             return refuse(response, who, 404, "No such result in your projects.", "/tasks");
         if (expectedRun !== null && (!/^[1-9]\d*$/.test(expectedRun) || selectedRow?.runId !== Number(expectedRun))) {
             return sendScreen(response, 409, screen("Result changed", html `<h1>Result changed</h1><p>This acceptance link no longer matches the current result. Review the current task before accepting.</p><p class="refusal-back"><a class="button-link" href="/tasks?view=ready">Review results</a></p>`, { chrome: chromeFor(project, "runs") }));
         }
         const selected = picked !== null ? picked.selected : selectedRow === null ? null : reviewCockpitViewOf(selectedRow, who, now);
-        // Opening a run's own result page is viewing it: the shell says so with a keyed POST /agents/seen (easy-start N1:
-        // a page load never writes), which leaves this person's unread Done once the run has finished.
         const reviewPage = reviewCockpitPage(chromeFor(wantedId === null ? project : chosenProject, "runs"), {
             queue: ranked,
             queueCap: REVIEW_QUEUE_CAP,
             selected,
             beyondQueue: beyond !== null && attemptRow === null,
-            // A deep link to a result this console cannot show — not done,
-            // not admitted, or never existed — says so in one sentence and
-            // shows the top of the queue; the three cases read identically.
             missing: wantedId !== null && chosen === null ? wantedId : null,
             csrf,
             canRetryReview: who.via === "cookie" && who.role === "approver",
@@ -364,8 +307,6 @@ export function createTasksHandlers(runtime) {
             user: who.name,
             now,
         });
-        // The result's task conversation, docked beside it (v77); messages
-        // sent here carry the result being viewed.
         const reviewFocus = selected === null ? null : taskChatFocus(selected.taskId, now, who, { mintNonce: false });
         const reviewDocked = reviewFocus === null || selected === null ? null
             : dockedConversation(who, reviewFocus, null, now, reviewHref(selected.taskId), selected.run !== null && reviewFocus.family.versions.some(one => one.refId === store.getRun(selected.run.id)?.taskRef) ? selected.run.id : null);
@@ -373,11 +314,6 @@ export function createTasksHandlers(runtime) {
             reviewPage.workspace = { ...reviewPage.workspace, conversation: reviewDocked, pageHtml: reviewPage.body };
         return sendScreen(response, 200, reviewPage);
     }
-    /** The old task list, retired into /work (docs/plans/reui-polish.md slice 7): its address keeps answering, as a
-     * redirect, so links and bookmarks still land. `state` carries over (an unknown one is still refused); `template`
-     * goes to the add page, which now pre-fills it. Anything else is dropped. */
-    /** Tasks (docs/plans/plain-toolroll.md P1.4): the one list, with List, Board, Ready, Archived and an every-project
-     * scope (`scope=all`). `view=board` is the Board, `view=order` the queue's order, `view=done` Finished. */
     async function showTasks(ctx) {
         const { url } = ctx;
         const template = url.searchParams.get("template");
@@ -386,7 +322,6 @@ export function createTasksHandlers(runtime) {
         const view = url.searchParams.get("view");
         if (view === "order")
             return showOrder(ctx);
-        // The list reads its own keys: Board is its layout, every project its roll-up, Finished its completed view.
         const read = new URL(url.href);
         if (view === "board") {
             read.searchParams.delete("view");
@@ -400,7 +335,6 @@ export function createTasksHandlers(runtime) {
         }
         return showWork({ ...ctx, url: read });
     }
-    /** The queue's order view, under Tasks: dispatch order with drag handles (scheduling, never authority). */
     async function showOrder(ctx) {
         const { url, who, response, project } = ctx;
         const csrf = who.via === "cookie" ? who.session.csrf : "";
@@ -415,8 +349,6 @@ export function createTasksHandlers(runtime) {
             html `<p class="meta" id="queue-region-stamp"></p>`,
         ], "\n"), { chrome: chromeFor(project, "work"), functional: { script: queueScript(), fetches: true } }));
     }
-    /** /n/<number>: a push's task link, by the task's stored number, never its title. It opens the task's page only
-     * inside the viewer's own projects; anything else is the same not-found as an unknown number. */
     async function showNumberedTask(ctx) {
         const { url, who, response } = ctx;
         const number = Number(url.pathname.slice("/n/".length));
@@ -432,7 +364,6 @@ export function createTasksHandlers(runtime) {
         const prefill = picked !== null && picked.kind === "task"
             ? { title: picked.title, goal: picked.goal, not: picked.outOfScope ?? "", touches: picked.touches.join(", "), acceptance: acceptanceToLines(picked.acceptance).join("\n") }
             : null;
-        // An idea's link (or any ?text=) puts words in the box: bounded to what the box takes, nothing filed.
         const text = ctx.url.searchParams.get("text");
         return newTaskScreen(ctx, 200, null, prefill, text === null ? null : text.slice(0, 200));
     }
@@ -447,24 +378,17 @@ export function createTasksHandlers(runtime) {
         const version = url.searchParams.get("version");
         if (version !== null && !family.versions.some(one => one.id === version))
             return refuse(response, who, 404, "That version is not available for this task.", taskHref(family.root.id));
-        // A version's own address lands on its family's page, still asking for the plan editor when it did (Chat's Edit plan).
         if (task.taskId !== family.root.id) {
-            // Everything else the address asked for (its tab, result run and view, a form's feedback) rides along.
             const kept = new URLSearchParams(url.searchParams);
             kept.delete("version");
             return redirect(response, `${taskHref(family.root.id)}?version=${encodeURIComponent(task.taskId)}${kept.size === 0 ? "" : `&${kept.toString()}`}`);
         }
-        // One page per task (docs/plans/one-page-task-and-agent.md): the tab named, and the Result tab's result — the shown
-        // version's own, or the exact run `run=` names, which must be a result of that very version.
         const tabWord = url.searchParams.get("tab");
-        // The first tab (Plan, or Result once there is one) unless the address names Activity or Attempts.
         const tab = tabWord === "result" || tabWord === "activity" || tabWord === "attempts" ? tabWord : "plan";
         const runWord = url.searchParams.get("run");
         const named = runWord === null ? null : /^[1-9][0-9]{0,14}$/.test(runWord) ? Number(runWord) : -1;
         if (named === -1)
             return refuse(response, who, 404, "No such result for this task.", taskHref(family.root.id));
-        // A run named without a version is shown with the version it belongs to: a saved link to a result outlives a newer
-        // revision becoming current. A run of no version of this family is no result of it.
         const owner = named === null || version !== null ? null : (() => { const ref = store.getRun(named)?.taskRef; const id = ref === undefined ? null : store.externalIdFor(ref); return id !== null && family.versions.some(one => one.id === id) ? id : null; })();
         const shown = version ?? owner ?? family.current.id;
         const picked = selectResultFor(shown, named, ctx.project, who, ctx.now);
@@ -474,19 +398,15 @@ export function createTasksHandlers(runtime) {
         const csrf = who.via === "cookie" ? who.session.csrf : "";
         const result = picked.selected === null ? null : (() => {
             const parts = reviewCockpitDetailParts(picked.selected, csrf, url.searchParams.get("noted") !== null, who.via === "cookie" && who.role === "approver", parseResultTab(url.searchParams.get("section")), who.name, { kind: "task", base });
-            // Current: the result the task itself would show (its latest), however the address named it — the header then
-            // owns its status and ceremonies, so no form is ever on the page twice.
             const latest = named === null ? picked.chosen?.runId ?? null : selectResultFor(shown, null, ctx.project, who, ctx.now).chosen?.runId ?? null;
             return { html: parts.html, selected: parts.selected, current: shown === family.current.id && latest !== null && latest === picked.chosen?.runId };
         })();
-        // The attempts the picker offers: exactly the runs this page would show for their version (the same rule as above).
         const admissible = new Set(family.versions.flatMap(one => {
             const ref = store.lookupRef(one.id);
             return ref === null ? [] : store.runsFor(ref.id).filter(run => resultRunAdmissible(one.id, run, ctx.project)).map(run => run.id);
         }));
         return taskScreen(response, who, shown, null, 200, undefined, undefined, url.searchParams.get("edit") === "plan", { tab, result, admissible });
     }
-    // v103: a task's evidence pack, as a printable page or JSON (the whole family, sealed ledger entries included).
     async function showTaskEvidence(ctx) {
         const { url, who, response, now } = ctx;
         const evidence = matchTaskPath(url.pathname, "/evidence$");
@@ -508,8 +428,6 @@ export function createTasksHandlers(runtime) {
         }
         return sendScreen(response, 200, evidenceRecordPage(chromeFor(family.root.repo, "tasks"), pack));
     }
-    /** Build history lives on Agents now ("Finished in the last …"), and each task keeps its own attempts: the old address
-     * keeps answering, as a GET alias. */
     async function showRuns(ctx) {
         return redirectGet(ctx.response, "/agents");
     }
@@ -529,14 +447,9 @@ export function createTasksHandlers(runtime) {
             return respond(response, 200, "text/html; charset=utf-8", checkProgressHtml(store.checkProgress(found.id)));
         }
         if (url.searchParams.get("fragment") === "facts") {
-            // The facts region alone — same auth and ceiling as the page; a
-            // finished or no-longer-live run says so rather than growing forms
-            // (finding 5; round-4 finding 15).
             return respond(response, 200, "text/html; charset=utf-8", runFactsFragment(found, taskId, running, store.runRoute(found.id)));
         }
         if (url.searchParams.get("fragment") === "peek") {
-            // The live peek: cookie sessions only (v2 §3), never stored, never
-            // cached by anything downstream.
             if (who.via !== "cookie")
                 return respond(response, 403, "text/plain; charset=utf-8", "the live peek is a browser session's view");
             const peeked = await peekFragment(found.id, who.session.csrf, options.editorLinks !== undefined && found.runner === options.localRunner && who.session.editorLinks === true);
@@ -546,18 +459,10 @@ export function createTasksHandlers(runtime) {
             return respond(response, peeked.status, "text/html; charset=utf-8", peeked.body);
         }
         if (url.searchParams.get("fragment") === "transcript") {
-            // The live conversation's window (arc 1; live-conversation.md §3–4):
-            // JSON over sanitized text or records — the sinks are textContent and
-            // React text, never innerHTML. Guards, enumerated: cookie session; run
-            // visible (proved above); this machine's runner asserted AND owning
-            // the run; byte offsets validated; the file read through its own
-            // descriptor with the exact numeric-id name, and its generation
-            // matched. Display state, not evidence — and never cached.
             response.setHeader("cache-control", "no-store");
             if (who.via !== "cookie")
                 return respond(response, 403, "application/json", JSON.stringify({ error: "session" }));
             const records = url.searchParams.get("shape") === "records";
-            // Notes come from the store, not the file: they show even where the transcript cannot be read.
             const notesOf = () => (records ? runNotes(store, found, who.name, now) : {});
             if (options.localRunner === undefined || found.runner !== options.localRunner) {
                 return respond(response, 200, "application/json", JSON.stringify({ error: "off", ...notesOf() }));
@@ -569,27 +474,19 @@ export function createTasksHandlers(runtime) {
             }
             const sawGen = url.searchParams.get("gen");
             const live = runIsLive(found);
-            // The final drain: a finished run's tail — including a torn last
-            // line — may be read until the sweep removes the file.
             const window = readLiveWindow(evidenceRoot, found.id, from, !live);
             if (!window.ok) {
                 if (window.reason === "replaced") {
                     return respond(response, 409, "application/json", JSON.stringify({ error: "replaced" }));
                 }
-                // Missing or unreadable: nothing to show. Final only when the
-                // run can never write again.
-                // Nothing was read, so the key state the cursor carried is handed straight back.
                 const inKey = url.searchParams.get("inkey") === "1";
                 const keyTail = validKeyTail(url.searchParams.get("ktail") ?? "") ? url.searchParams.get("ktail") ?? "" : "";
                 const empty = records ? { records: [], nextOffset: from, gen: sawGen, inKey, keyTail, final: !live } : { text: "", nextOffset: from, inKey, keyTail, final: !live };
                 return respond(response, 200, "application/json", JSON.stringify({ ...empty, ...notesOf() }));
             }
-            // An offset belongs to the file it was read from: another file starts over, visibly.
             if (sawGen !== null && sawGen !== "" && sawGen !== window.gen) {
                 return respond(response, 409, "application/json", JSON.stringify({ error: "replaced" }));
             }
-            // Re-proof after the read (peek discipline): the run row still says
-            // what admission said — visible, and still this machine's — or nothing is shown.
             const again = store.getRun(found.id);
             if (again === null || !runVisible(again) || again.runner !== options.localRunner) {
                 const inKey = url.searchParams.get("inkey") === "1";
@@ -597,35 +494,25 @@ export function createTasksHandlers(runtime) {
                 return respond(response, 200, "application/json", JSON.stringify(records ? { records: [], nextOffset: from, gen: window.gen, inKey, keyTail, final: true } : { text: "", nextOffset: from, inKey, keyTail, final: true }));
             }
             const final = !live && window.eof;
-            // A key block split across reads stays hidden: the cursor carries whether the last read ended inside one.
             const tailRaw = url.searchParams.get("ktail") ?? "";
             const keys = { inKey: url.searchParams.get("inkey") === "1", tail: validKeyTail(tailRaw) ? tailRaw : "" };
             if (records) {
-                // Command text and output only under this run's own captured answer, never the file's `open` record (v136).
                 const commands = runLiveCommands(store, found.id);
                 const shown = liveWindowRecords(window, commands, keys);
                 return respond(response, 200, "application/json", JSON.stringify({ records: shown, nextOffset: window.nextOffset, gen: window.gen, inKey: keys.inKey, keyTail: keys.tail ?? "", final, ...notesOf() }));
             }
-            // The plain words, whatever the file's format; the offset moves by the bytes read even when nothing shows.
             const lines = liveWindowLines(window, runLiveCommands(store, found.id), keys);
             return respond(response, 200, "application/json", JSON.stringify({ text: lines.length === 0 ? "" : `${lines.join("\n")}\n`, nextOffset: window.nextOffset, gen: window.gen, inKey: keys.inKey, keyTail: keys.tail ?? "", final }));
         }
-        // One result page (2026-10-02): a builder's finished result opens on
-        // its task's result page, titled with the task. The raw run record
-        // waits there under Details, and here with ?record=1.
         if (url.searchParams.get("record") === null && !running && found.role === "builder" && (found.outcome === "built" || found.outcome === "no-change") &&
             completedRowFor(taskId, null)?.runId === found.id) {
             const tab = parseResultTab(url.searchParams.get("tab"));
             return redirect(response, `${reviewHref(taskId, found.id)}${tab === "summary" ? "" : `&tab=${tab}`}`);
         }
-        // A build that failed or stopped opens on its own result page too: its changes, its checks and what went wrong.
         if (url.searchParams.get("record") === null && !running && (found.role === "builder" || found.role === "scout") && attemptRowFor(taskId, found.id, null) !== null) {
             const tab = parseResultTab(url.searchParams.get("tab"));
             return redirect(response, `${reviewHref(taskId, found.id)}${tab === "summary" ? "" : `&tab=${tab}`}`);
         }
-        // Pollers exist only for a LIVE run — an orphaned null-outcome run
-        // would otherwise be refetched forever (finding 15). The nonce is
-        // sendScreen's business now.
         const artifacts = store.artifactsFor(found.id);
         return sendScreen(response, 200, runPage(chromeFor(project, "runs", runListPane(project, found.id)), found, taskId, artifacts, terminalDiffView(artifacts, evidenceRoot), store.notesForRun(found.id), who.via === "cookie" ? who.session.csrf : "", store.liveDiffComments(found.id).filter(isRevisionFeedback), (() => {
             const publication = store.publicationForRun(found.id);
@@ -636,18 +523,12 @@ export function createTasksHandlers(runtime) {
             ? undefined
             : regionScript("run-facts", "facts") +
                 (options.localRunner === undefined ? "" : regionScript("run-peek", "peek")) +
-                (options.localRunner === undefined ? "" : transcriptScript()), options.localRunner !== undefined, running, 
-        // Editor links (arc 6): three statements align or nothing renders —
-        // the deployment capability, THIS machine's runner owning the run,
-        // and the session's own device-side yes.
-        options.editorLinks !== undefined &&
+                (options.localRunner === undefined ? "" : transcriptScript()), options.localRunner !== undefined, running, options.editorLinks !== undefined &&
             options.localRunner !== undefined &&
             found.runner === options.localRunner &&
             who.via === "cookie" &&
             who.session.editorLinks === true &&
-            // A reviewer run (v29) never had a checkout — no files to open.
             found.worktree !== null &&
-            // Idle cleanup removes the folder and a later run makes it again: no link to a folder that isn't there.
             existsSync(found.worktree)
             ? { worktree: found.worktree }
             : null, options.editorLinks !== undefined &&
@@ -655,9 +536,7 @@ export function createTasksHandlers(runtime) {
             found.runner === options.localRunner &&
             who.via === "cookie"
             ? { on: who.session.editorLinks === true }
-            : null, url.searchParams.get("noted") !== null, structuredHandoffView(artifacts, evidenceRoot), proofBundleView(store, found, artifacts, evidenceRoot), store.runRoute(found.id), store.publicationForRun(found.id), reviewFactsFor(found.id), 
-        // The shared result presentation (package 3) for a finished result.
-        !running && (found.outcome === "built" || found.outcome === "no-change")
+            : null, url.searchParams.get("noted") !== null, structuredHandoffView(artifacts, evidenceRoot), proofBundleView(store, found, artifacts, evidenceRoot), store.runRoute(found.id), store.publicationForRun(found.id), reviewFactsFor(found.id), !running && (found.outcome === "built" || found.outcome === "no-change")
             ? { detail: resultDetailOf(found, who, now), tab: parseResultTab(url.searchParams.get("tab")), user: who.name, requestToken: randomBytes(16).toString("hex") }
             : null, store.getScope(taskId)?.digest ?? null));
     }
@@ -668,7 +547,6 @@ export function createTasksHandlers(runtime) {
             return noPage(who, response);
         return runEvidence(response, Number(runArtifact[1]), Number(runArtifact[2]));
     }
-    // v115: routines became scheduled flows; an old link to the list or to one routine lands on the flows page.
     async function showRoutines(ctx) {
         return redirect(ctx.response, "/flows");
     }
@@ -707,8 +585,6 @@ export function createTasksHandlers(runtime) {
         const permitted = (repo) => visible(repo) && codingProjectAllowed(repo);
         const starting = verb === 'start';
         const sessionId = starting || verb === 'unknown' ? null : /^\/code\/([a-f0-9]{32})/.exec(url.pathname)[1];
-        // Sprint 8: a coding session is Codex taking turns: the organisation policy decides whether it may (provider,
-        // model, and a ceiling Codex can't run under), when it starts and on every action that makes it take another turn.
         const turnAction = ['send', 'resume', 'recover', 'continue', 'answer'].includes(verb);
         if (starting || turnAction) {
             const stopped = store.sessionPolicyRefusal('codex', starting ? body.get('model')?.trim() || null : null, 'coding sessions');
@@ -761,7 +637,6 @@ export function createTasksHandlers(runtime) {
                     runtime.coding.answer(id, actor, token, decision, answers);
                 }
             }
-            // Authorization is checked again after asynchronous startup/transport work.
             if (!codingActorAllowed(actor))
                 return fail(403, 'Your access changed. Sign in again.', 'unknown', id);
             return wantsJson ? respond(response, 200, 'application/json', JSON.stringify({ ok: true, id })) : redirect(response, `/code/${id}`);
@@ -787,8 +662,6 @@ export function createTasksHandlers(runtime) {
         if (project === undefined) {
             return refuse(response, who, 403, "that project is outside what this server was configured to show");
         }
-        // Stale-tab guard: a form rendered under one open project must not
-        // create into a different one switched-to since (finding 6).
         if (who.via === "cookie") {
             const seen = body.get("projectRevision");
             if (seen !== null && seen !== String(who.session.projectRevision)) {
@@ -796,38 +669,21 @@ export function createTasksHandlers(runtime) {
             }
         }
         const id = (body.get("id") ?? "").trim();
-        // The New task box stops at a title's length (render-new-task.ts): the title is all the planner reads of a no-goal
-        // filing. A direct POST longer than that is cut at a whole word, with an ellipsis (task-text.ts titleWithin), as a
-        // belt; a refusal keeps the person's own words (the draft below).
         const typed = body.get("title") ?? "";
         const title = titleWithin(typed);
-        // The EFFECTIVE placement (repo onboarding, findings 15/35): the
-        // trimmed, nonempty posted repo, else the open project — an empty
-        // input falls through correctly. In root mode the effective path is
-        // proved by authorizedProject EXACTLY as typed-then-canonicalized,
-        // and [canonical] is the admitted list — a fresh clone under a root
-        // must be able to receive its first task without waiting to appear
-        // in any table.
         const repoGiven = (body.get("repo") ?? "").trim();
         const effective = repoGiven !== "" ? repoGiven : (project ?? "");
         if (restricted() && !visible(effective === "" ? null : effective))
             return refuse(response, who, 403, "That project is outside your access.", "/projects");
-        // A scoped console refuses an EMPTY placement server-side (verification
-        // finding 1): the form's `required` is a courtesy, not the guard — a
-        // direct POST with no project open must not mint an unplaced task
-        // under a ceiling. Unscoped mode keeps its historic unplaced filings.
-        // A refusal from here on is the add page again with the person's own words (the old task list kept them too).
         const draft = { title: typed, goal: body.get("goal") ?? "", not: body.get("not") ?? "", touches: body.get("touches") ?? "", acceptance: body.get("acceptance") ?? "", values: body.sent };
         if (!unscopedMode && effective === "") {
             return newTaskScreen(ctx, 400, "name a repository — no project is open, so the task must say where it belongs", draft);
         }
         let repo = effective;
         let admitted = unscopedMode ? null : admissionList() ?? [];
-        // What this filing is decided on: re-checked inside the write below, after every await (project-identity.ts).
         const decidedOn = identities.generation();
         const rootMode = !unscopedMode && ceiling.roots.length > 0;
         if (rootMode && effective !== "") {
-            // Resolved off the console's thread (project-identity.ts), then proved against the ceiling as that identity.
             const resolved = await identities.resolveNow(effective);
             if (resolved === "no-answer")
                 return newTaskScreen(ctx, 503, `${effective} didn't answer — its folder may be on a drive that's disconnected, or waiting on macOS; try again in a moment`, draft);
@@ -853,9 +709,7 @@ export function createTasksHandlers(runtime) {
         if (qualityMode !== null && !isQualityMode(qualityMode)) {
             return refuse(response, who, 400, "quality must be Default or Strict / release", "/tasks/new");
         }
-        // One filing door for every surface (Codex adoption review, finding 7).
         const after = (body.get("after") ?? "").trim();
-        // From an issue or pull request (github-import.ts): read and quoted first; filing is the second press, on what was read.
         const fromLink = (body.get("from") ?? "").trim();
         if (fromLink !== "") {
             if (who.via !== "cookie" || repo === "")
@@ -871,8 +725,6 @@ export function createTasksHandlers(runtime) {
                 return newTaskScreen(ctx, filed.reason === "head-moved" ? 409 : 400, filed.message, draft);
             return redirect(response, taskHref(filed.taskId));
         }
-        // Small work a person starts themselves: their words become the exact terms, and Build is their yes (fast-start.ts).
-        // Anything else, or any doubt, is the ordinary filing below. `plain` is "Plan it first" from that form.
         if (who.via === "cookie" && body.get("plain") !== "1" && repo !== "" && goal === "" && notThis === "" && touchesGiven.length === 0 && !scout && id === "" && after === ""
             && (qualityMode === null || qualityMode === "default") && (permissionMode === null || permissionMode === "auto")) {
             const fast = await prepareFastStart(store, { actor: who.name, repo, title: typed.trim(), via: "console", ...(permissionMode === null ? {} : { permissionMode }), password: fastPasswordFacts(who) }, now);
@@ -881,8 +733,6 @@ export function createTasksHandlers(runtime) {
         }
         let chainProblem = null;
         const made = store.transact(() => {
-            // A project folder's identity changed while this request waited (a root or link now leads elsewhere): what was
-            // proved above may no longer hold, so nothing is filed on it.
             if (identities.generation() !== decidedOn || (rootMode && repo !== "" && !visible(repo)))
                 return null;
             const filed = fileTaskProposal(store, {
@@ -910,8 +760,6 @@ export function createTasksHandlers(runtime) {
                 if (!chained.ok)
                     chainProblem = chained.reason;
             }
-            // Missing dependencies leave a reviewable, inert task. They must
-            // never be silently dropped before automatic approval starts work.
             if (filed.ok && chainProblem === null && who.via === "cookie")
                 applyModeToNewFiling(store, filed.id, who.name, now);
             return filed;
@@ -924,8 +772,6 @@ export function createTasksHandlers(runtime) {
         const actionContext = requestContext.getStore();
         if (actionContext !== undefined)
             actionContext.createdTask = made.id;
-        // A proved root-mode placement joins the project table (finding 15):
-        // the new task's home is openable and admissible from now on.
         if (rootMode && repo !== "")
             store.upsertProject(repo, projectName(repo), now);
         if (chainProblem !== null)
@@ -939,9 +785,6 @@ export function createTasksHandlers(runtime) {
         if (project === undefined) {
             return refuse(response, who, 403, "that project is outside what this server was configured to show");
         }
-        // The note is a global runner label, not project-scoped work: the
-        // fleet screen (project-less) posts it too, so the null-project gate
-        // applies only to moves, which their task-level check re-proves.
         const worker = (body.get("runner") ?? "").trim();
         const note = (body.get("note") ?? "").trim();
         if (note.length > 200 || hasForbiddenControls(note)) {
@@ -965,8 +808,6 @@ export function createTasksHandlers(runtime) {
                 return refuse(response, who, 409, "the open project changed since this form was rendered — reload and try again", QUEUE_VIEW);
             }
         }
-        // A drag posts in place (fetch) when it can; the page re-renders its
-        // own fragment on success. A plain form still works with no script.
         const inPlace = body.get("respond") === "fragment";
         const fromFleet = who.via === "cookie" && body.get("projectRevision") === null;
         const respondMove = (status, message) => {
@@ -988,8 +829,6 @@ export function createTasksHandlers(runtime) {
         const toRunner = columnGiven === "" || columnGiven === "anyone" ? null : columnGiven;
         const beforeGiven = (body.get("before") ?? "").trim();
         const revisionGiven = Number(body.get("queueRevision") ?? "");
-        // The queue's own screen enforces the open project; the fleet screen
-        // is cross-project, so the ceiling is the only wall it needs.
         const belongs = (id) => {
             const ref = store.lookupRef(id);
             return ref !== null && visible(ref.repo) && (fromFleet || project === null || ref.repo === null || ref.repo === project);
@@ -997,12 +836,6 @@ export function createTasksHandlers(runtime) {
         if (!belongs(taskId) || (beforeGiven !== "" && beforeGiven !== QUEUE_FRONT && !belongs(beforeGiven))) {
             return respondMove(404, "that task is not in this queue");
         }
-        // The no-script "move to the front" button cannot name the front: the
-        // front of a task's partition is decided by the store's exact repo AND
-        // assignment, and the page's snapshot is bounded — so the sentinel is
-        // resolved HERE, against a fresh snapshot, into a real task id (slice
-        // 1b, fix 1). It is honored only within the task's own column; a
-        // cross-column front is not provable from a bounded snapshot.
         let beforeTaskId = beforeGiven === "" ? null : beforeGiven;
         if (beforeGiven === QUEUE_FRONT) {
             const ref = store.lookupRef(taskId);
@@ -1014,11 +847,6 @@ export function createTasksHandlers(runtime) {
             const now = clock();
             const snapshot = store.queueScoped(ref.repo, now);
             const self = snapshot.find(one => one.id === taskId);
-            // A claim can land after the form rendered WITHOUT
-            // bumping queueRevision, so the snapshot — not the form — decides
-            // whether the card is still free. A taken or vanished card is the
-            // typed refusal, never a silent no-op that would skip moveTask()'s
-            // own claimed recheck.
             if (self === undefined)
                 return respondMove(409, moveReason("unknown-task"));
             if (self.taken)
@@ -1028,9 +856,6 @@ export function createTasksHandlers(runtime) {
             if (front === undefined)
                 return respondMove(409, moveReason("unknown-task"));
             if (front.id === taskId) {
-                // Already the front: a no-op, but only against the revision the
-                // form was rendered with — this branch never reaches moveTask()'s
-                // CAS, so the check is made here.
                 if (!Number.isSafeInteger(revisionGiven) || revisionGiven !== store.queueRevision()) {
                     return respondMove(409, moveReason("stale"));
                 }
@@ -1071,10 +896,6 @@ export function createTasksHandlers(runtime) {
         }
         const choice = body.get("choice") ?? "";
         const chosen = decision.options.find(option => option.id === choice);
-        // Irreversible options never ride one accidental tap: the form arms
-        // them behind an explicit confirmation field, and the server checks —
-        // the client rendering is convenience, this is the rule.
-        // The question page's own form hears a refusal in its box, with nothing changed; /next keeps its refusal page.
         const inPlace = requestedReturn !== "next";
         const pageBack = requestedReturn === null ? null : decisionBack;
         if (chosen !== undefined && !chosen.reversible && body.get("confirm") !== "yes") {
@@ -1107,8 +928,6 @@ export function createTasksHandlers(runtime) {
         if (act === null)
             return noPage(who, response);
         const body = readForm(posted, CONSOLE_FORMS.recheckStopped);
-        // Check again: Toolroll looks at this computer's processes for the build once more (stop-proof.ts) and settles it
-        // when none of them is the build's. Nobody vouches that a build stopped, so there is nothing to confirm here.
         const back = taskHref(act.taskId);
         const ref = store.lookupRef(act.taskId);
         if (ref === null || !visible(ref.repo))
@@ -1141,8 +960,6 @@ export function createTasksHandlers(runtime) {
         if (act === null)
             return noPage(who, response);
         const body = readForm(posted, CONSOLE_FORMS.merge);
-        // Merging is a person's act behind their password, typed again: a browser session, an approver, the exact
-        // result's pull request. The flow re-reads GitHub before merging and records who merged in the ledger.
         if (store.isDemo())
             return taskScreen(response, who, act.taskId, "The demo merges nothing.", 403);
         const ref = store.lookupRef(act.taskId);
@@ -1159,7 +976,6 @@ export function createTasksHandlers(runtime) {
             return taskScreen(response, who, act.taskId, merged.message, merged.reason === "password" ? 403 : 409);
         return redirect(response, `${taskHref(act.taskId)}#merge`);
     }
-    /** A task act bound to its verb: taskMutation owns each verb's checks. */
     const taskAct = (verb) => async (ctx) => {
         const { url, who, response, now, posted } = ctx;
         const act = matchTaskPath(url.pathname, `/${verb}$`);
@@ -1167,8 +983,6 @@ export function createTasksHandlers(runtime) {
             return noPage(who, response);
         return taskMutation(response, who, act.taskId, verb, posted, now, ctx.request);
     };
-    // Cockpit E: Show in Finder — the checkout proved again right now (live, this machine's runner, inside the pool),
-    // then Finder asked to reveal it with a fixed argv. Nothing runs in it; a Mac only.
     async function runReveal(ctx) {
         const { url, who, response, now, posted } = ctx;
         const asked = /^\/r\/([0-9]{1,15})\/reveal$/.exec(url.pathname);
@@ -1195,10 +1009,6 @@ export function createTasksHandlers(runtime) {
         if (noted === null)
             return noPage(who, response);
         const body = readForm(posted, CONSOLE_FORMS.runNote);
-        // An operator's verdict beside the machine's record (M6): immutable,
-        // bounded by the same validator as decision notes, ceiling-checked
-        // like every run resource. Ordinary authenticated mutation — no
-        // nonce, because nothing here approves anything.
         const id = Number(noted[1]);
         const found = store.getRun(id);
         if (found === null || !visible(taskRepoOf(found.taskRef))) {
@@ -1216,31 +1026,17 @@ export function createTasksHandlers(runtime) {
         if (diffComment === null)
             return noPage(who, response);
         const body = readForm(posted, CONSOLE_FORMS.diffComment);
-        // A review comment on the IMMUTABLE terminal diff (M6.8): bound to
-        // the exact artifact and its hash. Ordinary authenticated mutation —
-        // the nonce belongs to the approval screen that later restates the
-        // batch, never to the comment box.
         const id = Number(diffComment[1]);
         const found = store.getRun(id);
         if (found === null || !visible(taskRepoOf(found.taskRef))) {
             return refuse(response, who, 404, "no such run");
         }
-        // Where the reader came from (package 3): the cockpit's deep link,
-        // the chat's result view, or the run page — validated to those exact
-        // shapes. A refusal sends them back THERE, where the browser has kept
-        // their draft, so a failed submission is recoverable in place.
         const returnTo = resultReturnTarget(body.get("return"), id, runTasks(found.taskRef));
         const selectedTab = parseResultTab(body.get("tab"));
-        // A task page's Result tab keeps the result's own view in `section=` (its `tab` is the task's).
         const viewParam = returnTo.startsWith("/t/") ? "section" : "tab";
         const back = selectedTab === "summary" ? returnTo
             : `${returnTo.replace(/&section=(?:summary|changes|checks)$/, "")}${returnTo.includes("?") ? "&" : "?"}${viewParam}=${selectedTab}`;
         if (body.get("intent") === "drop-image") {
-            // A saved note whose screenshot is gone or changed would block every revision that seals it. Its words stay:
-            // the note is superseded by an exact imageless copy, and the original remains in history.
-            // Who: a signed-in browser approver admitted to this run's project (checked above) — the same authority that
-            // seals any saved note into a revision. What: only a screenshot that is unusable right now, re-proved inside
-            // dropFeedbackImage's transaction, and recorded in the ledger under this person.
             if (who.via !== "cookie" || who.role !== "approver")
                 return refuse(response, who, 403, "Only a signed-in approver can change saved feedback.", back);
             const comment = Number(body.get("comment") ?? "");
@@ -1261,14 +1057,11 @@ export function createTasksHandlers(runtime) {
             const result = requestResultChanges(store, evidenceRoot, {
                 run: id, batch: body.get("batch"), source: body.get("source"), actor: who.name,
                 repos: admissionList(), includeUnplaced: visible(null), allowMode: who.via === "cookie",
-                // A browser session is a person's proof; a bearer credential is a machine's.
                 origin: who.via === "cookie" ? "person" : "machine",
                 note: body.get("note") ?? "", path: body.get("path") ?? "", line: body.get("line") ?? "", request: body.get("request"), image,
             }, now);
             if (!result.ok) {
                 const request = body.get("request") ?? "";
-                // The queue's link can stop resolving when a newer attempt finishes. The exact
-                // run record still hosts this account/run's recoverable feedback draft.
                 const retryBase = image === null ? back : `/r/${id}?record=1`;
                 const retryBack = /^[a-f0-9]{32}$/.test(request) ? `${retryBase}${retryBase.includes("?") ? "&" : "?"}conflict=${request}#request-changes` : retryBase;
                 return refuse(response, who, result.status, result.message, retryBack);
@@ -1279,9 +1072,6 @@ export function createTasksHandlers(runtime) {
         if (terminal === undefined) {
             return refuse(response, who, 400, "this run has no terminal diff to comment on", back);
         }
-        // The bytes must VERIFY before words attach to them (audit IV-10):
-        // "a comment on the exact reviewed bytes" is a lie if the bytes are
-        // gone or no longer hash to their record.
         const proven = readVerifiedArtifact(evidenceRoot, terminal);
         if (!proven.ok) {
             return refuse(response, who, 409, `the terminal diff no longer verifies (${proven.problem}) — nothing to comment on`, back);
@@ -1298,15 +1088,9 @@ export function createTasksHandlers(runtime) {
         if (line !== null && (!Number.isInteger(line) || line < 1 || line > 1_000_000)) {
             return refuse(response, who, 400, "Enter a whole line number from 1 to 1,000,000, or leave it blank.", back);
         }
-        // The form's own request token (package 3) is the dedupe key: a
-        // replayed or double submission finds its note already recorded and
-        // lands on the same receipt instead of a second note. The token is
-        // bound to the account, so nobody else's replay can consume it.
         const request = body.get("request");
         const sourceKey = commentSourceKey(who.name, request);
         const path = rawPath === "" ? null : rawPath;
-        // Freshness, custody and the insert in one write transaction: a newer attempt finishing in between can't leave a
-        // stale screenshot attached (check and write together).
         const saved = store.transact(() => {
             const imageProblem = feedbackImageProblem(store, evidenceRoot, id, image);
             if (imageProblem !== null)
@@ -1317,13 +1101,6 @@ export function createTasksHandlers(runtime) {
             return refuse(response, who, 409, saved.problem, `/r/${id}?record=1#request-changes`);
         const inserted = saved.inserted;
         if (inserted === null && sourceKey !== undefined) {
-            // The token was used before (repair 2026-09-14, finding 1). A
-            // request identity is IMMUTABLE: it names exactly one note on
-            // exactly one result. The unchanged retry — same run, same file,
-            // line and words — lands on its original receipt; any other reuse
-            // is refused, and the refusal's way back carries `conflict=<token>`
-            // so the browser mints a fresh identity for the words it still
-            // holds. Nothing typed is lost either way.
             const earlier = store.diffCommentBySourceKey(sourceKey);
             const conflictBack = `${back}${back.includes("?") ? "&" : "?"}conflict=${request}#request-changes`;
             if (earlier === null || earlier.run !== id) {
@@ -1333,21 +1110,12 @@ export function createTasksHandlers(runtime) {
                 return refuse(response, who, 409, `this request identity already recorded a different note on this result (${earlier.path === null ? "no file" : `${earlier.path}${earlier.line === null ? "" : `:${earlier.line}`}`}: "${oneLineOf(earlier.note, 80)}") — go back; your edited words are kept as a new note, and the form will carry a new identity`, conflictBack);
             }
         }
-        // Land back AT the request-changes form with the note field ready —
-        // writing five notes in a row must cost five keystrokes of
-        // navigation, not five scrolls (arc 6, finding 5/6). The receipt
-        // names the request token, so the browser clears exactly the draft
-        // that landed and no other.
         const receipt = sourceKey === undefined ? "1" : request;
         return redirect(response, `${back}${back.includes("?") ? "&" : "?"}noted=${receipt}#request-changes`);
     }
     async function sessionEditorLinks(ctx) {
         const { who, response, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.editorLinks);
-        // The session half of the editor-link activation (arc 6, finding 1):
-        // only the person at the browser can say "this device holds the
-        // worktrees". Per-session, dies with the session, grants nothing —
-        // it only lets already-authorized pages RENDER vscode links.
         if (who.via !== "cookie")
             return refuse(response, who, 403, "editor links are a browser session's choice");
         if (options.editorLinks === undefined)
@@ -1362,10 +1130,6 @@ export function createTasksHandlers(runtime) {
         if (revise === null)
             return noPage(who, response);
         const body = readForm(posted, CONSOLE_FORMS.revise);
-        // Seal the live comment batch into ONE unapproved revision task with
-        // an immutable brief (M6.8). Deterministic — no model reads anything
-        // here — and every revision takes its own approval: comments can
-        // semantically widen work, and no path check can prove they did not.
         const id = Number(revise[1]);
         const found = store.getRun(id);
         if (found === null || !visible(taskRepoOf(found.taskRef))) {
@@ -1381,8 +1145,6 @@ export function createTasksHandlers(runtime) {
             return refuse(response, who, result.status, result.message, back);
         return redirect(response, revisionDestination(result.id, back));
     }
-    // Follow-ups on a result: Run checks on its exact commit (a worker runs the
-    // approved command once and seals the log), or file a task to add tests.
     const runFollowUp = (op) => async (ctx) => {
         const { url, who, response, now, posted } = ctx;
         const followUp = /^\/r\/([0-9]{1,15})\//.exec(url.pathname);
@@ -1393,7 +1155,6 @@ export function createTasksHandlers(runtime) {
         const found = store.getRun(id);
         if (found === null || !visible(taskRepoOf(found.taskRef)))
             return refuse(response, who, 404, "no such run");
-        // The task page that offered Run checks in place is a return target too: this run's own task, or its family's root.
         const back = resultReturnTarget(body.get("return"), id, runTasks(found.taskRef));
         if (who.via !== "cookie")
             return refuse(response, who, 403, "Sign in with a browser session to do this.", back);
@@ -1406,7 +1167,6 @@ export function createTasksHandlers(runtime) {
             const asked = requestFollowUpChecks(store, { runId: id, level, actor: who.name }, now);
             if (!asked.ok)
                 return refuse(response, who, 409, asked.message, back);
-            // Back where it was asked: the task page's status row says the checks are running; a result page shows them under #follow-ups.
             return redirect(response, back.startsWith("/t/") ? back : `${back.split("#")[0]}#follow-ups`);
         }
         const filed = fileAddTestsTask(store, evidenceRoot, { runId: id, actor: who.name, filedVia: "console", ...(admissionList() === null ? {} : { admittedRepos: admissionList() }) }, now);
@@ -1419,10 +1179,6 @@ export function createTasksHandlers(runtime) {
         const draftRepair = /^\/r\/([0-9]{1,15})\/draft-repair$/.exec(url.pathname);
         if (draftRepair === null)
             return noPage(who, response);
-        // CI repair, suggestion-first (M8.18): a red episode never spawns an
-        // agent by itself — it EARNS a button, and the button creates one
-        // unapproved task through the same revision machinery as review
-        // comments. One draft per task/PR, ever: the merge blocker records it.
         const id = Number(draftRepair[1]);
         const found = store.getRun(id);
         if (found === null || !visible(taskRepoOf(found.taskRef))) {
@@ -1437,9 +1193,6 @@ export function createTasksHandlers(runtime) {
         }
         const sourceTaskId = store.externalIdFor(found.taskRef) ?? "?";
         const sourceScope = store.getScope(sourceTaskId);
-        // The observed episode, not the click: the brief binds the head the
-        // failure was SEEN on and when (audit C-2) — a PR that advanced since
-        // is a different failure, and the click time is not an observation.
         const episode = store.latestOpenCiEpisode(publication.githubRepo, publication.prNumber);
         const brief = {
             schema: 1,
@@ -1457,11 +1210,6 @@ export function createTasksHandlers(runtime) {
         const briefBytes = Buffer.from(JSON.stringify(brief, null, 2), "utf8");
         const briefName = `ci-repair-brief-${randomBytes(6).toString("hex")}.json`;
         const key = writeEvidenceFile(evidenceRoot, id, briefName, briefBytes);
-        // The SAME revision boundary the annotation road and the criterion
-        // repair use (contract handoff task 2): the inherited terms come from
-        // the source rows inside the seal; the scope read above only names
-        // the digest this draft was composed against.
-        // One draft per task/PR, ever: the PR's merge blocker names it, lifted or not, and is written in the seal's transaction.
         const sealed = store.transact(() => {
             const prior = store.raw().prepare("SELECT task_id FROM merge_blocker WHERE publication = ? AND task_id IS NOT NULL ORDER BY rowid LIMIT 1").get(publication.id);
             if (prior !== undefined)
@@ -1477,9 +1225,6 @@ export function createTasksHandlers(runtime) {
                 commentIds: null,
                 requestedBy: who.name,
             }, now);
-            // The merge blocker rides the SAME breath as the draft (merge grant,
-            // findings 3/12/13): while this repair exists, the source PR merges
-            // NOTHING — sticky until the operator's unblock act or the PR closes.
             if (result.ok)
                 store.createMergeBlocker(publication.id, result.id, now);
             return result;
@@ -1496,11 +1241,6 @@ export function createTasksHandlers(runtime) {
             return noPage(who, response);
         const body = readForm(posted, CONSOLE_FORMS.resolveIncident);
         const id = Number(resolve[1]);
-        // The ceiling applies to incident mutation exactly as to every other
-        // resource (v3 review, finding 3): resolve incident → run → task, and
-        // an incident outside this server's scope does not exist here. The
-        // task id is captured BEFORE resolving — afterwards the incident is
-        // no longer open and could not be found again.
         const openRow = store.openIncidents().find(one => one.id === id);
         const incidentRun = openRow === undefined ? null : store.getRun(openRow.run);
         if (openRow !== undefined && incidentRun !== null && !visible(taskRepoOf(incidentRun.taskRef))) {
@@ -1512,7 +1252,6 @@ export function createTasksHandlers(runtime) {
         const back = body.get("return") === "inbox" ? "/" : openRow === undefined ? "/" : taskHref(openRow.taskId);
         return redirect(response, back);
     }
-    /** The compact recent-runs list for the master pane. */
     function runListPane(project, currentId) {
         const rows = store.listRunsBefore(null, 50, project);
         const live = liveRunIds(rows);
@@ -1521,15 +1260,11 @@ export function createTasksHandlers(runtime) {
         return html `<h2>Builds</h2>\n${rows.length === 0 ? html `<p class="meta">None yet</p>` : items}`;
     }
     async function peekFragment(runId, sessionKey, editorMode = false) {
-        // The cache and the in-flight coalescer hold the fragment's bytes (runtime's types); they are markup this made.
         const said = (message, final) => peekSay(message, final);
         const guarded = peekGuards(runId);
         if (!guarded.ok)
             return { status: 200, body: said(guarded.message, guarded.final === true) };
         const { run, worktree, epoch, entries } = guarded.admit;
-        // The cache and the in-flight coalescer both vary by LINK MODE (arc 6,
-        // finding 3): a linked fragment rendered for one session must never be
-        // served to a session that has not activated links on its device.
         const key = `${runId}:${run.baseRevision}:${epoch}:${editorMode ? "links" : "plain"}`;
         const cached = peekCache.get(key);
         if (cached !== undefined && Date.now() - cached.at <= PEEK_CACHE_TTL_MS) {
@@ -1539,7 +1274,6 @@ export function createTasksHandlers(runtime) {
             peekCache.delete(key);
             runtime.peekCacheBytes -= cached.bytes;
         }
-        // Coalesce per run; bound per session and globally (finding 10).
         const flightKey = `${runId}:${editorMode ? "links" : "plain"}`;
         const inFlight = peekInFlight.get(flightKey);
         if (inFlight !== undefined)
@@ -1552,9 +1286,6 @@ export function createTasksHandlers(runtime) {
         peekBySession.set(sessionKey, (peekBySession.get(sessionKey) ?? 0) + 1);
         const work = (async () => {
             const seen = await observeWorktree(worktree, entries.entries, PEEK_LIMITS);
-            // The fence, proved AGAIN after the walk (findings 16/28): the same
-            // run still open, the same claim, the SAME epoch — or the whole
-            // observation is discarded, never rendered, never cached.
             const after = peekGuards(runId);
             if (!after.ok || after.admit.epoch !== epoch) {
                 return peekSay("the checkout changed hands mid-look — nothing is shown");
@@ -1572,9 +1303,6 @@ export function createTasksHandlers(runtime) {
             if (changed.length === 0 && deleted.length === 0 && fresh.total === 0) {
                 parts.push(html `<p class="row">nothing has changed against the starting point yet</p>`);
             }
-            // A name is linked ONLY when sanitize provably changed nothing (arc 6,
-            // finding 3): a masked or normalized label must never carry an href
-            // that discloses what the mask hid. Collapsed labels never link.
             const shownName = (path) => peekName(path);
             const linkedName = (path) => {
                 const shown = shownName(path);
@@ -1608,8 +1336,6 @@ export function createTasksHandlers(runtime) {
                 parts.push(html `<p class="meta">${seen.partial}</p>`);
             let fragment = joinHtml(parts, "\n");
             if (Buffer.byteLength(htmlString(fragment)) > PEEK_FRAGMENT_BYTES) {
-                // The byte cap is enforced AFTER escaping (finding 32): an oversize
-                // rendering is replaced whole by its exact counts.
                 fragment = html `<p class="meta">Best-effort look at ${stamp} UTC</p><p class="row">${changed.length} changed · ${deleted.length} deleted · ${fresh.total} new · ${unchecked.length} unverified — too much to render live; the final diff will hold the detail</p>`;
             }
             const bytes = Buffer.byteLength(htmlString(fragment));
@@ -1631,10 +1357,7 @@ export function createTasksHandlers(runtime) {
                 peekBySession.set(sessionKey, left);
         }
     }
-    // ---- mutations -----------------------------------------------------------
-    function taskMutation(response, who, taskId, verb, posted, now, 
-    /** Read only to shape an answer in place (answersInPlace), after the act's proofs. */
-    request = null) {
+    function taskMutation(response, who, taskId, verb, posted, now, request = null) {
         const ref = store.lookupRef(taskId);
         if (ref === null || store.getTask(taskId) === null) {
             return refuse(response, who, 404, "no such task", "/tasks");
@@ -1645,21 +1368,13 @@ export function createTasksHandlers(runtime) {
         switch (verb) {
             case "steer": {
                 const body = readForm(posted, CONSOLE_FORMS.taskSteer);
-                // Steering is a browser session's act, explicitly (arc 1 v2 §3):
-                // identify() accepts bearer credentials generically, and those are
-                // for machines — a person watching steers, cookie + CSRF only.
                 if (who.via !== "cookie") {
                     return refuse(response, who, 403, "steering is a browser session's act");
                 }
-                // The same gates as a pause or a stop (the route's act scope already refuses a viewer; this says why).
                 if (who.role !== "approver")
                     return taskScreen(response, who, taskId, "your login can watch — sending an agent a note is an approver's act", 403);
                 if (store.isDemo())
                     return taskScreen(response, who, taskId, "the demo authorizes nothing", 403);
-                // From the Agents view, the note is for the exact run on screen (live-conversation.md §6): filed only while that
-                // run is still the task's live build, once per draft key. Nothing is filed on a refusal; the view keeps the draft.
-                // An unsent note from an attempt that ended, sent on to the task's next attempt from that agent's page: filed
-                // task-level, back to the same agent with its draft key so only a confirmed send clears the draft.
                 if (body.has("after")) {
                     const afterRaw = body.get("after") ?? "";
                     const keyRaw = body.get("key") ?? "";
@@ -1669,9 +1384,7 @@ export function createTasksHandlers(runtime) {
                     if (ended === null || ended.taskRef !== ref.id || !/^[A-Za-z0-9-]{8,64}$/.test(keyRaw) || body.has("run") || (afterBack !== null && afterBack !== "task" && afterFlow === null)) {
                         return taskScreen(response, who, taskId, "that note did not say which agent it came from, so nothing was sent", 400);
                     }
-                    // The same receipt as a send to that run: a draft already filed while it ran comes back as sent, not twice.
                     const filed = store.fileSteerNoteForRun(taskId, verifiedAuthor(who.name), body.get("note") ?? "", now, { run: ended.id, key: keyRaw, onward: true });
-                    // From the task page or a flow card: back there with the draft's key (only that draft clears), or the refusal in words.
                     if (afterBack !== null) {
                         if (filed.ok)
                             return redirect(response, afterFlow !== null ? `/flows/${afterFlow.flow}?card=${afterFlow.card}&sent=${keyRaw}` : `${taskHref(taskId)}?sent=${keyRaw}#steering`);
@@ -1681,7 +1394,6 @@ export function createTasksHandlers(runtime) {
                         return redirect(response, `/agents?run=${ended.id}&said=steered-next&sent=${keyRaw}`);
                     return redirect(response, `/agents?run=${ended.id}&said=${filed.reason === "task-finished" ? "steer-next-finished" : filed.reason === "key-reused" ? "steer-stale" : "steer-invalid"}`);
                 }
-                // A form that asks for a run but names none properly is refused — never quietly filed unbound.
                 if (body.get("return") === "agents" || body.get("return") === "task" || returnedFlow(body.get("return")) !== null || body.has("run") || body.has("key")) {
                     const runRaw = body.get("run") ?? "";
                     const keyRaw = body.get("key") ?? "";
@@ -1693,22 +1405,17 @@ export function createTasksHandlers(runtime) {
                     const shown = store.getRun(Number(runRaw));
                     if (shown === null || shown.taskRef !== ref.id)
                         return taskScreen(response, who, taskId, "that run is not part of this task", 404);
-                    // An attempt that takes no notes (a planner, a scout, a reviewer, one repairing its handoff) is never filed one:
-                    // it would never read it (cockpit §4).
                     const capability = steerCapabilityOf(store, shown.id, now);
                     if (capability !== null && capability.send === null) {
                         return from === "agents" ? redirect(response, `/agents?run=${shown.id}&said=steer-no-notes`) : taskScreen(response, who, taskId, capability.words, 409);
                     }
                     const bound = store.fileSteerNoteForRun(taskId, verifiedAuthor(who.name), body.get("note") ?? "", now, { run: shown.id, key: keyRaw });
-                    // From the task page: back to its steering card, or the refusal in words (the page keeps nothing to restore).
                     if (from === "task") {
-                        // Back where it was written (the task page, or a flow card's task), with its draft's key: only that draft clears.
                         if (bound.ok)
                             return redirect(response, flowBack !== null ? `/flows/${flowBack.flow}?card=${flowBack.card}&sent=${keyRaw}` : `${taskHref(taskId)}?sent=${keyRaw}#steering`);
                         return taskScreen(response, who, taskId, bound.reason === "attempt-ended" || bound.reason === "task-finished" ? "that attempt ended before your note, so nothing was sent — reload and send it to the current one"
                             : bound.reason === "invalid-note" ? "that note will not store" : "that form was already used — reload and send it again", 409);
                     }
-                    // The draft's own key comes back: only that draft is cleared from the box.
                     if (bound.ok)
                         return redirect(response, `/agents?run=${shown.id}&said=steered&sent=${keyRaw}`);
                     if (bound.reason === "attempt-ended" || bound.reason === "task-finished")
@@ -1717,7 +1424,6 @@ export function createTasksHandlers(runtime) {
                         return redirect(response, `/agents?run=${shown.id}&said=steer-invalid`);
                     return redirect(response, `/agents?run=${shown.id}&said=steer-stale`);
                 }
-                // The session IS the verified principal here — cookie + CSRF proved it.
                 const filed = store.fileSteerNote(taskId, verifiedAuthor(who.name), body.get("note") ?? "", now);
                 if (!filed.ok) {
                     const said = filed.reason === "task-finished"
@@ -1731,10 +1437,8 @@ export function createTasksHandlers(runtime) {
             }
             case "reply": {
                 const body = readForm(posted, CONSOLE_FORMS.taskReply);
-                // A reply is steering, so it is a browser session's act too.
                 if (who.via !== "cookie")
                     return refuse(response, who, 403, "replying to an agent is a browser session's act");
-                // The same gates as a pause: the route's act scope already refuses a viewer; these say why, and the demo answers nothing.
                 if (who.role !== "approver")
                     return taskScreen(response, who, taskId, "your login can watch — replying to an agent is an approver's act", 403);
                 if (store.isDemo())
@@ -1754,19 +1458,11 @@ export function createTasksHandlers(runtime) {
                 if (reason.length > 200 || hasForbiddenControls(reason)) {
                     return taskScreen(response, who, taskId, "that reason will not render, so it will not store", 400);
                 }
-                // Operator-owned only, always: the form supplies a reason, never an
-                // owner. Decision, incident, and backoff holds are not reachable
-                // from here, whatever a request claims.
                 store.hold(ref.id, reason, null, now);
                 return redirect(response, taskHref(taskId));
             }
             case "block": {
                 const body = readForm(posted, CONSOLE_FORMS.taskBlock);
-                // Chains are scheduling, not authority (chains-and-next review,
-                // finding 2): the edge decides WHEN the ready set admits the task;
-                // approval still decides WHAT may build. Both ends are re-proved
-                // here — existence and ceiling — and the
-                // cycle refusal comes from the store's own closure check.
                 const on = (body.get("on") ?? "").trim();
                 const blocker = on === "" ? null : store.getTask(on);
                 const blockerRef = on === "" ? null : store.lookupRef(on);
@@ -1850,8 +1546,6 @@ export function createTasksHandlers(runtime) {
             }
             case "reopen": {
                 const body = readForm(posted, CONSOLE_FORMS.taskReopen);
-                // Authenticated like every approving act: the session alone may
-                // read; resuming external work takes the password, typed again.
                 const token = (body.get("token") ?? "").trim();
                 const authenticated = token !== "" ? authenticateApprover(who, token) : null;
                 if (authenticated === null || !authenticated.ok) {
@@ -1878,7 +1572,6 @@ export function createTasksHandlers(runtime) {
                 return redirect(response, taskHref(taskId));
             }
             case "stop-carrying": {
-                // One click, any active approver (release-once.md): later commits of this release ask again. Only ever stricter.
                 const found = releaseAuthorityOfTask(store, taskId);
                 if (found === null)
                     return taskScreen(response, who, taskId, "This task isn't part of a release.", 409);
@@ -1889,29 +1582,33 @@ export function createTasksHandlers(runtime) {
             }
             case "requeue": {
                 const body = readForm(posted, CONSOLE_FORMS.taskRequeue);
-                // Retry may carry a note for the next attempt: the same steering note, checked before anything changes.
                 const note = (body.get("note") ?? "").trim();
                 if (note !== "" && who.via !== "cookie")
                     return refuse(response, who, 403, "steering is a browser session's act");
                 if (note !== "" && !validateNote(note).ok)
                     return taskScreen(response, who, taskId, "that note will not store, so nothing was retried", 400);
-                const requeued = store.requeueTask(taskId, who.name, now);
-                if (!requeued.ok) {
-                    return taskScreen(response, who, taskId, `not requeued: ${requeued.reason}`, 409);
+                let replayed = false;
+                if (who.via === "cookie" && who.authority === "local-owner") {
+                    const retried = localOwnerRetry(store, taskId, body.get("run"), body.get("digest"), now);
+                    if (!retried.ok)
+                        return taskScreen(response, who, taskId, retried.message, retried.status);
+                    replayed = retried.replayed;
+                }
+                else {
+                    const requeued = store.requeueTask(taskId, who.name, now);
+                    if (!requeued.ok) {
+                        return taskScreen(response, who, taskId, `not requeued: ${requeued.reason}`, 409);
+                    }
                 }
-                if (note !== "") {
+                if (note !== "" && !replayed) {
                     const filed = store.fileSteerNote(taskId, verifiedAuthor(who.name), note, now);
                     if (!filed.ok)
                         return taskScreen(response, who, taskId, "Retried. The note wasn't saved; add it under Steering.", 409);
                 }
-                // Allow-listed return only — never an arbitrary URL from the form.
                 return redirect(response, body.get("return") === "inbox" || body.get("return") === "next" ? "/" : taskHref(taskId));
             }
             case "follow-up": {
                 const body = readForm(posted, CONSOLE_FORMS.taskFollowUp);
-                // A scout's proposed follow-up, filed by the operator's tap (mate
-                // arc §10): the ONE filing door, this task's repository, the scope
-                // text stamped as the scout's — mode coverage never seals it.
                 const indexRaw = body.get("index") ?? "";
                 if (!/^[0-9]{1,2}$/.test(indexRaw))
                     return taskScreen(response, who, taskId, "which follow-up?", 400);
@@ -1925,10 +1622,6 @@ export function createTasksHandlers(runtime) {
                     return taskScreen(response, who, taskId, "this task has no repository — file the follow-up by hand", 409);
                 if (!visible(ref.repo))
                     return taskScreen(response, who, taskId, "that repository is outside what this server shows", 403);
-                // Idempotent by construction (v4 review, finding 10): the filing's
-                // id is derived from the source task, the report's run, and the
-                // follow-up's place — a retried POST lands on the task the first
-                // one filed instead of minting a twin.
                 const followUpId = `${taskId.slice(0, 40)}-r${view.run}-f${Number(indexRaw) + 1}`;
                 if (store.getTask(followUpId) !== null)
                     return redirect(response, taskHref(followUpId));
@@ -1937,10 +1630,6 @@ export function createTasksHandlers(runtime) {
                     title: followUp.title,
                     repo: ref.repo,
                     goal: followUp.goal,
-                    // v39: the scout's report format does not yet draft a rubric
-                    // per follow-up — a placeholder names the operator's own
-                    // review as the outstanding work, the same posture a
-                    // coordinator's bare intent takes.
                     acceptance: PLACEHOLDER_RUBRIC,
                     filedVia: "console", filedBy: { name: who.name, kind: "person" },
                     proposedVia: "scout",
@@ -1954,14 +1643,15 @@ export function createTasksHandlers(runtime) {
                 return redirect(response, taskHref(filed.id));
             }
             case "plan": {
-                // The operator's explicit ask, refused transactionally when the
-                // moment has passed — approved scope, live claim, or a plan
-                // already under way (Codex planning review's requestPlan guard).
+                if (who.via === "cookie" && who.authority === "local-owner") {
+                    const asked = localOwnerPlan(store, taskId, readForm(posted, CONSOLE_FORMS.taskPlan).get("source"), now);
+                    return asked.ok ? redirect(response, taskHref(taskId)) : taskScreen(response, who, taskId, asked.message, asked.status);
+                }
                 const asked = store.requestPlan(ref.id, now);
                 if (!asked.ok) {
                     return taskScreen(response, who, taskId, `not planned: ${asked.reason}`, 409);
                 }
-                if (who.via === "cookie")
+                if (who.via === "cookie" && who.authority === "full")
                     authorizePlanUnderMode(store, taskId, who.name, now);
                 return redirect(response, taskHref(taskId));
             }
@@ -2025,10 +1715,6 @@ export function createTasksHandlers(runtime) {
             case "accept-revision":
             case "reject-revision": {
                 const body = readForm(posted, CONSOLE_FORMS.taskRevision);
-                // Adaptive execution plans (v44): resolving a revision the builder
-                // filed while its authority snapshot no longer matched the run it
-                // started under — the ONLY road a 'blocked' plan_revision reaches,
-                // since a plan-only proposal auto-applies without ever pausing here.
                 if (who.via !== "cookie") {
                     return refuse(response, who, 403, "resolving a plan revision is a browser session's act");
                 }
@@ -2039,9 +1725,6 @@ export function createTasksHandlers(runtime) {
                 }
                 const outcome = verb === "accept-revision" ? "applied" : "rejected";
                 if (outcome === "applied") {
-                    // Accepting a revision that changed signed scope or publication
-                    // authority takes the password ceremony again — the same act
-                    // that would be required to approve that authority from scratch.
                     const token = (body.get("token") ?? "").trim();
                     if (!authenticateApprover(who, token).ok) {
                         return taskScreen(response, who, taskId, "accepting this revision takes your password, typed again", 403);
@@ -2070,23 +1753,10 @@ export function createTasksHandlers(runtime) {
             }
             case "route": {
                 const body = readForm(posted, CONSOLE_FORMS.taskRoute);
-                // THE AGENTS EDIT (v47): an approver's session sets the size,
-                // overrides one role to an exact agent, or clears an override — ONE
-                // authenticated transaction in the store that CAS-checks the scope
-                // digest the form rendered (empty = "I saw no scope"), records the
-                // change under this name, reconciles the planner pin, re-files the
-                // scope so a sealed route goes visibly stale, and re-requests a
-                // drafted plan when the planner changed. The viewer gate above
-                // already refused a watcher; a live claim refuses
-                // inside the transaction.
                 const sizeGiven = body.get("size");
                 const riskyGiven = body.getAll("risky");
                 const phaseGiven = body.get("phase");
                 const clearGiven = body.get("clear-phase");
-                // The agent arrives as the form's `provider|model` choice (v48) or,
-                // for older clients, as separate fields — either way it must be one
-                // of the CONFIGURED, role-valid choices right now: the form offers
-                // nothing else, and the server believes nothing else.
                 const agentGiven = (body.get("agent") ?? "").trim();
                 const providerGiven = agentGiven === "" ? body.get("provider") : agentGiven.slice(0, agentGiven.indexOf("|") === -1 ? agentGiven.length : agentGiven.indexOf("|"));
                 const modelGiven = agentGiven === "" ? (body.get("model") ?? "").trim() : agentGiven.indexOf("|") === -1 ? "" : agentGiven.slice(agentGiven.indexOf("|") + 1).trim();
@@ -2098,7 +1768,6 @@ export function createTasksHandlers(runtime) {
                     return taskScreen(response, who, taskId, "size is small, medium, or large", 400);
                 if (riskyGiven.some(one => one !== "yes" && one !== "no"))
                     return taskScreen(response, who, taskId, "risky is yes or no", 400);
-                // A size keeps the task's risky flag unless the form says otherwise; marking risky keeps the size.
                 const sizeEdit = sizeGiven === null && riskyGiven.length === 0 ? undefined : {
                     size: sizeGiven !== null && isTaskSize(sizeGiven) ? sizeGiven : ref.sizing?.size ?? "medium",
                     risky: riskyGiven.includes("yes") ? true : riskyGiven.includes("no") ? false : ref.sizing?.risky ?? false,
@@ -2118,17 +1787,12 @@ export function createTasksHandlers(runtime) {
                     if ((phaseGiven === "plan" || phaseGiven === "review") && isAcpProvider(providerGiven))
                         return taskScreen(response, who, taskId, `${ACP_AGENTS[providerGiven].name} builds and repairs only — choose another agent to ${phaseGiven}`, 400);
                 }
-                // The configured-choice proof lives INSIDE the edit transaction
-                // (`configured`): the pair is held to the role's choices under the
-                // configuration standing at that instant, and a stale choice
-                // mutates nothing.
                 const edited = store.editTaskRoute(ref.id, {
                     by: who.name,
                     authenticate: () => {
                         const account = store.accountOf(who.name);
                         return account !== null && account.revokedAt === null && account.role === "approver" ? { ok: true } : { ok: false, reason: "your login is no longer an approver" };
                     },
-                    // A person's size replaces the classifier's; the risky flag rides with it.
                     ...(sizeEdit === undefined ? {} : { size: sizeEdit }),
                     ...(phase === null
                         ? {}
@@ -2139,7 +1803,6 @@ export function createTasksHandlers(runtime) {
                 if (!edited.ok) {
                     return taskScreen(response, who, taskId, edited.reason === "not-configured" ? `agents not changed: ${edited.detail}` : edited.detail, edited.reason === "unauthenticated" ? 403 : edited.reason === "nothing" || edited.reason === "not-configured" ? 400 : 409);
                 }
-                // v102: changing how a task runs is authoring it — the requester rule then refuses this person too.
                 const routed = store.getScope(taskId);
                 if (routed !== null)
                     store.recordScopeAuthor(taskId, routed.digest, who.name, now);
@@ -2173,14 +1836,11 @@ export function createTasksHandlers(runtime) {
                     : qualityGiven === "default"
                         ? "default"
                         : ref.qualityMode ?? store.qualityDefault().mode;
-                // The optional per-attempt dollar cap (v15) rides the same form.
                 const budgetGiven = (body.get("budget-usd") ?? "").trim();
                 const budgetUsd = budgetGiven === "" ? null : Number(budgetGiven);
                 if (budgetUsd !== null && (!Number.isFinite(budgetUsd) || budgetUsd <= 0)) {
                     return taskScreen(response, who, taskId, "the dollar cap is a positive amount", 400);
                 }
-                // The approval sheet's in-place editor carries the cap it was shown
-                // exactly, in millionths, and "none" for no limit (never a default).
                 const exactBudgetGiven = body.get("budget-microusd");
                 const exactBudget = exactBudgetGiven === null ? undefined : exactBudgetGiven === "none" ? null : /^[1-9][0-9]{0,14}$/.test(exactBudgetGiven) ? Number(exactBudgetGiven) : NaN;
                 if (Number.isNaN(exactBudget))
@@ -2189,13 +1849,6 @@ export function createTasksHandlers(runtime) {
                 let saved;
                 try {
                     saved = store.transact(() => {
-                        // C1/M3: the signer's own credentialed filing auto-approves —
-                        // coverage is asked INSIDE this transaction, the escalated
-                        // default and budget ride the filing, and the seal commits
-                        // atomically with it.
-                        // COOKIE ONLY (C1's channel table; surfaces round 1, finding 1):
-                        // bearer credentials are for machines, and a machine road must
-                        // never spend the signer's mode.
                         const coverage = who.via === "cookie"
                             ? modeFilingCoverage(store, ref.repo, who.name, now)
                             : null;
@@ -2205,7 +1858,6 @@ export function createTasksHandlers(runtime) {
                             goal: body.has("goal-brief") ? `${(body.get("goal") ?? "").trim()}${body.get("goal-brief")}` : body.get("goal") ?? "",
                             outOfScope: body.get("not") ?? null,
                             touches: (body.get("touches") ?? "").split(/[\n,]/),
-                            // The approval sheet's in-place editor sends Done when line by line.
                             acceptance: inPlace
                                 ? requirementsFromEditor(body, before?.acceptance ?? [])
                                 : acceptanceLinesToInput((body.get("acceptance") ?? "").split("\n")),
@@ -2230,9 +1882,6 @@ export function createTasksHandlers(runtime) {
                                 message: proposed.message ?? (proposed.reason === "acceptance-required" ? "Not saved: add at least one requirement under Done when." : `scope not saved: ${proposed.reason}`),
                             };
                         }
-                        // Editing the plan in place never changes what the agent may do:
-                        // a save that would (a legacy setting, a newer policy or mode)
-                        // rolls back whole.
                         if (inPlace && before?.profile != null && proposed.scope.profile != null && levelOfProfile(before.profile) !== levelOfProfile(proposed.scope.profile)) {
                             throw new PermissionsWouldChange();
                         }
@@ -2243,7 +1892,6 @@ export function createTasksHandlers(runtime) {
                             const filedScope = store.getScope(taskId);
                             if (filedScope?.profileState === "resolved") {
                                 const sealedUnderMode = store.sealScopeApproval(taskId, who.name, now, {}, { kind: "mode", modeDigest: coverage.digest });
-                                // The quarantine speaks at the caller (review finding 7).
                                 if (!sealedUnderMode) {
                                     return { ok: false, status: 200, message: "scope saved — coordinator-filed: mode coverage cannot admit it; sign the scope" };
                                 }
@@ -2258,8 +1906,6 @@ export function createTasksHandlers(runtime) {
                     saved = { ok: false, status: 409, message: "Not saved: this would change what the agent may do. Change permissions in Details, under edit the scope." };
                 }
                 if (!saved.ok) {
-                    // Refused because the plan moved on: the draft comes back with the version now on file, so saving it
-                    // again (having read the reason) can succeed instead of being refused the same way.
                     const draft = new URLSearchParams(body.sent);
                     if (saved.status === 409)
                         draft.set("sawDigest", store.getScope(taskId)?.digest ?? "");
@@ -2277,13 +1923,10 @@ export function createTasksHandlers(runtime) {
                     : requestedReturn === null
                         ? taskHref(taskId)
                         : safeChatReturn(requestedReturn);
-                // The release sheet's Approve release (trusted-release-reports.md A7): the same door, its own page for words.
                 const sheet = body.get("sheet") === "release";
-                // Each caller names its outcome (live-pages-and-home.md B2.3); none is inferred from the status.
                 const approvalProblem = (outcome, message, status) => {
                     if (sheet)
                         return releaseSheet.sheetScreen({ who, response, project: null }, taskId, message, status);
-                    // Asked in place: the same proofs ran, only the answer's shape differs.
                     if (answersInPlace(request))
                         return answerApprovalInPlace(response, outcome, message, status);
                     if (requestedReturn !== null && requestedReturn !== "next") {
@@ -2295,23 +1938,16 @@ export function createTasksHandlers(runtime) {
                 if (approvingRef?.plan === "requested") {
                     return approvalProblem("refused", "approval is blocked while planning is in progress — review the drafted plan first", 409);
                 }
-                // Step-up: the session got you here; only the token agrees. The
-                // digest names what was seen; the nonce proves this exact form was
-                // rendered to this approver and is spent either way.
                 const digest = body.get("digest") ?? "";
                 const token = body.get("token") ?? "";
                 const nonce = body.get("nonce") ?? "";
                 if (!consumeApprovalNonce(nonce, who.name, taskId, digest)) {
                     return approvalProblem("refused", "that approval form is stale — read it again", 409);
                 }
-                // An empty password stands for an explicit identity-provider re-check not yet spent, or (cockpit B2) a password
-                // remembered on this session; approve() decides whether these terms may stand on a remembered one.
-                // Easy-start C5: a laptop's local owner approves eligible work with no password (approve() proves it again).
                 if (token === "" && !passwordlessSessionFor(store, who.name) && !ssoNowAvailable(who.name) && withFreshness("approve-standard", () => freshnessFor(who.name)) === null
                     && !(who.authority === "local-owner" && localApprovalEligible(store, who.name, taskId).ok)) {
                     return approvalProblem("refused", "approval requires your password, typed again", 400);
                 }
-                // The sheet binds the release card's digest (the nonce was minted for it): the shared card wrapper decides.
                 if (sheet)
                     return releaseSheet.approveFromSheet({ who, response, project: null }, taskId, digest, token);
                 const scopeRow = store.getScope(taskId);
@@ -2322,21 +1958,14 @@ export function createTasksHandlers(runtime) {
                 if (digest !== expectedDigest) {
                     return approvalProblem("refused", "the scope or plan changed while this form was open — read the latest version and approve again", 409);
                 }
-                // A revision approves ONLY against a brief that still verifies
-                // (Codex M5-M8 audit, IV-3): the batch the screen restated must be
-                // provably the batch on disk at the moment of the yes — a brief
-                // deleted or corrupted between render and click blocks the
-                // approval instead of silently approving comment-free work.
                 if (approvingRef !== null && approvingRef.revisionBriefArtifact !== null) {
                     const view = revisionViewOf(approvingRef);
                     if (view !== null && "problem" in view) {
                         return approvalProblem("refused", `approval is blocked: ${view.problem}`, 409);
                     }
                 }
-                // A re-check is spent only if this yes is kept (sealed, or a protected-work vote recorded).
                 const approved = spendingOnlyOnSuccess(() => withFreshness("approve-standard", () => approveScope(store, taskId, who.name, now, scopeRow.digest, token)), result => !result.ok && !(result.reason === "second-approver" && !result.already));
                 if (!approved.ok) {
-                    // v102: a first yes on protected work is recorded, not refused — the page says who else is needed.
                     if (approved.reason === "second-approver")
                         return approvalProblem("vote", gateWords({ verdict: "vote", have: approved.have, need: 2, already: approved.already }), 200);
                     if (approved.reason === "policy")
@@ -2344,13 +1973,9 @@ export function createTasksHandlers(runtime) {
                     const status = approved.reason === "changed" || approved.reason === "unrouted" ? 409 : 403;
                     return approvalProblem("refused", approveRefusalWords(approved.reason), status);
                 }
-                // Approve & build again (the plan was rewritten after a build): the same yes requeues, only for the build the
-                // sheet named, and only while it is still the task's latest result, made to an earlier plan than this one.
                 const rebuildRaw = body.get("rebuild") ?? "";
                 if (rebuildRaw !== "") {
                     const named = /^[0-9]{1,15}$/.test(rebuildRaw) ? store.getRun(Number(rebuildRaw)) : null;
-                    // Built to an earlier plan than the one just approved (the scope this approval sealed, scopeRow.digest);
-                    // requeueTask re-proves, in its own transaction, that it is still the latest result and that scope approved.
                     const offered = named != null && named.taskRef === ref.id && named.role === "builder" && !!named.scopeDigest && named.scopeDigest !== scopeRow.digest;
                     const requeued = offered ? store.requeueTask(taskId, who.name, now, { run: named.id, scopeDigest: scopeRow.digest }) : null;
                     if (requeued === null || (!requeued.ok && requeued.reason === "moved"))
@@ -2364,13 +1989,9 @@ export function createTasksHandlers(runtime) {
             }
             case "accept-proof": {
                 const body = readForm(posted, CONSOLE_FORMS.taskAcceptProof);
-                // Accepting is a person's act, like approving a scope (Priority
-                // 2): a cookie session only, never a bearer credential.
                 if (who.via !== "cookie") {
                     return refuse(response, who, 403, "accepting a proof is a browser session's act");
                 }
-                // v40 fix: a reviewer run is never the attempt whose proof is
-                // being accepted.
                 const latest = store.runsFor(ref.id).find(runIsTaskResult);
                 if (latest === undefined) {
                     return taskScreen(response, who, taskId, "this task has no finished attempt to accept", 404);
@@ -2388,9 +2009,7 @@ export function createTasksHandlers(runtime) {
                     }
                     note = validated.note;
                 }
-                // A failed task's result is accepted only anyway, on purpose: with a reason.
                 if (note === null && store.getTask(taskId)?.state === "failed") {
-                    // Posted from the result page: back there, where the reason field is, with the refusal said on it.
                     const back = body.get("return") === null ? null : safeReturn(body.get("return"));
                     if (back !== null && back.startsWith("/review?"))
                         return redirect(response, withRefusal(back, "reason"));
@@ -2401,7 +2020,6 @@ export function createTasksHandlers(runtime) {
             }
             case "complete": {
                 const body = readForm(posted, CONSOLE_FORMS.taskComplete);
-                // The row admits only an approver's browser session; the principal re-proves that session's standing.
                 const principal = who.via === "cookie" ? leadPrincipal(who) : null;
                 if (principal === null)
                     return refuse(response, who, 403, "Your access changed. Sign in again.");
@@ -2412,8 +2030,6 @@ export function createTasksHandlers(runtime) {
                     return taskScreen(response, who, taskId, "This result changed. Open the current result before marking it complete.", 409);
                 }
                 if (body.get("accept") === "1") {
-                    // Accept and finish: the person's acceptance and the completion of what it accepted, in one request
-                    // and one transaction. The receipt named is the one read, before accepting.
                     const rawNote = (body.get("note") ?? "").trim();
                     let note = null;
                     if (rawNote !== "") {
@@ -2429,8 +2045,6 @@ export function createTasksHandlers(runtime) {
                     return redirect(response, publish ? `${taskHref(familyOf(taskId)?.root.id ?? taskId)}#merge` : body.get("return") === null ? reviewHref(taskId, Number(namedRun)) : safeReturn(body.get("return")));
                 }
                 if (body.get("publish") === "1") {
-                    // "Complete and open a pull request": the same exact-receipt completion, plus the owed PR for this
-                    // exact commit in one transaction. The watch process pushes and opens it; the task shows its progress.
                     const opened = completeAndOpenPullRequest(store, { taskId, digest, runId: Number(namedRun), who: principal, root: evidenceRoot }, now);
                     if (!opened.ok)
                         return taskScreen(response, who, taskId, opened.message, 409);
@@ -2439,7 +2053,6 @@ export function createTasksHandlers(runtime) {
                 const completed = checkAssignmentAsOperator(store, taskId, digest, principal, now, evidenceRoot);
                 if (!completed.ok)
                     return taskScreen(response, who, taskId, completed.message, 409);
-                // Back where it was completed (the task page's Result tab, or the result page), as Accept and finish does.
                 return redirect(response, body.get("return") === null ? reviewHref(taskId, Number(namedRun)) : safeReturn(body.get("return")));
             }
             case "retry-review": {
@@ -2447,12 +2060,6 @@ export function createTasksHandlers(runtime) {
             }
             case "stop": {
                 const body = readForm(posted, CONSOLE_FORMS.taskStop);
-                // The exact-run stop (v52): a browser session's act, an approver's
-                // act, naming ONE run. The store's transaction proves the run is
-                // this task's current live attempt and records who asked before
-                // any process is signalled; the answer is "stopping", never
-                // "stopped". A repeated post is the same request; a stale one (a
-                // finished run, a successor) is refused in words.
                 if (who.via !== "cookie")
                     return refuse(response, who, 403, "stopping a task is a browser session's act");
                 if (who.role !== "approver")
@@ -2474,7 +2081,6 @@ export function createTasksHandlers(runtime) {
                     return taskScreen(response, who, taskId, words[asked.reason] ?? asked.detail, 409);
                 }
                 const back = body.get("return") ?? "";
-                // From the Agents board: back to the same agent, saying what happens now.
                 if (back === "agents")
                     return redirect(response, `/agents?run=${Number(named)}&said=stopping`);
                 const stopFlow = returnedFlow(back);
@@ -2484,10 +2090,6 @@ export function createTasksHandlers(runtime) {
             }
             case "pause": {
                 const body = readForm(posted, CONSOLE_FORMS.taskPause);
-                // Pause, and Pause and steer (live steering): a browser session's act, an approver's act, naming the ONE run
-                // the page showed under the page's own request id. It stops the running Claude build's turn and keeps the
-                // build; a note that rides along is filed in the same transaction and sent right after. mode=resume continues a
-                // paused build with no note. Never a stop.
                 if (who.via !== "cookie")
                     return refuse(response, who, 403, "pausing a build is a browser session's act");
                 if (who.role !== "approver")
@@ -2498,7 +2100,6 @@ export function createTasksHandlers(runtime) {
                 if (!/^[0-9]{1,15}$/.test(named))
                     return taskScreen(response, who, taskId, "which build? a pause names one exact run", 400);
                 const note = (body.get("note") ?? "").trim();
-                // Resume: the paused build goes on where it stopped; no note is filed.
                 const asked = body.get("mode") === "resume"
                     ? store.requestResume({ taskId, runId: Number(named), by: verifiedAuthor(who.name), via: "web", requestId: body.get("request") ?? "" }, now)
                     : store.requestPause({ taskId, runId: Number(named), by: verifiedAuthor(who.name), via: "web", requestId: body.get("request") ?? "", ...(note === "" ? {} : { note }) }, now);
@@ -2514,14 +2115,10 @@ export function createTasksHandlers(runtime) {
                     return taskScreen(response, who, taskId, words[asked.reason] ?? asked.detail, asked.reason === "invalid-note" ? 400 : 409);
                 }
                 const back = body.get("return") ?? "";
-                // A note that rode along came from a composer's draft: its key comes back, so only that draft clears.
                 const keyRaw = body.get("key") ?? "";
-                // Only a note this request actually stored clears its draft: a repeated request answers with the note it stored
-                // the first time, and a draft edited since is not that note.
                 const storedId = "note" in asked && typeof asked.note === "number" ? asked.note : null;
                 const stored = storedId === null ? null : store.handle.prepare("SELECT note FROM task_steer WHERE id = ?").get(storedId)?.["note"];
                 const sent = note !== "" && /^[A-Za-z0-9-]{8,64}$/.test(keyRaw) && typeof stored === "string" && stored.trim() === note ? keyRaw : null;
-                // A note that rode along but is not the one this request stored (a reused form): said plainly, the draft kept.
                 if (note !== "" && (typeof stored !== "string" || stored.trim() !== note)) {
                     if (back === "agents")
                         return redirect(response, `/agents?run=${Number(named)}&said=pause-note-stale`);
@@ -2542,11 +2139,6 @@ export function createTasksHandlers(runtime) {
             }
             case "resume": {
                 const body = readForm(posted, CONSOLE_FORMS.taskResume);
-                // The resume itself (v52): password typed again + the durable nonce
-                // consumed INSIDE the store's resume transaction against the digest
-                // re-derived from live state. A replay finds the nonce spent; a
-                // changed approval finds the digest moved; a successor attempt finds
-                // the run superseded — each refuses without starting work; a submitted nonce remains one-shot.
                 if (who.via !== "cookie")
                     return refuse(response, who, 403, "resuming a task is a browser session's act");
                 if (who.role !== "approver")
@@ -2594,10 +2186,6 @@ export function createTasksHandlers(runtime) {
                 return refuse(response, who, 404, "That action isn't available here.", taskHref(taskId));
         }
     }
-    /** The queue as a region: dispatch order per column, drag handles and
-     * all — the /queue page's body, and the board's "order" view (the one
-     * place dragging exists, because reordering and reserving are scheduling,
-     * never authority). */
     function queueRegionFor(project, csrf, revision, now) {
         const tasks = store.queueScoped(project, now).map(one => ({
             ...one,
@@ -2620,23 +2208,12 @@ export function createTasksHandlers(runtime) {
         }));
         return queueBody(tasks, workers, revision, store.queueRevision());
     }
-    /** An OBSERVED CI failure on a completed row's PR — the open episode the
-     * watcher recorded for exactly that repository and number; never a guess
-     * from quiet. One indexed publication read per row that has a PR. */
     function ciFailingFor(runId, prNumber) {
         if (runId === null || prNumber === null)
             return false;
         const publication = store.publicationForRun(runId);
         return publication !== null && publication.prNumber === prNumber && store.hasOpenCiEpisode(publication.githubRepo, prNumber);
     }
-    /**
-     * One completed row by task id, for a `?result=` deep link the bounded
-     * queue could not show — the done list's own predicate, re-proved per
-     * read: the task is done, sits in this project (or in none), and its
-     * repository passes the ceiling; the result run is the newest finished
-     * built/no-change builder or scout attempt. Anything else is
-     * null, and null reads exactly like a task that never existed.
-     */
     function completedRowFor(taskId, project) {
         const family = familyOf(taskId);
         if (family === null)
@@ -2652,15 +2229,6 @@ export function createTasksHandlers(runtime) {
             (one.role === "builder" || one.role === "scout")) ?? null;
         return resultRowOf(task, ref.repo, family.problem, run);
     }
-    /**
-     * A build attempt that didn't deliver a result (failed, refused, stopped,
-     * never finished) still has a result page: its changes, its checks and what
-     * went wrong. The row for one: the run named by `runId` when it is an ended
-     * builder or scout attempt of this task that isn't a delivered result, or a
-     * failed task's latest attempt; with no run named, that latest attempt. The
-     * same admission as a completed row: in this project (or none) and inside
-     * the ceiling. Null otherwise, which reads like a task that never existed.
-     */
     function attemptRowFor(taskId, runId, project) {
         const family = familyOf(taskId);
         const task = store.getTask(taskId);
@@ -2672,7 +2240,6 @@ export function createTasksHandlers(runtime) {
         const attempts = store.runsFor(ref.id).filter(one => (one.role === "builder" || one.role === "scout") && (one.finishedAt !== null || one.outcome !== null));
         const latest = task.state === "failed" ? latestFinishedAttempt(attempts) : null;
         const run = runId !== null ? attempts.find(one => one.id === runId) ?? null : latest;
-        // A delivered result has its completed row; a failed task's latest attempt is what failed, whatever it ended as.
         if (run === null || runIsLive(run) || ((run.outcome === "built" || run.outcome === "no-change") && run.id !== latest?.id))
             return null;
         return resultRowOf(task, ref.repo, family.problem, run);
@@ -2708,8 +2275,6 @@ export function createTasksHandlers(runtime) {
     function reviewCockpitViewOf(row, who, now) {
         const ref = store.lookupRef(row.taskId);
         const scope = store.getScope(row.taskId);
-        // The result run, read once: the shared result detail below hangs off
-        // this one record.
         const run = row.runId === null ? null : store.getRun(row.runId);
         const intent = scope === null
             ? null
@@ -2767,39 +2332,27 @@ export function createTasksHandlers(runtime) {
                 summary: detail.handoff?.conclusion ?? run.handoff,
             },
             detail,
-            // How it ran: derived from the run's own records once it has finished, display only. A read ahead of the page's
-            // link (x-toolroll-read: prefetch) derives it and saves nothing.
             efficiency: (() => { try {
                 return runEfficiencyOf(store, evidenceRoot, run.id, now, requestContext.getStore()?.readPurpose !== "prefetch");
             }
             catch {
                 return null;
             } })(),
-            // What its network was and what its proxy saw (egress.ts), display only.
             network: store.runNetwork(run.id),
-            // Where the time went: its release check's parts and the task's deploys (latency-timeline.ts), display only.
             timing: timingFor(store, run.id, row.taskId),
-            // How far its checks reached (check-access.ts), display only.
             checkAccess: store.runCheckAccess(run.id),
-            // How its checks actually ran, by what was stamped at launch: said only for a result whose checks ran.
             checkRan: store.artifactsFor(run.id).some(one => one.kind === "check-log") ? ranWords(runCheckStamp(store, run.id)) : null,
             reviewRetry: store.reviewRetryStateOf(run.id),
             review: reviewFactsFor(run.id),
             notes: store.notesForRun(run.id),
         };
     }
-    // ---- evidence ------------------------------------------------------------
     function decisionEvidence(response, decisionId, artifactId) {
-        // The ceiling applies to decision evidence exactly as to run evidence
-        // (v2 review, finding 2): a decision whose task belongs to a repo this
-        // server may not serve does not exist here, and neither do its bytes.
         const decision = store.getDecision(decisionId);
         const decisionRun = decision === null ? null : store.getRun(decision.run);
         if (decisionRun !== null && !visible(taskRepoOf(decisionRun.taskRef))) {
             return respond(response, 404, "text/plain; charset=utf-8", "no such evidence");
         }
-        // Only through the decision's own relation — an artifact id from another
-        // run simply is not in this list, whatever the URL claims.
         const linked = store.evidenceFor(decisionId).find(one => one.id === artifactId);
         if (linked === undefined) {
             return respond(response, 404, "text/plain; charset=utf-8", "no such evidence");
@@ -2811,8 +2364,6 @@ export function createTasksHandlers(runtime) {
         if (run === null || !runVisible(run)) {
             return respond(response, 404, "text/plain; charset=utf-8", "no such run");
         }
-        // Membership is the lookup's own predicate — there is no way to check
-        // the run and fetch the artifact as two separate acts here.
         const linked = store.artifactForRun(runId, artifactId);
         if (linked === null) {
             return respond(response, 404, "text/plain; charset=utf-8", "no such evidence");
@@ -2824,9 +2375,6 @@ export function createTasksHandlers(runtime) {
         if (!read.ok) {
             return respond(response, 410, "text/plain; charset=utf-8", "the evidence no longer matches its record");
         }
-        // A validated screenshot is the one evidence kind meant to render
-        // inline (thumbnails, full-image links) — every other kind stays a
-        // downloaded text record, exactly as before.
         if (linked.kind === "screenshot") {
             const imageType = linked.key.endsWith(".png") ? "image/png" : linked.key.endsWith(".jpg") ? "image/jpeg" : null;
             if (imageType !== null) {
@@ -2842,7 +2390,6 @@ export function createTasksHandlers(runtime) {
         });
         response.end(read.content);
     }
-    /** The full guard list (v3 §4) — run on every request, hit or miss. */
     function peekGuards(runId) {
         if (options.localRunner === undefined || options.poolRoot === undefined) {
             return { ok: false, message: "live peek is off — start serve with --runner <name> naming this machine's runner", final: true };
@@ -2852,17 +2399,11 @@ export function createTasksHandlers(runtime) {
             return { ok: false, message: "no such build", final: true };
         if (run.outcome !== null)
             return { ok: false, message: "this build has finished — the final diff below is the record", final: true };
-        // The reviewer role (v29): artifact-only, honestly — there is no
-        // checkout anywhere to watch, and there never was.
         if (run.worktree === null) {
             return { ok: false, message: "this run reviewed the sealed diff — no workspace existed to watch", final: true };
         }
         if (run.baseRevision === null)
             return { ok: false, message: "the build has not settled its starting point yet" };
-        // The run's lease must be the task's CURRENT live lease — max generation,
-        // unreleased, strictly unexpired. liveClaimByLease proves only that the
-        // lease exists; a superseded lease would still pass it (round-4
-        // finding 15), and superseded is forever, so the poller may stop.
         if (store.currentLiveLease(run.taskRef, clock()) !== run.leaseId) {
             return { ok: false, message: "the build is not actively running right now", final: true };
         }
@@ -2872,8 +2413,6 @@ export function createTasksHandlers(runtime) {
         if (row.runner !== options.localRunner) {
             return { ok: false, message: "this build runs on another machine — open the console there to watch it", final: true };
         }
-        // Adoption-path rows can carry no epoch (round-3 finding 37): no fence,
-        // no peek — never a guess.
         if (row.leaseEpoch === null || row.leaseEpoch === undefined) {
             return { ok: false, message: "this checkout was set up before live watching existed — the next fresh build can be watched", final: true };
         }
@@ -2887,8 +2426,6 @@ export function createTasksHandlers(runtime) {
         catch {
             return { ok: false, message: "the checkout could not be found on this machine" };
         }
-        // The snapshot: exactly one successful, untruncated base-tree artifact
-        // whose envelope binds THIS run and THIS base (round-3 finding 42).
         const artifact = store.artifactsFor(runId).find(one => one.kind === "base-tree");
         if (artifact === undefined)
             return { ok: false, message: "no base snapshot was captured for this build" };
@@ -2904,7 +2441,6 @@ export function createTasksHandlers(runtime) {
         }
         return { ok: true, admit: { run, worktree: run.worktree, epoch: row.leaseEpoch, entries: snapshot } };
     }
-    /** The live subset of a bounded run page \u2014 one indexed lookup per row. */
     function liveRunIds(rows) {
         const live = new Set();
         for (const run of rows)
@@ -2914,7 +2450,6 @@ export function createTasksHandlers(runtime) {
     }
     const tidyHandlers = createTidyHandlers(runtime);
     const releaseSheet = createReleaseSheetHandlers(runtime);
-    /** The question page, with a refusal in its box when an answer was refused (the box keeps the choice to make). */
     function decisionScreen(ctx, id, back, refusal, code, now, draft) {
         const { who, response, project } = ctx;
         const decision = store.getDecision(id);
@@ -2941,13 +2476,10 @@ export function createTasksHandlers(runtime) {
         "code.changes-read": showCode("changes", true),
         "code.ship-preview": showCode("ship", true),
         "code.other": showCode("unknown"),
-        // Retired into Tasks and the task page (src/design/KIT.md): each old address still answers, as a redirect.
-        // Retired pages (docs/plans/plain-toolroll.md P1.4): permanent redirects, no page handler of their own.
         "inbox": async (ctx) => retiredRedirect("inbox", ctx.url, ctx.response),
         "work": async (ctx) => retiredRedirect("work", ctx.url, ctx.response),
         "next": async (ctx) => retiredRedirect("next", ctx.url, ctx.response),
         "board": async (ctx) => retiredRedirect("board", ctx.url, ctx.response),
-        // A result keeps its own page; the bare list moved to Tasks' Ready view.
         "review": async (ctx) => ctx.url.searchParams.has("result") ? showReview(ctx) : retiredRedirect("review", ctx.url, ctx.response),
         "done": async (ctx) => retiredRedirect("done", ctx.url, ctx.response),
         "tasks": showTasks,
@@ -3018,33 +2550,26 @@ export function createTasksHandlers(runtime) {
         "session.editor-links": sessionEditorLinks,
         "incident.resolve": resolveIncident,
     });
-    /** The add page, once more: blank, from a shipped template (`?template=`, as the old task list did), or with a refused
-     * filing's own words and status (the draft keeps the project revision it was written against). */
     function newTaskScreen(ctx, status, problem, draft, text = null) {
         const { who, response, project } = ctx;
         const chainable = store
             .listTasksScoped(project, undefined, 100, null)
             .filter(one => one.state !== "done" && one.state !== "cancelled" && visible(one.repo))
             .map(one => ({ id: one.id, title: one.title }));
-        // A refused draft keeps the task it was to start after, even if the refreshed list no longer carries it.
         const after = draft?.values?.get("after") ?? "";
         if (after !== "" && !chainable.some(one => one.id === after))
             chainable.unshift({ id: after, title: "(as submitted)" });
         const chrome = chromeFor(project, "tasks");
         const revision = draft?.values !== undefined ? undefined : who.via === "cookie" ? who.session.projectRevision : 0;
-        // Ideas for the project the box starts on: what the first run found there (issues, TODOs), else the safe generic
-        // ones while the first run is open; none once someone has filed work and nothing was found.
         const startsOn = draft?.values?.get("repo") ?? project ?? chrome.projects?.[0]?.path ?? null;
         const found = startsOn === null ? null : runtime.firstTasks.get(startsOn)?.found ?? null;
         const ideas = found ?? (runtime.firstRunStepsNow(ctx.now) !== null && !store.hasAnyWork() ? firstTaskSuggestions({ issues: [], todos: [] }) : []);
         return sendScreen(response, status, newTaskPage(chrome, project, revision, problem, chainable, store.permissionDefault().mode, store.qualityDefault().mode, chrome.projects ?? [], draft, text, ideas, ctx.url.searchParams.get("from")?.slice(0, 300) ?? null));
     }
-    /** What the password rule reads for this request (approval-password.ts), the same facts the approve forms read. */
     function fastPasswordFacts(who) {
         return { passwordless: passwordlessSessionFor(store, who.name), localOwner: who.via === "cookie" && who.authority === "local-owner",
             freshAt: withFreshness("approve-standard", () => freshnessFor(who.name, Date.now(), true))?.at ?? null, returnTo: "/tasks/new" };
     }
-    /** Build: the fast start's one write. Every check is made again inside fastStartBuild's transaction. */
     async function buildNow(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.tasksFast);
@@ -3064,7 +2589,6 @@ export function createTasksHandlers(runtime) {
             actionContext.createdTask = built.taskId;
         return redirect(response, taskHref(built.taskId));
     }
-    /** "Approve it to keep it": a fast start that grew gets a plan for its exact commit, on the ordinary approval. It seals nothing. */
     async function keepGrown(ctx) {
         const { url, who, response, now, posted } = ctx;
         readForm(posted, CONSOLE_FORMS.keepGrown);
@@ -3076,8 +2600,6 @@ export function createTasksHandlers(runtime) {
             return taskScreen(response, who, act.taskId, kept.message, 409);
         return redirect(response, taskHref(act.taskId));
     }
-    /** Findings, a failed check's repair and evidence (render-follow-through.ts). Nothing here is an approval: a repair is a
-     * draft, and its task page asks for the plan's approval as any other. */
     async function followThroughAct(ctx) {
         const { url, who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.followThrough);
@@ -3085,13 +2607,11 @@ export function createTasksHandlers(runtime) {
         if (act === null)
             return noPage(who, response);
         const { taskId } = act;
-        // Chat's gate, here too (findings.ts familyInReach): every project in this task's family, not only this page's.
         if (familyInWebReach(store, who, taskId, visible) === null)
             return refuse(response, who, 403, "That task is outside your access.", "/tasks");
         const number = (name) => Number(body.get(name) ?? "");
         const back = () => redirect(response, `${taskHref(taskId)}#findings`);
         const refused = (message) => taskScreen(response, who, taskId, message, 409);
-        /** A finding or a run named by a form must belong to this task's family: this page's project was the one admitted. */
         const ownFinding = () => { const found = getFinding(store, number("finding")); return found !== null && found.familyRoot === familyRootOf(store, taskId) ? found : null; };
         const ownRun = () => runOnTask(store, number("run"), taskId);
         switch (body.get("act")) {
@@ -3149,9 +2669,6 @@ export function createTasksHandlers(runtime) {
     }
     return { registrations, runListPane, peekFragment, taskMutation, queueRegionFor, ciFailingFor, completedRowFor, attemptRowFor, resultRowOf, reviewCockpitViewOf, decisionEvidence, runEvidence, sendArtifact, peekGuards, liveRunIds };
 }
-/** Put away and Restore one task, and Put away old tasks (docs/plans/task-tidy.md): the preview reads only (GET-quiet);
- * putting away many is an approver's step-up bound to the digest of exactly what the preview showed. Each write
- * re-proves the person's standing inside its own transaction. */
 export function createTidyHandlers(runtime) {
     const { store, sendScreen, chromeFor, authenticateApprover, workAccess, bustBadge } = runtime;
     async function showPutAway(ctx) {
@@ -3198,19 +2715,11 @@ export function createTidyHandlers(runtime) {
     return { "tasks.archive": showPutAway, "work.put-away": async (ctx) => retiredRedirect("work.put-away", ctx.url, ctx.response),
         "work.put-away.apply": applyPutAway, "task.act.archive": oneTask("archive"), "task.act.restore": oneTask("restore") };
 }
-/** A retired page's GET alias: a plain 302 (the shared 303 helper belongs to POST landings), as pages.ts morningAlias. */
 function redirectGet(response, to) {
     response.writeHead(302, { ...SAFETY, Location: to });
     response.end();
 }
-/** How many cards a Board column shows; the column's count covers them all and its "View all" opens the list. */
 export const BOARD_COLUMN_LIMIT = 40;
-/**
- * Easy-start C1 (N1): the two writes a page load used to make, as keyed POSTs the shell sends (wave 1c wires the
- * browser). `agents.seen`: a finished result this person opened leaves their unread Done. `agents.watch`: hold (on each
- * keep-alive) or release (on unload) the short lease that quiets chat pings while this person's page shows the agent.
- * Each re-proves the run is in the person's projects; a reply carries nothing else.
- */
 export function createAgentSignalHandlers(runtime) {
     const { store, runVisible } = runtime;
     const answer = (response, status, ok) => respond(response, status, "application/json", JSON.stringify({ ok }));
@@ -3225,7 +2734,6 @@ export function createAgentSignalHandlers(runtime) {
         const run = visibleRun(who, readForm(posted, CONSOLE_FORMS.agentSeen).get("run"));
         if (run === null)
             return answer(response, 404, false);
-        // Only once it finished: a page shown while it ran saw no finished version (cockpit §3).
         if (run.finishedAt === null)
             return answer(response, 409, false);
         markAgentSeen(store, who.name, run.id, now);
@@ -3249,17 +2757,9 @@ export function createAgentSignalHandlers(runtime) {
     }
     return { "agents.seen": agentSeen, "agents.watch": agentWatch };
 }
-/**
- * One-tap release approval (docs/plans/trusted-release-reports.md, slice A): the sheet (`/t/<id>/release`), the push's
- * opaque locator (`/approve/<task ref>`, a GET that only redirects to the sheet) and the sheet's approval, which the
- * task approval POST hands here once its shared checks (cookie session, CSRF and the browser key at admission, the
- * single-use nonce, a password or a standing proof) passed. The approval itself is the shared card wrapper around the
- * unchanged approve() (release-approval.ts approveReleaseCard).
- */
 export function createReleaseSheetHandlers(runtime) {
     const { store, sendScreen, chromeFor, visible, mintApprovalNonce, clock, authenticateApprover } = runtime;
     const missing = (who, response) => refuse(response, who, 404, "There's no release waiting for approval at this address.", "/work");
-    /** The sheet, with a problem said where it happened. */
     function sheetScreen(ctx, taskId, problem, status) {
         const { who, response, project } = ctx;
         const ref = store.lookupRef(taskId);
@@ -3270,7 +2770,6 @@ export function createReleaseSheetHandlers(runtime) {
             return missing(who, response);
         const card = built.card;
         const open = card.approved === null && card.refusal === null;
-        // This computer's local owner can't approve a release: the full sign-in comes first (scope.ts localApprovalEligible).
         const local = who.via === "cookie" && who.authority === "local-owner" ? localOwnerRefusal(store.accountOf(who.name)?.passwordSet === true, releaseSheetHref(taskId)) : null;
         const nonce = open && local === null && who.via === "cookie" && who.role === "approver" ? mintApprovalNonce(who.name, taskId, card.digest) : "";
         const remembered = (() => {
@@ -3290,7 +2789,6 @@ export function createReleaseSheetHandlers(runtime) {
             return missing(ctx.who, ctx.response);
         return sheetScreen(ctx, task.taskId, null, 200);
     }
-    /** The push's locator: proved a release in the person's projects from the plane's own state, then only redirected. */
     async function locate(ctx) {
         const { who, response, url } = ctx;
         const raw = /^\/approve\/([1-9][0-9]{0,14})$/.exec(url.pathname)?.[1];
@@ -3299,7 +2797,6 @@ export function createReleaseSheetHandlers(runtime) {
             return missing(who, response);
         return redirect(response, releaseSheetHref(ref.externalId));
     }
-    /** The sheet's Approve release, after the approval POST's shared checks. */
     function approveFromSheet(ctx, taskId, cardDigest, token) {
         const { who, response } = ctx;
         const now = clock();
@@ -3315,7 +2812,6 @@ export function createReleaseSheetHandlers(runtime) {
             return sheetScreen(ctx, taskId, refused.message, 403);
         return sheetScreen(ctx, taskId, approveRefusalWords(refused.reason), refused.reason === "changed" || refused.reason === "unrouted" ? 409 : 403);
     }
-    /** A held automatic release goes on: a person only, proved now. The watch then resumes it (release-next.ts). */
     async function goOn(ctx) {
         const { who, url, posted, now, response } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.releaseGoOn);
@@ -3334,8 +2830,18 @@ export function createReleaseSheetHandlers(runtime) {
     }
     return { routes: { "task.release": showSheet, "task.release.go-on": goOn, "release.locate": locate }, sheetScreen, approveFromSheet };
 }
-/** The answer to an approval asked in place: its named outcome and the same words the page would show, as JSON. Written
- * only after the approve route's proofs, by the caller that knows the outcome. */
 export function answerApprovalInPlace(response, outcome, words, status) {
     respond(response, status, "application/json; charset=utf-8", JSON.stringify({ outcome, words }));
 }
+export function localOwnerPlan(store, taskId, source, now) {
+    if (typeof source !== "string" || !/^[a-f0-9]{64}$/.test(source))
+        return { ok: false, status: 409, message: LOCAL_TASK_CHANGED };
+    const done = requestPlanAsLocalOwner(store, taskId, source, now);
+    return done.ok ? { ok: true } : { ok: false, status: done.reason === "local-owner" || done.reason === "refused" ? 403 : 409, message: done.message };
+}
+export function localOwnerRetry(store, taskId, run, digest, now) {
+    if (typeof run !== "string" || !/^[1-9][0-9]{0,14}$/.test(run) || typeof digest !== "string" || !/^[a-f0-9]{32}$/.test(digest))
+        return { ok: false, status: 409, message: LOCAL_TASK_CHANGED };
+    const done = retryAsLocalOwner(store, taskId, { run: Number(run), digest }, now);
+    return done.ok ? { ok: true, replayed: done.replayed } : { ok: false, status: done.reason === "local-owner" || done.reason === "refused" || done.reason === "limit" ? 403 : 409, message: done.message };
+}