toolroll 0.9.103 → 0.9.105

package/dist/exhaustion.js

@@ -1,21 +1,3 @@
-/**
- * How a finished attempt ended, classified where the evidence still exists
- * (the provider adapter's structural terminal record), never in disposal.
- * The one class that changes what happens next is `auth-expired`: a sign-in
- * or API key that no longer works pauses dispatch for that provider until
- * someone signs in, instead of burning attempts. Everything else is the
- * ordinary failure road.
- *
- * `usage-exhausted` moves the work to the next agent a person approved
- * (fallback.ts), so it comes only from a recogniser below, and a recogniser
- * comes only from a real run (docs/plans/fallback-chains.md). A provider with
- * none never reads as exhausted. `credits-depleted` and `transient-throttle`
- * are only ever read from older runs' records.
- */
-/** Classify a finished attempt: a sign-in that no longer works first, for
- * any provider or version; then a recognised plan limit, on the exact provider,
- * auth mode and CLI line it was seen on; then a structural failure terminal is
- * `not-exhausted`, and anything else `unknown`. */
 export function classifyTerminal(args) {
     const { terminal } = args;
     if (terminal !== null && terminal.failed === true && isAuthFailure(`${terminal.code ?? ""}\n${terminal.text ?? ""}`))
@@ -52,27 +34,16 @@ function planLimitReached(run, text) {
     return RECOGNISERS.some(one => one.provider === run.provider && one.authMode === run.authMode
         && !before(version, one.from) && before(version, one.below) && one.terminal.test(words));
 }
-/** Whether a terminal reads as a limit for this provider and auth mode, before its CLI version is asked. */
 export function terminalMatchesLimit(provider, authMode, terminal) {
     if (terminal === null || terminal.failed !== true || terminal.text === null)
         return false;
     const words = terminal.text.trim();
     return RECOGNISERS.some(one => one.provider === provider && one.authMode === authMode && one.terminal.test(words));
 }
-/** Whether Toolroll can recognise this agent running out at all: the words every surface shows beside an entry. */
 export function limitRecognised(provider, authMode) {
     return RECOGNISERS.some(one => one.provider === provider && one.authMode === authMode);
 }
-/**
- * The sign-in signals, provider-neutral: Claude's expired or unrefreshable
- * OAuth session and its "Please run /login", an API key the provider calls
- * invalid or revoked, Codex's and Gemini's "not logged in", and an HTTP 401
- * the harness reports as its terminal. Ordinary failures (a test that
- * failed, a timeout, a usage limit) match none of these.
- */
 const AUTH_FAILURE = [
-    // Provider-specific phrasings only: a build's own output (a login feature's
-    // tests, an HTTP 401 in a log) must never read as the agent's sign-in.
     /\bOAuth (?:session|token)\b[^\n]{0,80}\b(?:expired|could not be refreshed|revoked|invalid)/i,
     /\bFailed to authenticate\b[^\n]{0,40}\b(?:OAuth|token|session|credentials|API key)/i,
     /\bPlease run \/login\b/i,
@@ -83,7 +54,6 @@ const AUTH_FAILURE = [
     /\bMissing bearer (?:or basic )?authentication\b/i,
     /^Not logged in\b/m,
 ];
-/** Whether a provider's own words say its sign-in or key no longer works. */
 export function isAuthFailure(text) {
     const bounded = text.slice(0, 8192);
     return AUTH_FAILURE.some(re => re.test(bounded));

package/dist/export-ui.js

@@ -1,19 +1,12 @@
-/**
- * Settings → Data (v105): an instance operator downloads everything Toolroll
- * knows as one .zip: the password (when the rules ask for it) and a button.
- * Built from the revamp kit; the Settings frame adds the title.
- */
 import { html, joinHtml } from "./html.js";
 import { codeLine, note, notice, settingsSection } from "./server/kit.js";
 import { kitSectionForm } from "./settings-kit.js";
-/** The page is kit pieces now; nothing of the old look is left. Kept as an export for the shared stylesheet. */
 export const EXPORT_CSS = "";
 export function dataExportHtml(said) {
     return settingsSection({ id: "data-export", title: "Download everything",
         lead: "Everything Toolroll knows, as one .zip: projects, tasks, runs and cost, the action ledger, evidence packs, chats, flows, subagents and settings. Passwords, keys and tokens are never included.",
         body: joinHtml([
             said.problem ? notice(said.problem) : "",
-            // The answer is a download, not a page: post as a navigation.
             kitSectionForm({ proof: "data", action: "/settings/data", id: "data-form", download: true, save: { label: "Download export" }, body: html `` }),
             note("The same export from the command line:"),
             codeLine("toolroll export --out <path> [--zip]"),

package/dist/export.js

@@ -1,21 +1,3 @@
-/**
- * Full export (v105): everything Toolroll knows, for an instance
- * operator to take away — every table of the database as JSON Lines, grouped
- * by what it's about (projects, tasks, runs, the ledger, chats, flows,
- * subagents, people, settings), an evidence pack per task, the settings kept
- * in files beside the database, a README explaining the layout, and a
- * manifest with each file's SHA-256. One folder, or the same files in a .zip.
- *
- * Secrets never leave: tables that are nothing but secrets (sessions,
- * pairing codes, nonces) are skipped, columns that hold one (password and
- * token hashes, button tokens, push keys, webhook secrets) are dropped, a
- * column whose name looks like a secret and that nobody has reviewed is
- * dropped too, and any value shaped like a key or token is replaced by
- * "[redacted]". Provider keys and file-kept secrets are never read.
- *
- * Not included: artifact bodies (logs, diffs, screenshots), which stay in
- * the evidence folder; their records (size, SHA-256) are in runs/artifact.
- */
 import { createHash } from "node:crypto";
 import { closeSync, constants, fsyncSync, mkdirSync, openSync, writeSync } from "node:fs";
 import { dirname, join } from "node:path";
@@ -28,28 +10,22 @@ import { readSsoSettings } from "./sso-settings.js";
 import { readEmailSettings } from "./email-settings.js";
 import { SUBSCRIPTION_CAPABLE, readAuthMode } from "./keys.js";
 export const EXPORT_FORMAT = "standing-orders/export/v1";
-/** Tables that hold nothing but secrets or short-lived sign-in material, and derived search indexes. */
 const SECRET_TABLES = new Set(["web_session", "ceremony_nonce", "chat_pair", "oauth_code", "oauth_refresh"]);
 const DERIVED_TABLE = /^(sqlite_|memory_search)/;
-/** Columns that hold a secret (or what stands in for one): never exported. */
 const SECRET_COLUMNS = new Set([
     "credential.secret_hash", "approver.credential_hash", "runner.credential_hash", "invite.token_hash",
     "flow_trigger.hook_hash", "push_subscription.endpoint", "push_subscription.p256dh", "push_subscription.auth",
     "chat_turn.credential_key", "lead_session.credential_key", "mate_turn.credential_key", "chat_runtime.push_url", "workflow_preview.token",
     "quota.credential_fp", "oauth_grant.renew_hash", "oauth_client.source_hash",
 ]);
-/** A column named like this holds a secret unless it is reviewed below; an unreviewed one is dropped. */
 const SECRET_NAME = /hash|secret|token|passw|cookie|csrf|credential|p256dh|^auth$|key|nonce|endpoint|url/i;
-/** Reviewed: named like a secret, but it isn't one (a seal, a digest, a lookup name, an address with no key). */
 const REVIEWED_COLUMNS = new Set([
     "artifact.key", "budget.scope_key", "lead_thread.scope_key", "diff_comment.source_key", "chat_meta.key",
     "flow_trigger_event.key", "installation_fact.key", "mcp_idempotency.key", "memory_gap.key", "mutation.idempotency_key", "notification.dedupe_key",
     "service_cursor.key", "ledger_checkpoint.hash", "ledger_seal.hash", "merge_intent.grant_terms_hash", "plan_revision.parent_hash",
     "publication.body_hash", "publication.pr_url", "team_message.payload_hash", "team_request.payload_hash", "backend_grant.credential_scope",
 ]);
-/** Token counts are usage, not tokens. */
 const USAGE_COLUMN = /(^|_)tokens(_|$)|output_tokens/;
-/** Where a table's file goes: by what it's about. Anything new lands in "other", never nowhere. */
 export function categoryOf(table) {
     const rules = [
         [/^(action_ledger|ledger_seal|ledger_checkpoint|sync_ledger)$/, "ledger"],
@@ -64,7 +40,6 @@ export function categoryOf(table) {
     ];
     return rules.find(([pattern]) => pattern.test(table))?.[1] ?? "other";
 }
-/** Extra shapes beside the evidence scanner's: this installation's own tokens and password hashes, and bearer headers. */
 const EXTRA_SHAPES = [
     /\bso_[a-f0-9]{12}_[A-Za-z0-9_-]{43}/g,
     /\bsor_[a-f0-9]{12}_[A-Za-z0-9_-]{43}/g,
@@ -75,11 +50,8 @@ const EXTRA_SHAPES = [
     /\bxapp-[A-Za-z0-9-]{10,}/g,
     /\blin_(?:api|wh)_[A-Za-z0-9]{20,}/g,
 ];
-/** A whole private key, header to footer (or to the end of the text): it goes first, before the scanner's header-only
- * shape can take the header and leave the key's body behind. */
 const PRIVATE_KEY_BLOCK = /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g;
 const SHAPES = [PRIVATE_KEY_BLOCK, ...SECRET_PATTERNS.map(({ pattern }) => new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`)), ...EXTRA_SHAPES];
-/** Every key- or token-shaped run in `text` replaced by "[redacted]". */
 export function redactKeyShapes(text) {
     let out = text;
     for (const shape of SHAPES)
@@ -97,11 +69,10 @@ function cleanValue(value) {
 }
 const fileName = (value) => value.replace(/[^A-Za-z0-9._-]/g, "_").replace(/^\.+/, "_").slice(0, 120) || "_";
 const sha256 = (data) => createHash("sha256").update(data).digest("hex");
-/** The whole export, in memory: the files, the manifest and README among them. */
 export function buildExport(store, options) {
     const db = store.handle;
     const stamp = options.now.toISOString().replace(/[:.]/g, "-");
-    const root = `standing-orders-export-${stamp}`;
+    const root = `toolroll-export-${stamp}`;
     const files = [];
     const entries = [];
     const add = (path, data, rows) => { files.push({ path, data }); entries.push({ path, sha256: sha256(data), bytes: data.length, ...(rows === undefined ? {} : { rows }) }); };
@@ -130,7 +101,6 @@ export function buildExport(store, options) {
         const lines = [];
         const select = `SELECT ${kept.map(column => `"${column.replace(/"/g, '""')}"`).join(", ")} FROM "${table.replace(/"/g, '""')}" ORDER BY rowid`;
         let rows;
-        // A table without rowids keeps its own order.
         try {
             rows = db.prepare(select).all();
         }
@@ -146,7 +116,6 @@ export function buildExport(store, options) {
         add(`${categoryOf(table)}/${table}.jsonl`, Buffer.from(lines.length === 0 ? "" : `${lines.join("\n")}\n`, "utf8"), lines.length);
         written++;
     }
-    // An evidence pack per task: the task and each revision of it, their terms, approvals, runs, cost and ledger entries.
     const chain = store.ledgerChain({ full: true });
     const access = { principal: "operator", repos: null, includeUnplaced: true };
     const packed = new Set(), roots = new Set(), names = new Set();
@@ -171,7 +140,6 @@ export function buildExport(store, options) {
         add(`evidence-packs/${name}.json`, Buffer.from(`${redactKeyShapes(JSON.stringify(pack, null, 2))}\n`, "utf8"));
         packs++;
     }
-    // Settings kept in files beside the database: what they are set to, never their secrets.
     add("settings/files.json", Buffer.from(`${JSON.stringify(fileSettings(options.configDir), null, 2)}\n`, "utf8"));
     add("README.md", Buffer.from(readme(options.now, options.who), "utf8"));
     const manifest = {
@@ -181,7 +149,6 @@ export function buildExport(store, options) {
     files.push({ path: "manifest.json", data: Buffer.from(`${JSON.stringify(manifest, null, 2)}\n`, "utf8") });
     return { root, files, manifest, tables: written, packs };
 }
-/** The settings kept in files (monitoring, sign-in, email, how each provider bills), secrets left out. */
 function fileSettings(dir) {
     const monitoring = readMonitoring(dir);
     const sso = readSsoSettings(dir);
@@ -191,7 +158,6 @@ function fileSettings(dir) {
         billing[provider] = readAuthMode(provider);
     return {
         monitoring: {
-            // A webhook or collector address may carry a key in its path or query: only where it points.
             webhook: monitoring.webhook === null ? null : { origin: origin(monitoring.webhook.url) },
             folder: monitoring.folder,
             traces: monitoring.traces === null ? null : { origin: origin(monitoring.traces.endpoint), header: monitoring.traces.header?.name ?? null },
@@ -231,7 +197,6 @@ way no longer matches its seal. Artifact contents (logs, diffs, screenshots) sta
 with sizes and SHA-256, are in \`runs/artifact.jsonl\`.
 `;
 }
-/** Write the export as a new folder at `out` (its parent must exist; it must not). Files are readable by their owner only. */
 export function writeExportFolder(out, exported) {
     mkdirSync(out, { mode: 0o700 });
     for (const file of exported.files) {
@@ -247,7 +212,6 @@ export function writeExportFolder(out, exported) {
         }
     }
 }
-/** The same files as one .zip (deflated, inside a folder named for the export). */
 export function exportZip(exported) {
     const local = [], central = [];
     let offset = 0;
@@ -301,7 +265,6 @@ export function exportZip(exported) {
     end.writeUInt32LE(offset, 16);
     return Buffer.concat([...local, directory, end]);
 }
-/** One line for the ledger and the person who asked. */
 export function exportSummary(exported) {
     return `${exported.files.length} files · ${exported.tables} tables · ${exported.packs} evidence packs`;
 }

package/dist/failing-first.js

@@ -1,11 +1,7 @@
-/** Failing test first (docs/plans/fleet-follow-through.md), on its own so the steering mailbox can read it. Evidence pairs
- * reach the builder through follow-up checks, and the mailbox loads with the provider table: importing them from there
- * is a cycle that fails at load in every built command. */
 import { z } from "zod";
 import { readingFleet } from "./fleet-schema.js";
 import { cleanFindingText, familyRootOf } from "./findings.js";
 export const FAILING_FIRST_OUTPUT_LIMIT = 2_000;
-/** Where the agent writes its report, in the attempt's own mailbox folder. */
 export const FAILING_FIRST_FILE = "failing-first.json";
 export const failingFirstReportSchema = z.strictObject({ key: z.string().min(1).max(64), test: z.string().min(1).max(300), output: z.string().min(1).max(FAILING_FIRST_OUTPUT_LIMIT) });
 export function failingFirstOf(store, taskId) {
@@ -27,7 +23,6 @@ export function askFailingFirst(store, taskId, by, now) {
 export function dropFailingFirst(store, taskId) {
     store.handle.prepare("DELETE FROM failing_first WHERE family_root = ?").run(familyRootOf(store, taskId));
 }
-/** The agent's report, as data. Only a task that asked takes one. */
 export function saveFailingFirstReport(store, taskRef, runId, report, now) {
     const taskId = store.refById(taskRef)?.externalId;
     if (taskId === undefined)
@@ -36,7 +31,6 @@ export function saveFailingFirstReport(store, taskRef, runId, report, now) {
         .run(runId, cleanFindingText(report.test, 300), cleanFindingText(report.output, FAILING_FIRST_OUTPUT_LIMIT), now.toISOString(), familyRootOf(store, taskId));
     return Number(saved.changes) === 1;
 }
-/** How the step stands, or null when this task didn't ask for it. */
 export function failingFirstWords(step) {
     if (step === null)
         return null;

package/dist/fallback-schema.js

@@ -1,8 +1,3 @@
-/**
- * v156: fallback chains (docs/plans/fallback-chains.md). New tables only, so a saved row reads as it did. Their names
- * differ from the tables v115 dropped: nothing old comes back under an old name. Kept beside nothing else so the update
- * road can read the list without loading the store.
- */
 export const V156_SCHEMA = `
 CREATE TABLE IF NOT EXISTS fallback_setting (
   repo            TEXT PRIMARY KEY,

package/dist/fallback.js

@@ -1,16 +1,3 @@
-/**
- * Fallback chains (docs/plans/fallback-chains.md): when an agent runs out of its plan mid-task, the work moves to the
- * next agent a person approved.
- *
- * A person sets a project's chain and its paid grant. Filing snapshots the chain into the scope and the approval seals
- * it. A walk is one pass down a sealed chain for one task; every builder run on a chain approval is bound to one, and
- * a run with no binding spawns nothing. A move happens only in the transaction that seals a recognised exhausted run.
- * The next agent runs through the ordinary claim, keyed to its pinned entry. Paid entries re-read the live grant at the
- * move, the admission and the spawn.
- *
- * Tables may not exist on a database an older build still holds (update drain reads through here): every read treats
- * that as "no chain" (`hasTables`), never an error.
- */
 import { createHash } from "node:crypto";
 import { resolveScopeProfile } from "./agentconfig.js";
 import { isAcpProvider } from "./acp-agents.js";
@@ -39,25 +26,18 @@ export function entryDigestOf(entry) {
 }
 const planCapable = (provider) => SUBSCRIPTION_CAPABLE[provider] === true;
 const billingWord = (authMode) => authMode === "api-key" ? "API key" : "plan";
-/** An entry in the words every surface uses. */
 export function entryWords(entry) {
     return `${providerName(entry.provider)} ${entry.model} (${billingWord(entry.authMode)})`;
 }
-/** Whether Toolroll can see this entry run out, in plain words: an entry it can't recognise ends the chain there. */
 export function entryMovesOnWords(entry) {
     return limitRecognised(entry.provider, entry.authMode) ? "Moves on when its plan runs out" : "Won't move on: Toolroll can't yet recognise this agent running out";
 }
-/** Whether this entry spends money, by what it was pinned to: an API key, or a provider that only bills by use. A plan
- * entry is never paid: where its login can't be proved to be that plan, it doesn't run (invoke.ts), it is never
- * reinterpreted as a paid agent. */
 export function entryPaid(_store, entry) {
     return entry.authMode === "api-key" || !planCapable(entry.provider);
 }
-// ---- The project setting. Only a person changes it, and every change is logged.
 function personOnly() {
     return machineActing() ? "Only a person can change a project's fallback agents." : null;
 }
-/** Parse `provider:model:plan|api-key`. The model is everything between the first and last colon, so ":free" ids work. */
 export function parseEntry(text) {
     const first = text.indexOf(":"), last = text.lastIndexOf(":");
     if (first <= 0 || last <= first)
@@ -111,7 +91,6 @@ export function setFallbackChain(store, repo, entries, by, now) {
     if (problem !== null)
         return { ok: false, problem };
     return store.transact(() => {
-        // A chain Toolroll couldn't file refuses here, not on the next task.
         for (const entry of entries) {
             const resolved = resolveEntry(store, repo, entry);
             if (!resolved.ok)
@@ -134,7 +113,6 @@ export function clearFallbackChain(store, repo, by, now) {
     });
     return { ok: true };
 }
-/** The paid grant: the one explicit yes a paid entry spends under, read again at every money moment. */
 export function setPaidGrant(store, repo, allowed, by, now) {
     const problem = personOnly();
     if (problem !== null)
@@ -151,16 +129,10 @@ export function setPaidGrant(store, repo, allowed, by, now) {
 function paidGrantLive(store, repo) {
     return repo !== null && fallbackSettingOf(store, repo)?.paidGrant != null;
 }
-// ---- Filing and sealing.
 function resolveEntry(store, repo, entry, permissionMode = "auto") {
-    // "inherit": a repair turn resumes its own agent's session, so its model is the entry's whatever the repair row says.
     const resolved = resolveScopeProfile(store, repo, undefined, { provider: entry.provider, model: entry.model, repairModel: "inherit", permissionMode });
     return resolved.ok ? { ok: true, profile: resolved.profile } : { ok: false, problem: resolved.problem };
 }
-/**
- * The chain a new scope files with: its base agent, then the project's entries. Null means no chain. A setting that can't
- * resolve is a stated problem: the scope files unresolved in those words, and nothing runs on half a chain.
- */
 export function chainForFiling(store, repo, base, baseAuth, lower) {
     if (repo === null)
         return { ok: true, chain: null };
@@ -173,7 +145,6 @@ export function chainForFiling(store, repo, base, baseAuth, lower) {
     const chain = [{ profile: base, authMode: baseAuth }];
     const seen = new Set([entryDigestOf(chain[0])]);
     for (const entry of setting.entries) {
-        // An entry never reaches further than the base: full access only where the base already has it.
         const resolved = resolveEntry(store, repo, entry, permissionPlainWords(base)?.startsWith("full access") === true ? "bypassPermissions" : "auto");
         if (!resolved.ok)
             return { ok: false, problem: `This project's fallback agent ${entryWords(entry)} can't be used: ${resolved.problem}` };
@@ -186,11 +157,6 @@ export function chainForFiling(store, repo, base, baseAuth, lower) {
     return { ok: true, chain: chain.length < 2 ? null : chain };
 }
 export const chainJsonOf = (chain) => canonicalChainJson(chain, LIVE_CHAIN_VERSION);
-/**
- * Why this chain can't seal on this yes, or null. A paid entry takes a person's own yes: the ceremony or their chat tap,
- * never a mode, grant, schedule, lead or automatic seal, and no machine's credential. A chat tap is bound to the scope's
- * digest, which covers the chain, and the card shows the chain in full (chainTermsLines).
- */
 export function chainSealProblem(store, scope, basis) {
     const chain = liveChainFromJson(scope.proposedChainJson ?? null);
     if (chain === null)
@@ -211,12 +177,10 @@ function sealedChain(store, taskId) {
     if (!route.ok)
         return { kind: "problem", problem: route.detail };
     const chain = liveChainFromJson(scope.approvedChainJson ?? null);
-    // A chain sealed before v115 still verifies as history; it spends nothing now.
     if (chain === null)
         return { kind: "problem", problem: "this approval names fallback agents from an older version; save the scope again and approve it" };
     return { kind: "chain", chain, digest: chainDigestOf(chain, LIVE_CHAIN_VERSION), scope, routeDigest: routeDigestOf(route.route) };
 }
-// ---- The walk.
 function walkOf(row) {
     if (row === undefined)
         return null;
@@ -237,11 +201,6 @@ const pendingMove = (store, walk, index) => store.handle.prepare("SELECT 1 AS hi
 function closeWalk(store, id, reason, now) {
     store.handle.prepare("UPDATE fallback_walk SET state = 'closed', closed_reason = ?, closed_at = ? WHERE id = ? AND state = 'open'").run(reason, now.toISOString(), id);
 }
-/**
- * THE ONE RESOLVER: what a walk's tail says about the walk. An open tail or a move waiting to run leaves it; a parked
- * tail keeps it, because the answer resumes that agent; a built tail closes it; anything else closes it, and the retry
- * starts a fresh walk at the base. Whichever pass gets here, after any crash, settles it the same way.
- */
 function settleWalk(store, walk, now) {
     const ref = store.refForId(walk.taskRef);
     const scope = ref === null ? null : store.getScope(ref.externalId);
@@ -267,7 +226,6 @@ function settleWalk(store, walk, now) {
         return;
     closeWalk(store, walk.id, finished ? "succeeded" : "entry-ended", now);
 }
-/** Each tick, before any dispatch: settle every open walk. */
 export function reconcileWalks(store, now) {
     if (!hasTables(store))
         return;
@@ -276,10 +234,6 @@ export function reconcileWalks(store, now) {
             settleWalk(store, walkOf(row), now);
     });
 }
-/**
- * Which entry the next build of this task runs as, read by the tick before anything is claimed: null is the ordinary
- * road (no chain, or the base agent). A move whose paid grant has since gone closes here and says so: nothing runs on it.
- */
 export function dispatchEntryOf(store, taskRef, taskId, now) {
     if (!hasTables(store))
         return null;
@@ -312,7 +266,6 @@ export function dispatchEntryOf(store, taskRef, taskId, now) {
         return { index: walk.cursor, entry, paid };
     });
 }
-/** A route stamp for a fallback entry, checked against the sealed chain: the admission's proof of `fallback` provenance. */
 export function fallbackStampProblem(store, taskRef, taskId, stamp, parentRun) {
     if (!hasTables(store))
         return "this database has no fallback records yet";
@@ -342,11 +295,6 @@ export function fallbackStampProblem(store, taskRef, taskId, stamp, parentRun) {
 function stampRun(store, runId, walk, index, entry) {
     store.handle.prepare("UPDATE run SET chain_cycle = ?, chain_index = ?, entry_digest = ?, auth_mode = ? WHERE id = ?").run(walk, index, entryDigestOf(entry), entry.authMode, runId);
 }
-/**
- * Inside the run's admission transaction: bind it to its walk, or say why not (the caller rolls the row back). A base run
- * opens a walk; a pending entry consumes its edge exactly once, with the paid grant re-read; a parked tail hands custody to
- * its resumption; a repair inherits its parent's binding verbatim. Nothing else opens on a chain approval.
- */
 export function bindRunToWalk(store, runId, now) {
     if (!hasTables(store))
         return null;
@@ -404,7 +352,6 @@ export function bindRunToWalk(store, runId, now) {
     stampRun(store, run.id, walk.id, walk.cursor, entry);
     return null;
 }
-/** The pinned entry a bound run spends as, or null for a run with no binding. */
 export function pinnedEntryOf(store, runId) {
     if (!hasTables(store))
         return null;
@@ -420,11 +367,6 @@ export function pinnedEntryOf(store, runId) {
         return { problem: "this run's fallback entry isn't in the approved chain" };
     return { index: run.chainIndex, entry };
 }
-/**
- * THE LAST LOOK AT THE SPAWN: one read of every authority a chain run spends under. A builder or repair on a chain
- * approval with no binding spends nothing; a bound run must hold the walk's current place, under the live approval, as its
- * exact entry; a paid entry must still hold the live grant. Null means go.
- */
 export function chainCustodyProblem(store, runId) {
     if (!hasTables(store))
         return null;
@@ -459,28 +401,21 @@ export function chainCustodyProblem(store, runId) {
         return null;
     });
 }
-/** A builder's newest repair turn, when it ran out of plan holding the builder's exact place in the walk: the evidence a
- * repair turn gives its owning attempt. Any newer turn, a turn that never spawned or never finished, or one bound
- * elsewhere, is none. */
 function exhaustedRepairOf(store, run) {
     const row = store.handle.prepare("SELECT id FROM run WHERE parent_run = ? AND role = 'repair' ORDER BY id DESC LIMIT 1").get(run.id);
     const child = row === undefined ? null : bindingOf(store, Number(row["id"]));
-    // Only the agent's own failed exit: a turn the gateway refused (a session that didn't match, any protocol problem) is
-    // never evidence, whatever its stamp says.
     if (child === null || child.terminalClass !== "usage-exhausted" || child.providerStartedAt === null || child.outcome !== "failed" || child.reason !== "agent")
         return null;
     if (child.taskRef !== run.taskRef || child.chainCycle !== run.chainCycle || child.chainIndex !== run.chainIndex || child.entryDigest !== run.entryDigest)
         return null;
     return child;
 }
-/** Whether this finished attempt is about to move on: it holds a walk's place and the gateway classed it exhausted. */
 export function ranOutOnChain(store, runId) {
     if (!hasTables(store))
         return false;
     const run = bindingOf(store, runId);
     return run !== null && run.chainCycle !== null && run.terminalClass === "usage-exhausted" && (run.outcome === null || (run.outcome === "failed" && run.reason === "agent"));
 }
-/** The gateway refused this bound run: its plan login isn't proved. The walk closes, a person is told, no strike. */
 export function closeWalkSignedOut(store, runId, now) {
     if (!hasTables(store))
         return;
@@ -499,11 +434,6 @@ export function closeWalkSignedOut(store, runId, now) {
         }, now);
     });
 }
-/**
- * After the dispatch road finished a refused run: when it was a fallback agent refused for not being signed in to its
- * plan, the task stops and waits for a person (task state failed, the run's reason saying why), until they retry it.
- * Nothing expires it. True when it did.
- */
 export function blockAfterSignedOut(store, runId, now) {
     if (!hasTables(store))
         return false;
@@ -521,12 +451,6 @@ export function blockAfterSignedOut(store, runId, now) {
         return true;
     });
 }
-/**
- * THE MOVE, inside sealFailure's transaction (the claim is already released, the run still open): only the walk's own tail,
- * started and classed exhausted by the gateway, on the exact entry it was pinned to. Null means the ordinary failure road
- * runs, with the walk closed in words when it can't go on. The caller finishes the run either way; a walk that moved leaves
- * no strike.
- */
 export function moveOnIfExhausted(store, runId, taskId, now) {
     if (!hasTables(store))
         return null;
@@ -535,7 +459,6 @@ export function moveOnIfExhausted(store, runId, taskId, now) {
         return null;
     if (run.role !== "builder" || run.chainCycle === null || run.chainIndex === null)
         return null;
-    // The evidence: this attempt's own terminal, or its last repair turn's, proved to hold the same place on the same entry.
     const evidence = run.terminalClass === "usage-exhausted" ? run : exhaustedRepairOf(store, run);
     if (evidence === null)
         return null;
@@ -589,10 +512,6 @@ function tell(store, run, taskId, what, to, now) {
                 : "Every approved agent has run out. Wait for a plan to reset and requeue.",
     }, now);
 }
-/**
- * What the next agent is told about the move, for its brief. The one place the handover note plugs in: once it merges, a
- * fallback run gets that note here. Null for any run that isn't continuing another agent's work.
- */
 export function fallbackBriefFor(store, runId) {
     if (!hasTables(store))
         return null;