toolroll 0.9.104 → 0.9.105

package/dist/chat-actions.js

@@ -1,5 +1,3 @@
-/** Shared, exact-state actions. Models may prepare; only the existing human
- * confirmation door executes. Protected actions use a one-use review receipt. */
 import { endHoldout, setCodeMapSwitch } from "./code-map-acts.js";
 import { codeMapOn } from "./code-map-store.js";
 import { dismissSuggestion, ruleById, stopTrial, suggestionsFor, suggestionWords, taskEvidenceWords, trialWords } from "./route-rules.js";
@@ -60,7 +58,6 @@ import { callWords, checkRule, defaultRule, grantListed, revokeTool, ruleLoosens
 import { aboutYouOf, checkAboutYouLine, saveAboutYou, withAboutYouLine } from "./lead-about.js";
 import { CHAT_ACTION_FIELDS, readChatActionRequest, readSharedAction, SHARED_ACTION_VERSION } from "./contracts/chat-actions.js";
 export { CHAT_ACTION_FIELDS };
-/** A tool from the lead's card: a common tool by its id, or the operator's own program or address. */
 function toolSpecFromRequest(input) {
     if (input["catalog"] !== undefined) {
         const chosen = catalogTool(String(input["catalog"]));
@@ -102,17 +99,11 @@ export const CHAT_ACTIONS = {
         protected: false,
         password: false,
     },
-    // A tool runs on this computer for every build the operator approves from now on: the password screen, like an approval.
     tool_add: { label: "Add tool", protected: true, password: true },
     tool_remove: { label: "Remove tool", protected: false, password: false },
-    // Flows: a drawing and cards on it. Any work a card files is an ordinary task under the usual approvals.
     flow_create: { label: "Create flow", protected: false, password: false },
-    // A starter flow: its zones and its trigger, switched on with one yes (flow-starters.ts).
     flow_starter: { label: "Switch on", protected: false, password: false },
-    // Lead fan-out (docs/plans/lead-fan-out.md): files N tasks under one brief and approves each one's scope — the
-    // person's ceremony (protected, with the password), N ordinary approvals of exactly the scopes shown.
     sweep_file: { label: "Start sweep", protected: true, password: false },
-    // Stops every item of a sweep not yet ready; finished results stay. An ordinary act, like cancelling a task.
     sweep_cancel_rest: { label: "Cancel the rest", protected: false, password: false },
     flow_edit: { label: "Save flow", protected: false, password: false },
     flow_card_add: { label: "Add card", protected: false, password: false },
@@ -129,8 +120,6 @@ export const CHAT_ACTIONS = {
     flow_trigger_pause: { label: "Pause trigger", protected: false, password: false },
     flow_trigger_resume: { label: "Turn trigger on", protected: false, password: false },
     flow_trigger_remove: { label: "Remove trigger", protected: false, password: false },
-    // Browser use widens a flow's sandbox (flow-browser.ts): the lead may only propose it; a person allows it with their own
-    // yes on a card that shows every term, in a chat they are signed in to or linked from. Turning it off lowers authority.
     flow_browser: { label: "Allow browser", protected: true, password: false },
     flow_browser_off: { label: "Turn off browser", protected: false, password: false },
     subagent_create: { label: "Add subagent", protected: false, password: false },
@@ -146,15 +135,10 @@ export const CHAT_ACTIONS = {
     kit_setup: { label: "Set up kit", protected: false, password: false },
     decision_record: { label: "Record decision", protected: false, password: false },
     decision_retire: { label: "Retire decision", protected: false, password: false },
-    // Not now only takes a suggestion off the list for 30 days: nothing about which models run changes.
     suggestion_not_now: { label: "Not now", protected: false, password: false },
-    // Stopping a trial only lowers: new tasks build on the configured model; approved ones keep theirs.
     trial_stop: { label: "Stop trial", protected: false, password: false },
-    // The code map's switch and holdout (docs/plans/code-map.md §5): a person's yes on the card, re-proved in the write.
     code_map_switch: { label: "Change code map", protected: false, password: false },
     code_map_holdout_end: { label: "End holdout", protected: false, password: false },
-    // Chat and console parity (docs/plans/toolroll-cards.md): plain acts that lower authority or change no one's reach,
-    // each the console's own write. Ending a mode and turning a flow off its own only ever lower authority.
     mode_revoke: { label: "End automatic approvals", protected: false, password: false },
     flow_unattended_off: { label: "Stop running on its own", protected: false, password: false },
     flow_archive: { label: "Archive flow", protected: false, password: false },
@@ -165,37 +149,25 @@ export const CHAT_ACTIONS = {
     task_restore: { label: "Restore task", protected: false, password: false },
     incident_resolve: { label: "Resolve incident", protected: false, password: false },
     memory_decide: { label: "Decide memory proposal", protected: false, password: false },
-    // Follow-through (findings.ts): not an approval. A person's yes to words shown on the card sends them to the agent.
     finding_send: { label: "Send finding", protected: false, password: false },
     finding_resend: { label: "Send finding back", protected: false, password: false },
-    // The rest of the approvals: a person's own yes on a card that shows every term.
     task_reopen: { label: "Reopen task", protected: true, password: false },
     revision_accept: { label: "Accept plan revision", protected: true, password: false },
     revision_reject: { label: "Reject plan revision", protected: true, password: false },
     flow_unattended: { label: "Let flow run on its own", protected: true, password: false },
-    // What the owner's own lead knows about them: theirs alone, in no project (lead-about.ts).
     lead_about_you: { label: "Remember", protected: false, password: false },
     scope_approve: { label: "Approve work", protected: true, password: false },
     result_accept: { label: "Accept", protected: true, password: false },
     task_cancel: { label: "Cancel task", protected: true, password: false },
     task_resume: { label: "Resume task", protected: true, password: false },
-    // One-step start from chat (docs/plans/one-step-chat.md C2): files and approves one small task the lead drafted, under
-    // exactly the fast start rules. Only the lead's turn loop drafts one (propose_start); a person's own yes starts it.
     task_start: { label: "Start work", protected: true, password: false },
 };
-// Every action has a schema (contracts/chat-actions.ts) and every schema an action: a mismatch fails to compile.
 const SAME_ACTIONS = true;
 void SAME_ACTIONS;
-/** Approvals (owner's decision, docs/plans/toolroll-cards.md): a person's own yes from their chat stands without a password.
- * Only a person's tap in a linked chat, or their click in a signed-in browser, ever runs one. */
 export const APPROVAL_ACTIONS = new Set(["scope_approve", "task_resume", "sweep_file", "flow_browser", "task_reopen", "revision_accept", "revision_reject", "flow_unattended", "task_start"]);
-/** Protected actions a linked chat may confirm behind its own explicit yes/cancel challenge instead of the review screen.
- * Password actions and long or redacted terms never qualify: the card must show the exact terms. */
 export const APPROVAL_TERM_CHARS = 3000;
 export const CHALLENGE_ACTIONS = new Set(["result_accept", ...APPROVAL_ACTIONS]);
-/** Actions about the person themselves, in no project: their card carries no project (repo ""). */
 export const OWNER_ACTIONS = new Set(["lead_about_you", "provider_resume", "worker_note", "lead_identity"]);
-/** Actions the console refuses a project-limited account (route table: limited "deny"): the same here. */
 const INSTANCE_ACTIONS = new Set(["mode_revoke", "flow_unattended_off", "flow_unattended", "provider_resume", "worker_note", "lead_identity", "incident_resolve", "memory_decide"]);
 export function isChatAction(value) {
     return typeof value === "string" && Object.hasOwn(CHAT_ACTIONS, value);
@@ -205,7 +177,6 @@ const nonceHash = (value) => createHash("sha256").update(value).digest("hex");
 function requireActor(store, who, repo, operation) {
     if (!store.schemaCurrent())
         throw Error("The running build changed. Reload before proposing an action.");
-    // An action about the person themselves names no project; every other one names one they can reach.
     const owned = repo === "" && operation !== undefined && OWNER_ACTIONS.has(operation);
     if (!isVerifiedApprover(who) ||
         !reproveApprover(store, who).ok ||
@@ -216,7 +187,6 @@ function text(input, key, cap, optional = false) {
     const value = input[key];
     if (optional && value === undefined)
         return "";
-    // Over its limit is refused with the limit, never cut.
     if (typeof value === "string" && value.length > cap)
         throw Error(`The ${key} is ${value.length.toLocaleString("en-US")} characters; the limit is ${cap.toLocaleString("en-US")}. Shorten it and propose again.`);
     if (typeof value !== "string" ||
@@ -259,7 +229,6 @@ function resultOf(store, task, run, repo) {
         throw Error("This result changed. Review the current result.");
     return current;
 }
-/** The flow (and card) a flow action names; its project decides who may act. */
 function flowTargetOf(store, input) {
     const card = input["card"] === undefined ? null : store.getFlowCard(integer(input, "card"));
     if (input["card"] !== undefined && (card === null || card.state !== "active"))
@@ -275,12 +244,10 @@ function flowTargetOf(store, input) {
         throw Error("This flow's drawing can't be read. Save it again on its canvas.");
     return { flow, definition, card, trigger };
 }
-/** Where this installation keeps its files: beside the database. */
 function configDirOf(store) {
     const file = store.databaseFile();
     return file === null ? null : dirname(file);
 }
-/** A zone named by id or by its title. */
 function flowZoneOf(definition, input, fallback) {
     const named = input["zone"] === undefined ? fallback : text(input, "zone", 60).trim();
     const stage = named === null ? undefined : definition.stages.find(one => one.id === named || one.title.toLowerCase() === named.toLowerCase());
@@ -288,7 +255,6 @@ function flowZoneOf(definition, input, fallback) {
         throw Error(`This flow has no zone called ${named}.`);
     return stage;
 }
-/** A flow drawing from chat: whole, keyless, plain, and every named decider can decide on the project. */
 function flowDrawingOf(store, input, repo) {
     const definition = validateFlowDefinition(input["definition"]);
     const words = JSON.stringify(definition);
@@ -300,16 +266,9 @@ function flowDrawingOf(store, input, repo) {
     return definition;
 }
 const quoted = (value) => `“${value}”`;
-/** No writes, including at preview. Store-derived snapshots are never accepted
- * from a model. Rebuilding the same request before execution catches changes. */
-export function prepareSharedAction(store, who, operation, input, root, now = new Date(), 
-/** The lead turn the card is (or is being) drafted in: a Start card's preview must have been prepared in it. Read
- * from the proposal row (or the running turn), never from the request. */
-turn) {
+export function prepareSharedAction(store, who, operation, input, root, now = new Date(), turn) {
     if (!isChatAction(operation))
         throw Error("Choose an available action.");
-    // The action's own schema: its fields and their kinds, refused by path. The request itself is used as given, so a
-    // confirmation rebuilds the same stamp from the same bytes.
     const read = readChatActionRequest(operation, input);
     if (!read.ok)
         throw Error(`This action can't be read — ${read.issues.map(issue => issue.line).join("; ")}.`);
@@ -322,7 +281,6 @@ turn) {
         return { version: SHARED_ACTION_VERSION, operation, request, repo: "", title, terms, stamp, state };
     }
     if (operation === "lead_about_you") {
-        // The owner's own note: the card shows the line, and the line it replaces beside it.
         const checked = checkAboutYouLine(input["line"]);
         if (!checked.ok)
             throw Error(checked.message);
@@ -336,8 +294,6 @@ turn) {
         const terms = replaces === 0
             ? [checked.line, "Your lead keeps this about you in every project. Change it in Settings → Lead."]
             : [`Was: ${lines[replaces - 1]}`, `Now: ${checked.line}`, "Replaces that line in what your lead knows about you. Change it in Settings → Lead."];
-        // An added line goes on the end, so it holds whatever else changed; a replacing card holds only while the line
-        // it replaces is still that line.
         const state = replaces === 0 ? {} : { was: lines[replaces - 1] };
         const title = replaces === 0 ? "Remember about you" : "Update what your lead knows about you";
         const stamp = hash({ operation, request, repo: "", state, terms, actor: who.name, generation: who.generation, ceiling: who.ceilingDigest });
@@ -347,7 +303,6 @@ turn) {
         ? null
         : text(input, "task", 64);
     const flowTarget = operation.startsWith("flow_") && operation !== "flow_create" && operation !== "flow_script_save" && operation !== "flow_starter" ? flowTargetOf(store, input) : null;
-    // v92: a subagent names its project; a question names it through its card's flow.
     const subagentTarget = operation.startsWith("subagent_") && operation !== "subagent_create" && operation !== "subagent_answer" ? store.getSubagent(integer(input, "subagent")) : null;
     if (subagentTarget !== null && subagentTarget.state === "removed")
         throw Error("That subagent is off the team.");
@@ -420,7 +375,6 @@ turn) {
         }
     }
     else if (operation.startsWith("tool_")) {
-        // The staleness fence: the project's tools as the card saw them.
         const current = projectToolsOf(store, repo);
         state = { tools: current.map((one) => `${one.name}:${one.digest}`) };
         const project = repo.split(/[\\/]/).filter(Boolean).at(-1) ?? repo;
@@ -428,7 +382,6 @@ turn) {
             const spec = toolSpecFromRequest(input);
             if (current.some((one) => one.name === spec.name))
                 throw Error(`${project} already has a tool called ${spec.name}.`);
-            // The request is rewritten to exactly what was checked, so confirming re-checks the same words.
             for (const key of ["name", "command", "args", "url", "secrets", "about"])
                 delete request[key];
             if (input["catalog"] === undefined)
@@ -448,7 +401,6 @@ turn) {
         }
     }
     else if (operation === "kit_setup") {
-        // a starter kit — its subagent, its flow and its buttons.
         const project = repo.split(/[\\/]/).filter(Boolean).at(-1) ?? repo;
         const kit = kitOf(String(input["kit"] ?? ""));
         if (kit === null)
@@ -505,7 +457,6 @@ turn) {
             terms.push(wanted === "paused" ? "Its decisions go to people and the zones it handles wait until you resume it." : wanted === "active" ? "It picks up its zones' cards again." : "It leaves the team: zones that name it go to people.");
         }
         else if (operation === "subagent_tools") {
-            // v94: which project tools it may use, and its rule for one action.
             const tool = text(input, "tool", 40);
             const change = input["change"];
             const grant = store.subagentGrant(mate.id, tool);
@@ -521,7 +472,6 @@ turn) {
                     throw Error(`${name} can already use ${tool}.`);
                 if ((found.lastTest?.tools ?? []).length === 0)
                     throw Error(`${tool} hasn't said what it can do yet. Test it on the Tools page first.`);
-                // Giving a subagent a tool takes the person's password (chat-management.md §0a.3), which never goes in chat.
                 throw Error(`Giving ${name} a tool takes your password. Open ${name}'s page in Toolroll, then Tools → Let ${name} use ${tool}.`);
             }
             else if (change === "revoke") {
@@ -539,7 +489,6 @@ turn) {
                 const checked = checkRule(grant, action, { use: input["use"], limit, undo: input["undoWith"] ?? grant.rules[action]?.undo ?? "" });
                 if (!checked.ok)
                     throw Error(checked.said);
-                // Letting it do more on its own takes the person's password (chat-management.md §0a.3), never a card.
                 const info = grant.actions.find(one => one.name === action);
                 if (ruleLoosens(grant.rules[action] ?? defaultRule(info), checked.rule))
                     throw Error(`Letting ${name} do more with ${action} on its own takes your password. Change the rule on ${name}'s page in Toolroll.`);
@@ -551,7 +500,6 @@ turn) {
                 throw Error("Choose grant, revoke or rule.");
         }
         else if (operation === "subagent_undo") {
-            // v97: undo one of its tool calls with the action its manager named for that.
             const call = store.subagentCall(integer(input, "call"));
             const undo = call === null || call.subagent !== mate.id ? null : undoFor(store, call);
             if (call === null || undo === null)
@@ -561,7 +509,6 @@ turn) {
             state = { call: call.id };
         }
         else if (operation === "subagent_routine") {
-            // v96: a routine: on a schedule, a card on its desk saying what to do; its answer goes to its manager.
             const name = nameOf(mate);
             if (input["change"] === "add") {
                 const schedule = routineSchedule(text(input, "schedule", 80));
@@ -587,7 +534,6 @@ turn) {
                 throw Error("Choose add or remove.");
         }
         else if (operation === "subagent_memory") {
-            // v95: edit or forget one thing it remembers.
             const memory = store.subagentMemory(integer(input, "memory"));
             if (memory === null || memory.subagent !== mate.id)
                 throw Error(`${nameOf(mate)} doesn't remember that any more.`);
@@ -608,7 +554,6 @@ turn) {
             state = { text: memory.text };
         }
         else if (operation === "subagent_ask") {
-            // D5: the lead delegates. The card says exactly what goes to the subagent, which works it within its own rules.
             const asked = text(input, "text", 4000).replace(/\r\n?/g, "\n").trim();
             if (asked === "")
                 throw Error(`Say what to ask ${nameOf(mate)}.`);
@@ -646,11 +591,6 @@ turn) {
         }
     }
     else if (operation === "task_start") {
-        // A Start card (docs/plans/one-step-chat.md C2). The preview is the one the lead's turn loop prepared in this card's
-        // own turn, for this person, on chat (never an id the model chose: the request only names it back), unexpired and
-        // unused. Every word below is Toolroll's, from a filing dry-run in a savepoint that is always rolled back, with the
-        // fast start rules read on it: the tap files again, and the stamp, approve()'s digest and its whole-terms check refuse
-        // anything that differs.
         const preview = text(input, "preview", 64);
         const saved = turn === undefined ? null : chatStartPreview(store, preview, who.name, turn, now);
         if (saved === null || saved.repo !== repo)
@@ -666,17 +606,12 @@ turn) {
         state = { preview, taskId: saved.taskId, digest: read.scope.digest };
         const project = repo.split(/[\\/]/).filter(Boolean).at(-1) ?? repo;
         title = `Start work in ${project}: ${saved.title}`;
-        terms.push(`Starts now as a small change. If it grows past ${FAST_MAX_FILES} files or ${FAST_MAX_LINES} changed lines, it waits for you to approve it again.`, 
-        // The goal and its one success test are the lead's words, shown exactly and labelled as the lead's.
-        `Written by the lead from your request: ${quoted(saved.title)}`, scopeTermsText(read.scope), ...fastTermsLines(store, read.scope, repo).map(line => `${line.label}: ${line.words}`), `Agent permissions and limits\n${runtimeTerms(authority.profile)}\n${authority.authMode === "api-key" ? "Uses your API key; spend is charged to that account." : authority.authMode === "subscription" ? "Uses your subscription login." : ""}`);
+        terms.push(`Starts now as a small change. If it grows past ${FAST_MAX_FILES} files or ${FAST_MAX_LINES} changed lines, it waits for you to approve it again.`, `Written by the lead from your request: ${quoted(saved.title)}`, scopeTermsText(read.scope), ...fastTermsLines(store, read.scope, repo).map(line => `${line.label}: ${line.words}`), `Agent permissions and limits\n${runtimeTerms(authority.profile)}\n${authority.authMode === "api-key" ? "Uses your API key; spend is charged to that account." : authority.authMode === "subscription" ? "Uses your subscription login." : ""}`);
     }
     else if (operation === "sweep_cancel_rest") {
-        // Exactly the items open now: if any settles or starts in between, the card is stale and a fresh one is needed.
         const table = sweepTable(store, integer(input, "sweep"), now, who.repos);
         if (table === null || table.repo !== repo)
             throw Error("That sweep isn't one of yours.");
-        // Exactly the items as they stand now — each one's active task (a revision, after one), state, running attempt and
-        // last change: any change makes this card stale, so nothing is acted on that wasn't shown.
         const open = sweepOpen(store, table, now);
         if (open.length === 0)
             throw Error("Nothing in that sweep is still unfinished.");
@@ -686,8 +621,6 @@ turn) {
         terms.push(`Cancels ${open.length - running.length} unfinished item${open.length - running.length === 1 ? "" : "s"}${running.length === 0 ? "" : ` and stops ${running.length} running build${running.length === 1 ? "" : "s"}`}: ${open.map(one => `${one.label} (${one.task})`).join(", ")}.`, "Finished results stay.");
     }
     else if (operation === "sweep_file") {
-        // Everything the person approves is on this screen: the shared rules, every item, the one success test, the
-        // limit. Confirming files exactly these and approves exactly these scopes; anything changed is a new card.
         const sweepTitle = text(input, "title", 200).trim(), brief = text(input, "brief", 8000).trim();
         const items = Array.isArray(input["items"]) ? input["items"] : [];
         if (items.length < 2 || items.length > 20)
@@ -701,20 +634,13 @@ turn) {
         request["items"] = cleaned.map(({ title, item }) => ({ title, item }));
         const project = repo.split(/[\\/]/).filter(Boolean).at(-1) ?? repo;
         title = `Start a sweep in ${project}: ${sweepTitle}`;
-        // Every word each child's scope will hold is shown here (the security review: nothing approved off-screen): its
-        // goal is the shared rules, then its item, then the verdict line; its success test is the shared acceptance.
         const acceptance = Array.isArray(input["acceptance"]) ? input["acceptance"] : [];
         if (acceptance.length === 0)
             throw Error("A sweep needs a success test every item shares.");
-        // Every child's scope exactly as filing would make it — its words AND its agent's permissions, limits and route —
-        // found by filing them in a savepoint that is always rolled back (prepare writes nothing). They are on this card and
-        // in its state: if a project default changes before confirm, the card is stale and nothing is filed or approved.
         const children = sweepChildScopes(store, who, repo, brief, cleaned.map(({ title, item }) => ({ title, item })), input["acceptance"], now);
         state = { children: children.map(one => one.fingerprint) };
         const tests = acceptance.map((one, index) => `Success test ${index + 1}${typeof one["id"] === "string" ? ` (${one["id"]})` : ""}: ${String(one["statement"] ?? "")}${Array.isArray(one["evidence"]) ? ` — shown by ${one["evidence"].map(String).join(", ")}` : ""}`);
-        terms.push(`${cleaned.length} tasks, each in its own worktree on its own branch, at most ${maxParallel} running at once, built directly (no separate planning step).`, `Shared rules for every item: ${brief}`, ...cleaned.map(one => `Item ${one.index + 1} — ${one.title}: ${one.item}`), `Each item's goal is the shared rules, then its own item, then: ${VERDICT_RULE}`, ...tests.map(line => `Every item — ${line}`), ...(children.every(one => one.runtime === children[0].runtime) ? [`Every item — ${children[0].runtime}`] : children.map((one, index) => `Item ${index + 1} — ${one.runtime}`)), 
-        // Each item's own terms, word for word: its yes is bound to this text.
-        ...children.map((one, index) => `Item ${index + 1} in full:\n${one.terms}`), "Confirming files all of them and approves each one's scope exactly as shown. An item that needs a second person, or that the project's rules keep from its requester, is filed and waits for its own approval.", "Each ends with a verdict (fixed, not reproducible, blocked or done) and the sweep's table shows them as they land.");
+        terms.push(`${cleaned.length} tasks, each in its own worktree on its own branch, at most ${maxParallel} running at once, built directly (no separate planning step).`, `Shared rules for every item: ${brief}`, ...cleaned.map(one => `Item ${one.index + 1} — ${one.title}: ${one.item}`), `Each item's goal is the shared rules, then its own item, then: ${VERDICT_RULE}`, ...tests.map(line => `Every item — ${line}`), ...(children.every(one => one.runtime === children[0].runtime) ? [`Every item — ${children[0].runtime}`] : children.map((one, index) => `Item ${index + 1} — ${one.runtime}`)), ...children.map((one, index) => `Item ${index + 1} in full:\n${one.terms}`), "Confirming files all of them and approves each one's scope exactly as shown. An item that needs a second person, or that the project's rules keep from its requester, is filed and waits for its own approval.", "Each ends with a verdict (fixed, not reproducible, blocked or done) and the sweep's table shows them as they land.");
     }
     else if (operation.startsWith("flow_")) {
         const project = repo.split(/[\\/]/).filter(Boolean).at(-1) ?? repo;
@@ -729,7 +655,6 @@ turn) {
             state = {};
             title = `Create the ${name} flow in ${project}`;
             terms.push(...flowTerms(definition, null));
-            // A template's trigger (Issues to PRs: labelled issues) comes with it, checked as the flow will have it.
             if (input["trigger"] !== undefined) {
                 const draft = { id: 0, repo, name, definitionJson: JSON.stringify(definition), revision: 1, state: "active", createdBy: who.name, createdAt: now.toISOString(), updatedBy: who.name, updatedAt: now.toISOString(), owner: who.name };
                 const config = validateTriggerConfig(input["trigger"], { store, flow: draft, definition, actor: who.name });
@@ -799,7 +724,6 @@ turn) {
         else if (operation === "flow_trigger_add") {
             const { flow, definition } = flowTarget;
             const config = validateTriggerConfig(input["trigger"], { store, flow, definition, actor: who.name });
-            // A webhook address is a secret: it is made and shown on the flow's own Triggers panel, never through chat.
             if (takesDeliveries(config))
                 throw Error("Webhook addresses are secrets, so they are set up on the flow's Triggers panel. From chat, use a trigger that is checked every 2 minutes.");
             request["trigger"] = config;
@@ -820,7 +744,6 @@ turn) {
             const view = browserViewOf(store, flow);
             if (view === null)
                 throw Error(`No zone in ${flow.name} says it starts a browser. Mark its script zone first (edit the flow), then propose this.`);
-            // As on the flow page (route table: instance access), a project-limited account can't allow browser use.
             if (operation === "flow_browser" && store.accountOf(who.name)?.projects !== null)
                 throw Error("Allowing browser use needs an account with access to every project.");
             if (operation === "flow_browser_off") {
@@ -835,12 +758,9 @@ turn) {
                     throw Error(`${view.words}.`);
                 if (view.digest === null)
                     throw Error(view.problem ?? "This flow's browser zones can't be approved as they are.");
-                // The approval the person reads and the one their password signs: the digest is re-derived when they confirm.
                 state = { flow: flow.id, revision: flow.revision, digest: view.digest };
                 title = `Allow browser use in ${flow.name}`;
-                terms.push(`Flow: ${flow.name} · project ${project}`, 
-                // Each script by its short digest: the whole approval, every script's full digest included, is bound in the state.
-                ...view.zones.map(zone => `${zone.title} runs ${zone.script} v${zone.version}\nScript ${zone.digest.slice(0, 12)}`), "Each run of these zones starts a headless Chromium.", ...view.terms);
+                terms.push(`Flow: ${flow.name} · project ${project}`, ...view.zones.map(zone => `${zone.title} runs ${zone.script} v${zone.version}\nScript ${zone.digest.slice(0, 12)}`), "Each run of these zones starts a headless Chromium.", ...view.terms);
             }
         }
         else if (operation === "flow_trigger_pause" || operation === "flow_trigger_resume" || operation === "flow_trigger_remove") {
@@ -904,7 +824,6 @@ turn) {
                 terms.push("The card leaves the flow. Any tasks it filed stay as they are.");
             }
             else if (operation === "flow_card_choose") {
-                // "Person chooses" (flow-send.ts): one of the zone's own options, or a reply that becomes the note.
                 if (at?.kind !== "choose")
                     throw Error("That card isn't waiting for a choice.");
                 const person = flowPersonOf(card, flowTarget.flow);
@@ -917,7 +836,6 @@ turn) {
                     if (option === undefined)
                         throw Error(`Choose one of its ${(at.options ?? []).length} options, by number.`);
                     delete request["note"];
-                    // Bound to the option as shown: if the flow's options change before it is confirmed, it is refused.
                     Object.assign(state, { label: option.label, to: option.to });
                     title = `Choose “${option.label}” for ${quoted(card.title)}`;
                     terms.push(option.to === "end" ? `${at.title}: “${option.label}”. The card is closed as Ignored.` : `${at.title}: “${option.label}”. It moves to ${titleOf(option.to)}.`);
@@ -968,7 +886,6 @@ turn) {
         }
     }
     else if (operation === "suggestion_not_now") {
-        // Only a suggestion on offer now, by its exact id (which binds its evidence, prices and Models generations).
         const asked = text(input, "suggestion", 200);
         const offer = suggestionsFor(store, repo, now).find(one => one.id === asked);
         if (offer === undefined)
@@ -978,7 +895,6 @@ turn) {
         terms.push(suggestionWords(offer), "Keeps this suggestion quiet for 30 days. Nothing about which models run changes. To accept it instead, review it in Settings → Models.");
     }
     else if (operation === "trial_stop") {
-        // Only a live trial of this project, by its number; the card is stale once the trial moves.
         const asked = integer(input, "trial");
         const trial = Number.isSafeInteger(asked) ? ruleById(store, asked) : null;
         if (trial === null || trial.kind !== "trial" || trial.repo !== repo || (trial.state !== "trialling" && trial.state !== "paused"))
@@ -999,8 +915,6 @@ turn) {
         terms.push("No new builds are enrolled. Builds already enrolled keep their arm, so the results stay comparable.");
     }
     else if (operation.startsWith("decision_")) {
-        // The staleness fence: the newest decision id and the active count, so a
-        // card drafted before a subagent recorded or retired one is refused.
         const stamp = store.handle.prepare("SELECT COALESCE(MAX(id),0) AS newest, COUNT(*) AS active FROM project_decision WHERE repo=? AND status='active'").get(repo);
         state = { newest: Number(stamp?.["newest"] ?? 0), active: Number(stamp?.["active"] ?? 0) };
         if (operation === "decision_record") {
@@ -1079,7 +993,6 @@ turn) {
             if (!authority.ok)
                 throw Error(authority.problem);
             state["authMode"] = authority.authMode;
-            // The whole terms word for word (the yes is bound to this text: chat-terms.ts cardShowsScope), then everything else.
             terms.push(scopeTermsText(scope), ...describeScope(scope, undefined, taskEvidenceWords(store, scope.taskId, now))
                 .filter((line) => !/^\s*(reference|approved|goal|not this|touches)\s/.test(line))
                 .map((line) => line
@@ -1143,7 +1056,6 @@ turn) {
                     terms.push(`Limitation: ${caveat}`);
         }
     }
-    // An approval keeps the digest of the exact words its card shows, from now on: the yes is to these (scope.ts approve).
     if (APPROVAL_ACTIONS.has(operation))
         state["shown"] = cardTermsDigest(terms.join("\n"));
     const stamp = hash({
@@ -1158,17 +1070,11 @@ turn) {
     });
     return { version: SHARED_ACTION_VERSION, operation, request, repo, title, terms, stamp, state };
 }
-/** A saved proposal's action, read by its schema (contracts/chat-actions.ts); null when it can't be read. */
 export function sharedActionPayload(value) {
     const read = readSharedAction(value);
     return read.ok ? read.value : null;
 }
-/** A shortened or redacted preview is not complete consent. This rule lives
- * in the shared door, so a forged transport callback cannot bypass it. */
 function sharedActionContentNeedsReview(action) {
-    // An approval's card has room for longer terms. Its words are compared exactly: anything the card would hide or
-    // rewrite (a long hex value, a path, a secret) sends the person to the review page. Toolroll's own digest is bound in
-    // the state, never in the terms, and a commit is written short, so an ordinary approval shows every word as stored.
     const approval = APPROVAL_ACTIONS.has(action.operation), cap = approval ? APPROVAL_TERM_CHARS : 1200;
     const content = [action.title, ...action.terms];
     return (action.terms.join("\n").length > cap ||
@@ -1178,15 +1084,6 @@ export function sharedActionNeedsReview(action) {
     return (CHAT_ACTIONS[action.operation].protected ||
         sharedActionContentNeedsReview(action));
 }
-/** Whether a linked chat may confirm this protected action behind its own
- * explicit challenge: the action is on the challenge list, needs no
- * password, and every term fits the card unshortened. An approval's yes is
- * a yes to the words the card showed (they are sealed as shown), so it also
- * needs a chat app that shows them exactly as stored (shownAsWritten: never
- * Teams, whose card reads Markdown; not Slack when a word would become an
- * emoji). There the card links to the review page and no tap approves. The
- * chat app is the one the card is drawn for or the tap came through, never
- * something the action or a caller's input names. */
 export function sharedActionAllowsChallenge(action, channel) {
     const config = CHAT_ACTIONS[action.operation];
     return (CHALLENGE_ACTIONS.has(action.operation) &&
@@ -1221,13 +1118,7 @@ function savedActionContext(store, who, id, state) {
     requireActor(store, who, payload.repo, payload.operation);
     return payload;
 }
-/** An action's terms alone, without whose proposal it was (actor, generation, ceiling). */
 const termsStampOf = (action) => hash({ operation: action.operation, request: action.request, repo: action.repo, state: action.state, terms: action.terms });
-/**
- * Whether the live action is the saved one: the exact stamp; or, for a scope approval already holding another
- * approver's yes on these exact terms (awaiting the second), the same terms — each reviewer's own nonce and authority
- * are still bound to them individually.
- */
 function sameSharedAction(store, who, live, saved) {
     if (live.stamp === saved.stamp)
         return true;
@@ -1256,20 +1147,15 @@ export function mintSharedActionReview(store, who, id, root, now) {
         throw Error("Too many reviews are open. Close older reviews and try again.");
     return { payload: live, nonce };
 }
-/** Whether a typed yes may stand in for the challenge's tap on this action: a Start card, on Telegram, a person (never a
- * machine), terms whole on the card, and an unsettled typed-yes record naming exactly this proposal. */
 export function typedStartOpens(store, proposal, action, options) {
     const typed = options.typedStart;
     return typed !== undefined && action.operation === "task_start" && options.via === "telegram" && typed.provider === "telegram"
         && options.authority !== "local-owner" && !machineActing() && sharedActionAllowsChallenge(action, "telegram") && typedStartNames(store, typed, proposal);
 }
-/** Called inside the proposal door's transaction, after ownership and session
- * checks. No password or review receipt is ever part of a saved proposal. */
 export function executeSharedAction(store, who, id, payload, now, options) {
     const refuse = (reason, said) => ({ ok: false, reason, said });
     if (store.isDemo())
         return refuse("refused", "The demo authorizes nothing.");
-    // Easy-start C1, a belt under the confirm door's own gate: a local owner runs only an operation that is one of its acts.
     if ((options.authority === "local-owner" || currentLocalOwner() !== null) && (!isChatAction(payload.operation) || CHAT_ACTION_LOCAL_ACTS[payload.operation] === null))
         return refuse("refused", "Set a password to do this.");
     let live;
@@ -1288,11 +1174,9 @@ export function executeSharedAction(store, who, id, payload, now, options) {
             ? error.message
             : "This action is no longer available.");
     }
-    // The review nonce was minted against the saved proposal's stamp: it is checked against that, whoever reviews.
     const savedStamp = payload.stamp;
     payload = live;
     const config = CHAT_ACTIONS[live.operation], req = live.request;
-    // A typed yes (C5) is checked on the live action and the live record; any use it doesn't open refuses.
     const typed = typedStartOpens(store, id, payload, options);
     if (options.typedStart !== undefined && !typed)
         return refuse("refused", TYPED_START_REFUSED);
@@ -1301,7 +1185,6 @@ export function executeSharedAction(store, who, id, payload, now, options) {
         ((options.confirm === true && sharedActionAllowsChallenge(payload, options.via)) || typed);
     if (APPROVAL_ACTIONS.has(live.operation) && machineActing())
         return refuse("needs-confirm", "Only a person approves this.");
-    // A lead's or remote token reaches the same web door: an approval needs a person's own session (or tap, above).
     if (APPROVAL_ACTIONS.has(live.operation) && options.via === "web" && options.authority !== "local-owner" && options.person !== true)
         return refuse("needs-confirm", "Approve this yourself, in your signed-in chat.");
     if (sharedActionNeedsReview(payload) && !challenged) {
@@ -1314,8 +1197,6 @@ export function executeSharedAction(store, who, id, payload, now, options) {
             return refuse("needs-confirm", "Confirm with your password in the secure screen.");
     }
     try {
-        // A scope approval's re-check (sso-now) is spent only if it happens: a refusal or a rolled-back savepoint puts it
-        // back (its every effect is in this transaction). Other actions spend it whatever comes of them.
         const act = () => store.savepoint(() => {
             const task = typeof req["task"] === "string" ? req["task"] : null, repo = payload.repo, actor = who.name;
             let taskId = task;
@@ -1355,10 +1236,7 @@ export function executeSharedAction(store, who, id, payload, now, options) {
                         : { restore: Number(req["restore"]) }),
                 }, now);
             else if (payload.operation === "flow_browser") {
-                // Only through the secure screen with the person's own password (protected + password above); signFlowBrowser
-                // re-reads the flow, its zones and scripts in this transaction and refuses unless they are what the card showed.
                 const flow = Number(payload.state["flow"]);
-                // signFlowBrowser re-reads the account's generation and reach in its transaction (it may have narrowed since).
                 const by = approvalBy(store, who, repo, now, options, drafted);
                 if (by.ok === false)
                     throw Error(by.why);
@@ -1427,8 +1305,6 @@ export function executeSharedAction(store, who, id, payload, now, options) {
                 return { ok: true, taskId: null, said: payload.operation === "code_map_switch" ? `The code map is ${req["on"] === true ? "on" : "off"}.` : "The holdout has ended.", href: `/settings/project?repo=${encodeURIComponent(repo)}#code-map` };
             }
             else if (payload.operation === "suggestion_not_now") {
-                // The rule door (route-store.ts proveRuleDoor) re-proves who says it: this computer's local owner only inside
-                // its `dismiss-suggestion` act, or the confirming person.
                 const door = currentLocalOwner() !== null ? { kind: "local-owner", actor } : { kind: "person", person: { actor: who.name, generation: who.generation, method: "session", live: () => true } };
                 const done = dismissSuggestion(store, { repo, id: String(payload.state["suggestion"]) }, door, now);
                 if (!done.ok)
@@ -1456,23 +1332,17 @@ export function executeSharedAction(store, who, id, payload, now, options) {
                 }, now);
             else if (payload.operation === "scope_approve") {
                 const scope = store.getScope(task);
-                // Cockpit B2: classified by the act, not the road — the same standard-approval freshness as /t/:id/approve.
                 const by = approvalBy(store, who, repo, now, options, drafted);
                 if (by.ok === false)
                     throw Error(by.why);
                 const limited = chatLimitProblem(scope, by.limits, "your chat approval setting");
                 if (limited !== null)
                     throw Error(limited);
-                // A local owner keeps its own road (approve proves it again in the seal); everyone else, their own yes from chat,
-                // to the scope and the words the card was made with.
                 const sawDigest = String(drafted.state["scope"]?.digest ?? "");
                 const result = withFreshness("approve-standard", () => approve(store, task, actor, now, sawDigest, options.review?.password ?? "", {}, undefined, by.chat));
                 if (!result.ok) {
-                    // A first yes on protected work is kept, with how its person was proved: committed, never rolled back.
-                    // The card stays open (`awaiting`) for the second approver; the same person again changes nothing.
                     if (result.reason === "second-approver")
                         return { ok: true, taskId, awaiting: true, ...(result.already ? { already: true } : {}), said: gateWords({ verdict: "vote", have: result.have, need: 2, already: result.already }) };
-                    // v102: the project's approval rules speak for themselves.
                     if (result.reason === "requester" || result.reason === "person-required")
                         throw Error(gateWords({ verdict: "refuse", reason: result.reason }));
                     if (result.reason === "policy")
@@ -1481,8 +1351,6 @@ export function executeSharedAction(store, who, id, payload, now, options) {
                 }
             }
             else if (payload.operation === "result_accept") {
-                // Accept and finish, as on the result page: whether a check only the person makes is accepted
-                // too is decided inside the same transaction, against the receipt as it stands.
                 const completed = acceptAndCompleteAsOperator(store, task, { runId: null, receiptDigest: String(payload.state["receipt"] ?? ""), note: null }, who, now, options.root);
                 if (!completed.ok)
                     throw Error(completed.message);
@@ -1549,24 +1417,14 @@ export function executeSharedAction(store, who, id, payload, now, options) {
             : "The action could not be completed.");
     }
 }
-/** A confirmed subagent action (v92), through the same helpers the Subagents pages use. */
-/**
- * Lead fan-out: file every item (all of them or none — any refusal throws and the savepoint takes the whole sweep
- * back), link them to one sweep record, then approve each one's scope through the ordinary approval (its own digest,
- * its own rules). A child the approval refuses stays filed and unapproved; it is named, never retried.
- */
-/** One child as filing makes it (the shared brief, its item, the verdict rule; the shared acceptance; built directly). */
 function fileSweepChild(store, who, repo, brief, one, acceptance, now) {
     const goal = `${brief}\n\nThis item:\n${one.item}\n\n${VERDICT_RULE}`;
     return fileTaskProposal(store, {
         title: one.title, repo, goal, acceptance, planning: "skip",
-        // Sized now, by the same heuristic filing would use: no background classifier is started — the card's dry run must
-        // leave nothing running after its rollback, and the approved scope must be the one shown (Codex sweep r2).
         sizing: heuristicSizing({ title: one.title, goal, outOfScope: null }),
         filedVia: "mate", filedBy: { name: who.name, kind: "person" }, proposedVia: "mate", admittedRepos: [...who.repos],
     }, now);
 }
-/** A filed child's scope in the words an approval agrees to (no identity lines), its runtime terms, and their digest. */
 function sweepChildScopeOf(store, taskId) {
     const scope = store.getScope(taskId);
     if (scope === null)
@@ -1576,16 +1434,12 @@ function sweepChildScopeOf(store, taskId) {
         throw Error(authority.problem);
     const words = describeScope(scope).filter(line => !/^\s*(reference|approved)\s/.test(line)).map(line => line.trim());
     const runtime = `Agent permissions and limits: ${runtimeTerms(authority.profile)} ${authority.authMode === "api-key" ? "Uses your API key; spend is charged to that account." : authority.authMode === "subscription" ? "Uses your subscription login." : ""}`.trim();
-    // The fingerprint covers the scope's every field, not only what is rendered (a profile setting no sentence names, such
-    // as an agent's idle timeout, still makes the card stale): its exact terms with only identity left out.
     const { taskId: _task, digest: _digest, approvedDigest: _approved, approvedBy: _by, approvedAt: _at, proposedAt: _proposed, approvalBasis: _basis, modeDigest: _mode, approvedProfile: _approvedProfile, approvedProfileJson: _approvedProfileJson, approvedChainJson: _approvedChain, ...terms } = scope;
     return { fingerprint: hash({ words, runtime, authMode: authority.authMode, profile: authority.profile, terms }), runtime, words, terms: scopeTermsText(scope) };
 }
-/** Every child as filing would make it, found in a savepoint that is always rolled back: prepare never writes. */
 function sweepChildScopes(store, who, repo, brief, items, acceptance, now) {
     const dryRun = new Error("sweep dry run");
     let found = [];
-    // Inside one transaction (filing opens its own; transact flattens), a savepoint that always rolls back.
     store.transact(() => {
         try {
             store.savepoint(() => {
@@ -1605,15 +1459,7 @@ function sweepChildScopes(store, who, repo, brief, items, acceptance, now) {
     });
     return found;
 }
-/**
- * A Start card's yes (docs/plans/one-step-chat.md C2): file and approve in one step through fastStartBuild, in this
- * action's savepoint. Two proofs of the person and no third: their own yes from chat (approvalBy gives `chat`, with the
- * card's whole words and their digest), under their own chat limits; or this computer's local owner on web chat, whose
- * approve() proves the owner itself and allows `build-now` only with a fast marker. Anything else refuses, and a refusal
- * throws, taking the filing back.
- */
 function startFromCard(store, who, proposal, drafted, options, now) {
-    // `toolroll chat` keeps refusing approvals; a Start card names the terminal's own fast start instead.
     if (options.via === "cli")
         throw Error(startFromTerminalWords(store, drafted));
     const by = approvalBy(store, who, drafted.repo, now, options, drafted);
@@ -1623,7 +1469,6 @@ function startFromCard(store, who, proposal, drafted, options, now) {
     if (by.chat !== undefined) {
         const chat = by.chat;
         proof = { chat: by.limits };
-        // A typed yes (C5) is recorded beside the fast marker: which message was the yes. The executor's gate has proved it.
         const typed = options.typedStart;
         approveNow = (taskId, saw, fast) => approve(store, taskId, who.name, now, saw, "", {}, typed === undefined ? fast : { ...fast, typed: { provider: typed.provider, event: typed.event } }, chat);
     }
@@ -1640,12 +1485,6 @@ function startFromCard(store, who, proposal, drafted, options, now) {
         throw Error(built.message);
     return built.taskId;
 }
-/**
- * A value safe to paste into a shell as ONE word, single-quoted, or null. The value is model- or person-written (the
- * lead's title, a project path), so only a strict allowlist passes: letters, digits, spaces and `. , : _ / - ( ) + # @`,
- * 1 to 120 characters, no leading `-`. Anything else (quotes, backticks, `$`, `\`, newlines, globs, redirections…) is
- * null, and the caller shows a placeholder instead.
- */
 export function shellWordOrNull(text) {
     if (text.length < 1 || text.length > 120 || text.startsWith("-"))
         return null;
@@ -1653,16 +1492,12 @@ export function shellWordOrNull(text) {
         return null;
     return `'${text}'`;
 }
-/** Where `toolroll chat` sends a Start card: the terminal's own fast start, with the words the lead drafted when they are
- * safe to paste as one shell word, else the placeholders. Never a value unquoted or in double quotes. */
 export function startFromTerminalWords(store, action) {
     const row = store.handle.prepare("SELECT title FROM fast_preview WHERE id = ?").get(String(action.state["preview"] ?? ""));
     const title = row === undefined ? null : shellWordOrNull(String(row["title"]));
     const project = shellWordOrNull(action.repo);
     return `Start it from the terminal with \`toolroll task new ${title ?? "\"<title>\""} --repo ${project ?? "<project>"}\`.`;
 }
-/** How this yes stands, and under whose limits: a person's own from chat, by their own chat setting, with the words and
- * digest the card was made with. A local owner's road has none: approve() proves it itself. */
 function approvalBy(store, who, repo, now, options, drafted) {
     if (options.authority === "local-owner")
         return { ok: true, limits: { fullAccess: true, capMicrousd: null } };
@@ -1692,7 +1527,6 @@ function fileSweep(store, who, proposal, payload, by, now) {
         const made = fileSweepChild(store, who, payload.repo, brief, one, req["acceptance"], now);
         if (!made.ok)
             throw Error(`Item ${index + 1} (${one.title}) couldn't be filed: ${made.message}. Nothing was filed.`);
-        // Each filed scope must be exactly the one the card showed (words, permissions, limits, route); else nothing is filed.
         if (sweepChildScopeOf(store, made.id).fingerprint !== payload.state["children"]?.[index])
             throw Error(`Item ${index + 1} (${one.title}) no longer matches what you reviewed (a project default changed). Nothing was filed; ask for a fresh card.`);
         store.addSweepTask(sweep, made.id, index, one.title);
@@ -1701,7 +1535,6 @@ function fileSweep(store, who, proposal, payload, by, now) {
     const waiting = [];
     for (const one of filed) {
         const scope = store.getScope(one.id);
-        // A person's own limits hold for each item: one past them is filed and waits for its own approval.
         const approved = scope === null || chatLimitProblem(scope, by.limits, "your chat approval setting") !== null ? null
             : withFreshness("approve-standard", () => approve(store, one.id, who.name, now, scope.digest, "", {}, undefined, by.chat));
         if (approved === null || !approved.ok)
@@ -1731,7 +1564,6 @@ function runSubagentAction(store, payload, actor, now) {
     if (mate === null || mate.state === "removed")
         throw Error("That subagent is off the team.");
     if (payload.operation === "subagent_ask") {
-        // One card per confirmed proposal: the confirmation runs once, so a retried tap never asks twice.
         if (mate.version !== payload.state["version"])
             throw Error("Someone changed its soul file since. Ask for a fresh proposal.");
         const asked = askSubagent(store, mate, { who: actor, via: "the lead" }, String(req["text"]), now);
@@ -1767,7 +1599,6 @@ function runSubagentAction(store, payload, actor, now) {
         if ((grant === null ? "" : JSON.stringify(grant.rules)) !== payload.state["rules"])
             throw Error("Someone changed its tools since. Ask for a fresh proposal.");
         const found = projectToolsOf(store, mate.repo).find(one => one.name === tool);
-        // A grant takes the person's password on the subagent's page (chat-management.md §0a.3): never from a card.
         if (req["change"] === "grant")
             throw Error("Giving a subagent a tool takes your password. Do it on its page in Toolroll.");
         const done = req["change"] === "grant" ? found === undefined ? { ok: false, said: `There's no tool called ${tool} any more.` } : grantListed(store, mate, found, null, actor, now, {})
@@ -1787,8 +1618,6 @@ function runSubagentAction(store, payload, actor, now) {
         throw Error(done.said);
     return { said: done.said, href: payload.operation === "subagent_state" && req["state"] === "removed" ? "/settings/lead/subagents" : `/settings/lead/subagents/${mate.id}` };
 }
-/** A confirmed flow action, through the same helpers the canvas uses; then
- * the flow moves what it can right away, as it does after a canvas change. */
 function runFlowAction(store, payload, actor, repos, root, now) {
     const req = payload.request;
     const settle = (flow, said, card) => {
@@ -1797,7 +1626,7 @@ function runFlowAction(store, payload, actor, repos, root, now) {
             try {
                 advanceFlows(store, repo, now, root === undefined ? {} : { evidenceRoot: root });
             }
-            catch { /* the next worker pass retries */ }
+            catch { }
         }
         const after = card === null ? null : store.getFlowCard(card);
         const filed = after !== null && after.task !== null && after.state === "active" ? " Its step filed a task under your usual approvals." : "";
@@ -1868,7 +1697,6 @@ function runFlowAction(store, payload, actor, repos, root, now) {
     const acted = payload.operation === "flow_card_move" ? moveCardInFlow(store, card, String(req["zone"]), actor, now)
         : payload.operation === "flow_card_cancel" ? cancelFlowCard(store, card, actor, now)
             : payload.operation === "flow_card_choose" ? (() => {
-                // The option (its words and where it leads) or reply target exactly as proposed; a proposal from before carries neither and is refused.
                 const bound = payload.state;
                 if (typeof bound["to"] !== "string" || (Number.isSafeInteger(req["choice"]) && typeof bound["label"] !== "string"))
                     return { ok: false, message: "Those options changed since; nothing was changed. Ask for a fresh proposal." };
@@ -1885,7 +1713,6 @@ function runFlowAction(store, payload, actor, repos, root, now) {
         throw Error(acted.message);
     return settle(card.flow, acted.said, card.id);
 }
-// ---- chat and console parity (docs/plans/toolroll-cards.md) ------------------------------------------------------------
 const LATE_APPROVALS = new Set(["task_reopen", "revision_accept", "revision_reject", "flow_unattended"]);
 const PARITY_ACTIONS = new Set(["mode_revoke", "flow_unattended_off", "flow_archive", "task_archive", "task_restore", "incident_resolve", "memory_decide", "finding_send", "finding_resend", ...LATE_APPROVALS]);
 const OWNER_PARITY = new Set(["provider_resume", "worker_note", "lead_identity"]);
@@ -1901,7 +1728,6 @@ function instanceAction(store, who, operation, input) {
         const pause = authPauseOf(store, provider);
         if (pause === null)
             throw Error("That agent isn't paused.");
-        // The pause is the whole installation's: every project with work waiting on it is named, and must be in reach here.
         const repos = [...new Set(store.handle.prepare(`SELECT t.repo AS repo FROM run r JOIN task_ref t ON t.id = r.task_ref WHERE r.provider = ? AND r.reason = 'auth-expired' AND r.finished_at >= ?
       UNION SELECT repo FROM task_ref WHERE auth_wait_pause = ?`).all(provider, pause.openedAt, pause.id).flatMap(row => row["repo"] === null ? [] : [String(row["repo"])]))].sort();
         if (repos.some(one => !who.repos.includes(one)))
@@ -1928,7 +1754,6 @@ const REOPEN_REFUSED = {
     claimed: "This task is being built right now.", held: "A hold stands: lift it first.", "question-open": "An unanswered question stands: answer or close it first.",
     "incident-open": "An unresolved incident stands: resolve it first.", "bad-state": "This task is not in a state reopen can take.",
 };
-/** The one plan revision waiting on a decision for this task, by its id or as the only one. */
 function waitingRevision(store, task, asked) {
     const ref = store.lookupRef(task);
     const waiting = ref === null ? [] : store.listPlanRevisions(ref.id).filter(one => one.status === "blocked");
@@ -1937,7 +1762,6 @@ function waitingRevision(store, task, asked) {
         throw Error("That plan revision isn't waiting on a decision.");
     return found;
 }
-/** A finding follows its task's family, so every project the family reaches must be in reach (findings.ts, one gate). */
 function familyWithin(store, who, task) {
     if (familyInReach(store, who, task) === null)
         throw Error("This task's work reaches a project outside your access here.");
@@ -2030,7 +1854,6 @@ function parityAction(store, who, operation, input, repo, flow, now, request, ro
                 throw Error("Name schedules from this flow's own list.");
             if (covered.length === 0)
                 throw Error("Choose a schedule to include: this flow's schedules bring in outside content, so none is covered unless you pick it.");
-            // Every project its work files in: the person must reach each, and each is named and checked at the yes.
             const repos = [...new Set([flow.repo, ...workReposOf(flow)])];
             if (repos.some(one => !who.repos.includes(one) || !store.accountCanAccess(who.name, one)))
                 throw Error("This flow files work in a project outside your access here.");
@@ -2076,7 +1899,6 @@ function parityAction(store, who, operation, input, repo, flow, now, request, ro
             const proposal = listProposals(store, repo).find(one => one.id === id);
             if (proposal === undefined)
                 throw Error("That proposal isn't waiting any more.");
-            // A lesson note is accepted in the person's own words (memory-pass.ts): never a model's, so never from a card.
             if (decision === "accept" && lessonNoteOf(store, id) !== null)
                 throw Error("A lesson note is accepted in your own words: write it on the Knowledge page.");
             return { state: { proposal: id }, title: `${decision === "accept" ? "Accept" : "Reject"} a memory proposal`, terms: [proposal.title, ...(proposal.beforeText === null ? [] : [`Was: ${proposal.beforeText}`]), `Becomes: ${proposal.afterText}`, `Why: ${proposal.rationale}`, decision === "accept" ? "Later agent sessions in this project read this." : "Nothing is added to project memory."] };
@@ -2085,12 +1907,9 @@ function parityAction(store, who, operation, input, repo, flow, now, request, ro
             throw Error("Choose an available action.");
     }
 }
-/** Where a yes came from, in the words the other chat approvals' ledger lines use. */
 const approvalRoad = (options) => `via ${options.via}${options.binding === undefined ? "" : ` · chat binding #${options.binding}`}`;
-/** The approvals added last: the console's own write, after the same question every approval asks. */
 function runLateApproval(store, who, payload, byFor, road, now) {
     const req = payload.request, actor = who.name, by = byFor(payload.repo);
-    // Rejecting lowers: it takes a person's yes, not their approving setting.
     if (by.ok === false && payload.operation !== "revision_reject")
         throw Error(by.why);
     if (payload.operation === "task_reopen") {
@@ -2101,7 +1920,6 @@ function runLateApproval(store, who, payload, byFor, road, now) {
     }
     if (payload.operation === "flow_unattended") {
         const ask = payload.state["ask"];
-        // The person's own setting holds in every project this flow's work files in, not only its own.
         for (const repo of payload.state["repos"]) {
             const here = byFor(repo);
             if (here.ok === false)
@@ -2115,7 +1933,6 @@ function runLateApproval(store, who, payload, byFor, road, now) {
         return { ok: true, taskId: null, said: `Runs on its own until ${untilWords(signed.grant.absoluteExpiry)}.`, href: `/flows/${Number(req["flow"])}` };
     }
     const task = String(req["task"]), revision = waitingRevision(store, task, req["revision"]), accept = payload.operation === "revision_accept";
-    // A saved limit can't be read against a change of authority: that one opens in Toolroll.
     if (accept && by.ok && revision.authorityKind === "authority-change" && (!by.limits.fullAccess || by.limits.capMicrousd !== null))
         throw Error("This revision changes what was approved, beyond your chat approval limits. Open it in Toolroll.");
     if (!store.resolvePlanRevision(revision.id, accept ? "applied" : "rejected", actor, now))
@@ -2123,7 +1940,6 @@ function runLateApproval(store, who, payload, byFor, road, now) {
     store.releaseOwnedHold("revision", String(revision.id));
     return { ok: true, taskId: task, said: accept ? "Revision accepted." : "Revision rejected." };
 }
-/** Each runs the write the console's own handler calls, as this person, inside the confirm door's transaction. */
 function runParityAction(store, who, payload, now, root) {
     const req = payload.request, actor = who.name, repo = payload.repo;
     const done = (said, href, taskId = null) => ({ ok: true, taskId, said, ...(href === undefined ? {} : { href }) });
@@ -2134,7 +1950,6 @@ function runParityAction(store, who, payload, now, root) {
             const sent = payload.operation === "finding_resend" ? resendFinding(store, Number(req["finding"]), now)
                 : req["pointer"] !== undefined ? sendReviewFinding(store, task, String(req["pointer"]), actor, now)
                     : req["run"] !== undefined ? sendCheckFinding(store, root ?? "", task, Number(req["run"]), actor, now)
-                        // The lead drafted these words and the person confirmed them: recorded as the lead's, sent by the person.
                         : sendFinding(store, { taskId: task, source: "lead", by: actor, summary: String(req["summary"]), file: typeof req["file"] === "string" ? req["file"] : null, line: typeof req["line"] === "number" ? req["line"] : null }, now);
             if (!sent.ok)
                 throw Error(sent.message);