toolroll 0.9.104 → 0.9.105

package/dist/repository-context.js

@@ -1,6 +1,3 @@
-/** Optional repository context. Callers admit project access; this module grants no authority.
- * The index is disposable. Every read hashes the current bounded tracked source set;
- * a missing/changed/unreadable index falls back to ordinary text search, never a task gate. */
 import { checkoutGitSync, viewedGitSync } from './teardown-git.js';
 import { createHash, randomUUID } from 'node:crypto';
 import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
@@ -13,17 +10,11 @@ const CODE = /\.(?:[cm]?[jt]sx?)$/i;
 const TEXT = /\.(?:[cm]?[jt]sx?|md|txt|css|html|json)$/i;
 const MAX_NODES = 16_000, MAX_EDGES = 12_000;
 const sha = (value) => createHash('sha256').update(value).digest('hex');
-// Read-only and bounded, and always the hardened checkout git (a crew worktree is agent-written, and a page read or a
-// lead's refresh reads it alike): no filter, hook, program or network, its config and info frozen in a view of the
-// plane's own before they're inspected (teardown-git.ts checkoutGitSync).
-// Bound to the project's record, so a pointer or commondir can't turn the read to another repository.
 const git = (repo, args, binding) => checkoutGitSync(repo, args, { timeoutMs: 10_000, maxBuffer: 2_000_000, binding }).trimEnd();
 const inside = (root, path) => { const r = relative(root, path); return r !== '..' && !r.startsWith('..' + sep) && !isAbsolute(r); };
-/** Whether a tracked path is one the index reads, by its name alone. */
 const skippedPath = (file) => !TEXT.test(file) || /(?:^|\/)(?:node_modules|vendor|dist|build|coverage|\.git)(?:\/|$)/.test(file);
 const unsafePath = (file) => file.split('/').some(p => p === '..') || /[\x00-\x1f]/.test(file);
 const unreadableText = (data, text) => data.length > MAX_FILE_BYTES || /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f\ufffd]/u.test(text) || scanForSecrets(text).length > 0;
-/** The working tree's tracked files, for a lead or a person looking at the project's own checkout. */
 function workingTreeSources(repo, binding) {
     const files = git(repo, ['ls-files', '-z', '--cached'], binding).split('\0').filter(Boolean).sort();
     const sources = [];
@@ -38,7 +29,6 @@ function workingTreeSources(repo, binding) {
         }
         try {
             const stat = lstatSync(path);
-            // Never follow even an internal symlink: the index is scoped to tracked ordinary files.
             if (!stat.isFile() || stat.isSymbolicLink() || realpathSync(path) !== path) {
                 omitted++;
                 continue;
@@ -64,10 +54,6 @@ function workingTreeSources(repo, binding) {
     }
     return { sources, omitted, omittedBytes };
 }
-/**
- * A crew's sources: the task base's tree and raw blobs, never the working tree an agent writes. A dirty tracked file,
- * a symlink swapped in or a replace ref is not read; no filter runs on a raw blob.
- */
 function baseCommitSources(repo, base, binding) {
     const read = (args, maxBuffer, input) => {
         const ran = viewedGitSync(repo, ['--no-replace-objects', ...args], { timeoutMs: 10_000, maxBuffer, binding, buffer: true, ...(input === undefined ? {} : { input }) });
@@ -125,8 +111,6 @@ function capture(request) {
     const repo = realpathSync(request.repo);
     if (repo !== resolve(request.repo))
         throw Error('The project location changed.');
-    // The project's record, never the checkout's own pointer files: the admitted project, or the one a crew worktree
-    // belongs to. Only a person's local look at an unrecorded folder has none.
     const binding = { repo: request.project ?? null };
     if (realpathSync(git(repo, ['rev-parse', '--show-toplevel'], binding)) !== repo)
         throw Error('Choose the project checkout root.');
@@ -150,7 +134,6 @@ function capture(request) {
 }
 function cacheFile(root, checkout) {
     const absolute = resolve(root);
-    // Reject an existing symlink anywhere in the cache path, and caches inside the repo.
     let parent = absolute;
     while (!existsSync(parent) && dirname(parent) !== parent)
         parent = dirname(parent);
@@ -190,7 +173,7 @@ function writeIndex(path, index) {
         try {
             unlinkSync(tmp);
         }
-        catch { /* Successful atomic rename leaves no temp file. */ }
+        catch { }
     }
 }
 async function buildIndex(snapshot) {
@@ -348,8 +331,6 @@ function finishContext(request, result, snapshot, index) {
     return boundContext(result, budget);
 }
 function boundContext(result, budget) {
-    // Metadata is part of the same budget: a Unicode query alone can exceed
-    // a small crew allocation even when every excerpt was already omitted.
     if (Buffer.byteLength(JSON.stringify(result)) > budget) {
         result.query = result.query.slice(0, 128);
         result.warnings.push('Response size limited the selection and shortened the displayed query.');
@@ -362,7 +343,6 @@ function boundContext(result, budget) {
             result.omissions.relationships++;
         }
         if (Buffer.byteLength(JSON.stringify(result)) > budget) {
-            // Never truncate path identity and then imply it still pins source.
             result.checkout = null;
             result.index = { engine: 'text-search', status: 'unavailable', generation: null, extractor: null };
             result.warnings = ['Repository context identity exceeded the response limit. Continue with ordinary file reading.'];
@@ -370,8 +350,6 @@ function boundContext(result, budget) {
     }
     return result;
 }
-/** Synchronous, read-only capture for DB transaction and provider-admission callers.
- * Call once and persist the returned selection; resume uses that capture, never fresh source. */
 export function repositoryContextRead(request) {
     const result = initialResult(request), snapshot = captureForResult(request, result);
     if (!snapshot)
@@ -390,7 +368,6 @@ export function repositoryContextRead(request) {
     }
     return finishContext(request, result, snapshot, index);
 }
-/** Explicit refresh is the only cache-writing path. It never changes project/task records. */
 export async function repositoryContext(request) {
     if (!request.refresh)
         return repositoryContextRead(request);

package/dist/request-budget-ui.js

@@ -3,15 +3,11 @@ import { btn, disclose, formRow, input, note, select, settingsSection } from "./
 import { kitSectionForm } from "./settings-kit.js";
 import { effectiveLimits, limitOverrides, PER_DAY_MAX, PER_MINUTE_MAX, REQUEST_BUDGET_DEFAULTS } from "./request-budget.js";
 const n = (value) => value.toLocaleString("en-US");
-/** The old card look; the section is built from the kit now. Kept for chrome.ts, which still concatenates it. */
 export const REQUEST_LIMITS_CSS = "";
-/** "120 requests a minute · 10,000 a day" for one token's line. */
 export function tokenLimitWords(db, token) {
     const limits = effectiveLimits(db, token.id, token.access);
     return `${n(limits.perMinute)} requests a minute · ${n(limits.perDay)} a day`;
 }
-/** The operator's section: everyone's tokens, or one token. Blank fields use the default shown. Saving takes the
- * operator's password (or Passwordless, or a fresh identity-provider sign-in). */
 export function requestLimitsHtml(db, tokens, now) {
     const overrides = limitOverrides(db);
     const everyone = overrides.get("*") ?? { readPerMinute: null, actPerMinute: null, perDay: null };

package/dist/request-budget.js

@@ -22,9 +22,7 @@ export const PER_DAY_MAX = 100_000;
 export const TRACKED_TOKENS = 1024;
 export const FLUSH_MS = 5_000;
 const MINUTE = 60_000, DAY = 86_400_000;
-/** The words for a 429, in one line. */
 export const limitWords = (limit, retryAfter) => `Request limit reached (${limit === "per-day" ? "requests per day" : limit === "read-per-minute" ? "read requests per minute" : limit === "act-per-minute" ? "act requests per minute" : "requests per minute"}). Try again in ${retryAfter} second${retryAfter === 1 ? "" : "s"}.`;
-/** A limit typed into a form: a whole number within bounds, "" for none, or a problem. */
 export function parseLimit(raw, max) {
     const text = raw.trim();
     if (text === "")
@@ -48,7 +46,6 @@ function readOverride(db, target) {
         return null;
     return { readPerMinute: within(row["read_per_minute"], PER_MINUTE_MAX), actPerMinute: within(row["act_per_minute"], PER_MINUTE_MAX), perDay: within(row["per_day"], PER_DAY_MAX) };
 }
-/** Every override: the installation's under "*", each token's under its id. */
 export function limitOverrides(db) {
     const out = new Map();
     for (const row of db.prepare("SELECT target FROM request_budget_limit ORDER BY target").all()) {
@@ -57,7 +54,6 @@ export function limitOverrides(db) {
     }
     return out;
 }
-/** Token override, then the installation's, then the default — per limit. */
 export function effectiveLimits(db, tokenId, access) {
     const token = readOverride(db, tokenId), installation = readOverride(db, "*");
     const pick = (of, fallback) => (token === null ? null : of(token)) ?? (installation === null ? null : of(installation)) ?? fallback;
@@ -65,7 +61,6 @@ export function effectiveLimits(db, tokenId, access) {
     const perMinute = pick(minute, REQUEST_BUDGET_DEFAULTS[access]), perDay = pick(one => one.perDay, REQUEST_BUDGET_DEFAULTS.day);
     return { perMinute, perDay, overridden: perMinute !== REQUEST_BUDGET_DEFAULTS[access] || perDay !== REQUEST_BUDGET_DEFAULTS.day };
 }
-/** Set (or, all null, clear) an override, with the change in the policy ledger. The caller checks who may. */
 export function setLimitOverride(store, target, next, by, now) {
     const db = store.handle;
     if (target !== "*" && !/^[0-9a-f]{12}$/.test(target))
@@ -102,7 +97,6 @@ function prune(usage, now) {
             usage.dirty = true;
         }
 }
-/** One per server: both routes share it, so a token's allowance is never doubled. */
 export class RequestBudget {
     store;
     clock;
@@ -117,12 +111,7 @@ export class RequestBudget {
         this.flushMs = options.flushMs ?? FLUSH_MS;
         this.lastFlush = this.clock();
     }
-    /** How many tokens are tracked in memory now (never more than `tracked`). */
     get size() { return this.usage.size; }
-    /**
-     * Admit one request by an authenticated token, or say why not. Called once per HTTP request, before its body is
-     * read. Anything unreadable refuses with 503 and nothing runs.
-     */
     admit(tokenId, route) {
         const result = this.check(tokenId, route);
         if (!result.ok)
@@ -163,7 +152,6 @@ export class RequestBudget {
             if (limit !== null) {
                 const retryAfter = Math.max(1, Math.ceil(wait / 1000));
                 const window = limit === "per-day" ? "day" : "minute";
-                // Once per exhausted window: the marker lasts until the window has room again, and is saved with the entry.
                 if (usage.noted[window] <= now) {
                     usage.noted[window] = now + retryAfter * 1000;
                     usage.dirty = true;
@@ -186,14 +174,12 @@ export class RequestBudget {
             return { ok: false, status: 503 };
         }
     }
-    /** Save every changed entry. A server calls this on a timer and when it closes. */
     flush() {
         const now = this.clock();
         this.lastFlush = now;
         for (const [id, usage] of this.usage)
             if (usage.dirty)
                 this.save(id, usage, now);
-        // Saved rows whose every count has expired are no use to anyone.
         this.store.handle.prepare("DELETE FROM request_budget_usage WHERE saved_at <= ?").run(now - DAY - MINUTE);
     }
     save(id, usage, now) {
@@ -202,7 +188,6 @@ export class RequestBudget {
             .run(id, JSON.stringify(usage.minute), JSON.stringify([...usage.day]), JSON.stringify(usage.noted), now);
         usage.dirty = false;
     }
-    /** The tracked entry (now the most recently used), from memory or as last saved; the least recently used is saved and let go. */
     load(id, now) {
         let usage = this.usage.get(id);
         if (usage !== undefined) {
@@ -232,15 +217,7 @@ export class RequestBudget {
         return usage;
     }
 }
-/** Per-minute allowances for non-person-token identities and unauthenticated ingress. Password accounts get room
- * for two-second follower polling plus ordinary commands; OAuth exchanges stay keyed by source address. */
 export const SOURCE_BUDGET_DEFAULTS = Object.freeze({ password: 120, oauthToken: 30, coordinator: 120, teamsSource: 120, teamsTenant: 600 });
-/**
- * A sliding minute per source or proved account, with bounded in-memory LRU history. Expired entries are
- * pruned first; at capacity the least recently used entry is evicted so new callers are never globally locked out.
- * Unverified account names must never be keys. Person API tokens use the persisted RequestBudget above. An address
- * key counts by sourceKey (a native IPv6 caller by its /64). Verified identities must explicitly use exact keys.
- */
 export class SourceAdmission {
     perMinute;
     clock;

package/dist/restart-certification.js

@@ -1,24 +1,3 @@
-/**
- * Restart certification (plan acceptance 7): a BASELINE of the boot, the
- * runtime, the installed service and the database's live custody, taken
- * before a login or reboot; and a VERIFICATION afterwards against the same
- * database — boot identity as the OS reports it, service liveness by a
- * fresh heartbeat, recovery of what the old boot left pending, task
- * completion — without printing a secret and without rebooting anything.
- *
- * The precise limits, written into every baseline so nobody reads more
- * into a pass than it proves:
- *   - macOS LaunchAgents resume at USER LOGIN after a reboot, not before
- *     FileVault unlock / login; a machine that sits at the login window
- *     runs nothing.
- *   - Linux user services depend on a login session or `loginctl
- *     enable-linger`; without linger the user manager stops at logout.
- *   - The Windows Task Scheduler logon trigger is a LOGON trigger, not a
- *     boot service.
- *   - This tool never reboots, logs out, or restarts a service itself. A
- *     physical reboot that has not happened is not claimed: `bootChanged`
- *     is the OS's own word, and `unknown` stays unknown.
- */
 import { hostname } from "node:os";
 import { createHash, randomUUID } from "node:crypto";
 import { dirname, join } from "node:path";
@@ -61,7 +40,6 @@ export function restartRuntimeDigest(executable = process.execPath, root = dirna
         hash.update(name).update(readFileSync(join(root, name)));
     return hash.digest("hex");
 }
-/** Everything a person needs to compare later, none of what they must not see. */
 export async function recordRestartBaseline(inputs) {
     const { store } = inputs;
     const now = inputs.now ?? new Date();
@@ -107,14 +85,6 @@ function readPackageVersion() {
         return null;
     }
 }
-/**
- * Compare now against the baseline. Recovery is judged by the SAME rules
- * the controller uses (stopQuiescenceProblem, settleQuiescentStops): a
- * stop the old boot left pending settles only when its witnesses are
- * proven gone — by the verified boot change, or by the probes — and a
- * stop that still cannot settle is reported with the exact reason, never
- * forced.
- */
 export async function verifyRestartRecovery(inputs) {
     const { store, baseline } = inputs;
     const expectation = inputs.expect ?? "either";
@@ -123,8 +93,6 @@ export async function verifyRestartRecovery(inputs) {
     const current = await recordRestartBaseline({ ...inputs, ...(baseline.runnerName ? { runnerName: baseline.runnerName } : {}), completionTasks: baseline.completionTasks ?? [], boot: identity });
     const sameDatabase = baseline.version === 2 && baseline.database.identity === current.database.identity;
     checks.push({ name: "database", ok: sameDatabase, detail: sameDatabase ? "same database file identity" : "database identity differs or baseline predates identity verification; no recovery mutations performed" });
-    // 1. Boot identity, as the OS reports it.
-    // This machine under any of its own names (machine-identity.ts): a reboot onto another network can move the hostname.
     const sameHost = sameMachineHost(baseline.host, current.host);
     const bootChanged = !sameHost || baseline.boot.id === null || current.boot.id === null
         ? null
@@ -139,11 +107,9 @@ export async function verifyRestartRecovery(inputs) {
                 ? `verified boot change ${baseline.boot.id} → ${current.boot.id}${expectation === "login" ? " — but a login without reboot was expected" : ""}`
                 : `same boot ${current.boot.id}${expectation === "reboot" ? " — the reboot has NOT happened" : ""}`,
     });
-    // 2. Runtime identity.
     const sameRuntime = baseline.runtime.digest === current.runtime.digest && baseline.runtime.execPath === current.runtime.execPath && baseline.runtime.nodeVersion === current.runtime.nodeVersion && baseline.runtime.packageVersion === current.runtime.packageVersion;
     checks.push({ name: "runtime", ok: sameRuntime, detail: sameRuntime ? `same runtime node ${current.runtime.nodeVersion} at ${current.runtime.execPath}, package ${current.runtime.packageVersion ?? "?"}` : `runtime changed: ${baseline.runtime.nodeVersion}@${baseline.runtime.execPath} (${baseline.runtime.packageVersion ?? "?"}) → ${current.runtime.nodeVersion}@${current.runtime.execPath} (${current.runtime.packageVersion ?? "?"})` });
     checks.push({ name: "schema", ok: current.database.schemaVersion === baseline.database.schemaVersion, detail: `schema v${baseline.database.schemaVersion} → v${current.database.schemaVersion}` });
-    // 3. Service liveness: loaded is not working; a working controller shows a running process AND a fresh heartbeat.
     if (baseline.service !== null || current.service !== null) {
         const service = current.service;
         if (service === null)
@@ -165,7 +131,6 @@ export async function verifyRestartRecovery(inputs) {
                 ? "no live runner is registered — the controller has not come back"
                 : `no runner has beaten since the baseline (${liveRunners.map(one => `${one.name}: ${one.heartbeatAt}${one.alive ? "" : " (stale)"}`).join(", ")}) — a loaded service is not a working controller`,
     });
-    // 4. Recovery of what the old boot left pending.
     if (sameDatabase && inputs.recover !== false)
         store.settleQuiescentStops(inputs.now ?? new Date());
     const remaining = baseline.database.pendingStops.map(stop => ({ run: stop.run, settled: store.stopOf(stop.run)?.settledAt != null, problem: store.stopQuiescenceProblem(stop.run) }));
@@ -198,7 +163,6 @@ export async function verifyRestartRecovery(inputs) {
             ? `${oldWitnesses.length} witness(es) of the previous boot are proven gone by boot identity`
             : `${baseline.database.witnesses.length} open witness(es) at the baseline are judged by their probes, not by a boot change`,
     });
-    // 5. Task completion since the baseline.
     const stillRunning = current.database.runningTasks.filter(id => baseline.database.runningTasks.includes(id));
     checks.push({
         name: "tasks",
@@ -215,7 +179,6 @@ export async function verifyRestartRecovery(inputs) {
     }
     return { ok: checks.every(check => check.ok), bootChanged, expectation, checks, current, limits: RESTART_LIMITS };
 }
-/** The baseline and verification are meant to be printed; this keeps a secret from ever entering them. */
 export function assertNoSecret(json, secrets) {
     for (const secret of secrets) {
         if (secret !== "" && json.includes(secret))

package/dist/result-actions.js

@@ -1,8 +1,4 @@
 import { verifyResultImage } from "./chat-evidence.js";
-/** Shared result-to-revision action for the result form and chat.
- * The caller authenticates; this service checks project access and the exact
- * displayed note batch, then uses the existing atomic revision/approval boundary.
- */
 import { createHash, randomBytes } from "node:crypto";
 import { EVIDENCE_CAPS, readVerifiedArtifact, writeEvidenceFile } from "./evidence.js";
 import { parseFeedbackImage, sameFeedbackImage, isRevisionFeedback, parseRevisionBatch, revisionSourceOf, commentSourceKey, REQUEST_TOKEN } from "./result-review.js";
@@ -10,7 +6,6 @@ import { validateNote, hasForbiddenControls } from "./decision.js";
 import { TASK_TEXT_LIMITS, validateTaskText } from "./task-text.js";
 import { modeFilingCoverage } from "./scope.js";
 import { recordRevisionOrigin } from "./route-store.js";
-/** Re-prove image custody and current result at each write. No file paths supplied by callers. */
 export function feedbackImageProblem(store, root, runId, image) {
     if (image == null)
         return null;
@@ -29,8 +24,6 @@ export function feedbackImageProblem(store, root, runId, image) {
     const verified = verifyResultImage(store, root, [repo], { taskId: task, ...image });
     return verified.ok ? null : "This screenshot is unavailable or changed. Restore it or remove it from your feedback. Your draft is unchanged.";
 }
-/** One user action: add the typed change and seal exactly the displayed
- * saved notes. A refusal rolls back the note; a replay returns the same task. */
 export function requestResultChanges(store, evidenceRoot, input, now) {
     try {
         return store.transact(() => store.savepoint(() => {
@@ -67,8 +60,6 @@ export function requestResultChanges(store, evidenceRoot, input, now) {
             const earlier = store.diffCommentBySourceKey(sourceKey);
             if (earlier && (earlier.run !== run.id || earlier.path !== path || earlier.line !== line || earlier.note !== valid.note || !sameFeedbackImage(earlier.image, input.image)))
                 return fail(409, "This submission already saved different feedback. Reopen the result and try again.");
-            // An exact consumed replay only returns its existing revision. Every new
-            // use proves the image before insertion, so malformed targets refuse cleanly.
             if (earlier?.consumedBy == null) {
                 const problem = feedbackImageProblem(store, evidenceRoot, run.id, input.image);
                 if (problem !== null)
@@ -110,11 +101,6 @@ export function createResultRevision(store, evidenceRoot, input, now) {
         if (sourceFamily === null || sourceFamily.problem !== null)
             return fail(409, "The revision history cannot be verified in this project.");
         const repo = store.refById(found.taskRef)?.repo ?? null;
-        // THE DISPLAYED BATCH (repair 2026-09-14, finding 2): the form names
-        // the exact note ids its reader saw and the source terms it was
-        // rendered against. The seal binds to those ids and nothing else —
-        // "every live note at POST time" would let an old submission, a
-        // replay, or a second tab consume notes its reader never displayed.
         const batchIds = parseRevisionBatch(input.batch);
         const postedSource = input.source;
         if (batchIds === null || postedSource === null || postedSource === "") {
@@ -126,9 +112,6 @@ export function createResultRevision(store, evidenceRoot, input, now) {
             return fail(400, "this batch names notes that are not on this result — reload the result");
         }
         const batch = named;
-        // A replay must match the immutable brief's entire batch and source,
-        // not just a subset whose notes happen to name the same child. Read-only
-        // replay can return its original child even after the source is rescoped.
         const replayChild = (notes) => {
             const child = notes[0]?.consumedBy;
             if (!child || notes.length !== batchIds.length || notes.some(one => one.consumedBy !== child))
@@ -150,9 +133,6 @@ export function createResultRevision(store, evidenceRoot, input, now) {
                 return null;
             }
         };
-        // A retry of an OLD request: every note it names is already sealed
-        // into one revision — that revision is the answer, and no note added
-        // since is touched. A batch partly sealed elsewhere is refused whole.
         const consumers = new Set(batch.map(one => one.consumedBy).filter((one) => one !== null));
         const replay = replayChild(batch);
         if (replay !== null)
@@ -174,8 +154,6 @@ export function createResultRevision(store, evidenceRoot, input, now) {
                 return fail(409, problem);
         }
         const comments = batch;
-        // Keep the subject recognizable, including when revising a revision.
-        // Reserve the suffix before truncating, at whole grapheme boundaries.
         const suffix = " — revision";
         const subject = (store.getTask(sourceTaskId)?.title ?? "").trim().replace(/(?: — revision)+$/u, "").trim() || "Task";
         let prefix = "";
@@ -194,10 +172,6 @@ export function createResultRevision(store, evidenceRoot, input, now) {
                 return fail(409, `the reviewed diff no longer verifies (${proven.problem}) — the batch cannot seal against it`);
             }
         }
-        // The brief is serialized and size-checked BEFORE anything is created
-        // (Codex M5-M8 audit, IV-3): a structured artifact must never pass
-        // through byte truncation — truncated JSON is not a smaller brief,
-        // it is no brief wearing one's name.
         const brief = {
             schema: 1,
             sourceTask: sourceTaskId,
@@ -219,29 +193,10 @@ export function createResultRevision(store, evidenceRoot, input, now) {
         if (briefBytes.length > EVIDENCE_CAPS["revision-brief"]) {
             return fail(400, "this batch is too large for one brief — seal it in parts");
         }
-        // The file first, under a nonce name — a file whose seal fails is an
-        // orphan on disk, never authority. Then ONE transaction: task with
-        // the source scope's limits INHERITED (audit IV-2 — a revision that
-        // drops the exclusions is an approval screen telling a lie), the
-        // artifact row, the relation, and exactly this comment batch.
         const briefName = `revision-brief-${randomBytes(6).toString("hex")}.json`;
         const key = writeEvidenceFile(evidenceRoot, id, briefName, briefBytes);
-        // C1's revision arm: when the SEALER is the mode's signer and the
-        // mode auto-approves their filings, the revision task approves
-        // inside the same transaction, with mode provenance. Everything
-        // else about the seal is unchanged; without coverage, the revision
-        // keeps its own approval ceremony.
         const sealed = store.transact(() => {
-            // Coverage first (cookie road only): its budget and escalated
-            // posture ride the FILING so the digest binds them (surfaces
-            // round 1, finding 2) — never a stamp after the fact.
             const coverage = input.allowMode === true ? modeFilingCoverage(store, repo, input.actor, now) : null;
-            // ONE revision boundary (contract handoff task 2): the source's
-            // goal, exclusions, touches, rubric, risk, quality, posture,
-            // budget, overrides and pins are read from the SOURCE ROWS inside
-            // the seal, which re-proves the task/run/scope-digest binding and
-            // the brief's custody first — the scope read above only names the
-            // digest this batch was drafted against.
             const result = store.sealRevision({
                 source: { task: sourceTaskId, run: id, scopeDigest: sourceScope?.digest ?? null },
                 brief: { evidenceRoot, key, sha256: createHash("sha256").update(briefBytes).digest("hex"), bytes: briefBytes.length, capture: "machine-authored revision brief (exit 0)" },
@@ -254,40 +209,23 @@ export function createResultRevision(store, evidenceRoot, input, now) {
                 requestedBy: input.actor,
             }, now);
             if (result.ok) {
-                // The unchanged legacy title above feeds the store's existing slug
-                // and collision handling. Set only this new row's display title,
-                // atomically with its seal; retries returned earlier, untouched.
                 store.raw().prepare("UPDATE task SET title = ? WHERE id = ?").run(title, result.id);
-                // Who it comes from, with its seal (route-store.ts: written once, on a revision only).
                 recordRevisionOrigin(store, result.id, input.origin);
             }
-            // Planned afresh: the planner reads the copied terms and these notes, and a note asking for
-            // more than the old plan allows becomes an amendment the person approves before anything
-            // builds. Under a live mode the filing is approved at once instead, as every signer filing
-            // is; revisions never inherit the mode's planner authority (docs/AUTO_APPROVAL.md).
             if (result.ok && coverage === null) {
                 const ref = store.lookupRef(result.id);
                 if (ref !== null)
                     store.requestPlan(ref.id, now);
             }
             if (result.ok && coverage !== null) {
-                // A scope whose profile could not resolve is unapprovable by the
-                // human road (approve() refuses) — the mode road refuses too.
                 const filedScope = store.getScope(result.id);
                 if (filedScope?.profileState === "resolved") {
-                    // A false answer here is the coordinator quarantine (review
-                    // finding 7): the revision stays honestly unapproved and the
-                    // task page it redirects to says so in the quarantine words.
                     void store.sealScopeApproval(result.id, input.actor, now, {}, { kind: "mode", modeDigest: coverage.digest });
                 }
             }
             return result;
         });
         if (!sealed.ok) {
-            // Two sealers of one batch race on the consumption count; the
-            // loser is sent to the winner's revision — the one that consumed
-            // EXACTLY this batch, never merely the newest child of the run — so
-            // a double click or a two-tab submission lands on ONE revision.
             if (sealed.reason === "duplicate" || sealed.reason === "comments-taken") {
                 const settled = store.allDiffComments(id).filter(one => batchIds.includes(one.id));
                 const takers = new Set(settled.map(one => one.consumedBy).filter((one) => one !== null));

package/dist/result-acts.js

@@ -1,26 +1,3 @@
-/** The result page's acts (2026-10-02; docs/plans/plain-toolroll.md P1.3), chosen in one place: three verbs, each a
- * relabel over the post it has always made. Exactly one ink act at most, the one that resolves the result's state,
- * and never navigation; at most one outline act beside it. A result that can't be accepted says why in one line
- * before them. Run checks stays in the Checks row, and a person's own checks in the Checks list: neither is an act here.
- *
- *   everything met                      → Accept
- *   a "You check this one" unanswered   → (the check itself, above), then Accept without your check
- *   a check you marked Not right        → Send back, then Accept anyway
- *   checks queued or running            → (Checks running, in its row), then Accept without checks
- *   checks didn't run, a check exists   → (Run checks, in its row), then Accept without checks
- *   report and changes disagree,
- *   or the proof is refuted             → Send back, then Accept (as allowed);
- *                                         never Accept as ink, even with no form here
- *   a Needs you form resolves it        → that form (Retry: Build again; Check again)
- *   saved notes or a failing PR         → Send back (the revision from the notes, or the repair of the PR)
- *   a failed build                      → Retry (its note starts with what to change); never Accept: a failed build
- *                                         is not a result to accept
- *   a failed task's delivered result    → Retry, then Accept anyway (in outline, with a reason) where it may be
- *                                         accepted
- *
- * Accepting finishes the task in one request: the person's acceptance, when one is owed, and the completion
- * together. This only decides which act is ink; the page recomputes it as the person answers each check. */
-/** The words over the reason field an Accept of a refuted result requires. */
 export const ACCEPT_NEEDS_REASON = "Accepting needs a reason";
 export const FAILED_CHECK = /^the repository's approved verification command exited (-?[0-9]+)/;
 export function evidenceProblemOf(verdict, reasons) {
@@ -30,13 +7,9 @@ export function evidenceProblemOf(verdict, reasons) {
         return reasons.some(reason => FAILED_CHECK.test(reason)) ? "checks-failed" : "mismatched";
     return "missing";
 }
-/** Why a result can't be accepted as it stands, in one plain line, or null
- * when nothing refutes it (a person's acceptance settles it). The result page
- * shows it before Request changes, its one ink act. */
 export function cantAcceptYetOf(verdict, reasons, accepted) {
     if (accepted || verdict !== "refuted")
         return null;
-    // A mismatch is the status card's own headline; here only what accepting takes.
     return evidenceProblemOf(verdict, reasons) === "checks-failed"
         ? "Can't accept yet: the project's check failed on these changes."
         : ACCEPT_NEEDS_REASON;
@@ -46,10 +19,8 @@ export const RESULT_VERB = {
     "request-changes": "Send back", revise: "Send back", "draft-repair": "Send back",
     retry: "Retry", rebuild: "Retry",
     "recheck-stopped": null,
-    // Never in the act row: Run checks lives in the Checks row, and a person's own checks in the Checks list.
     "next-check": null, "checks-running": null, "run-checks": null,
 };
-/** What Send back does, said on its own confirm line: the rule is fixed by whether the result is already published. */
 export const SEND_BACK_UNPUBLISHED = "Sends it back with your notes. The same task builds again once you approve the revision.";
 export const SEND_BACK_PUBLISHED = "It's already published, so this files a fix as a new version for you to approve.";
 export function resultActsOf(facts) {
@@ -61,18 +32,14 @@ export function resultActsOf(facts) {
     }
     if (facts.need !== null)
         return { primary: facts.need, secondary: request, line: null };
-    // Saved notes or a failing pull request: Send back is ink, and Accept the quiet other way.
     if (facts.next !== null)
         return { primary: facts.next, secondary: accept, line: null };
-    // Can't be accepted yet: Accept is never the ink act, even when the feedback form isn't here.
     if (facts.blocked !== null)
         return { primary: request, secondary: accept, line: facts.blocked };
-    // The person's own checks come first, in the Checks list above: nothing here is ink until each is answered.
     if (accept !== null && (facts.unanswered ?? 0) > 0)
         return { primary: null, secondary: accept, line: null };
     if (accept !== null && (facts.notRight ?? 0) > 0)
         return { primary: request, secondary: accept, line: null };
-    // Checks running, or not run: their row says so and offers Run checks; Accept waits in outline.
     if (facts.checksRunning)
         return { primary: null, secondary: accept ?? request, line: null };
     if (facts.accept === null)
@@ -91,7 +58,6 @@ export function acceptWithChecksOf(base, checks) {
         return { label: "Accept anyway", ready: false, why: `You marked ${named(checks.notRight)} not right.` };
     return base;
 }
-/** The Requirements row as the person answers their checks: each Looks right is met, each answer leaves "You check". */
 export function requirementsWordsOf(req, looked, notRight) {
     const met = req.met + looked;
     const yours = Math.max(0, req.yours - looked - notRight);

package/dist/result-completion.js

@@ -1,18 +1,10 @@
 import { readVerifiedArtifact } from "./evidence.js";
-/** The ledger action a person's (or lead's) completion of a result writes. */
 export const COMPLETION_ACTION = "assignment handoff checked";
-/** The actor of an automatic completion: the result's work already landed (landed-cleanup.ts). Its ledger detail is
- * the plain-English reason ("its pull request merged"), the one place every surface reads it from. */
 export const LANDED_ACTOR = "system:landed";
-/** Who may complete a result, as a completion's ledger actor: a person, a lead, or Toolroll when the work landed. */
 export const COMPLETER_ACTOR = /^(?:(?:operator|coordinator|lead):.+|system:landed)$/;
-/** Why Toolroll marked a result complete, from its completion's actor and detail; null for a person's completion. */
 export function landedReasonOf(actor, detail) {
     return actor === LANDED_ACTOR ? detail?.trim() || "its work is already in main" : null;
 }
-/** Whether a task's family is marked complete. Completion is recorded on the
- * family's root against its current version's latest result, so the root, a
- * superseded revision and the current version all read Complete together. */
 export function familyCompleted(store, taskId) {
     const family = store.taskFamilyOf(taskId, null, true);
     return store.handle.prepare(`SELECT 1 AS hit FROM action_ledger INDEXED BY work_completion
@@ -21,7 +13,6 @@ export function familyCompleted(store, taskId) {
         AND run.finished_at IS NOT NULL AND run.role IN ('builder','scout') ORDER BY run.id DESC LIMIT 1) LIMIT 1`)
         .get(taskId, family?.root.id ?? taskId, COMPLETION_ACTION, family?.current.refId ?? store.lookupRef(taskId)?.id ?? -1) !== undefined;
 }
-/** The files a build changed, renames on both sides; null when the inventory can't be read whole. */
 export function changedFilesOf(store, runId, root) {
     const stat = store.artifactsFor(runId).find(one => one.kind === "diff-stat");
     if (stat === undefined || stat.truncated || stat.captureStatus !== "ok")
@@ -33,18 +24,12 @@ export function changedFilesOf(store, runId, root) {
         const inventory = JSON.parse(read.content.toString("utf8"));
         if (inventory.filesTruncated !== false || !Array.isArray(inventory.files))
             return null;
-        // A rename changes both places: moving a protected file out of its folder touches it.
         return inventory.files.flatMap(one => [one.path, one.renamedFrom]).filter((path) => typeof path === "string" && path !== "");
     }
     catch {
         return null;
     }
 }
-/** Everything a result's branch carries: this build's changes and every build of every task it revises (a
- * revision builds on its source's head, so its branch holds the source's commits too). null when any of
- * them can't be read whole. An earlier build with no recorded diff is skipped by default; with
- * `missing: "unknown"` (the local owner's boundary) it is skipped only when its run record proves it committed
- * nothing, and any other one makes the whole answer unknown. */
 export function familyChangedFiles(store, taskId, runId, root, options = {}) {
     const files = new Set();
     const runs = new Map([[runId, null]]);
@@ -58,8 +43,6 @@ export function familyChangedFiles(store, taskId, runId, root, options = {}) {
                 runs.set(run.id, run);
     }
     for (const [id, run] of runs) {
-        // A build that never recorded a diff contributed nothing to the branch; one whose diff can't be read counts as protected.
-        // Under "unknown", a missing inventory proves nothing by itself: only a finished run that committed nothing is skipped.
         if (!store.artifactsFor(id).some(one => one.kind === "diff-stat") && id !== runId) {
             if (options.missing !== "unknown" || (run?.committed === false && run.finishedAt !== null))
                 continue;
@@ -73,9 +56,6 @@ export function familyChangedFiles(store, taskId, runId, root, options = {}) {
     }
     return [...files];
 }
-/** Why a build's branch must wait before it's pushed (and so before any PR or merge): it (or a task it
- * revises) changed protected files on a one-person approval, and nobody but its approver and requesters
- * has marked it complete. */
 export function protectedPublicationHold(store, runId, root) {
     const run = store.getRun(runId);
     const taskId = run === null ? null : store.externalIdFor(run.taskRef);
@@ -84,19 +64,14 @@ export function protectedPublicationHold(store, runId, root) {
     const changed = familyChangedFiles(store, taskId, runId, root);
     if (store.protectedResultProblem(taskId, changed, null) === null)
         return null;
-    // Only a person's completion counts here (approval policy §1.7a): one a machine credential made, or one from before
-    // completions said who made them, never stands as the second person.
     const completers = store.handle.prepare("SELECT DISTINCT actor FROM action_ledger WHERE run_id = ? AND action = ? AND detail = ?").all(runId, COMPLETION_ACTION, COMPLETION_BY_PERSON)
         .map(row => String(row["actor"])).filter(actor => actor.startsWith("operator:")).map(actor => actor.slice("operator:".length));
     if (completers.some(name => store.protectedResultProblem(taskId, changed, name) === null))
         return null;
     return "held: it changed protected files on a one-person approval, so it publishes once someone other than its approver marks it complete";
 }
-/** A completion's mark (v134, approval policy §1.7a): whether a person or a machine credential made it. */
 export const COMPLETION_BY_PERSON = "proof person";
 export const COMPLETION_BY_MACHINE = "proof machine";
-/** Whether this person completing an already-complete result would release a protected publication hold: protected
- * work needs someone other than its approver, no person's completion on record provides it, and this person can. */
 export function personCompletionOwed(store, taskId, runId, receiptDigest, person, root) {
     const changed = familyChangedFiles(store, taskId, runId, root);
     if (store.protectedResultProblem(taskId, changed, null) === null || store.protectedResultProblem(taskId, changed, person) !== null)

package/dist/result-evidence-readers.js

@@ -27,7 +27,6 @@ export function structuredHandoffView(artifacts, root, displayText = text => tex
         .map(one => oneLineOf(one, 240));
     return { conclusion, changes: list(handoff.changes), verification: list(handoff.verification), followUps: list(handoff.followUps) };
 }
-/** A failed capture or unverifiable bytes keep their problem; absence returns null. */
 export function terminalDiffView(artifacts, root) {
     const patchArtifact = artifacts.find(one => one.kind === "terminal-diff");
     const statArtifact = artifacts.find(one => one.kind === "diff-stat");
@@ -59,8 +58,6 @@ export function terminalDiffView(artifacts, root) {
             else {
                 try {
                     const parsed = JSON.parse(read.content.toString("utf8"));
-                    // Every field this page renders is type-proved (arc 6, finding 7):
-                    // "an object with a base key" was accepting any shape at all.
                     const count = (value) => typeof value === "number" && Number.isFinite(value);
                     const wellFormed = parsed !== null &&
                         typeof parsed === "object" &&