toolroll 0.9.103 → 0.9.105

package/dist/claim.js

@@ -1,32 +1,3 @@
-/**
- * The claim, and the fence around it.
- *
- * This is the record §4 calls the one that matters, and the reason is a
- * specific 3am failure. A runner takes a task, starts work, and then stops
- * being reachable — the machine sleeps, the process is OOM-killed, the network
- * partitions. The scheduler cannot tell "dead" from "slow", so it waits for the
- * lease to expire and gives the task to someone else. Then the first runner
- * wakes up, finishes the work it was doing, and reports success for a task that
- * another runner is now halfway through.
- *
- * Both runners are behaving correctly. Without a fence, the control plane
- * believes the last one to speak.
- *
- * So a lease carries two things. `lease_id` is immutable and identifies one
- * grant of one task to one runner. `lease_generation` counts how many times
- * that task has been granted at all, and it only ever goes up. Acquiring is a
- * compare-and-swap on the generation; every later call carries the lease it
- * thinks it holds, and anything whose generation has been superseded is
- * refused. The late completion above is refused not because we detected the
- * crash — we never did — but because the world moved on without it.
- *
- * Losing a race here is ordinary, not an error. Several runners asking for the
- * same task at the same moment is the system working; exactly one wins.
- *
- * Time is a parameter everywhere. Expiry decided by an implicit clock is
- * untestable, and a lease is exactly the kind of thing that has to be provable
- * rather than probable.
- */
 import { randomUUID } from "node:crypto";
 import { authenticate, drainOf } from "./runner.js";
 import { pauseForAuth } from "./provider-auth.js";
@@ -35,62 +6,26 @@ import { BUILT_IN, checkCleanupTaskOf, isClosedState, refArchived, taskStateForC
 import { digestOf } from "./scope.js";
 import { parseExecutionPlanDocument } from "./plan.js";
 import { sealUnchangedPlanUnderMode } from "./plan-auto.js";
-import { routeFromJson } from "./phase-routing.js";
+import { readinessRefuses, routeFromJson } from "./phase-routing.js";
 import { contractChangesOf, decodePlannerSource, encodePlannerSource, canonicalContractJson, PLANNER_SOURCE_LIMITS, describeContractChanges, encodePlanContractRecord, plannerContractOf, plannerSourceDigest, } from "./planner-source.js";
 import { storeEvidence, readVerifiedArtifact, EVIDENCE_CAPS } from "./evidence.js";
 import { moveOnIfExhausted } from "./fallback.js";
 import { moveTask } from "./task-moves.js";
-/** How stale a mirror's last complete sync may be before admission refuses. */
 export const SYNC_MAX_AGE_MS = 15 * 60_000;
-/**
- * Long enough that an ordinary build does not lose its lease mid-thought,
- * short enough that a dead runner's work is picked up the same night rather
- * than at breakfast.
- */
 export const DEFAULT_LEASE_MS = 15 * 60_000;
-/**
- * Take the task, if it is free.
- *
- * Free means no claim, or a claim whose lease expired, or one already released.
- * A live lease belonging to somebody else is refused with who holds it and
- * until when, because "no" without a reason is indistinguishable from a bug.
- */
 export function acquire(store, taskRef, runner, options) {
-    // Replay detection is ACQUIRE-SPECIFIC (external dispatch, finding 36):
-    // the stored payload is untouched — the flag rides only the returned
-    // copy, so a second replay cannot double-stamp, and Store.replay's T→T
-    // contract holds for every other user.
     const replayed = store.hasMutationRecord(options.mutation ?? {});
     const result = inTransaction(store, () => acquireLocked(store, taskRef, runner, options, "refuse"));
     return replayed && result.ok ? { ...result, replayed: true } : result;
 }
-/**
- * The body of `acquire`, for callers already holding the transaction.
- * `acquireIfReady` needs its readiness check and the CAS to be one atomic
- * step, and SQLite does not nest transactions.
- */
-function acquireLocked(store, taskRef, runner, options, 
-/** Not an AcquireOptions field, so no options object (CLI flag, HTTP body, chat, MCP) can carry it. Only
- * acquireForCheckCleanup passes "check-cleanup", after proving its check row in this transaction. */
-closed) {
+function acquireLocked(store, taskRef, runner, options, closed) {
     const { now, ttlMs = DEFAULT_LEASE_MS, newLeaseId = randomUUID, mutation = {} } = options;
     const db = store.handle;
-    // Idempotency wraps the CAS, not the other way round: a retried
-    // acquire must hand back the first answer rather than take a second lease.
     return (store.replay(mutation, "acquire", () => {
         const stamp = now.toISOString();
-        // THE RUNNER GATE, first leg (MCP gateway spec v6). Identity is
-        // proven INSIDE this transaction — the row re-read, the hash
-        // re-compared — so a takeover between the caller's own auth and
-        // this CAS never lets a stale process ride its successor's
-        // authority. Then the repo tuple: authority derives from
-        // task_ref.repo ONLY; a task placed nowhere cannot be authorized
-        // by a repo-scoped runner, and a runner not bound to the task's
-        // repo never even holds a claim.
         const gate = authenticate(store, runner, options.token);
         if (!gate.ok)
             return { ok: false, reason: "unauthenticated", detail: gate.reason };
-        // DRAINING (v137): a runner whose stop has begun admits nothing new, on every claim road.
         const drain = drainOf(store, gate.runner, now);
         if (drain !== null)
             return { ok: false, reason: "draining", until: drain.until };
@@ -101,45 +36,21 @@ closed) {
         if (!gate.runner.repos.includes(placedRepo)) {
             return { ok: false, reason: "unauthorized-repo", repo: placedRepo };
         }
-        // The watch may have lapsed while this pass awaited I/O, before its heartbeat callback ran. Runner tokens
-        // survive a role restart, so prove this exact watch in the claim transaction as well.
         if (options.incarnation !== undefined && db.prepare("SELECT 1 FROM watch_lease WHERE runner = ? AND repo = ? AND owner = ? AND expires_at > ?").get(runner, placedRepo, options.incarnation, stamp) === undefined)
             return { ok: false, reason: "watch-custody" };
-        // THE COORDINATOR QUARANTINE in the one primitive every claim road
-        // shares (MCP spec v6, round-3 f1): a coordinator-filed task whose
-        // scope has not been sealed by the password ceremony claims for
-        // NOBODY — not the pre-approval planner road, not a raw CLI claim.
-        // One SQL predicate, so roads cannot diverge. After the seal it is
-        // ordinary in every respect.
         if (placedRef !== null && placedRef.coordinatorCid !== null && !store.scopeSealed(placedRef.externalId)) {
             return { ok: false, reason: "coordinator-filed" };
         }
-        // A PUT-AWAY TASK (v145, task-tidy.md) claims for nobody, on every road: restore it first.
         if (refArchived(store, taskRef))
             return { ok: false, reason: "archived" };
-        // The reservation gate lives HERE, in the one primitive every
-        // acquisition path shares (queue-columns review, finding 1): tick's
-        // acquireIfReady and the raw CLI claim both
-        // pass through this line, so a task reserved for one worker can
-        // never be taken by another, whatever the caller's snapshot said.
-        // Scheduling, not authority: nothing about WHAT may build changes.
         const reservedFor = store.assignedRunnerOf(taskRef);
         if (reservedFor !== null && reservedFor !== runner) {
             return { ok: false, reason: "reserved", reservedFor };
         }
-        // The external-mirror gate (dispatch v3 §2): every acquisition path
-        // shares this line, so a stale, closed, revoked, or plane-blocked
-        // mirror never starts a build — whatever the caller's snapshot said.
-        // An ordinary task costs one indexed lookup.
         const mirrorWhy = store.mirrorAdmissionRefusal(taskRef, now, options.syncMaxAgeMs ?? SYNC_MAX_AGE_MS);
         if (mirrorWhy !== null && mirrorWhy !== "not-a-mirror") {
             return { ok: false, reason: "external", detail: mirrorWhy };
         }
-        // THE MODE BELT on the one primitive every claim road shares (Codex
-        // people round 2, finding 2): a mode-sealed approval whose signature
-        // no longer stands — revoked, expired by clock, or a dead signer —
-        // does not dispatch, CLI claim included. Live claims already taken
-        // are untouched; this fences only NEW takes.
         if (!store.modeApprovalLive(taskRef, now)) {
             return {
                 ok: false,
@@ -147,8 +58,6 @@ closed) {
                 message: "the approval it was sealed with no longer stands (an ended mode or flow grant, or an approval that wasn't a person's) — a person approves it again",
             };
         }
-        // A LEAD SWEEP'S LIMIT, inside this write transaction so two runners can't both take the last slot: at most
-        // max_parallel of its families hold a live claim (claimed-but-not-started counts; a revision counts as its child).
         const sweep = placedRef === null ? null : store.sweepOfTask(placedRef.externalId);
         if (sweep !== null && store.sweepLiveClaims(sweep.id, stamp, taskRef) >= sweep.maxParallel) {
             return { ok: false, reason: "sweep-limit", sweep: sweep.id, limit: sweep.maxParallel };
@@ -162,10 +71,6 @@ closed) {
                 until: String(existing["expires_at"]),
             };
         }
-        // A CLOSED TASK claims for nobody (docs/plans/closed-task-claims.md, decision A), read here in the same write
-        // transaction as the insert below. Placed after every older refusal, so each of those answers as before; this
-        // only replaces what would have been a grant. A built-in reference with no task row has nothing to claim. A
-        // task of another backend keeps today's answer: its state is in that tracker, not in this database.
         if (placedRef !== null && placedRef.backend === BUILT_IN) {
             const known = taskStateForClaim(store, taskRef);
             if (known.kind === "missing")
@@ -184,11 +89,6 @@ closed) {
             expiresAt: new Date(now.getTime() + ttlMs).toISOString(),
             heartbeatAt: stamp,
         };
-        // The compare-and-swap, enforced by UNIQUE (task_ref, lease_generation)
-        // rather than by anything this code does. Two runners that both read the
-        // same generation both try to write generation + 1; the database admits
-        // one. OR IGNORE turns the loser's constraint violation into a row count
-        // of zero, because losing a race is an ordinary outcome and not an error.
         const { changes } = db
             .prepare(`INSERT OR IGNORE INTO claim
              (lease_id, task_ref, lease_generation, runner, acquired_at, expires_at, heartbeat_at, released_at, incarnation)
@@ -204,39 +104,14 @@ closed) {
             };
         }
         return { ok: true, claim, reclaimed: existing !== undefined };
-    }, 
-    // Only a lease that was actually granted is worth remembering. Recording
-    // the refusal would make this key a permanent "no" for a task that is
-    // free again five minutes later.
-    result => result.ok));
+    }, result => result.ok));
 }
-/** The newest lease on a task, held or not. */
 function latest(db, taskRef) {
     return db
         .prepare("SELECT * FROM claim WHERE task_ref = ? ORDER BY lease_generation DESC LIMIT 1")
         .get(taskRef);
 }
-/** DESIGN §8 gate 6: above this many open decisions, stop dispatching the parkers.
- * `missingCapability` remains re-exported for callers of the old claim seam. */
 export { DEFAULT_MAX_OPEN_DECISIONS, missingCapability } from "./dispatch.js";
-/**
- * Take the task, if it is free *and still worth taking*.
- *
- * `listReady` then `acquire` is two reads of a world that moves between them:
- * a hold placed, a blocker reopened, the task cancelled — and the CAS admits
- * the claim anyway, because the CAS only defends against other claimants. An
- * unattended pass has nobody watching who would notice the stale dispatch, so
- * the readiness conditions are re-proved inside the same transaction as the
- * acquire, against rows the write lock has already pinned.
- *
- * "Not ready" is a different answer from "held": held means somebody else got
- * it, which is a race being won; not-ready means nobody should have it, and
- * says why.
- */
-/**
- * A conformance check's claim (acp-check.ts): its task has no scope to approve, so readiness is not asked — but a
- * check runs real agents, so the runner's capacity is counted where the claim lands, as for dispatch.
- */
 export function acquireForCheck(store, taskRef, runner, options) {
     return inTransaction(store, () => {
         const registered = store.getRunner(runner);
@@ -252,13 +127,6 @@ export function acquireIfReady(store, taskRef, runner, options) {
         const why = taskReadinessBlocker(store, taskRef, options.now);
         if (why !== null)
             return { ok: false, reason: "not-ready", message: why.message };
-        // The role's own precondition, re-read where the write lock has pinned
-        // it — never an early return past the shared gates below. A planner
-        // dispatches exactly when the operator asked and no promise exists yet;
-        // a builder dispatches exactly when the promise is approved. A
-        // mode-sealed approval additionally re-proves its signature is STILL
-        // the live mode (belt to the demotion sweep — R-REVOKE's next gate
-        // holds even in the window before an expired mode is durably closed).
         const approvedScope = scopeApprovedForDispatch(store, taskRef, options.now);
         if (role === "planner") {
             const ref = store.refForId(taskRef);
@@ -269,9 +137,6 @@ export function acquireIfReady(store, taskRef, runner, options) {
                 return { ok: false, reason: "not-ready", message: "the scope is already approved — nothing left to plan" };
             }
         }
-        // The deliverable is re-read here (v34): a scout dispatches exactly on
-        // a report task with an approved scope, and a builder never on one —
-        // the caller's survey chose the role, the row proves it.
         if (role === "scout" || role === "builder") {
             const deliverable = store.refForId(taskRef)?.deliverable ?? "branch";
             if (role === "scout" && deliverable !== "report") {
@@ -287,16 +152,9 @@ export function acquireIfReady(store, taskRef, runner, options) {
         if (role !== "planner" && !approvedScope) {
             return { ok: false, reason: "not-ready", message: "the scope is not approved" };
         }
-        // Capabilities are re-read inside the same transaction as the CAS, like
-        // every other readiness fact: a key that expired between the survey and
-        // the take must not be dispatched on the survey's answer.
         const gap = missingCapability(store, taskRef, options.repo ?? null, options.now);
         if (gap !== null)
             return { ok: false, reason: "capability", message: gap };
-        // Capacity (§8 gate 3), counted where the claim lands — two overlapping
-        // passes cannot both see a free slot that only exists once. Enforced for
-        // registered runners; a runner the store has never met is a test driving
-        // the API directly, and the CLI always registers.
         const registered = store.getRunner(runner);
         if (registered !== null) {
             const held = store.liveClaimCount(runner, options.now);
@@ -308,13 +166,7 @@ export function acquireIfReady(store, taskRef, runner, options) {
                 };
             }
         }
-        // Quota, same gate: an exhausted credential refuses; a half-open one
-        // admits exactly this dispatch as its probe, consumed here so a racing
-        // pass cannot also treat it as open.
         const scope = options.model ?? "";
-        // Quota is keyed to the credential that actually exhausts: the RESOLVED
-        // provider, never a fixed binary name — codex quota must not collide
-        // with claude's, nor bypass it (Codex provider review, high finding 5).
         const quota = store.quotaState(runner, options.provider ?? "claude", scope, options.now, options.authMode ?? "subscription");
         if (quota !== null && quota.state === "exhausted") {
             return {
@@ -323,27 +175,16 @@ export function acquireIfReady(store, taskRef, runner, options) {
                 message: `${runner}'s provider quota is exhausted (${quota.reason})${quota.resetAt === null ? "" : ` until ${quota.resetAt}`} — a free slot against an exhausted quota is not capacity`,
             };
         }
-        // THE ROUTED PROVIDER'S READINESS (v47), re-read inside the same
-        // transaction: a provider THIS runner has reported unavailable never
-        // claims — no substitution, no second-best. Unknown passes; only a
-        // recorded unavailable refuses, and it says what was observed.
         const readiness = store.runnerReadinessOf(runner, options.provider ?? "claude");
-        if (readiness !== null && readiness.state === "unavailable") {
+        if (readiness !== null && readinessRefuses(readiness, options.authMode ?? "subscription")) {
             return {
                 ok: false,
                 reason: "provider-unavailable",
                 message: `${readiness.provider} is reported unavailable on ${runner} (${readiness.reason}; observed ${readiness.observedAt}) — nothing substitutes for a routed provider`,
             };
         }
-        // The attention budget (§8, gate 6), proved where every other readiness
-        // fact is proved. A phone with thirty open questions answers none of
-        // them; above the budget, tasks with a *measured* habit of parking step
-        // aside so the night keeps building what builds. First-time parkers pass
-        // — a rate nobody measured is not a rate.
         const budget = options.maxOpenDecisions ?? DEFAULT_MAX_OPEN_DECISIONS;
         if (store.countUnanswered() >= budget) {
-            // A planner exists to generate questions; above the budget it is
-            // refused outright — no zero-rate first-timer pass (finding 2).
             if (role === "planner") {
                 return {
                     ok: false,
@@ -361,28 +202,16 @@ export function acquireIfReady(store, taskRef, runner, options) {
             }
         }
         const taken = acquireLocked(store, taskRef, runner, options, "refuse");
-        // The half-open probe slot is consumed only WITH the claim it admits —
-        // an attention refusal or a lost CAS must not re-arm the quota as
-        // exhausted with no probe in flight (finding 3). Same transaction, so
-        // consume-with-claim is all-or-nothing.
         if (taken.ok && quota !== null) {
             store.consumeHalfOpen(runner, options.provider ?? "claude", scope, options.now, options.authMode ?? "subscription");
         }
         return taken;
     });
 }
-/**
- * "I am still here." Extends the lease, and tells a superseded runner that it
- * has been superseded — which is the cheapest moment for it to find out, well
- * before it has finished work nobody will accept.
- */
 export function heartbeat(store, leaseId, now, ttlMs = DEFAULT_LEASE_MS) {
     const db = store.handle;
     const expiresAt = new Date(now.getTime() + ttlMs).toISOString();
     return inTransaction(store, () => {
-        // An expired claim is not brought back on a task closed meanwhile (closed-task-claims.md, finding 1): that would
-        // be a new claim on a closed task by another road. A live claim, and an expired one on an open task, renew as
-        // always. Read in this write transaction, before the renewal.
         const closedNow = expiredOnClosedTask(store, leaseId, now);
         if (closedNow !== null)
             return { ok: false, reason: "closed", state: closedNow };
@@ -396,41 +225,21 @@ export function heartbeat(store, leaseId, now, ttlMs = DEFAULT_LEASE_MS) {
         return { ok: true, claim: readClaim(row) };
     });
 }
-/**
- * The fence, as a predicate on the write rather than a check before it.
- *
- * Checking first and updating second leaves a window: a reclaim committing
- * between the two makes the check's answer stale, and the update — matching on
- * lease id alone — succeeds anyway. Both runners then believe they hold the
- * task, which is the precise failure this module was written to make
- * impossible. Putting the condition inside the statement closes it, because
- * SQLite evaluates it against the row it is about to write.
- */
 const NOT_SUPERSEDED = `NOT EXISTS (
   SELECT 1 FROM claim AS newer
    WHERE newer.task_ref = claim.task_ref
      AND newer.lease_generation > claim.lease_generation
 )`;
-/**
- * Why a fenced write matched nothing. Worth the extra read: "you were
- * superseded" and "I have never heard of this lease" send a runner to very
- * different places.
- */
 function refusal(db, leaseId) {
     const row = db.prepare("SELECT 1 AS hit FROM claim WHERE lease_id = ?").get(leaseId);
     return { ok: false, reason: row === undefined ? "unknown" : "fenced" };
 }
-/** The release every ending makes: a compare-and-swap that only the live lease nobody superseded wins. */
 function releaseAs(store, leaseId, as, now) {
     const { changes } = store.handle
         .prepare(`UPDATE claim SET released_at = ?, released_by = ? WHERE lease_id = ? AND released_at IS NULL AND ${NOT_SUPERSEDED}`)
         .run(now.toISOString(), as, leaseId);
     return Number(changes) > 0;
 }
-/**
- * The open attempt an ending seals, proved first inside finalize's transaction: the run must be this lease's open
- * attempt of the role the ending is for (anything else is a caller defect, thrown — not a race to absorb).
- */
 function openAttempt(store, leaseId, runId, what, role) {
     const run = store.getRun(runId);
     if (run === null || run.leaseId !== leaseId || run.outcome !== null)
@@ -439,8 +248,6 @@ function openAttempt(store, leaseId, runId, what, role) {
         throw new Error(`run ${runId} is a ${run.role} run — only ${role} runs can be sealed as ${what}`);
     return run;
 }
-/** Release the claim as `as`, or — for a lease the world moved past — finish the run (and its open repair child) as a
- * fenced refusal and say why. Null when the release won. */
 function releaseOrRefuse(store, leaseId, as, runId, now, repairRun = null) {
     if (releaseAs(store, leaseId, as, now))
         return null;
@@ -449,36 +256,10 @@ function releaseOrRefuse(store, leaseId, as, runId, now, repairRun = null) {
     store.finishRun(runId, { outcome: "refused", reason: "fenced", now });
     return refusal(store.handle, leaseId);
 }
-/**
- * Hand the task back.
- *
- * Accepted only from the lease that currently holds it. A completion arriving
- * on a superseded lease is the failure this whole module exists for, and it is
- * rejected without touching anything — the work is not lost, it is simply not
- * this runner's to report, and the record says so rather than overwriting a
- * live claim with a dead runner's opinion.
- */
 export function release(store, leaseId, now) {
     const db = store.handle;
     return inTransaction(store, () => {
         if (!releaseAs(store, leaseId, "released", now)) {
-            // A repeat of a hand-back this same lease already made is not a fence —
-            // nobody took the task away, the runner simply said so twice because its
-            // first acknowledgement was lost. M1 asks for duplicate completion to be
-            // reconciled rather than refused, and telling an honest runner it was
-            // superseded would send it to stop when it should carry on.
-            //
-            // Deliberately not filtered by supersession. A lease that released and
-            // was then reacquired by somebody else still *completed*: its work was
-            // accepted at the time, and the honest answer to a late retry is "you
-            // already did this", not "you were fenced" — which would say its work
-            // never counted. Fencing is for a lease that never finished.
-            //
-            // But *how* the lease came to be released decides everything. Only a
-            // release the runner itself made counts as "you already did this". A
-            // lease the reaper or dead-runner recovery took back was never handed
-            // in by anybody — the world moved on without it, and the answer to its
-            // late retry is the fence.
             return duplicateOrRefusal(db, leaseId, ["released", "completed"]);
         }
         const row = db.prepare("SELECT * FROM claim WHERE lease_id = ?").get(leaseId);
@@ -486,12 +267,6 @@ export function release(store, leaseId, now) {
         return { ok: true, claim: readClaim(row) };
     });
 }
-/**
- * Whether an already-released lease was released in a way the caller may
- * treat as its own doing. Anything else — reaped, recovered, or provenance
- * unknown — is the fence, because accepting it would let a reclaimed lease's
- * late retry pass as an ordinary duplicate.
- */
 function duplicateOrRefusal(db, leaseId, own) {
     const released = db
         .prepare("SELECT * FROM claim WHERE lease_id = ? AND released_at IS NOT NULL")
@@ -503,18 +278,6 @@ function duplicateOrRefusal(db, leaseId, own) {
         return { ok: false, reason: "fenced" };
     return refusal(db, leaseId);
 }
-/**
- * THE ONE WAY AN ATTEMPT ENDS: seal `outcome` for `leaseId` in one fenced transaction.
- *
- * Every ending passes the same fence, in the same order: the run is this lease's open attempt of the right role (a
- * caller defect otherwise, thrown); a stop that applies to it wins — the attempt is sealed as interrupted instead
- * (except the endings that ARE a stop or a service hand-back); then the claim is released by a compare-and-swap only the
- * live, unsuperseded lease wins. A lease the world moved past writes nothing but its own run's fenced refusal (the
- * stop and hand-back endings still end their run, touching no task state), and a retry of an ending the same lease
- * already made answers as a duplicate where that ending allows it. Only then does the ending's own effect run —
- * decision and hold, incident, strike and backoff, scope, report, revision, task state, the disowned mirror — inside
- * the same transaction, so nothing of it exists without the release, and a crash rolls all of it back together.
- */
 export function finalize(store, leaseId, outcome) {
     return inTransaction(store, () => {
         switch (outcome.kind) {
@@ -532,20 +295,6 @@ export function finalize(store, leaseId, outcome) {
         }
     });
 }
-/**
- * Release the lease and write the task's terminal state, as one step.
- *
- * Release-then-mark is a window: between the two, the freed task is back in
- * the ready set, and another pass can claim it before the terminal state
- * lands — two builders for one task, the second dispatched by our own
- * bookkeeping. Here the state is written inside the same transaction as the
- * fenced release, so a task is never simultaneously free and unfinished.
- *
- * A fenced or unknown lease writes nothing: a runner the world moved past
- * does not get to say how the task ended. A duplicate release reports
- * `duplicate` and also writes nothing — the first completion already said,
- * and a retry changing the answer would make "done" negotiable.
- */
 function sealComplete(store, leaseId, args) {
     const { state, now, mutation = {} } = args;
     const db = store.handle;
@@ -559,12 +308,6 @@ function sealComplete(store, leaseId, args) {
         return { ok: false, reason: "stopped" };
     }
     if (!releaseAs(store, leaseId, "completed", now)) {
-        // Only a completion this same lease already made reads as a duplicate.
-        // The DURABLE disposition (released_by) reproduces the original arm —
-        // whatever the task or the tracker did since (finding 33). A lease
-        // the reaper or recovery released was never *accepted*; a late
-        // completion after that is exactly the stale commit the fence keeps
-        // out.
         const released = db
             .prepare("SELECT * FROM claim WHERE lease_id = ? AND released_at IS NOT NULL")
             .get(leaseId);
@@ -587,11 +330,6 @@ function sealComplete(store, leaseId, args) {
     const taskId = db
         .prepare("SELECT external_id FROM task_ref WHERE id = ? AND backend = ?")
         .get(claim.taskRef, BUILT_IN);
-    // The completion gate (external dispatch, v4 §24): the latch is read
-    // INSIDE this transaction, on a FRESH win only. A latched mirror's
-    // completion is DISOWNED — the task is cancelled, the disposition is
-    // written durably, and the caller never sees the completed arm, so
-    // publication is impossible by construction.
     const disowned = taskId !== undefined && !store.mirrorAllowsCompletion(String(taskId["external_id"]));
     if (disowned) {
         db.prepare("UPDATE claim SET released_by = 'disowned' WHERE lease_id = ?").run(leaseId);
@@ -599,8 +337,6 @@ function sealComplete(store, leaseId, args) {
     if (taskId !== undefined) {
         store.replay(mutation, "completeFenced", () => {
             if (disowned) {
-                // Cancellation goes through the one floor — a disowned
-                // completion is a typed machine reason, not a bare state write.
                 store.applyCancellation(String(taskId["external_id"]), { kind: "machine", code: "disowned-completion" }, now, null);
             }
             else {
@@ -612,11 +348,6 @@ function sealComplete(store, leaseId, args) {
     store.bumpWake();
     return { ok: true, arm: disowned ? "disowned" : "completed", claim };
 }
-/**
- * Validate the optional accepted formatting child against the open planner
- * root. The child remains open until the root's fence settles, so a crash or
- * takeover can never leave it masquerading as successfully delivered work.
- */
 function plannerRepairChild(store, root, repairRunId) {
     if (repairRunId === null)
         return null;
@@ -656,22 +387,6 @@ function plannerRepairChild(store, root, repairRunId) {
     }
     throw new Error(`run ${repairRunId} is outside planner ${root.id}'s bounded linear correction chain`);
 }
-/**
- * Seal a park, fenced at the write (§7).
- *
- * The builder proved its lease after the agent ran; this transaction proves
- * it again *in the same statement that releases it*, because everything a
- * park creates — the decision, its hold, the outbox row — is only true if
- * this lease still spoke for the task at the moment of sealing. A superseded
- * lease creates none of it: no decision, no hold, no notification, and the
- * run is finalized as the fenced refusal it was. A crash anywhere inside
- * rolls all of it back together; there is no instant at which a decision
- * exists without its hold.
- *
- * `released_by = 'parked'` so a late retry from this lease is answered with
- * the fence, not "duplicate": a park hands the task to a person, and nothing
- * the runner says afterwards is that person's answer.
- */
 function sealPark(store, leaseId, args) {
     const { runId, taskId, decision, artifactIds, now } = args;
     const run = openAttempt(store, leaseId, runId, "a park");
@@ -694,9 +409,6 @@ function sealPark(store, leaseId, args) {
     }, now);
     for (const artifact of artifactIds)
         store.linkEvidence(decisionId, artifact);
-    // The hold is indefinite by construction. The decision's deadline is
-    // attention metadata; wiring it into `until` would dispatch the task,
-    // unanswered, the moment the deadline passed — expiry never chooses.
     store.holdOwned({
         taskRef: run.taskRef,
         ownerKind: "decision",
@@ -714,21 +426,11 @@ function sealPark(store, leaseId, args) {
         kind: "decision",
         subject: `${taskId} parked a decision`,
         body: `${oneLine(decision.question, 200)}\n\`toolroll decide ${decisionId}\``,
-        // The push stamp (arc 3): class + machine-minted link, at enqueue
-        // or never. Fixed phrases ride the push service; this subject does not.
         pushClass: "decision",
         link: `/d/${decisionId}`,
     }, now);
     return { ok: true, decisionId };
 }
-/**
- * Seal a park whose payload never became a decision (§6's bounded repair ran
- * out). Same fence, same atomicity, different record: an incident that stays
- * in every brief until a person resolves it, holding the task so the next
- * pass does not spend the same tokens hitting the same wall nightly. The
- * malformed payload is preserved as evidence — a person may still be able to
- * read what the agent meant.
- */
 function sealMalformed(store, leaseId, args) {
     const { runId, taskId, problems, now } = args;
     const run = openAttempt(store, leaseId, runId, "a park");
@@ -762,35 +464,16 @@ function sealMalformed(store, leaseId, args) {
     }, now);
     return { ok: true, incidentId };
 }
-/** 1m, 2m, 4m, 8m, 16m — doubling, capped. Indexed by strikes-1. */
 const BACKOFF_MS = [60_000, 120_000, 240_000, 480_000, 960_000];
 export const MAX_STRIKES = 3;
-/**
- * Seal an operator-stopped attempt (v52): ONE fenced transaction for the
- * claim's release as `interrupted`, the run's ending as `failed` /
- * `interrupted` (the same words dead-runner recovery writes, so the
- * recovered-draft road inherits the preserved work exactly as after a
- * crash), every open run the attempt owns, the task's return to the
- * queue under the stop's own hold, and the stop's settlement. Nothing
- * here is a failure: no strike, no backoff, no incident, no automatic
- * repair task, no notification page. A commit the attempt already made
- * is kept as a reviewable artifact — `committed` records that it exists.
- *
- * A lease the world moved past (reaped, recovered, superseded) still
- * ends the run as interrupted — that IS the honest ending — but touches
- * no task state: the task belongs to whoever holds it now.
- */
 function sealInterrupted(store, leaseId, args) {
     const { runId, taskId, stopRun, now } = args;
     const db = store.handle;
     openAttempt(store, leaseId, runId, "an interruption");
-    // A lease the world moved past still ends its run as interrupted — that IS the honest ending — touching no task state.
     const fenced = !releaseAs(store, leaseId, "interrupted", now);
     if (args.message !== undefined && args.message.trim() !== "") {
         store.recordOutcomeFacts(runId, { handoff: args.message });
     }
-    // Owned descendants first (a repair turn, a correction) — the parent's
-    // ending settles the stop, and every owned row ends in the same write.
     for (const owned of store.ownedRunsOf(runId)) {
         if (owned === runId)
             continue;
@@ -809,28 +492,14 @@ function sealInterrupted(store, leaseId, args) {
     store.settleRunStop(stopRun, "interrupted", now);
     if (fenced)
         return { ok: true, stopRun, requeued: false, fenced: true };
-    // Back to the queue, where the stop's hold keeps it — a paused task
-    // reads as queued-and-held, exactly like an operator pause.
     const requeued = moveTask(db, taskId, "requeue", now);
     store.bumpWake();
     return { ok: true, stopRun, requeued, fenced: false };
 }
-/**
- * Hand an attempt back because the SERVICE stopped (its builder is
- * stopping or restarting), not because anyone stopped the task: one fenced
- * transaction releases the claim as `interrupted`, ends the run (and every
- * open run it owns) as `failed` / `interrupted` — the words dead-runner
- * recovery writes, so the next attempt inherits the preserved work in the
- * same checkout exactly as after a crash — and returns the task to the
- * queue with no strike, no backoff and no hold, so the next builder pass
- * resumes it. A lease the world moved past still ends the run, touching no
- * task state.
- */
 function sealHandBack(store, leaseId, args) {
     const { runId, taskId, now } = args;
     const db = store.handle;
     openAttempt(store, leaseId, runId, "a hand-back");
-    // A lease the world moved past still ends its run as interrupted — that IS the honest ending — touching no task state.
     const fenced = !releaseAs(store, leaseId, "interrupted", now);
     if (args.message.trim() !== "")
         store.recordOutcomeFacts(runId, { handoff: args.message });
@@ -848,14 +517,6 @@ function sealHandBack(store, leaseId, args) {
     store.bumpWake();
     return { ok: true, requeued, fenced: false };
 }
-/**
- * THE STOP FENCE at settlement (v52): when a stop applies to the run —
- * its own or an owning ancestor's — seal the attempt as interrupted and
- * answer with the seal; otherwise null, and the caller's own ending
- * proceeds. Every fenced finalizer asks this first, inside its own
- * transaction, so a stop that commits before terminal settlement wins
- * whatever the attempt was about to say.
- */
 export function interruptIfStopped(store, args) {
     const stop = store.applicableStopFor(args.runId);
     if (stop === null)
@@ -869,21 +530,6 @@ export function interruptIfStopped(store, args) {
         message: args.message ?? `stopped by ${stop.requestedBy} (run #${stop.run}) — ${where === null ? "the attempt's evidence is on record" : `the work is preserved in ${where}`}`,
     }));
 }
-/**
- * Seal a failed attempt: one fenced transaction for the release, the run,
- * the strike, the hold, and the page (§6, gnhf adopted rather than
- * reinvented).
- *
- * Strikes count only top-level builder attempts; built, no-change, and
- * parked reset them elsewhere; refusals, fenced attempts, and repair
- * children never reach this function. Under three strikes the task
- * requeues behind a doubling backoff hold the failure owns; at three it
- * stalls — an 'attempts-exhausted' incident, the task marked failed, held,
- * and paged once — because a fourth identical attempt at 3am is a token
- * bonfire, not persistence. A commit-stage failure takes neither road: the
- * worktree holds unpreserved work, ordinary re-pooling would refuse it as
- * dirty forever, so it is an immediate incident naming the checkout.
- */
 function sealFailure(store, leaseId, args) {
     const { runId, taskId, failureClass, message, now } = args;
     const run = openAttempt(store, leaseId, runId, "a failure", "builder");
@@ -893,14 +539,9 @@ function sealFailure(store, leaseId, args) {
     const fenced = releaseOrRefuse(store, leaseId, "released", runId, now);
     if (fenced !== null)
         return fenced;
-    // A sign-in that no longer works is not the attempt's fault: no strike,
-    // no retry, the task back in the queue, and its provider paused.
     if (failureClass !== "commit-failure" && run.terminalClass === "auth-expired") {
         return { ok: true, ...sealAuthExpired(store, run, taskId, now) };
     }
-    // Out of plan on an approved chain: the walk moves on, no strike, and the next agent runs through the ordinary claim.
-    // Anything else about this ending (fallback.ts says what closed the walk) stays the ordinary road below.
-    // Only the agent's own exit moves: a lease, branch or HEAD law that failed, or a commit that failed, is that ending.
     if (failureClass === "unknown") {
         const moved = moveOnIfExhausted(store, runId, taskId, now);
         if (moved !== null) {
@@ -910,8 +551,6 @@ function sealFailure(store, leaseId, args) {
     }
     store.finishRun(runId, { outcome: "failed", reason: failureClass, now });
     if (failureClass === "commit-failure") {
-        // The work exists and is uncommitted; nothing times its way out of
-        // that. A person (or an explicit repair) proves the checkout.
         const incidentId = store.createIncident({ run: runId, kind: "commit-failure" }, now);
         store.holdOwned({
             taskRef: run.taskRef,
@@ -933,8 +572,6 @@ function sealFailure(store, leaseId, args) {
     }
     const strikes = store.addStrike(run.taskRef);
     if (strikes >= MAX_STRIKES) {
-        // The state first: a task a person already closed keeps its state, and then no incident, hold or page is
-        // written either (closed-task-claims.md, decision B). The run's outcome, the release and the strike stand.
         const closedState = exhaustUnlessClosed(store, run, taskId, now);
         if (closedState !== null)
             return { ok: true, disposition: "closed", strikes, state: closedState };
@@ -957,16 +594,12 @@ function sealFailure(store, leaseId, args) {
         }, now);
         return { ok: true, disposition: "stalled", strikes, incidentId };
     }
-    // Under the limit: requeue behind a doubling pause the failure owns.
-    // Replacing the previous backoff hold is correct — this attempt's strike
-    // already reflects the whole streak.
     const wait = BACKOFF_MS[Math.min(strikes, BACKOFF_MS.length) - 1];
     const until = new Date(now.getTime() + wait);
     store.holdOwned({
         taskRef: run.taskRef,
         ownerKind: "backoff",
         ownerId: String(run.taskRef),
-        // Run 2085: this failure is named in plain words wherever the hold shows.
         reason: failureClass === "no-handoff"
             ? `The agent stopped before handing off; its work was kept and it is being resumed (retry ${strikes}/${MAX_STRIKES} in ${Math.round(wait / 60_000)}m)`
             : `retry ${strikes}/${MAX_STRIKES} after ${failureClass} — backing off ${Math.round(wait / 60_000)}m`,
@@ -983,12 +616,6 @@ function sealFailure(store, leaseId, args) {
     }, now);
     return { ok: true, disposition: "backoff", strikes, until: until.toISOString() };
 }
-/**
- * The auth-expired ending, inside the caller's fenced transaction (claim
- * already released): the run fails as `auth-expired`, the task goes back to
- * the queue with no strike and no backoff, and dispatch for the run's
- * provider pauses — the first such run of an incident tells a person once.
- */
 function sealAuthExpired(store, run, taskId, now) {
     store.finishRun(run.id, { outcome: "failed", reason: "auth-expired", now });
     moveTask(store.handle, taskId, "requeue", now);
@@ -996,33 +623,16 @@ function sealAuthExpired(store, run, taskId, now) {
     store.bumpWake();
     return { disposition: "auth-expired", provider: run.provider };
 }
-/** Untrusted text on its way into a subject line: one line, bounded. */
 function oneLine(text, cap) {
     const flat = text.replace(/\s+/g, " ").trim();
     return flat.length <= cap ? flat : `${flat.slice(0, cap)}…`;
 }
-/** The live claim on a task, if there is one. */
 export const MAX_PLAN_STRIKES = 3;
-/** Backoff for planner retries: shorter than the builder's — a planner that
- * cannot start is usually a transient, and nothing downstream is waiting on
- * a workspace. */
 const PLAN_BACKOFF_MS = [60_000, 2 * 60_000, 4 * 60_000];
-/**
- * Seal a successful planning run: the proposed scope, the plan document
- * artifact, the drafted state, the run outcome, and the page to the
- * operator exist together or — if the lease was superseded — not at all.
- * The scope proposal is authority-bearing (it is what the approve card
- * will restate), which is why this is the park discipline, not the DONE
- * one (Codex planning review, question 2).
- */
 function sealPlan(store, leaseId, args) {
     const { runId, taskId, plan, now } = args;
-    // The ingestion record (contract handoff, task 1) is composed here from
-    // the filed terms and the drafted plan; its file and row land inside the
-    // transaction below, only after the stale-source check admits the draft.
     const filed = args.source?.contract.scope ?? null;
     const contractChanges = filed === null ? [] : contractChangesOf(filed, plan);
-    // A hand-built plan (the pre-source road) carries no amendment field.
     const amendment = plan.amendment ?? null;
     const record = args.source === undefined
         ? null
@@ -1049,8 +659,6 @@ function sealPlan(store, leaseId, args) {
         return failed.ok ? { ok: false, reason: "source-invalid", detail } : failed;
     };
     const sources = store.artifactsFor(runId).filter(one => one.kind === "plan-contract" && one.key.endsWith("/planner-source.json"));
-    // Legacy rows have no input stamp or artifact. Every current dispatch
-    // stamps even an empty scope; dropping a caller argument cannot bypass custody.
     if (args.source !== undefined || sources.length > 0 || run.scopeDigest !== null) {
         if (args.source === undefined || args.evidenceRoot === undefined || sources.length !== 1 || sources[0].id !== args.sourceArtifact) {
             return invalidSource("the planner's admitted source inventory is missing, ambiguous, or was not presented");
@@ -1073,13 +681,6 @@ function sealPlan(store, leaseId, args) {
             return invalidSource("a planner changed the filed contract without a bounded, explicit amendment");
         }
     }
-    // THE SOURCE RECHECK (contract handoff, task 1): the filed request is
-    // re-derived from durable state inside this very transaction and must
-    // still be the one the planner read. A scope rewritten, approved, or
-    // re-termed while the planner ran is the NEWER source; an old draft
-    // never overwrites it. The attempt ends refused in words — no strike,
-    // the planner did nothing wrong — and the task stays requested. The
-    // claim releases under the same fence the ingestion would have used.
     if (args.source !== undefined) {
         const current = plannerContractOf(store, taskId);
         const currentDigest = current.ok ? plannerSourceDigest(current.contract) : null;
@@ -1181,8 +782,6 @@ function sealPlan(store, leaseId, args) {
     }, now);
     return { ok: true, changes: contractChanges.length, amendment };
 }
-/** Which part of the filed request moved, in words — for the refusal,
- * the page, and the notification. */
 function describeSourceDrift(source, current) {
     const was = source.contract;
     const parts = [];
@@ -1205,40 +804,6 @@ function describeSourceDrift(source, current) {
         parts.push("the revision brief changed");
     return `the filed request changed while the planner ran: ${parts.length === 0 ? "its source identity moved" : parts.join("; ")} (planned against ${source.sourceDigest.slice(0, 12)})`;
 }
-/**
- * Seal a running build's plan-revision proposal (adaptive execution plans).
- *
- * A builder that finds repository evidence invalidating a named dependency,
- * risk, or assumption in the plan it was given files ONE proposal and stops
- * without committing — the park discipline, applied to the road rather than
- * to a question. The ledger row, the hold when one is owed, the run's
- * outcome, and the page exist together or, if the lease was superseded,
- * not at all. Structurally the plan ending's twin: the same
- * open-attempt assertion, the same fenced release, the same all-or-nothing
- * transaction.
- *
- * Two dispositions, decided by the caller's classification and recorded
- * here:
- *
- *   plan-only        the signed scope and publication authority are
- *                    byte-identical to what this build started under, so
- *                    nothing authority-bearing moved and the revision is
- *                    APPLIED. The claim releases plainly, the task returns
- *                    to the ready set, and the next attempt reads the new
- *                    plan — that is the "resume" the subject line promises.
- *
- *   authority-change something else moved the signed scope or the
- *                    publication authority WHILE this build ran. Whatever
- *                    the revision proposes, it is never auto-applied: the
- *                    row lands 'blocked', a `revision` hold keeps the task
- *                    out of every ready set until a person accepts or
- *                    rejects it, and the page names exactly which fields
- *                    changed.
- *
- * The lease is released either way — the attempt is over — and the run is
- * finished as `refused`, reusing the existing outcome vocabulary rather
- * than growing it: no work was committed, and nothing failed.
- */
 function sealRevision(store, leaseId, args) {
     const { runId, taskId, taskRef, revision, now } = args;
     openAttempt(store, leaseId, runId, "a plan revision", "builder");
@@ -1276,19 +841,6 @@ function sealRevision(store, leaseId, args) {
     }, now);
     return { ok: true, revisionId, authorityKind: revision.authorityKind };
 }
-/**
- * The planner's own fenced failure finalizer (Codex planning review,
- * finding 6): releases exactly the planner claim, finishes the run,
- * counts a SEPARATE planning strike — a planner that cannot finish must
- * never spend the builder's three attempts — and eventually leaves a
- * durable incident + hold + page. It never marks the task done, never
- * touches builder strikes, never commits, never publishes.
- *
- * A malformed payload goes straight to its incident with no strike: the
- * protocol failed, not the weather, and retrying the same session buys
- * nothing without the repair machinery (deliberately not wired for
- * planners in v1).
- */
 function sealPlanFailure(store, leaseId, args) {
     const { runId, taskId, failure: kind, message, now } = args;
     const run = openAttempt(store, leaseId, runId, "a failure", "planner");
@@ -1347,8 +899,6 @@ function sealPlanFailure(store, leaseId, args) {
     const until = new Date(now.getTime() + wait);
     store.holdOwned({
         taskRef: run.taskRef,
-        // Its own owner id: a planning pause must never displace the
-        // builder's backoff for the same task, or vice versa.
         ownerKind: "backoff",
         ownerId: `plan:${run.taskRef}`,
         reason: `plan retry ${strikes}/${MAX_PLAN_STRIKES} — backing off ${Math.round(wait / 60_000)}m`,
@@ -1363,13 +913,6 @@ function sealPlanFailure(store, leaseId, args) {
     }, now);
     return { ok: true, disposition: "backoff", strikes };
 }
-/**
- * Seal a successful scouting run (mate arc §10): the report artifact, the
- * run outcome, the task's terminal state, and the page to the operator
- * exist together or — if the lease was superseded — not at all. Nothing
- * here touches a branch, a publication, or a scope: the deliverable is
- * the artifact, and the task is done the moment it verifies.
- */
 function sealScout(store, leaseId, args) {
     const { runId, taskId, report, now } = args;
     const run = openAttempt(store, leaseId, runId, "a report", "scout");
@@ -1384,8 +927,6 @@ function sealScout(store, leaseId, args) {
     store.finishRun(runId, { outcome: "built", reason: "report-delivered", now });
     const done = store.setTaskState(taskId, "done", now);
     if (!done.ok) {
-        // A mirror the tracker closed meanwhile: the report stands as evidence
-        // on the run; the task keeps the tracker's word for its state.
         store.finishRun(runId, { outcome: "built", reason: `report-delivered (task ${done.reason})`, now });
     }
     store.enqueueNotification({
@@ -1397,13 +938,6 @@ function sealScout(store, leaseId, args) {
     }, now);
     return { ok: true };
 }
-/**
- * The scout's fenced failure finalizer: the BUILDER's discipline, not the
- * planner's — a scout task has no builder attempts, so its strikes are the
- * task's own (three stall it, `task requeue` clears them), and a malformed
- * report is a straight incident with no strike. Never a branch, never a
- * repair session, never a commit.
- */
 function sealScoutFailure(store, leaseId, args) {
     const { runId, taskId, failure: kind, message, now } = args;
     const run = openAttempt(store, leaseId, runId, "a failure", "scout");
@@ -1439,7 +973,6 @@ function sealScoutFailure(store, leaseId, args) {
     }
     const strikes = store.addStrike(run.taskRef);
     if (strikes >= MAX_STRIKES) {
-        // Same as the build: a task a person already closed keeps its state, with no incident, hold or page.
         const closedState = exhaustUnlessClosed(store, run, taskId, now);
         if (closedState !== null)
             return { ok: true, disposition: "closed", strikes, state: closedState };
@@ -1486,20 +1019,9 @@ export function currentClaim(store, taskRef, now) {
         return null;
     return readClaim(row);
 }
-/**
- * Release every lease that has run out.
- *
- * Expiry alone already frees a task for acquisition, so this is not what makes
- * reclaim work — it is what makes it *visible*. A daemon reaping on a tick
- * turns "this lease is being ignored because its timestamp is in the past" into
- * a released row somebody can read, which is the difference between a system
- * that recovers and a system that appears to have lost the work.
- */
 export function reap(store, now) {
     const stamp = now.toISOString();
     const db = store.handle;
-    // One transaction, so the list returned is exactly the list released — a
-    // lease expiring between the read and the write belongs to the next reap.
     return inTransaction(store, () => {
         const expired = db
             .prepare("SELECT * FROM claim WHERE released_at IS NULL AND expires_at <= ?")
@@ -1524,21 +1046,9 @@ function readClaim(row) {
         heartbeatAt: String(row["heartbeat_at"]),
     };
 }
-/**
- * IMMEDIATE rather than DEFERRED: the write lock is taken up front, so two
- * processes racing for the same task queue behind one another instead of both
- * reading, both deciding they won, and one failing at commit time.
- */
 function inTransaction(store, body) {
-    // The store's transact: same BEGIN IMMEDIATE, plus reentrancy — a caller
-    // composing a fenced finalizer with more writes (completion + publication
-    // intent) joins one transaction instead of dying on a nested BEGIN.
     return store.transact(body);
 }
-/**
- * Whether `leaseId` is an expired claim, still unreleased and the newest for its task, on a built-in task that is now
- * done, failed or cancelled: that closed state, else null. heartbeat refuses to renew exactly this case.
- */
 function expiredOnClosedTask(store, leaseId, now) {
     const row = store.handle
         .prepare(`SELECT task_ref FROM claim WHERE lease_id = ? AND released_at IS NULL AND expires_at <= ? AND ${NOT_SUPERSEDED}`)
@@ -1548,13 +1058,6 @@ function expiredOnClosedTask(store, leaseId, now) {
     const known = taskStateForClaim(store, Number(row["task_ref"]));
     return known.kind === "built-in" && isClosedState(known.state) ? known.state : null;
 }
-/**
- * The stall's state write (build and scouting), inside finalize's transaction. The task is the run's own: a supplied
- * id that names another task is a caller defect, thrown like openAttempt's. An open built-in task is marked failed
- * (null back, the stall goes on as before). One a person already closed keeps its state: that state comes back and
- * the caller writes no incident, hold or page. A reference with no built-in task row behind it (a missing row, or a
- * task of another backend) writes no state and answers null, so the stall goes on as it did before.
- */
 function exhaustUnlessClosed(store, run, taskId, now) {
     const ref = store.refForId(run.taskRef);
     if (ref === null || ref.externalId !== taskId) {
@@ -1567,13 +1070,6 @@ function exhaustUnlessClosed(store, run, taskId, now) {
     const state = store.getTask(taskId)?.state;
     return state !== undefined && isClosedState(state) ? state : null;
 }
-/**
- * Check cleanup's claim (acp-check.ts settleChecks): the one road that may claim a closed task. Only the task bound to
- * check `checkId`, when that check is this runner's, finished and unsettled, held right now by this cleanup `attempt`,
- * and its task is the built-in one named from the check row's own id (store.ts checkCleanupTaskOf) — proved here, in
- * the same transaction as the grant. Every other gate of the claim still applies. When the proof fails, the claim
- * answers exactly as an ordinary one would: never wider.
- */
 export function acquireForCheckCleanup(store, checkId, attempt, runner, options) {
     return inTransaction(store, () => {
         const proved = checkCleanupTaskOf(store, checkId, runner, attempt, options.now);