toolroll 0.9.104 → 0.9.105

package/dist/server/settings.js

@@ -43,7 +43,6 @@ import { approvalGroup, projectPicker, GROUP_PATHS, groupTitle, modeCeremonyHtml
 import { HANDOFF_STYLE, redirect, respond, safeReturn, sayTo, signInSpent, startedHere } from "./http.js";
 import { html, htmlString, joinHtml, postForm, reauth } from "../html.js";
 import { browserCaller, sessionWithinLifetime } from "./session.js";
-/** settings handlers, moved without changing their route bodies. */
 import { DEFAULT_ACCENT, normalHex } from "../accent-colors.js";
 import { resolvePhaseAgent } from "../agentconfig.js";
 import { parseProtectedPaths } from "../approval-policy.js";
@@ -97,6 +96,8 @@ import { MAX_NETWORK_HOSTS, normalizeHost } from "../egress.js";
 import { isWritesMode } from "../writes-mode.js";
 import { isCheckAccess, signInsUnavailableWords, widerThan } from "../check-access.js";
 import { LOCAL_MODE_CONFINES, localModeOn } from "../local-owner.js";
+import { policyInForce, setAdvancedPreference } from "../advanced.js";
+import { advancedShownNow } from "../advanced-view.js";
 import { parseMachLookup, parseReadDeny } from "../project-sandbox.js";
 import { projectDeleteConfirmHtml, projectSettingsHtml } from "../project-delete-ui.js";
 import { endHoldout, setCodeMapSwitch } from "../code-map-acts.js";
@@ -153,9 +154,6 @@ import { chatReturnWithSaid, goOutside } from "./http.js";
 import { leadSettingsHtml, notificationProjects, SETTINGS_AUTOSAVE_SCRIPT, settingsWorkers, telegramDeliveryWords, telegramTrouble } from "./render-settings.js";
 export function createSettingsHandlers(runtime) {
     const { identities, store, providerHome, managedRepos, consoleProjects, sendScreen, chromeFor, connectionCheck, connectionKnown, lastChecks, checkRelease, clock, modelCatalog, modelSeams, toolsViewOf, codexServers, projectViewOf, sessions, restricted, options, integrations, consoleOrigin, evidenceRoot, storagePool, visible, ssoSettings, checkLocalAgents, chatKeyFor, chatCatalog, chatCatalogKnown, leadWords, agentSignInCommand, settingsUpdates, phoneSetup, authenticateApprover, authenticateCredential, deletedRepos, projectOf, providerFor, admissionList, toolHome, connectVisits, mintApprovalNonce, consumeApprovalNonce, googleVisits } = runtime;
-    // What agent work cost, by month: API dollars, plan usage and unknown cost apart (spend-report.ts), with this
-    // month's limits first. An instance operator's page. A limit opens its form in place (?edit=<scope:key>) and saves
-    // to /spend/budget with a step-up.
     async function spendPage(ctx) {
         const { url, who, response, now } = ctx;
         const current = monthOf(now);
@@ -166,16 +164,14 @@ export function createSettingsHandlers(runtime) {
         const rows = spendRows(store.handle, month.from, month.to);
         const subagentNames = subagentNamesOf(store.handle);
         if (url.searchParams.get("format") === "csv") {
-            response.writeHead(200, { "content-type": "text/csv; charset=utf-8", "content-disposition": `attachment; filename="standing-orders-spend-${month.name}.csv"`, "cache-control": "no-store", "x-content-type-options": "nosniff" });
+            response.writeHead(200, { "content-type": "text/csv; charset=utf-8", "content-disposition": `attachment; filename="toolroll-spend-${month.name}.csv"`, "cache-control": "no-store", "x-content-type-options": "nosniff" });
             return void response.end(spendReportCsv(rows, subagentNames));
         }
         const shift = (by) => { const at = new Date(`${month.name}-01T00:00:00.000Z`); at.setUTCMonth(at.getUTCMonth() + by); return at.toISOString().slice(0, 7); };
-        // Limits read what the budget gate counts today (spend.ts spendItems): always this month's, whichever month is shown.
         const items = spendItems(store.handle, current.from, current.to);
         const saved = store.budgets();
         const budgets = budgetStates(saved, items);
         const has = (scope, key) => saved.some(one => one.scope === scope && one.key === key);
-        // Everything and each project with no limit yet, with what it spent this month (counted as a limit would count it).
         const spentFor = (scope, key) => budgetStates([{ id: 0, scope, key, limitMicrousd: 1, hardStop: false, updatedBy: "", updatedAt: "" }], items)[0].spentMicrousd;
         const unlimited = [
             ...(has("installation", "*") ? [] : [{ target: "installation:*", label: "Everything", budget: null, spentMicrousd: spentFor("installation", "*") }]),
@@ -196,9 +192,7 @@ export function createSettingsHandlers(runtime) {
         const windows = limitsView(store.providerLimits(), [], { project: projectName, subagent: id => subagentNames.get(id) ?? `Subagent ${id}` }, now);
         const view = { month: month.name, previous: shift(-1), next: month.name === current.name ? null : shift(1), current: current.name, report: spendReport(rows),
             budgets, unlimited, targets, windows, subagentNames, edit, facts: approvalFactsNow(),
-            // Suggestions and rules (results-routing slice 4): read-only, for every project this console shows.
             savings: savingsReportOrError(store, consoleProjects(), now) };
-        // A refusal for the open form shows in the form; anything else under the limits' heading.
         const said = { said: url.searchParams.get("said"), problem: edit === null ? url.searchParams.get("problem") : null };
         return sendScreen(response, 200, screen("Spend", spendHtml(view, said), { chrome: chromeFor(null, "spend"), functional: { script: spendScript() } }));
     }
@@ -224,7 +218,6 @@ export function createSettingsHandlers(runtime) {
         if (!isProviderId(asked))
             return refuse(response, who, 400, "Choose a known provider.", "/control");
         const task = url.searchParams.get("task") ?? "";
-        // The last sign-in check: Check again posts (docs/plans/get-side-effects.md).
         const connection = connectionKnown(asked);
         if (view === "connection") {
             const command = asked === "claude" ? "claude auth login" : asked === "codex" ? "codex login" : asked === "gemini" ? "gemini" : null;
@@ -234,17 +227,12 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         }
         const setup = store.liveWorktreeSetup(project);
         const preparation = detectPreparation(project);
-        // The saved live catalog when it has models for this provider; the
-        // built-in short list otherwise.
         const live = asked === "openrouter" ? [] : modelOptions(store, asked, clock(), providerHome).map(({ value, label }) => ({ value, label }));
         const configured = saved?.provider === asked ? saved.model : null;
         const models = live.length === 0 ? modelChoices(asked, configured, providerHome)
             : configured && !live.some(one => one.value === configured) ? [{ value: configured, label: `${configured} — current choice` }, ...live] : live;
         const instructions = previewProjectInstructions(project);
-        // The model list as last loaded; Refresh models posts, and the background checks keep it current.
         const catalog = asked === "openrouter" ? modelCatalog.known(readProviderKey("openrouter", providerHome)) ?? { ok: false, problem: "The model list has not loaded yet." } : null;
-        // With nothing saved, setup preselects what the installation builds routine tasks with, else "Sized by job"'s
-        // routine builder (Sonnet 5.5) for Claude: an exact id, never a floating name.
         const installationBuild = store.phaseConfig(INSTALLATION_SCOPE, "build");
         const routineDefault = PRESETS[DEFAULT_PRESET].rows["build"] ?? "";
         const preselected = installationBuild?.provider === asked && installationBuild.model !== null && models.some(one => one.value === installationBuild.model) ? installationBuild.model
@@ -253,7 +241,6 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         return sendScreen(response, 200, screen("Project setup", controlSetupHtml({ repo: project, csrf: who.via === "cookie" ? who.session.csrf : "", provider: asked, inputs, models, connection, catalog, task, preparation,
             instructions: instructions.ok ? { installed: instructions.installed } : { installed: false, message: instructions.message } }), { chrome: chromeFor(project, "settings"), ...(catalog === null ? {} : { functional: { script: openRouterPickerScript() } }) }));
     };
-    // Settings → Projects → Pull requests → Check setup: git and GitHub, for one project, by an approver who may turn it on.
     async function pullRequestsCheck(ctx) {
         const { who, response, posted } = ctx;
         const repo = readForm(posted, CONSOLE_FORMS.pullRequestsCheck).get("repo") ?? "";
@@ -265,7 +252,6 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         await lastChecks.run(`publishing:${repo}`, () => checkPublishing(repo, options.publishExec === undefined ? {} : { exec: options.publishExec }));
         return redirect(response, `/settings/pull-requests?repo=${encodeURIComponent(repo)}`);
     }
-    // Settings → Storage → Check now: measure the checkouts again.
     async function storageCheck(ctx) {
         const databaseFile = store.databaseFile();
         if (databaseFile !== null)
@@ -273,12 +259,10 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         return redirect(ctx.response, "/settings/storage");
     }
     const measureStorage = (databaseFile) => lastChecks.run("storage", () => checkoutPlan(store, storagePool(databaseFile), clock(), { manual: true }));
-    // Settings → Updates → Check now: ask npm once, whether or not automatic checks are on.
     async function updatesCheck(ctx) {
         await checkRelease();
         return redirect(ctx.response, "/settings/updates");
     }
-    // Check again (Settings → providers, Project setup): ask this computer's CLI, or test the saved key, now.
     async function connectionCheckNow(ctx) {
         const { response, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.connectionCheck);
@@ -289,7 +273,6 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         await connectionCheck(provider, true).catch(() => undefined);
         return redirect(response, back);
     }
-    // Refresh models (Project setup, OpenRouter): load the list again, then show the setup page with it.
     async function modelsRefresh(ctx) {
         const { response, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.modelsRefresh);
@@ -300,10 +283,6 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
     async function modelsPage(ctx) {
         const { url, who, response, project } = ctx;
         const now = clock();
-        // The page shows the last check and when it ran (docs/plans/get-side-effects.md): Check now, or the watch loop's
-        // automatic checks, fetch the lists and may queue a notice; opening the page never does.
-        // Only an instance operator changes models (docs/plans/spend-dashboard.md D4); a preset or a switch is previewed
-        // here, read-only, and applied by its own password-checked POST.
         const view = modelsView(who.via === "cookie" && store.isInstanceOperator(who.name), who.via === "cookie" ? who.session.csrf : "", now, url.searchParams.get("said"), url.searchParams.get("problem"), url.searchParams);
         return sendScreen(response, 200, screen("Models", modelsHtml({ ...view, facts: approvalFactsNow() }), { chrome: chromeFor(project, "settings"), functional: { script: modelsScript() } }));
     }
@@ -333,13 +312,11 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         if (chosen && !projects.includes(chosen))
             return refuse(response, who, 403, "That project is outside your access.", "/projects");
         const kit = kitOf(url.searchParams.get("kit") ?? "")?.id ?? null, wanted = (oneClickOf(url.searchParams.get("connect") ?? "") ?? localConnectOf(url.searchParams.get("connect") ?? ""))?.id ?? null;
-        // Choosing a project opens it at once (keeping a kit's Connect), so every form below acts on the project shown.
         const selector = toolsProjectPicker(projects, chosen, { ...(kit === null ? {} : { kit }), ...(wanted === null ? {} : { connect: wanted }) });
         let content = html `<p>Add a project to give its builds tools.</p>`;
         if (chosen) {
             try {
                 const approver = who.role === "approver" && who.via === "cookie";
-                // What Codex had configured at the last background check (docs/plans/get-side-effects.md): the page starts no codex.
                 const view = toolsViewOf(chosen, approver ? lastChecks.known(`codex-tools:${chosen}`)?.value ?? null : null, kit, wanted);
                 if (approver)
                     view.others = projects.filter(one => one !== chosen).map(one => ({ repo: one, project: projectName(one), open: connectionsOf(store, one).filter(c => c.state === "open").map(c => c.id) }));
@@ -351,7 +328,6 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         }
         return sendScreen(response, 200, screen("Tools", settingsSubPage("agents", "Tools", html `${selector}${content}`), { chrome: chromeFor(chosen || project, "settings"), functional: { script: SETTINGS_AUTOSAVE_SCRIPT + TOOLS_PROJECT_SCRIPT } }));
     }
-    // Settings → Project: what Toolroll holds for a project; an instance operator deletes it here.
     async function projectPage(ctx) {
         const { url, who, response, project } = ctx;
         const projects = consoleProjects();
@@ -364,7 +340,6 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         const content = chosen === "" ? html `${notice.said ? infoLine(notice.said) : ""}${empty({ title: "No projects yet.", action: btn("Add a project", { sm: true, href: "/projects" }) })}` : (projectSettingsHtml({ ...projectViewOf(chosen, who), remoteUrl: store.projectRemote(chosen), codeMap: codeMapView(chosen, who, ctx.now) }, notice));
         return sendScreen(response, 200, screen("Project", settingsSubPage("projects", "Project", html `${selector}${content}`), { chrome: chromeFor(chosen || null, "settings") }));
     }
-    /** The project's code map section: the switch, and the holdout while new builds are still being enrolled. */
     function codeMapView(repo, who, now) {
         const row = store.handle.prepare("SELECT code_map, code_map_enroll_until FROM project WHERE path = ?").get(repo);
         const until = typeof row?.["code_map_enroll_until"] === "string" ? row["code_map_enroll_until"] : null;
@@ -389,9 +364,6 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
             return back("said", kind === "holdout" ? "The holdout has ended. Builds already enrolled keep their arm." : on ? "The code map is on." : "The code map is off.");
         };
     }
-    // v102: Settings → Approvals and safety: the defaults for new tasks, a project's separation of duties and release
-    // approval, and the way to its operating mode. Anyone who sees the project reads them; each form's own route decides
-    // who may change it (an approver for the defaults and releases, an instance operator for the rules).
     async function approvalPage(ctx) {
         const { url, who, response, project, now } = ctx;
         const projects = consoleProjects();
@@ -402,8 +374,9 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         const release = chosen === "" ? null : releaseApprovalSetting(store, chosen);
         const notice = { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") };
         const csrf = who.via === "cookie" ? who.session.csrf : "";
-        const rules = chosen === "" ? html `` : html `${approvalRulesHtml({ repo: chosen, name: projectName(chosen), rules: store.approvalRules(chosen), canChange: who.via === "cookie" && store.isInstanceOperator(who.name), approvers }, notice)}${releaseApprovalHtml({ repo: chosen, auto: release.auto, setBy: release.setBy, at: release.at, canChange: who.via === "cookie" && who.role === "approver" && !store.isDemo() && store.accountCanAccess(who.name, chosen) })}`;
-        // The installation-wide defaults are not a project-limited account's to see or set.
+        const releases = chosen !== "" && (advancedShownNow() || release.auto);
+        const rules = chosen === "" ? html `` : html `${approvalRulesHtml({ repo: chosen, name: projectName(chosen), rules: store.approvalRules(chosen), canChange: who.via === "cookie" && store.isInstanceOperator(who.name), approvers }, notice)}${!releases ? "" :
+            releaseApprovalHtml({ repo: chosen, auto: release.auto, setBy: release.setBy, at: release.at, canChange: who.via === "cookie" && who.role === "approver" && !store.isDemo() && store.accountCanAccess(who.name, chosen) })}`;
         const limited = restricted();
         const permission = store.permissionDefault(), quality = store.qualityDefault();
         const changed = (at, by) => at === null ? null : `Changed ${when(at)}${by === null ? "" : ` by ${by}`}`;
@@ -413,11 +386,16 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
                 permission: limited ? null : { mode: permission.mode, canManage: who.role === "approver" && csrf !== "", changed: changed(permission.updatedAt, permission.updatedBy) },
                 quality: limited ? null : { mode: quality.mode, canManage: who.role === "approver" && csrf !== "", changed: changed(quality.updatedAt, quality.updatedBy) } },
             flags: {}, projects: projects.map(repo => ({ repo, name: projectName(repo) })), chosen, rules,
+            advanced: { on: advancedShownNow(), modeActive: projects.some(repo => { try {
+                    return store.activeMode(repo, now) !== null;
+                }
+                catch {
+                    return true;
+                } }), policy: policyInForce(store) },
             mode: chosen === "" ? "Open a project to sign one" : live === null ? `${projectName(chosen)}: locked, approvals stay with people` : `${projectName(chosen)}: ${live.name} until ${when(live.absoluteExpiry)}`,
         });
         return sendScreen(response, 200, screen("Approvals and safety", page, { chrome: chromeFor(chosen || project, "settings") }));
     }
-    // Sprint 8: Settings → Policy, the organisation policy and its history. Anyone signed in reads it; an instance operator changes it.
     async function policyPage(ctx) {
         const { url, who, response, project } = ctx;
         const repos = consoleProjects();
@@ -425,8 +403,6 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         const view = { policy: store.orgPolicy(), history: store.policyHistory(50), canChange: who.via === "cookie" && store.isInstanceOperator(who.name), toolNames };
         return sendScreen(response, 200, screen("Policy", settingsSubPage("approval", "Policy", html `${(policyHtml(view, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") }))}`), { chrome: chromeFor(project, "settings") }));
     }
-    // Settings → Flows: the starter flows live under New flow → Starter flows now. This address (and a task's "Do this
-    // every time…", ?starter=) lands there with the project, the starter asked about and how a switch went.
     async function flowsPage(ctx) {
         const { url, who, response, project } = ctx;
         const projects = consoleProjects();
@@ -443,7 +419,6 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         }
         return redirect(response, `/flows/new?${query.toString()}`);
     }
-    // Settings → Integrations: which integrations work. The list is the last checks; a render never waits on one.
     async function integrationsPage(ctx) {
         const { url, response, project } = ctx;
         const who = browserCaller(ctx.who);
@@ -452,7 +427,6 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         const list = integrations.list();
         return sendScreen(response, 200, screen("Integrations", settingsSubPage("system", "Integrations", html `${(integrationsHtml(list, who.session.csrf, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem"), checking: integrations.checking, secrets: toolSecretStorage() }))}`), { chrome: chromeFor(project, "settings") }));
     }
-    // v104: Settings → Monitoring, where the audit stream and traces go. An instance operator's page.
     async function monitoringPage(ctx) {
         const { url, request, response, project } = ctx;
         const who = browserCaller(ctx.who);
@@ -461,42 +435,34 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         const view = { settings: readMonitoring(options.configDir), status: store.monitoringStatus(), head: store.ledgerHeadId(), origin: consoleOrigin(request.headers.host) };
         return sendScreen(response, 200, screen("Monitoring", settingsSubPage("system", "Monitoring", html `${(monitoringHtml(view, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") }))}`), { chrome: chromeFor(project, "settings") }));
     }
-    // Settings → Updates: the installed version, three ways to update, the update's steps live, then What's new. An instance operator's page.
     async function updatesPage(ctx) {
         const { url, response, project } = ctx;
         const who = browserCaller(ctx.who);
         const databaseFile = store.databaseFile();
         if (databaseFile === null)
             return refuse(response, who, 403, "An instance operator updates Toolroll.", "/settings");
-        // A stalled update is released by the background pass, never by opening this page (docs/plans/get-side-effects.md).
         const status = runtimeUpdateStatus(dirname(databaseFile));
         if (url.searchParams.get("fragment") === "steps")
             return respond(response, 200, "text/html; charset=utf-8", status.journal ? updateStepsHtml(status.journal, status.running) : html `<div id="update-live" data-done="1"></div>`);
         const active = status.journal !== null && !runtimeUpdateTerminal(status.journal.phase);
         const current = options.updates?.current ?? PACKAGE_VERSION;
-        // The last answer npm gave (the background checks ask while update checks are on; Check now asks once).
         const checksOff = updateChecksOff(process.env, options.configDir ?? dirname(databaseFile)).off;
         const known = lastChecks.known("release")?.value ?? null;
         const view = { current, latest: active ? { version: current } : known ?? (checksOff ? { off: true } : { pending: true }), method: options.updates?.method ?? installMethod(), journal: status.journal, running: status.running, whatsNew: status.whatsNew, rollbackTo: status.lastUpdate?.to === current ? status.lastUpdate.from : null, csrf: who.session.csrf };
         return sendScreen(response, 200, screen("Updates", settingsSubPage("system", "Updates", html `${(updatesHtml(view, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") }))}`), { chrome: chromeFor(project, "settings"), ...(active ? { functional: { script: updatesScript(), fetches: true } } : {}) }));
     }
-    // v105: Settings → Retention, how long each kind of data is kept. An instance operator's page.
     async function retentionPage(ctx) {
         const { url, response, now, project } = ctx;
         const who = browserCaller(ctx.who);
         const view = { periods: store.retentionPeriods(), chosen: Object.keys(store.retentionChosen()), next: retentionPlan(store, evidenceRoot, now).counts, lastSweep: lastSweepAt(store), csrf: who.session.csrf };
         return sendScreen(response, 200, screen("Retention", settingsSubPage("system", "Retention", html `${(retentionHtml(view, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") }))}`), { chrome: chromeFor(project, "settings") }));
     }
-    // Settings → Storage: what task checkouts use, cleaning up now (the preview behind the password), and when a
-    // finished task's clean checkout goes by itself. An instance operator's page.
     async function storagePage(ctx) {
         const { url, response, now, project } = ctx;
         const who = browserCaller(ctx.who);
         const databaseFile = store.databaseFile();
         if (databaseFile === null)
             return refuse(response, who, 403, "An instance operator looks after storage.", "/settings");
-        // The last measurement (docs/plans/get-side-effects.md): the background checks measure the checkouts, and so do
-        // Check now and every clean-up; opening the page runs no du or git.
         const measured = lastChecks.known("storage");
         const check = postForm("/settings/storage/check", btn("Check now", { sm: true, type: "submit" }));
         if (measured === null) {
@@ -506,8 +472,6 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         const sweep = { last: lastSweep(store), off: storageSweepOff(), schedule: sweepSchedule(store, now) };
         return sendScreen(response, 200, screen("Storage", settingsSubPage("system", "Storage", html `${(storageHtml({ plan, csrf: who.session.csrf, sweep, landed: landedSummary(store), measured: html `<div class="k-acts"><span class="k-note">Measured ${new Date(measured.at).toLocaleTimeString("en-US", { hour: "numeric", minute: "2-digit" })}</span>${check}</div>` }, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") }))}`), { chrome: chromeFor(project, "settings") }));
     }
-    // Settings → Projects → Pull requests: one project's setup. Off, the checks run on open, so the page says
-    // exactly what turning on would do, or what to fix first.
     async function pullRequestsPage(ctx) {
         const { url, who, response, project } = ctx;
         const repo = url.searchParams.get("repo") ?? "";
@@ -516,13 +480,11 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
             return refuse(response, who, 404, "No such project.", "/projects");
         const publishing = publishingOf(store, repo);
         const canChange = who.role === "approver" && !store.isDemo();
-        // The last setup check for this project (Check setup posts); opening the page asks git and GitHub nothing.
         const check = publishing.on || !canChange ? null : lastChecks.known(`publishing:${repo}`)?.value ?? "unchecked";
         const body = (pullRequestSettingsHtml({ repo, name: projectName(repo), csrf: who.session.csrf, canChange, publishing, check,
             said: url.searchParams.get("said"), problem: url.searchParams.get("problem") }));
         return sendScreen(response, 200, screen("Pull requests", settingsSubPage("projects", "Pull requests", html `${body}`), { chrome: chromeFor(project, "projects") }));
     }
-    // Settings → Projects → Checks: how much checks after each build, and the quick command beside the full one.
     async function checksPage(ctx) {
         const { url, who, response, project } = ctx;
         const repo = url.searchParams.get("repo") ?? "";
@@ -533,10 +495,10 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         const body = (checkSettingsHtml({ repo, name: projectName(repo), csrf: who.session.csrf, canChange: who.role === "approver" && !store.isDemo(),
             level: projectCheckLevel(store, repo).level, full: store.liveVerifyCommand(repo), quick, suggestion: quick === null ? suggestQuickCommand(repo) : null,
             review: (({ on, source }) => ({ on, source }))(store.reviewSwitch(repo, clock())), batch: { on: projectBatchChecks(store, repo).on }, fast: { on: fastStartOn(store, repo) },
-            said: url.searchParams.get("said"), problem: url.searchParams.get("problem") }));
+            said: url.searchParams.get("said"), problem: url.searchParams.get("problem"),
+            needsPassword: who.authority === "local-owner" && store.accountOf(who.name)?.passwordSet !== true }));
         return sendScreen(response, 200, screen("Checks", settingsSubPage("projects", "Checks", html `${body}`), { chrome: chromeFor(project, "projects") }));
     }
-    // Sprint 8: Settings → Backups, how the last backup went and the schedule. An instance operator's page.
     async function backupsPage(ctx) {
         const { url, response, now, project } = ctx;
         const who = browserCaller(ctx.who);
@@ -549,13 +511,11 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
             live: { state: live, folder: liveFolderOf(live.settings, databaseFile), defaultFolder: defaultLiveFolder(databaseFile) } };
         return sendScreen(response, 200, screen("Backups", settingsSubPage("system", "Backups", html `${(backupHtml(view, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") }))}`), { chrome: chromeFor(project, "settings") }));
     }
-    // v105: Settings → Data, where an instance operator downloads everything. The download is a POST with the password.
     async function dataPage(ctx) {
         const { url, response, project } = ctx;
         browserCaller(ctx.who);
         return sendScreen(response, 200, screen("Data", settingsSubPage("system", "Data export", html `${(dataExportHtml({ problem: url.searchParams.get("problem") }))}`), { chrome: chromeFor(project, "settings") }));
     }
-    // v100: Settings → Sign-in, the identity provider people sign in with. An instance operator's page.
     async function signInPage(ctx) {
         const { url, request, response, project } = ctx;
         const who = browserCaller(ctx.who);
@@ -567,7 +527,6 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         const body = ssoSettingsHtml({ settings, redirect: origin === null ? null : `${origin}${SSO_CALLBACK}`, projects, linked: settings !== null && store.ssoIdentitiesOf(who.name).some(one => one.issuer.replace(/\/+$/, "") === settings.issuer) }, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") });
         return sendScreen(response, 200, screen("Sign-in", settingsSubPage("access", "Sign-in with a provider", html `${body}`), { chrome: chromeFor(project, "settings") }));
     }
-    /** Passwordless (docs/plans/passwordless.md): the switch, and the trade in plain words. */
     async function passwordlessPage(ctx) {
         const { url, response, project } = ctx;
         browserCaller(ctx.who);
@@ -588,7 +547,6 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         }
         if (action !== "on")
             return back("problem", "Choose on or off.");
-        // Turning it on is a credential act: a password typed now (or a one-use provider re-check), never a session.
         if (!authenticateCredential(who, body.get("password") ?? "").ok)
             return back("problem", "Enter your Toolroll password to turn Passwordless on.");
         setPasswordless(store, true, who.name, now);
@@ -655,7 +613,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
         }
         return sendScreen(response, 200, screen("Learning", settingsSubPage("agents", "Learning", html `${selector}${content}`), { chrome: chromeFor(chosen || project, "settings") }));
     }
-    // Settings → Lead (onboarding): what runs the lead in one line, and the full form under Advanced.
     async function leadPage(ctx) {
         const { url, response, now, project } = ctx;
         const who = browserCaller(ctx.who);
@@ -681,11 +638,7 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
     async function telegramPage(ctx) {
         const { response, now, project } = ctx;
         const who = browserCaller(ctx.who);
-        // Any approver pairs their OWN phone here; the bot token stays on /settings.
         const botId = options.telegramTokenFile === undefined ? null : loadBotToken(process.env, options.telegramTokenFile)?.botId ?? null;
-        // The settings view holds no secret (a pairing code only appears in
-        // the response to Pair, which stays script-free), so it joins the
-        // workspace like every other settings page.
         return sendScreen(response, 200, screen("Telegram", telegramSettingsHtml(store, botId, who.name, { now }), { chrome: chromeFor(project, "settings") }));
     }
     async function teamsPage(ctx) {
@@ -713,14 +666,12 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
         const { who, response } = ctx;
         if (!options.configDir)
             return refuse(response, who, 403, "An installation approver can connect Slack.", "/settings");
-        response.writeHead(200, { "Content-Type": "application/json; charset=utf-8", "Content-Disposition": 'attachment; filename="standing-orders-slack.json"', "Cache-Control": "no-store" });
+        response.writeHead(200, { "Content-Type": "application/json; charset=utf-8", "Content-Disposition": 'attachment; filename="toolroll-slack.json"', "Cache-Control": "no-store" });
         response.end(JSON.stringify(SLACK_MANIFEST, null, 2));
         return;
     }
     async function settingsHome(ctx) {
         const { url, who, request, response, now, project } = ctx;
-        // The overview and its group pages (docs/plans/settings-revamp.md §3): one handler reads the facts once and draws
-        // the page asked for; each section's form posts to its own route, which proves the act again.
         const group = GROUP_PATHS[url.pathname] ?? "hub";
         const minimal = options.telegramTokenFile === undefined || restricted();
         const csrf = who.via === "cookie" ? who.session.csrf : "";
@@ -731,15 +682,12 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
             ? null
             : effectivePrimary(process.env, options.configDir, options.telegramTokenFile !== undefined && loadBotToken(process.env, options.telegramTokenFile) !== null);
         const push = minimal || csrf === "" ? null : {
-            // The section lights only where a secure context exists: the stated
-            // public origin, or localhost development (arc 3 finding 2).
             available: options.publicUrl !== undefined || (request.headers.host ?? "").startsWith("localhost") || (request.headers.host ?? "").startsWith("127.0.0.1"),
             devices: store.listPushSubscriptions(who.name).filter(one => one.retiredAt === null || one.retiredReason === "gone")
                 .map(one => ({ id: one.id, words: `${one.uaWords} · since ${when(one.createdAt)}`, state: one.retiredAt !== null ? "expired" : one.consecutiveFailures >= 20 ? "failing" : "ok", removable: one.retiredAt === null })),
         };
         const providerKeys = who.role !== "approver" || minimal || csrf === ""
             ? null
-            // ACP agents sign in their own way; Toolroll keeps no key for them, so the key list holds only the others.
             : await Promise.all(PROVIDER_IDS.filter(isKeyedProvider).map(async (provider) => {
                 const key = keyStatus(provider, providerHome), connection = connectionKnown(provider) ?? undefined;
                 const mode = readAuthMode(provider, providerHome) === "api-key" ? "api-key" : "subscription";
@@ -779,7 +727,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
             workers: minimal ? null : settingsWorkers(store, now),
             updates,
             firstResult: (() => {
-                // The installation fact: when the first Ready result arrived, measured from the first account.
                 const at = store.firstSuccessAt(now), since = store.installationStartedAt();
                 return at === null || since === null ? null : firstResultWords(since, at);
             })(),
@@ -788,14 +735,11 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
             push,
             digest: digest === null || csrf === "" || chosen?.mode === "quiet" ? null : { every: digest.everyMs === null ? "off" : String(Math.round(digest.everyMs / 60_000)), held: digest.everyMs === null ? null : `${digest.held} routine update${digest.held === 1 ? "" : "s"} held` },
             telegram: {
-                // The installation's bot: no part of it (not even its id or last characters) for a project-limited account.
                 state: minimal ? "" : hasEnv ? "from the environment" : existing === null ? "not set" : "saved",
                 current: minimal ? "" : hasEnv ? `set in the environment (${TOKEN_ENV}), which takes precedence over anything saved here` : existing === null ? "not set" : `saved: ${redactToken(existing.token)} (bot ${existing.botId})`,
                 delivery: minimal ? null : telegramDeliveryWords(store, telegramBot), failing: !minimal && telegramTrouble(store, telegramBot),
             },
             email: who.role === "approver" && csrf !== "" && !minimal ? (() => {
-                // v87: the mail server flows send email through; the password is never shown back.
-                // v89: where Inbox triggers read it, and a connected Google account (its client secret is never shown back either).
                 const email = readEmailSettings(options.configDir ?? null), google = (() => { try {
                     return readGoogleMail(options.configDir ?? null);
                 }
@@ -824,6 +768,7 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
                     return null;
                 return { owner: who.authority !== "full", passwordSet: store.accountOf(who.name)?.passwordSet === true, canTurnOff: who.authority === "full" && operator };
             })(),
+            advanced: { on: requestContext.getStore()?.advanced !== false, canChange: who.via === "cookie" },
             backup: lastBackup === null ? null : lastBackup.ok === false
                 ? { failed: true, words: `Failed ${when(lastBackup.startedAt)}${lastBackup.error === null ? "" : `: ${lastBackup.error}`}` }
                 : { failed: false, words: lastBackup.finishedAt === null ? "Backing up now" : `Backed up ${when(lastBackup.finishedAt)}` },
@@ -835,8 +780,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
             ...(script === null ? {} : { functional: { script, ...(group === "alerts" ? { fetches: true } : {}) } }),
         }));
     }
-    // A person says a provider's sign-in works again: its sign-in pause
-    // lifts, its tasks may start, and one short message says so.
     async function providerResume(ctx) {
         const { url, who, response } = ctx;
         const provider = url.pathname.split("/")[2];
@@ -847,8 +790,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
         liftAuthPause(store, provider, "person", who.name, clock());
         return redirect(response, "/tasks");
     }
-    // The update notice is dismissed per browser and per version: a newer release shows it again.
-    // Cockpit B2: Forget — nothing verified on this session before now counts as fresh (a CSRF-checked post, like every act).
     async function forgetPassword(ctx) {
         const { who, response, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.forgetPassword);
@@ -874,7 +815,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
         }
         return redirect(response, safeReturn(body.get("return") ?? "/settings/system#updates"));
     }
-    // The daily check's switch: an installation setting, so an operator's. (Its own address: POST /settings/updates starts an update.)
     async function updatesChecks(ctx) {
         const { who, response, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.updatesChecks);
@@ -956,13 +896,10 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
             try {
                 content = (skillsHtml(skillsView(store, repo, who.name), who.session.csrf, true, { error: message, draft: Object.fromEntries(['method', 'content', 'url', 'sample', 'sha'].map(k => [k, body.get(k) ?? ''])) }));
             }
-            catch { /* Do not display unverified packages. */ }
+            catch { }
             return sendScreen(response, 409, screen('Skills', settingsSubPage("agents", "Skills", html `${content}`), { chrome: chromeFor(repo, 'settings'), functional: { script: skillsScript() } }));
         }
     };
-    // v105: set or remove a monthly budget. An instance operator, with a step-up; the ledger keeps before → after. The
-    // amount is checked before the password (nothing is written before the password is proved), so a refused amount
-    // shows next to its field with the person's draft kept.
     async function spendBudget(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.spendBudget);
@@ -996,7 +933,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
         const saved = store.setBudget({ scope, key, limitMicrousd: Math.round(dollars) * 1_000_000, hardStop: body.get("stop") === "1" }, who.name, now);
         return done(`${label}: ${spendUsd(saved.limitMicrousd)} a month${saved.hardStop ? ", new API work pauses at the limit" : ", alerts only"}.`);
     }
-    // Settings → Project → Builds at once: an approver for the project sets it; the ledger keeps before → after.
     async function projectConcurrency(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.projectConcurrency);
@@ -1018,8 +954,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
         store.bumpWake();
         return back("said", changed.before === changed.after ? "Nothing changed." : `Saved. Up to ${n} at once.`);
     }
-    // Settings → Project → Live view (live-detail.ts): an approver for the project shows commands with their password,
-    // or hides them in one step; the ledger keeps each change. It applies from the next run.
     async function projectLiveView(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.projectLiveView);
@@ -1034,15 +968,12 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
             return back("said", setLiveCommands(store, { repo, commands: false, by: who.name, via: "the console" }, now).said);
         if (act !== "on")
             return back("problem", "That change isn't available.");
-        // Single use, for this person and exactly this change: a replayed or copied form changes nothing.
         if (!consumeApprovalNonce(body.get("nonce") ?? "", who.name, LIVE_VIEW_CONSENT, liveViewConsentDigest(repo)))
             return back("problem", "That form was already used or is out of date. Try again from this page.");
         if (!authenticateApprover(who, body.get("password") ?? "", repo).ok)
             return back("problem", "Enter your Toolroll password to show commands.");
         return back("said", setLiveCommands(store, { repo, commands: true, by: who.name, via: "the console" }, now).said);
     }
-    // Settings → Project → Network (egress.ts): what the project's builds may reach. An approver for the project changes it
-    // with their password typed now; the ledger keeps before → after. New scopes use it; approved ones keep theirs.
     async function projectNetwork(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.projectNetwork);
@@ -1063,7 +994,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
         const same = JSON.stringify(changed.before) === JSON.stringify(changed.after);
         return back("said", same ? "Nothing changed." : "Saved. Tasks scoped from now on use it; tasks already approved keep the network they were approved with.");
     }
-    // Delete a project, in two steps: its name, then what goes and the password. An instance operator; the ledger keeps who and what.
     async function projectDelete(ctx) {
         const { response, now, posted } = ctx;
         const who = browserCaller(ctx.who);
@@ -1096,7 +1026,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
         }
         return back("said", `Deleted ${view.name}: ${holdingsWords(done.removed)}.${done.left.length > 0 ? ` Git kept ${done.left.length === 1 ? "one item" : `${done.left.length} items`}: ${done.left.join("; ")}.` : ""}`, "");
     }
-    // Sprint 8: an instance operator saves the organisation policy, with a step-up; the ledger keeps each rule's before → after.
     async function policySave(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.policy);
@@ -1112,7 +1041,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
         const same = Object.keys(before).every(rule => before[rule] === after[rule]);
         return back("said", same ? "Nothing changed." : "Policy saved.");
     }
-    // v102: an instance operator changes a project's approval rules, with a step-up; the ledger keeps before → after.
     async function approvalSave(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.approval);
@@ -1133,8 +1061,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
         store.setApprovalRules(repo, next, who.name, now);
         return back("said", `Saved. ${rulesSummary(next)}`);
     }
-    // v112: request limits for API tokens (request-budget.ts). An instance operator, in a browser, with their password;
-    // never over /api/cli or /mcp (a token never reaches a console form).
     async function requestLimitsSave(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.requestLimits);
@@ -1172,7 +1098,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
             const found = await providerFor(before.issuer);
             return found.ok ? back("said", `${before.label} answers: it's ready for people to sign in.`) : back("problem", found.said);
         }
-        // Sign-in methods and the identity provider are the login itself: a credential act, a password typed now.
         if (!authenticateCredential(who, body.get("password") ?? "").ok)
             return back("problem", "Enter your Toolroll password to change sign-in.");
         if (action === "remove") {
@@ -1190,13 +1115,11 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
             scopes: body.get("scopes") ?? "", groupsClaim: body.get("groups-claim") ?? "", passwords: body.get("passwords") ?? "", rules }, before);
         if (!saved.ok)
             return back("problem", saved.said);
-        // The provider has to answer before anyone depends on it.
         runtime.ssoProvider = null;
         const found = await providerFor(saved.settings.issuer);
         store.recordAction({ at: now.toISOString(), actor: who.name, repo: null, taskId: null, runId: null, action: before === null ? "sign-in with a provider turned on" : "sign-in with a provider changed", outcome: "changed", source: "policy", detail: ssoChangeWords(before, saved.settings) });
         return found.ok ? back("said", `Saved. People can sign in with ${saved.settings.label}.`) : back("problem", `Saved, but ${saved.settings.label} didn't answer: ${found.said}`);
     }
-    // Settings → Updates: start the `toolroll update` job. A step-up; the job writes the ledger entries.
     const updatesAct = (op) => async (ctx) => {
         const { who, response, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.updates);
@@ -1241,10 +1164,8 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
             abandonRuntimeUpdate(stateDir, prepared.id, `The update could not start: ${error.message}`, clock());
             return back("problem", `The update could not start: ${error.message}`);
         }
-        // The job records its first step within moments; show it rather than the old page.
         return back("said", when === "at" ? `Update to ${version} scheduled for 03:00.` : `Updating to ${version}.`);
     };
-    // v105: change how long each kind of data is kept. A step-up; the ledger keeps before → after for each kind.
     async function retentionSave(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.retention);
@@ -1252,7 +1173,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
         if (!authenticateApprover(who, body.get("password") ?? "").ok)
             return back("problem", "Enter your Toolroll password to change retention.");
         const before = store.retentionPeriods();
-        // Only what the page offers (or the period already set): a hand-made value doesn't save.
         const offered = (kind, days) => days !== undefined && periodChoices(kind, before[kind]).includes(days) ? days : undefined;
         const chosen = RETENTION_KINDS.map(({ kind }) => ({ kind, days: body.has(kind) ? offered(kind, parsePeriod(body.get(kind) ?? "")) : before[kind] }));
         if (chosen.some(one => one.days === undefined))
@@ -1262,15 +1182,12 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
             store.setRetentionPeriod(one.kind, one.days ?? null, who.name, now);
         return back("said", changed.length === 0 ? "Nothing changed." : "Saved. The next daily sweep uses these periods.");
     }
-    // Settings → Storage: when a finished task's clean checkout goes, cleaning up what the preview showed, and throwing
-    // away a checkout kept for its changes. Each takes the password; the ledger keeps every change and removal.
     const storageAct = (op) => async (ctx) => {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.storage);
         const databaseFile = store.databaseFile();
         if (databaseFile === null)
             return refuse(response, who, 403, "An instance operator looks after storage.", "/settings");
-        // What the page shows next is measured again after the change.
         const said = sayTo(response, "/settings/storage");
         const back = async (kind, words) => { await measureStorage(databaseFile).catch(() => undefined); return said(kind, words); };
         const what = op === "clean" ? "clean up" : op === "discard" ? "discard a task folder" : "change automatic cleanup";
@@ -1290,7 +1207,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
         }
         const pool = storagePool(databaseFile);
         if (op === "clean") {
-            // Only what the preview showed goes: when that changed since, the person looks again.
             const plan = await checkoutPlan(store, pool, clock(), { manual: true });
             if (plan.go.length === 0)
                 return back("said", "Nothing to clean up.");
@@ -1303,8 +1219,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
         const done = await discardCheckout(store, pool, body.get("path") ?? "", now, who.name);
         return done.ok ? back("said", `Discarded, about ${bytesWords(done.bytes)}. Its branch stays.`) : back("problem", done.message);
     };
-    // Pull requests for one project: turn on (the checks run again and must match what the page showed), merge
-    // settings, or turn off. Each takes the password and lands in the ledger.
     async function pullRequestsSave(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.pullRequests);
@@ -1344,8 +1258,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
         }
         return back("problem", "That change isn't available.");
     }
-    // Checks for one project: the level, or the quick command (approved like `verify set --quick`). Each takes
-    // the password and lands in the ledger.
     async function checksSave(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.checks);
@@ -1361,19 +1273,16 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
         if (!authenticateApprover(who, body.get("password") ?? "", repo).ok)
             return back("problem", "Enter your Toolroll password to change checks.");
         const act = body.get("act");
-        // The automatic review switch: the policy log keeps before → after.
         if (act === "review") {
             const on = body.get("on") === "1";
             store.setReviewSwitch(repo, on, who.name, now);
             return back("said", on ? "Automatic review is on." : "Automatic review is off.");
         }
-        // Batch checks: off by default; the ledger keeps before → after.
         if (act === "batch") {
             const on = body.get("on") === "1";
             const changed = setProjectBatchChecks(store, repo, on, who.name, now);
             return back("said", !changed.changed ? "Saved." : on ? "Batch checks are on." : "Batch checks are off.");
         }
-        // Small tasks start right away: a person's own logged settings act, behind this form's password.
         if (act === "small-tasks") {
             const on = body.get("on") === "1";
             store.upsertProject(repo, projectName(repo), now);
@@ -1409,7 +1318,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
         }
         return back("problem", "That change isn't available.");
     }
-    // Sprint 8: back up now. An instance operator; the outcome is kept like a scheduled one's.
     async function backupStart(ctx) {
         const { who, response } = ctx;
         const databaseFile = store.databaseFile();
@@ -1420,7 +1328,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
             return redirect(response, `/settings/backups?problem=${encodeURIComponent(`Backed up. The activity log failed its tamper check, so it was not anchored: ${made.checkpoint.problem}`)}`);
         return redirect(response, made.ok ? `/settings/backups?said=${encodeURIComponent("Backed up.")}` : `/settings/backups?problem=${encodeURIComponent(`The backup failed: ${made.error}`)}`);
     }
-    // Sprint 8: change the backup schedule. A step-up; the ledger keeps before → after.
     async function backupsSave(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.backups);
@@ -1444,8 +1351,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
             if (problem !== null)
                 return back("problem", problem);
         }
-        // The continuous copy (live-backup.ts): how often, and a folder that is a plain, private folder of this user's
-        // outside every project and checkout. A form without these fields leaves it as it is.
         const liveBefore = liveBackupState(store).settings;
         const liveEvery = body.get("live_every") ?? null;
         const liveMinutes = Number(liveEvery);
@@ -1464,7 +1369,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
             keep: liveBefore.keep, folder: liveFolder }, who.name, now);
         return back("said", every === "off" ? "Saved. Scheduled backups are off." : "Saved.");
     }
-    // v105: download everything as a .zip. An instance operator, with a step-up; the ledger records it.
     async function dataExport(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.data);
@@ -1478,7 +1382,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
             "cache-control": "no-store", "x-content-type-options": "nosniff" });
         return void response.end(zip);
     }
-    // Settings → Flows → Switch on: a starter flow's zones and trigger, made together.
     async function flowsOn(ctx) {
         const { who, response, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.flowsOn);
@@ -1495,7 +1398,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
         const switched = switchOnStarter(store, starter, repo, who.name, clock(), options.configDir ?? null);
         return switched.ok ? back("said", switched.said) : back("problem", switched.said);
     }
-    // Settings → Integrations → youiyoux → Turn off / Turn on: whether a project's change requests become tasks.
     async function integrationsYouiyoux(ctx) {
         const { who, response, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.integrationsYouiyoux);
@@ -1510,7 +1412,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
         setYouiyouxIntake(store, repo, on, who.name, clock());
         return back("said", on ? `youiyoux requests in ${basename(repo)} become tasks again.` : `youiyoux requests in ${basename(repo)} are off.`);
     }
-    // Settings → Integrations → Check connection: one harmless read-only check of one integration, now.
     async function integrationsTest(ctx) {
         const { who, response, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.integrationsTest);
@@ -1524,7 +1425,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
         return checked.state === "connected" ? back("said", `${checked.name} works${checked.account === null ? "" : ` (${checked.account})`}.`)
             : back("problem", `${checked.name}: ${checked.action.kind === "fix" ? checked.action.words : "not set up."}`);
     }
-    // v104: change where monitoring goes. A step-up; the ledger keeps before → after (addresses, never secrets).
     async function monitoringSave(ctx) {
         const { who, request, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.monitoring);
@@ -1534,13 +1434,11 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
         if (!authenticateApprover(who, body.get("password") ?? "").ok)
             return back("problem", "Enter your Toolroll password to change monitoring.");
         const before = readMonitoring(options.configDir);
-        // Never into Toolroll's own folder, a project or the build checkouts: an agent could read the stream there.
         const saved = saveMonitoring(options.configDir, { webhook: body.get("webhook") ?? "", folder: body.get("folder") ?? "", tracesEndpoint: body.get("traces") ?? "",
             headerName: body.get("header-name") ?? "", headerValue: body.get("header-value") ?? "", rotate: body.get("rotate") === "1" }, before, [...new Set([...managedRepos(), ...store.knownRepos(), ...(options.poolRoot === undefined ? [] : [options.poolRoot])])]);
         if (!saved.ok)
             return back("problem", saved.said);
         const after = saved.settings;
-        // A destination that's new or points elsewhere starts over on the monitoring loop's next pass.
         const change = monitoringChange(before, after, saved.secret !== null);
         if (change !== null) {
             store.recordAction({ at: now.toISOString(), actor: who.name, repo: null, taskId: null, runId: null, action: "monitoring changed", outcome: "changed", source: "policy", detail: change });
@@ -1557,23 +1455,17 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
         const reachable = (one) => visible(one) && consoleProjects().includes(one);
         if (!reachable(repo))
             return refuse(response, who, 403, "That project is outside your access.", "/projects");
-        // "Also connect to …": a service connected on the shown project, signed in again for another project.
         const also = body.get("also");
         const split = also === null ? -1 : also.indexOf(":");
         const service = oneClickOf(also === null ? body.get("service") ?? "" : split > 0 ? also.slice(0, split) : "");
-        // An app on this computer (Figma's desktop app) connects here, never "also" elsewhere.
         const local = service === null && also === null ? localConnectOf(body.get("service") ?? "") : null;
         const chosen = service ?? local;
         const target = also === null ? repo : split > 0 ? also.slice(split + 1) : "";
-        // From a gallery template that uses this tool: it comes back to that template's page, for this project.
         const gallery = also === null && chosen !== null ? galleryTemplateOf(body.get("template") ?? "") : null;
         const template = gallery !== null && (gallery.tools ?? []).includes(chosen.id) ? gallery.id : null;
         const kit = template === null ? kitOf(body.get("kit") ?? "")?.id ?? null : null;
-        // A Connect that fails comes back to its own button, where the reason is said (no #fragment: one stops the alert's
-        // autofocus); an "Also connect to" refusal goes back to the Connect card.
         const back = (words, page = repo) => template !== null ? redirect(response, `/flows/new/${template}?repo=${encodeURIComponent(page)}&problem=${encodeURIComponent(words)}`)
             : redirect(response, `/settings/tools?repo=${encodeURIComponent(page)}${kit === null ? "" : `&kit=${kit}`}${chosen === null || also !== null ? "" : `&connect=${chosen.id}`}&problem=${encodeURIComponent(words)}${also === null ? "" : "#connect"}`);
-        // The page posts the project it showed; a post from a page showing another project is stale.
         const shown = body.get("shown") ?? "";
         if (shown !== repo)
             return back("The project changed; connect again.", reachable(shown) ? shown : repo);
@@ -1589,7 +1481,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
         }
         if (!authenticateApprover(who, body.get("password") ?? "").ok)
             return back("Enter your Toolroll password to connect a tool.");
-        // An app on this computer: added like a common tool and tested; one that can't be reached isn't kept.
         if (local !== null) {
             const had = projectToolsOf(store, repo).find(one => one.name === local.id);
             if (had !== undefined && localAppOf(had.spec) === null)
@@ -1614,7 +1505,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
         const origin = consoleOrigin(request.headers.host);
         if (origin === null)
             return back("Connect tools from this computer (localhost) or from your https address.");
-        // Reconnect read-only (from a connected service's Tools entry): the same sign-in, asking only to read.
         const readOnly = also === null && body.get("access") === "read";
         const started = await startConnect({ service: service.id, repo: target, by: who.name, origin, kit: also === null ? kit : null, template, readOnly }, options.connectFetch ?? fetch);
         if (!started.ok)
@@ -1622,8 +1512,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
         for (const [key, visit] of connectVisits)
             if (visit.expires < Date.now())
                 connectVisits.delete(key);
-        // The password above proves one thing: this connection, by this account as it is now, and (from a kit whose subagent
-        // is set up) letting that subagent use this tool in this project. The callback holds the visit to exactly that.
         const kitSet = kit === null || also !== null ? null : kitOf(kit);
         const installed = kitSet === null || !kitSet.tools.some(one => one.tool === service.id) ? null : kitInstalled(store, kitSet, target);
         connectVisits.set(started.state, { ...started.visit, generation: store.accountOf(who.name)?.generation ?? -1,
@@ -1637,7 +1525,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
         if (!visible(repo) || !consoleProjects().includes(repo))
             return refuse(response, who, 403, "That project is outside your access.", "/projects");
         const back = sayTo(response, `/settings/tools?repo=${encodeURIComponent(repo)}`);
-        // As for Connect: a post from a page that showed another project is refused, never applied here.
         const shown = body.get("shown") ?? "";
         if (shown !== repo) {
             const page = visible(shown) && consoleProjects().includes(shown) ? shown : repo;
@@ -1645,7 +1532,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
         }
         const action = body.get("action") ?? "";
         const name = body.get("name") ?? "";
-        // Anything that adds what a build can run or reach, or a secret, needs the password.
         if (["add-catalog", "add-custom", "import", "secret"].includes(action) && !authenticateApprover(who, body.get("password") ?? "").ok) {
             return back("problem", "Enter your Toolroll password to change this project's tools.");
         }
@@ -1677,7 +1563,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
                 const wanted = body.getAll("import");
                 if (wanted.length === 0)
                     return back("problem", "Choose at least one tool to add.");
-                // The project's own .mcp.json read now, off the console's thread (folder-look.ts).
                 let projectConfig;
                 if (options.identities !== undefined) {
                     const looked = await lookProjectMcp(repo);
@@ -1730,8 +1615,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
     async function appearanceSave(ctx) {
         const { who, response, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.appearance);
-        // A per-browser preference, not a shared setting: it lives in this
-        // person's own cookie and never in the database.
         const accentField = body.get("accent");
         if (accentField !== null) {
             const accent = normalHex(accentField);
@@ -1740,7 +1623,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
             response.setHeader("Set-Cookie", accent === DEFAULT_ACCENT
                 ? "so-accent=; SameSite=Lax; Path=/; Max-Age=0"
                 : `so-accent=${accent.slice(1)}; SameSite=Lax; Path=/; Max-Age=31536000`);
-            // The picker saves in the background as the colour settles; a plain form post goes back.
             if (body.get("quiet") === "1") {
                 response.writeHead(204);
                 response.end();
@@ -1804,7 +1686,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
         }
         return redirect(response, `/settings/knowledge?repo=${encodeURIComponent(repo)}&saved=1`);
     }
-    /** A lesson note: a person's own words, accepted as a decision through the one proposal writer, or rejected. */
     async function knowledgeNote(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.knowledgeNote);
@@ -1824,8 +1705,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
         }
         return redirect(response, `/settings/knowledge?repo=${encodeURIComponent(repo)}&saved=1`);
     }
-    /** Project memory's clean-up: a person's request, accepting or rejecting one proposal, and restores. Every writer
-     * proves the person inside its own transaction. */
     async function knowledgeTidy(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.knowledgeTidy);
@@ -1834,7 +1713,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
             return refuse(response, who, 403, 'That project is outside your access.', '/settings/knowledge');
         const back = `/settings/knowledge?repo=${encodeURIComponent(repo)}`;
         const said = (id) => /^[0-9]{1,12}$/.test(id) ? Number(id) : null;
-        // Only a browser session is a person's proof here; the writers refuse anything else.
         const proof = who.via === 'cookie' ? 'session' : 'remote-token';
         try {
             if (action === 'propose')
@@ -1911,7 +1789,7 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
             try {
                 content = (knowledgeHtml(knowledgeView(store, repo, who.name), who.session.csrf, true, draft, error instanceof Error ? error.message : 'Save failed. Your draft is below.'));
             }
-            catch { /* never render unverified saved context */ }
+            catch { }
             return sendScreen(response, 409, screen('Knowledge', settingsSubPage("agents", "Knowledge", html `${content}`), { chrome: chromeFor(repo, 'settings') }));
         }
         return redirect(response, `/settings/knowledge?repo=${encodeURIComponent(repo)}&saved=1`);
@@ -1995,7 +1873,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
             savePrimary(dir, "slack");
             return redirect(response, "/settings/slack");
         }
-        // Connecting or pairing opens a way to act from Slack: a credential act. Unpairing or disconnecting only closes one.
         if (!(action === "connect" || action === "pair" ? authenticateCredential(who, body.get("password") ?? "") : authenticateApprover(who, body.get("password") ?? "")).ok)
             return show("Enter your Toolroll password to change Slack access.", 403);
         const generation = store.accountOf(who.name).generation;
@@ -2008,7 +1885,6 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
                 if (credentials || loadSlackCredentials(dir))
                     return show("Disconnect the current Slack app before connecting another.", 409);
                 saveSlackCredentials(dir, checked);
-                // A fresh connection asks for the 👀 again at once (an app reinstalled with reactions:write).
                 state.deleteMeta(checked.installation, ACK_REFUSED_META);
             }
             catch (error) {
@@ -2040,13 +1916,9 @@ ${restoreHtml(chosen, retired, undoableMerges(store, chosen), disabledLessons(st
     };
     async function telegramRetry(ctx) {
         const { who, response, now } = ctx;
-        // The signed-in person's own unsent replies only: already written and fenced on the pairing; this sends them again now.
         store.retryTelegramReplies(who.name, now);
         return redirect(response, "/settings/telegram");
     }
-    // Approving from chat, as the person's lasting setting (chat-approval.ts): for all their projects or one. Turning it
-    // on or changing its limits is the mode's ceremony (the exact terms, a single-use nonce bound to them, the password
-    // typed again); turning it off is one step, csrf only. Every change is a ledger line.
     const chatApprovalAct = (step) => async (ctx) => {
         const { request, response, now, posted } = ctx;
         const who = browserCaller(ctx.who);
@@ -2094,16 +1966,12 @@ ${postForm("/settings/chat-approval/save", html `\
         const { request, response, now, posted } = ctx;
         const who = browserCaller(ctx.who);
         const body = readForm(posted, CONSOLE_FORMS.telegramPair);
-        // The person's own pairing, under their password: a code minted for
-        // them alone, or their own chats revoked. Teammates' pairings are
-        // never touched from here.
         const botId = options.telegramTokenFile === undefined ? null : loadBotToken(process.env, options.telegramTokenFile)?.botId ?? null;
         const show = (problem, status = 400) => sendScreen(response, status, screen("Telegram", telegramSettingsHtml(store, botId, who.name, { problem }), { chrome: chromeFor(projectOf(who, request) ?? null, "settings") }));
         if (body.getAll("password").length > 1)
             return show("Submit one value for each field.");
         if (botId === null)
             return show("Connect the Telegram bot first.", 409);
-        // Pairing a phone is a credential act (a typed password, always); unpairing only closes a way in.
         if (op === "unpair" && authenticateApprover(who, body.get("password") ?? "").ok) {
             store.unpairTelegram(botId, who.name, now);
             return redirect(response, "/settings/telegram");
@@ -2242,8 +2110,6 @@ ${postForm("/settings/chat-approval/save", html `\
         const body = readForm(posted, CONSOLE_FORMS.messaging);
         const wanted = (body.get("primary") ?? "").trim();
         const facts = effectivePrimary(process.env, options.configDir, loadBotToken(process.env, options.telegramTokenFile) !== null);
-        // Only a CONFIGURED service may page — choosing silence is not a
-        // selection, and an unconfigured primary would page nobody.
         if (!isMessagingChannel(wanted) || !facts.configured.includes(wanted)) {
             return refuse(response, who, 400, "primary must be one of the configured services");
         }
@@ -2259,8 +2125,6 @@ ${postForm("/settings/chat-approval/save", html `\
         if (wanted !== "auto" && wanted !== "bypassPermissions") {
             return refuse(response, who, 400, "permissions must be Auto or Full access", "/settings");
         }
-        // Widening every new task to Full access takes a password (chat-management.md §0a.3): an ordinary step-up, so a
-        // signed-in session does under Passwordless. Back to Auto narrows, and needs none.
         if (wanted === "bypassPermissions" && store.permissionDefault().mode !== "bypassPermissions" && !authenticateApprover(who, body.get("password") ?? "").ok) {
             return redirect(response, `/settings/approval?problem=${encodeURIComponent("Enter your Toolroll password to start new tasks with Full access. Nothing changed.")}#defaults`);
         }
@@ -2286,7 +2150,6 @@ ${postForm("/settings/chat-approval/save", html `\
     async function notificationsSave(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.notifications);
-        // Each person's own choice: a closed list of modes and a 24-hour HH:MM, or off.
         const mode = body.get("mode"), time = (body.get("digest") ?? "").trim(), shots = body.get("screenshots");
         if (mode !== null && mode !== "quiet" && mode !== "all")
             return refuse(response, who, 400, "choose Only when I'm needed or Every step", "/settings");
@@ -2307,7 +2170,6 @@ ${postForm("/settings/chat-approval/save", html `\
     async function notificationsMute(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.notificationsMute);
-        // Each person's own pings: a muted project stays in Tasks and the evening digest.
         const repo = body.get("repo") ?? "";
         const project = notificationProjects(store, who.name).find(one => one.repo === repo);
         if (project === undefined)
@@ -2321,8 +2183,6 @@ ${postForm("/settings/chat-approval/save", html `\
         if (options.telegramTokenFile === undefined)
             return refuse(response, who, 404, "There's no page at this address.", "/chat");
         const body = readForm(posted, CONSOLE_FORMS.telegramDigest);
-        // The cadence is a closed list of minutes — never a free number from
-        // a form; "off" clears it. Any approver session may set it.
         const wanted = (body.get("every") ?? "").trim();
         const allowed = { off: null, "30": 30, "60": 60, "240": 240, "720": 720, "1440": 1440 };
         if (!(wanted in allowed))
@@ -2334,8 +2194,6 @@ ${postForm("/settings/chat-approval/save", html `\
     const providerKeyAct = (op) => async (ctx) => {
         const { who, response, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.providerKey);
-        // The central gate already required an ACTIVE approver; the value is
-        // write-only from here — status pages say set/not-set, never bytes.
         const provider = body.get("provider") ?? "";
         if (!isProviderId(provider))
             return refuse(response, who, 400, "unknown provider", "/settings");
@@ -2350,10 +2208,6 @@ ${postForm("/settings/chat-approval/save", html `\
                     ? `the ${provider} key is removed — ${provider} uses its own login, so builds are unaffected`
                     : `the ${provider} key is removed — an environment variable, if one exists, takes over`)}#providers`);
         }
-        // Validate EVERYTHING before mutating anything (Codex round 5,
-        // finding 2): an invalid key must never persist a mode change it
-        // then hides, a mode equal to the current one is not a "change",
-        // and an unchanged blank form does nothing.
         const wantedMode = body.get("auth-mode");
         const value = (body.get("value") ?? "").trim();
         const modeSelected = wantedMode === "subscription" || wantedMode === "api-key";
@@ -2361,16 +2215,12 @@ ${postForm("/settings/chat-approval/save", html `\
         if (!modeSelected && value === "") {
             return refuse(response, who, 400, "nothing to change — paste a key or pick a sign-in", "/settings");
         }
-        // A selected-but-inapplicable mode (openrouter subscription) refuses
-        // before any write.
         if (modeSelected && wantedMode === "subscription" && !SUBSCRIPTION_CAPABLE[provider]) {
             return refuse(response, who, 409, `${provider} has no subscription login — it is API-key only`, "/settings");
         }
-        // A present key must be plausible BEFORE the mode is touched.
         if (value !== "" && !plausibleKey(value)) {
             return refuse(response, who, 400, "that does not look like an API key — check the paste and try again", "/settings");
         }
-        // Apply the mode only when it actually differs.
         const modeChanged = modeSelected && wantedMode !== currentMode;
         if (modeChanged)
             setAuthMode(provider, wantedMode, providerHome);
@@ -2378,10 +2228,7 @@ ${postForm("/settings/chat-approval/save", html `\
         if (value === "") {
             return redirect(response, `/settings/agents?said=${encodeURIComponent(modeChanged ? `${provider} now uses ${wantedMode === "api-key" ? "the API key" : "its own subscription / login"}` : `no change — ${provider} already uses ${currentMode === "api-key" ? "the API key" : "its own subscription / login"}`)}#providers`);
         }
-        saveProviderKey(provider, value, providerHome); // known plausible
-        // Verify right now, so a paste gets an immediate yes/no instead of a
-        // failed build later. A stored-but-unreachable key still says so.
-        // In API-key mode the account check tests the stored key, and remembers the answer until the key changes.
+        saveProviderKey(provider, value, providerHome);
         const checked = readAuthMode(provider, providerHome) === "api-key" ? await connectionCheck(provider, true) : null;
         const verdict = checked?.verdict ?? await verifyProviderKey(provider, value);
         const stored = `the ${provider} key is stored`;
@@ -2398,7 +2245,6 @@ ${postForm("/settings/chat-approval/save", html `\
             return redirect(response, `/settings/alerts?problem=${encodeURIComponent(saved.message)}#telegram-token`);
         return redirect(response, `/settings/alerts?said=${encodeURIComponent("Bot token saved. Pair your phone on the Telegram page.")}#telegram-token`);
     }
-    // v87: the mail server Send email steps use, and a test email to its own address.
     const emailAct = (op) => async (ctx) => {
         const { who, response, posted } = ctx;
         if (who.role !== "approver" || options.configDir === undefined)
@@ -2410,7 +2256,6 @@ ${postForm("/settings/chat-approval/save", html `\
             return saved.ok ? said(saved.said) : said(saved.message, "problem");
         }
         if (op === "read-test") {
-            // Sign in and open the inbox read-only, as an Inbox trigger's first check does: nothing is read or changed.
             const signed = await mailboxAccess(options.configDir, options.googleFetch ?? fetch);
             if (!signed.ok)
                 return said(signed.said);
@@ -2424,7 +2269,6 @@ ${postForm("/settings/chat-approval/save", html `\
         const sent = await (options.mailSender ?? sendThroughServer)(settings, { from: settings.from, to: [settings.from], subject: "Toolroll: test email", text: "This is a test from Toolroll. Send email steps in your flows will come from this address." });
         return said(sent.ok ? `Sent a test email to ${settings.from}.` : sent.said);
     };
-    // v89: a Google account for email: save the OAuth client and go to Google's consent screen, or disconnect.
     const googleAct = (op) => async (ctx) => {
         const { who, request, response, posted } = ctx;
         if (who.role !== "approver" || options.configDir === undefined)
@@ -2467,11 +2311,8 @@ ${postForm("/settings/chat-approval/save", html `\
             planAuto: body.get("plan-auto") === "1",
             reviewAuto: false,
             reviewRetryAuto: false,
-            // Repairing failed checks: only the explicit choice grants it, with the limit it signs (check-repair.ts).
             repairAuto: body.get("repair-auto") === "1",
             repairMaxAttempts: body.get("repair-auto") === "1" ? CHECK_REPAIR_LIMIT : 0,
-            // Approving from the paired chat: only the explicit choice grants it, naming every chat app it covers (a grant
-            // signed before it named them stays Telegram only).
             chatApprove: body.get("chat-approve") === "1",
             ...(body.get("chat-approve") === "1" ? { chatApproveChats: CHAT_APPROVE_ALL } : {}),
             publication: body.get("publication") === "automerge" ? "automerge" : "notify",
@@ -2487,16 +2328,12 @@ ${postForm("/settings/chat-approval/save", html `\
         }
         const digest = modeDigestOf(terms);
         if (step === "confirm") {
-            // THE CEREMONY (M1): every resolved term in words, and the password
-            // signs exactly this digest — a drifted form refuses at /mode/sign.
             const nonce = mintApprovalNonce(who.name, "mode-sign", `${project}:${digest}`);
             const signed = Object.fromEntries(["name", "days", "publication", "auto-approve", "plan-auto", "chat-approve", "repair-auto"]
                 .map(field => [field, body.get(field) ?? ""]));
             const bodyHtml = modeCeremonyHtml({ name, project: projectName(project), words: modeWords(terms), chatApprove: signed["chat-approve"] === "1", repairAuto: signed["repair-auto"] === "1", hidden: { nonce, digest, ...signed, expiry } });
             return sendScreen(response, 200, screen("Sign the mode", bodyHtml, { chrome: chromeFor(project, "mode") }));
         }
-        // /mode/sign: the fixed expiry rides the form; the digest is
-        // RE-DERIVED from the posted fields — drift is a 409, never a guess.
         const fixedExpiry = body.get("expiry") ?? "";
         const signedTerms = { ...terms, absoluteExpiry: fixedExpiry };
         const rederived = modeDigestOf(signedTerms);
@@ -2508,7 +2345,6 @@ ${postForm("/settings/chat-approval/save", html `\
             return refuse(response, who, 409, "the terms moved while you were reading — read them again", "/mode");
         }
         const token = body.get("token") ?? "";
-        // A mode that lets a chat app approve, or repairs start by themselves, opens a way to act: a credential act. Any other mode is an ordinary one.
         if (!(body.get("chat-approve") === "1" || body.get("repair-auto") === "1" ? authenticateCredential(who, token) : authenticateApprover(who, token)).ok) {
             return refuse(response, who, 403, "signing a mode takes your password, typed again", "/mode");
         }
@@ -2530,12 +2366,9 @@ ${postForm("/settings/chat-approval/save", html `\
         const project = projectOf(who, request);
         if (project === null || project === undefined)
             return refuse(response, who, 409, "open a project first", "/mode");
-        // LOWERING authority is ONE CLICK for any approver (the v4 ruling):
-        // csrf only, no password — the fastest possible off-switch.
         const ended = store.revokeMode(project, who.name, "operator", now);
         return redirect(response, ended ? "/mode?said=the%20mode%20is%20ended%20—%20every%20act%20falls%20back%20to%20its%20own%20ceremony" : "/mode");
     }
-    // Settings → Lead: the name and persona this person's lead speaks with.
     async function leadIdentity(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.leadIdentity);
@@ -2545,7 +2378,6 @@ ${postForm("/settings/chat-approval/save", html `\
         store.setLeadConfig(who.name, checked.identity.name, checked.identity.persona, now);
         return redirect(response, "/settings/lead?saved=1");
     }
-    // Settings → Lead: what this person's lead knows about them, one line each.
     async function leadAbout(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.leadAbout);
@@ -2555,19 +2387,13 @@ ${postForm("/settings/chat-approval/save", html `\
         saveAboutYou(store, who.name, checked.lines, now);
         return redirect(response, "/settings/lead?saved=about");
     }
-    // Settings → Lead: stop the lead following up on one of your promises.
     async function leadPromiseCancel(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.leadPromiseCancel);
         const id = Number(body.get("promise"));
         const done = Number.isSafeInteger(id) && cancelCommitment(store, who.name, id, who.name, "Cancelled in Settings.", now);
-        // The promise leaving the list says it was cancelled; only a refusal needs words.
         return redirect(response, done ? "/settings/lead" : chatReturnWithSaid("/settings/lead", "That promise was already closed."));
     }
-    // Turn the lead on with the agent signed in on this computer: its membership spends no dollars, so like starting a
-    // conversation it needs no second password; the full form (Advanced) still asks for one.
-    // The welcome's "Use this one" names the agent (`agent`, claude or codex: only one signed in with its account here)
-    // and comes back to the welcome (`return`, that one address only).
     async function leadOn(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.leadOn);
@@ -2583,10 +2409,6 @@ ${postForm("/settings/chat-approval/save", html `\
             const words = asked === null ? `No agent is signed in on this computer yet. Run ${agentSignInCommand()}, then try again.` : `${asked === "claude" ? "Claude Code" : "Codex"} isn't signed in on this computer yet.`;
             return redirect(response, back ?? chatReturnWithSaid("/settings/lead", words));
         }
-        // Choosing the one already in use changes nothing (its daily turns and the rest stay as set). The local owner's
-        // choice also starts the installation's models on that agent's default preset, in the same write, while nothing
-        // is chosen yet (model-choices.ts fillDefaultRouting): its first task can then be planned and approved without a
-        // password. A full session's choice is as before: its models are Settings → Models'.
         store.transact(() => {
             if (store.getChatConfig()?.provider !== provider)
                 store.setChatConfig({ provider, model: "default", dailyTurns: 50, weeklyCeilingMicrousd: 0, priceInMicrousd: 0, priceOutMicrousd: 0 }, who.name, now);
@@ -2596,8 +2418,6 @@ ${postForm("/settings/chat-approval/save", html `\
         });
         return redirect(response, back ?? "/chat");
     }
-    /** Settings → Models, read from the saved catalog and the role rows at the scope being edited (the installation,
-     * or one project and what it inherits). */
     function modelsView(canManage, csrf, now, said, problem, query = new URLSearchParams()) {
         const runtimes = runtimeStates(store);
         const installed = new Set(runtimes.map(one => one.tool));
@@ -2629,11 +2449,9 @@ ${postForm("/settings/chat-approval/save", html `\
         const inUse = presetInUse(store, scope);
         const unchosen = repo === null && ALL_SLOTS.every(slot => rowAt(store, INSTALLATION_SCOPE, slot) === null);
         const checked = checkScope(store, repo);
-        // A preset or a switch, previewed: the exact rows it moves, with what a change of provider brings along.
         const pairWords = (pair, slot) => pair === null ? (repo !== null ? "same as the installation" : slot.phase === "repair" ? "same as the builder" : slot.phase === "review" ? "same as the planner" : slot.tier === "light" ? "routine builder" : slot.tier === "strong" ? "routine one" : "not set") : (pair.model ?? `${pair.provider} default`);
         const switchFrom = query.get("switch"), switchTo = query.get("to");
         const presetAsked = query.get("preset");
-        // The rows, what they inherit, and both digests come from one snapshot (model-choices.ts previewModelChange).
         const previewOf = (title, change, hidden) => {
             const snapshot = previewModelChange(store, scope, change);
             const rows = snapshot.rows.map(row => {
@@ -2652,7 +2470,6 @@ ${postForm("/settings/chat-approval/save", html `\
         const preview = !canManage ? null
             : isPresetName(presetAsked) ? previewOf(`Use ${PRESETS[presetAsked].label}`, presetChange(presetAsked), { preset: presetAsked })
                 : switchFrom !== null && switchTo !== null && exactModelId(switchFrom) && exactModelId(switchTo) ? previewOf(`Switch to ${switchTo}`, switchChange(store, scope, switchFrom, switchTo), { switch: switchFrom, to: switchTo })
-                    // A new installation with nothing chosen yet opens on the default, ready to apply.
                     : unchosen ? previewOf(`Start with ${PRESETS[DEFAULT_PRESET].label}`, presetChange(DEFAULT_PRESET), { preset: DEFAULT_PRESET })
                         : null;
         const chat = store.getChatConfig();
@@ -2679,7 +2496,6 @@ ${postForm("/settings/chat-approval/save", html `\
             suggested: suggestedView(repo, projects, query.get("suggestion"), now),
         };
     }
-    /** Google's redirect back: the code becomes a saved refresh token, and a page sends the person back to Settings. */
     async function googleCallback(ctx) {
         const { request, response, url } = ctx;
         const done = (said) => {
@@ -2714,14 +2530,11 @@ ${postForm("/settings/chat-approval/save", html `\
             response.end(htmlString(html `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta http-equiv="refresh" content="0;url=${to}"><title>Toolroll</title>${HANDOFF_STYLE}<p>${words} <a href="${to}">Back to Toolroll</a></p>`));
         };
         const state = url.searchParams.get("state") ?? "";
-        // Every arrival is logged (never the code or state): a sign-in that never came back is then visible as an absence.
         logEvent("info", "connect.callback", { error: url.searchParams.get("error"), known: connectVisits.has(state) });
         if (!startedHere(request, state))
             return done("/settings/tools", "problem", "That sign-in was started in another browser. Connect again from this one.");
         const visit = connectVisits.get(state);
         connectVisits.delete(state);
-        // The signer as at Connect: still an approver, not revoked, the same generation, still in the project. Checked here,
-        // before the connection changes, and again at the grant, after every wait.
         const standing = () => {
             const account = visit === undefined ? null : store.accountOf(visit.by);
             return visit !== undefined && account !== null && account.role === "approver" && account.revokedAt === null && visit.generation !== undefined
@@ -2731,7 +2544,6 @@ ${postForm("/settings/chat-approval/save", html `\
             return done("/settings/tools", "problem", "That sign-in expired. Connect again.");
         const service = oneClickOf(visit.service);
         const kit = visit.kit === null ? null : kitOf(visit.kit);
-        // Started from a gallery template's page: back to it, for the same project.
         const template = visit.template === null ? null : galleryTemplateOf(visit.template);
         const back = template !== null ? `/flows/new/${template.id}?repo=${encodeURIComponent(visit.repo)}`
             : kit === null ? `/settings/tools?repo=${encodeURIComponent(visit.repo)}` : `/kits/${kit.id}?repo=${encodeURIComponent(visit.repo)}`;
@@ -2747,13 +2559,10 @@ ${postForm("/settings/chat-approval/save", html `\
         const finished = await finishConnect(store, visit, code, now, { fetcher: options.connectFetch ?? fetch, home: toolHome, omitEnv: ALL_CREDENTIAL_ENV, stillStanding: standing });
         if (!finished.ok)
             return done(back, "problem", finished.said);
-        // From a kit: its teammate may use the tool now (reading freely, the rest after a person approves each call).
         const set = kit === null || !kit.tools.some(one => one.tool === service.id) ? null : kitInstalled(store, kit, visit.repo);
         const bound = visit.grant ?? null;
         if (set !== null && bound !== null && bound.subagent === set.mate.id && bound.tool === service.id && bound.repo === visit.repo && set.mate.repo === visit.repo
             && store.subagentGrant(set.mate.id, service.id) === null && standing()) {
-            // The password at Connect (toolsConnect) is this grant's proof, for exactly the grant the visit names, while the
-            // signer still stands: re-checked after the tool's listing, in the step that saves the grant.
             const granted = await grantTool(store, set.mate, service.id, visit.by, now, { toolHome }, { widening: "proved", stillProved: standing });
             if (granted.ok)
                 return done(back, "said", `${service.label} is connected to ${to}, and ${nameOf(set.mate)} can use it: reading freely, the rest after you approve each call.`);
@@ -2807,6 +2616,7 @@ ${postForm("/settings/chat-approval/save", html `\
         "settings.group-projects": settingsHome.bind(null),
         "settings.group-access": settingsHome.bind(null),
         "settings.group-system": settingsHome.bind(null),
+        "settings.group-advanced": settingsHome.bind(null),
         "provider.resume": providerResume,
         "settings.updates-dismiss": updatesDismiss,
         "session.forget-password": forgetPassword,
@@ -2916,12 +2726,11 @@ ${postForm("/settings/chat-approval/save", html `\
         "settings.lead-on": leadOn,
         "settings.code-map": codeMapAct("switch"),
         "settings.code-map-holdout": codeMapAct("holdout"),
+        "settings.advanced": advancedAct,
     }, {
         "edge.google-callback": googleCallback,
         "edge.connect-callback": connectCallback,
     });
-    // Settings → Project → Where builds write (writes-mode.ts). An approver for the project changes it with their password
-    // typed now; the ledger keeps before → after. New scopes use it; approved ones keep theirs.
     async function projectWrites(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.projectWrites);
@@ -2939,9 +2748,6 @@ ${postForm("/settings/chat-approval/save", html `\
         const changed = store.setProjectWrites(repo, wanted, who.name, now);
         return back("said", changed.before === changed.after ? "Nothing changed." : "Saved. Tasks scoped from now on use it; tasks already approved keep what they were approved with.");
     }
-    // Settings → Project → Check access (check-access.ts). Widening is an instance operator's act with a password typed now
-    // (an identity-provider re-check doesn't count); any approver for the project narrows it. The level is compared again
-    // inside the write, so a change made meanwhile can't turn a narrowing into a widening. The ledger keeps before → after.
     async function projectCheckAccess(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.projectCheckAccess);
@@ -2954,15 +2760,12 @@ ${postForm("/settings/chat-approval/save", html `\
         const wanted = body.get("level");
         if (!isCheckAccess(wanted))
             return back("problem", "Choose how far checks reach. Nothing changed.");
-        // Not available yet (check-access.ts signInsAvailable): refused before the password, whatever the form sent.
         const unavailable = wanted === "sign-ins" ? signInsUnavailableWords(options.platform ?? process.platform) : null;
         if (unavailable !== null)
             return back("problem", `${unavailable} Nothing changed.`);
         const widening = widerThan(wanted, store.projectCheckAccess(repo));
-        // Easy-start C5: while local mode is on, this installation always confines; said before the password.
         if (wanted === "unsandboxed" && localModeOn(store))
             return back("problem", `${LOCAL_MODE_CONFINES} Nothing changed.`);
-        // Sign-ins with an open network: a second, explicit yes, said before the password.
         if (wanted === "sign-ins" && widening && store.projectNetwork(repo).mode === "open" && body.get("confirm-open") !== "yes") {
             return back("problem", "This project's network is open: confirm that its checks could send your sign-ins to any host. Nothing changed.");
         }
@@ -2977,9 +2780,6 @@ ${postForm("/settings/chat-approval/save", html `\
             return back("problem", "Check access changed meanwhile, and this would now widen it. Nothing changed.");
         return back("said", changed.before === changed.after ? "Nothing changed." : "Saved. Tasks scoped from now on use it; tasks already approved keep what they were approved with.");
     }
-    // Settings → Project → Home folder (project-sandbox.ts, sandbox parity C9): what the project's builds and checks may not
-    // read, and the macOS services they may also use. An approver for the project changes it with
-    // their password typed now; the ledger keeps before → after. New scopes seal it; approved ones keep theirs.
     async function projectSandbox(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.projectSandbox);
@@ -3002,8 +2802,6 @@ ${postForm("/settings/chat-approval/save", html `\
             return back("problem", "An approver for this project changes its sandbox. Nothing changed.");
         return back("said", JSON.stringify(changed.before) === JSON.stringify(changed.after) ? "Nothing changed." : "Saved. Tasks scoped from now on use it; tasks already approved keep what they were approved with.");
     }
-    // Release approval (docs/plans/auto-approve-green.md): an approver of the project. Approving automatically is a
-    // credential act (a password typed now, never a session); asking again is one click and takes back automatic seals.
     async function releaseApprovalSave(ctx) {
         const { response, now, posted } = ctx;
         const who = browserCaller(ctx.who);
@@ -3026,15 +2824,10 @@ ${postForm("/settings/chat-approval/save", html `\
         const changed = setReleaseApproval(store, repo, true, who.name, now);
         return back("said", changed.changed ? "Releases approve themselves once CI and the release check pass." : "Saved.");
     }
-    // Settings → Spend moved onto the Spend page (/spend), limits first; the old address keeps working.
     async function spendSettingsPage(ctx) {
         const said = ctx.url.searchParams.get("said"), problem = ctx.url.searchParams.get("problem");
         return redirect(ctx.response, `/spend${problem !== null ? `?problem=${encodeURIComponent(problem)}` : said !== null ? `?said=${encodeURIComponent(said)}` : ""}`);
     }
-    // Settings → Models (docs/plans/spend-dashboard.md, slice 3): the one editor. Both posts are an instance operator's,
-    // browser-only step-ups: the password (or a Passwordless session, or an identity-provider re-check) is proved here,
-    // and model-choices.ts re-proves the same session, credential generation and operator standing inside the one
-    // transaction that checks the form against what is stored, validates the result and writes and ledgers every row.
     function modelsAuthority(who, method) {
         const session = who.session;
         return { actor: who.name, generation: session.generation, method, live: () => sessions.holds(session) && sessions.savedNow(session) && sessionWithinLifetime(session, Date.now()) };
@@ -3049,7 +2842,6 @@ ${postForm("/settings/chat-approval/save", html `\
         const done = count === 0 ? "Nothing changed." : `${what}: ${count} change${count === 1 ? "" : "s"} saved for tasks filed from now on.`;
         return { key: "said", words: result.unresolved === null ? done : `${done} Some roles have no model yet, so new tasks can't be filed here.` };
     }
-    /** One save of the whole editor: every role at the scope, sets and clears, as one change. */
     async function modelsSave(ctx) {
         const { response, now, posted } = ctx;
         const who = browserCaller(ctx.who);
@@ -3075,7 +2867,6 @@ ${postForm("/settings/chat-approval/save", html `\
                 return back("problem", "Choose a model from the list. Nothing changed.");
             change.push({ slot, to: { provider: value.slice(0, split), model: value.slice(split + 1) } });
         }
-        // Repairs resume the builder's session: a builder moved to another provider takes repair with it.
         const builder = change.find(one => one.slot.phase === "build" && one.slot.tier === "routine")?.to ?? null;
         const repair = change.findIndex(one => one.slot.phase === "repair");
         let follows = false;
@@ -3087,7 +2878,6 @@ ${postForm("/settings/chat-approval/save", html `\
         const said = modelsSaid(result, scope === INSTALLATION_SCOPE ? "All projects" : projectName(scope));
         return back(said.key, follows && result.ok ? `${said.words} Repairs now follow the builder.` : said.words);
     }
-    /** A preset or a switch, applied exactly as previewed: the change's own digest rides the form. */
     async function modelsApply(ctx) {
         const { response, now, posted } = ctx;
         const who = browserCaller(ctx.who);
@@ -3108,9 +2898,6 @@ ${postForm("/settings/chat-approval/save", html `\
         const said = modelsSaid(result, isPresetName(preset) ? PRESETS[preset].label : `Switched to ${to}`);
         return back(said.key, said.words);
     }
-    // Easy-start C5: turning local mode off (Settings → People and sign-in), from a full session only: an instance
-    // operator's step-up, proved and written in one transaction. It bumps local mode's generation, so every local-owner
-    // session, link and approval bound to the old one stops standing. It is never turned back on here.
     async function localModeOff(ctx) {
         const { response, now, posted } = ctx;
         const who = browserCaller(ctx.who);
@@ -3131,8 +2918,6 @@ ${postForm("/settings/chat-approval/save", html `\
             return back("problem", turned.reason === "not-on" ? "Local mode is already off." : "Only an instance operator can turn off local mode.");
         return back("said", "Local mode is off. This computer's browser signs in with your password now.");
     }
-    /** Settings → Models → Suggested: one project's offers, rules and switch; on the installation scope, every
-     * project's offers and rules, each reviewed on its own project's page. */
     function suggestedView(repo, projects, asked, now) {
         const repos = repo === null ? projects : [repo];
         const offers = repos.flatMap(one => suggestionsFor(store, one, now));
@@ -3156,13 +2941,6 @@ ${postForm("/settings/chat-approval/save", html `\
                 title: `Trying ${sizeTitle(one.cohortSize, modelName(store, one.model))}`, words: trialWords(store, one), live: one.state === "trialling" || one.state === "paused" })),
         };
     }
-    /**
-     * Settings → Models → Suggested (results routing, slice 2): the earned-rule doors (route-rules.ts), re-proved inside
-     * their own transaction. Accepting, keeping a paused rule and switching suggestions on are an instance operator's
-     * step-up (the password, or a Passwordless session); turning a rule off or dropping it, Not now, and switching
-     * suggestions off only take authority away, so a signed-in session does — or this computer's local owner, whose
-     * route row narrows it to exactly that act.
-     */
     function modelsRuleAct(kind) {
         return async (ctx) => {
             const { response, now, posted } = ctx;
@@ -3204,8 +2982,6 @@ ${postForm("/settings/chat-approval/save", html `\
                                     : kind === "suggest-on" ? "Suggestions are on for this project." : "Suggestions are off for this project.");
         };
     }
-    // Settings → Project → Fallback agents (fallback.ts): who takes over when an agent runs out of its plan. An approver for
-    // the project, with their password typed now; the ledger keeps every change. New tasks seal it; approved ones keep theirs.
     async function projectFallback(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.projectFallback);
@@ -3229,12 +3005,30 @@ ${postForm("/settings/chat-approval/save", html `\
         });
         return done.ok ? back("said", "Saved. Tasks scoped from now on use it; tasks already approved keep the chain they were approved with.") : back("problem", `Nothing changed: ${done.problem}`);
     }
-    // Settings → Lead: quick answers on or off (installation-wide; the route admits an instance operator only).
     async function leadQuick(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.leadQuick);
         setLeadQuickAnswers(store, body.get("enabled") === "on", who.name, now);
         return redirect(response, "/settings/lead?saved=quick");
     }
+    async function advancedAct(ctx) {
+        const { who, response, now, posted } = ctx;
+        const body = readForm(posted, CONSOLE_FORMS.advancedView);
+        const back = sayTo(response, "/settings/advanced");
+        if (who.via !== "cookie")
+            return refuse(response, who, 403, "This address needs a browser sign-in.", "/settings");
+        const values = body.getAll("advanced");
+        if (values.length !== 1 || (values[0] !== "on" && values[0] !== "off"))
+            return refuse(response, who, 400, "Choose on or off.", "/settings/advanced");
+        const on = values[0] === "on";
+        const session = who.session;
+        const door = who.authority === "full"
+            ? { kind: "person", actor: who.name, generation: session.generation, live: () => sessions.holds(session) && sessions.savedNow(session) && sessionWithinLifetime(session, Date.now()) }
+            : { kind: "local-owner", actor: who.name };
+        const done = setAdvancedPreference(store, door, on, now);
+        if (!done.ok)
+            return refuse(response, who, 403, done.problem, "/settings/advanced");
+        return back("said", on ? "Advanced features show in your menus." : "Advanced features are out of your menus. They still open from here.");
+    }
     return { registrations, modelsView };
 }