toolroll 0.9.104 → 0.9.105

package/dist/live.js

@@ -1,18 +1,3 @@
-/**
- * The live window (arc 1): what the running agent is saying, on disk, for
- * the run page to poll — and NOTHING else.
- *
- * This file is display state, not evidence. No artifact row points at it,
- * no digest binds it, and the page that renders it says so: the machine
- * running the agent could alter it. It exists so a person can watch work
- * happen without a terminal, and every byte in it went through the same
- * sanitize discipline as the peek: controls stripped, credential-shaped
- * lines replaced whole, tool activity described in OUR fixed vocabulary —
- * event metadata is never echoed.
- *
- * Fail-soft everywhere: a live view that cannot be written must never
- * break, slow, or reclassify a build.
- */
 import { randomBytes } from "node:crypto";
 import { closeSync, constants, fstatSync, linkSync, lstatSync, mkdirSync, openSync, readSync, readdirSync, renameSync, statSync, unlinkSync, writeSync } from "node:fs";
 import { join } from "node:path";
@@ -23,34 +8,23 @@ import { topLevelEvent } from "./stream-scope.js";
 export const LIVE_LINE_CAP = 2 * 1024;
 export const LIVE_FILE_CAP = 4 * 1024 * 1024;
 export const LIVE_REDACTED_LINE = "[a credential-shaped line was redacted]";
-/** Finalized runs keep their live file this long for the final drain. */
 export const LIVE_RETAIN_MS = 24 * 60 * 60 * 1000;
-/** The bounded sweep: at most this many FINALIZED runs' files survive a pass (a run's records and its subagents' file
- * count as one). */
 export const LIVE_FILE_BOUND = 500;
-/** A run's subagent file (docs/plans/agents-view.md §2.3) is never larger than this; its writer stops there. */
 export const LIVE_SUB_FILE_CAP = 16 * 1024 * 1024;
-/** All finished and orphan live files together stay under this; the oldest runs go first past it. */
 export const LIVE_TOTAL_BYTES = 1024 * 1024 * 1024;
 export function liveDir(root) {
     return join(root, "live");
 }
-/** The exact filename, from the numeric id and nothing else — no user
- * input is ever parsed into this path. Records (`.jsonl`) are what every
- * run writes now; the name is the format. */
 export function liveLogPath(root, runId) {
     return join(liveDir(root), `${Math.trunc(runId)}.jsonl`);
 }
-/** A run's subagents' records (docs/plans/agents-view.md §2.3): the run's file, swept with it. */
 export function liveSubLogPath(root, runId) {
     return join(liveDir(root), `${Math.trunc(runId)}.sub.jsonl`);
 }
-/** The plain-text file runs wrote before the live conversation; read until it ages out. */
 export function legacyLiveLogPath(root, runId) {
     return join(liveDir(root), `${Math.trunc(runId)}.log`);
 }
 export { LIVE_ACTIVITY_KINDS } from "./live-records.js";
-/** The activity line's kinds for known Claude tools (task-activity.ts). */
 const TOOL_KINDS = new Map([
     ["Edit", "edit"],
     ["Write", "edit"],
@@ -67,14 +41,8 @@ const TOOL_KINDS = new Map([
     ["Task", "delegate"],
 ]);
 const toolKind = (name) => TOOL_KINDS.get(typeof name === "string" ? name : "") ?? "tool";
-/**
- * What one stream event says the agent just did, as one fixed kind: the
- * last-activity line's only input. Never text, names or arguments; an
- * event that says nothing (results, deltas, subagent chatter) is null.
- */
 export function liveActivityKind(event) {
     try {
-        // A subagent's events, of every type, are not this run's activity (stream-scope.ts).
         if (!topLevelEvent(event))
             return null;
         const type = String(event["type"] ?? "");
@@ -109,40 +77,26 @@ export function liveActivityKind(event) {
         return null;
     }
 }
-/** Strip ANSI escapes and every control character; tabs become spaces. */
 function stripControls(text) {
     return text
         .replace(/\x1b\[[0-9;?]*[ -\/]*[@-~]/g, "")
         .replace(/\t/g, " ")
         .replace(/[\x00-\x1f\x7f-\x9f]/g, "");
 }
-/** Cut a string to at most `cap` UTF-8 bytes without splitting a character. */
 function capBytes(text, cap) {
     if (Buffer.byteLength(text, "utf8") <= cap)
         return text;
     const bytes = Buffer.from(text, "utf8").subarray(0, cap);
     const decoded = bytes.toString("utf8");
-    // A cut mid-character decodes with a trailing replacement char — drop it.
     return decoded.endsWith("�") ? decoded.slice(0, -1) : decoded;
 }
-/** Bidirectional overrides and isolates (U+202A–U+202E, U+2066–U+2069): they can make shown text read differently from what was written. */
 const BIDI_CONTROLS = /[\u202a-\u202e\u2066-\u2069]/g;
-/** Sanitize one display line: strip controls and bidi overrides, redact whole on any secret hit, cap. */
 export function sanitizeTranscriptLine(line) {
     const stripped = stripControls(line).replace(BIDI_CONTROLS, "");
     if (scanForSecrets(stripped).length > 0)
         return LIVE_REDACTED_LINE;
     return capBytes(stripped, LIVE_LINE_CAP);
 }
-/**
- * Open the run's live file for appending records. The directory is 0700,
- * the file 0600 and CREATED HERE (O_EXCL: a name that already exists —
- * whatever put it there — is refused, not appended to), opened O_NOFOLLOW
- * with the descriptor retained for the run's whole duration. `options` is
- * the run's trusted context: its checkout, and whether its project shows
- * commands (read once, here). Returns null on any failure: no live view is
- * ever worth a build.
- */
 export function openLiveLog(root, runId, options = {}) {
     let fd;
     try {
@@ -153,8 +107,6 @@ export function openLiveLog(root, runId, options = {}) {
         return null;
     }
     const recorderOptions = { base: options.base ?? null, commands: options.commands === true, ...(options.clock === undefined ? {} : { clock: options.clock }) };
-    // The run's subagents go to their own file (live-children.ts), under the same captured answer; this file is unchanged
-    // (the recorder only tells the subagents' side which step it wrote for each delegation).
     const children = createChildRecorder(recorderOptions);
     const recorder = createLiveRecorder({ ...recorderOptions, onStep: children.parentStep });
     const childLog = childLogWriter(root, runId);
@@ -165,7 +117,6 @@ export function openLiveLog(root, runId, options = {}) {
         if (closed || capped)
             return;
         const payload = Buffer.from(`${serializeLiveRecord(record)}\n`, "utf8");
-        // The cap record is RESERVED inside the cap: whatever remains must still fit it.
         const capLine = `${serializeLiveRecord({ k: "cap", at: record.at })}\n`;
         if (written + payload.length + Buffer.byteLength(capLine, "utf8") > LIVE_FILE_CAP) {
             capped = true;
@@ -173,7 +124,6 @@ export function openLiveLog(root, runId, options = {}) {
                 writeSync(fd, capLine);
             }
             catch {
-                // Nothing to do: the file simply ends early.
             }
             return;
         }
@@ -182,12 +132,11 @@ export function openLiveLog(root, runId, options = {}) {
             written += payload.length;
         }
         catch {
-            closed = true; // a broken descriptor never breaks the run
+            closed = true;
             try {
                 closeSync(fd);
             }
             catch {
-                // already gone
             }
         }
     };
@@ -204,7 +153,6 @@ export function openLiveLog(root, runId, options = {}) {
                 }
             }
             catch {
-                // Recording is observational; a malformed event records nothing.
             }
         },
         close() {
@@ -215,29 +163,25 @@ export function openLiveLog(root, runId, options = {}) {
                     append(record);
             }
             catch {
-                // the steps simply stay open in the file
             }
             try {
                 const before = childLog.due() ? children.checkpoint() : null;
                 childLog.append(children.end(), before);
             }
-            catch { /* the subagents' steps stay open in theirs */ }
+            catch { }
             childLog.close();
             closed = true;
             try {
                 closeSync(fd);
             }
             catch {
-                // already gone
             }
         },
     };
 }
 const READ_WINDOW = 64 * 1024;
 const READ_LOOKAHEAD = 2 * 1024;
-/** How far past an over-long line one read looks for its end; past it, the line is skipped up to there. */
 const SKIP_SCAN = 64 * 1024 * 1024;
-/** The live directory itself: a real directory, never a link to one. */
 function liveDirIsReal(root) {
     try {
         const stat = lstatSync(liveDir(root));
@@ -255,22 +199,9 @@ function openForRead(path) {
         return error.code === "ENOENT" ? { missing: true } : { unreadable: true };
     }
 }
-/** The line that stands in for one too long to read, in the file's own format. */
 function cutLine(format) {
     return format === "records" ? `${serializeLiveRecord({ k: "cut", at: "" })}\n` : "[a line was too long to show]\n";
 }
-/**
- * Read the live file from a byte offset, returning only COMPLETE lines
- * (through the last LF in the window). The records file is read when it
- * exists, else the legacy text file. The descriptor is the authority:
- * opened O_NOFOLLOW | O_NONBLOCK inside a real live directory, proved a
- * regular file, measured and read through itself. A file smaller than the
- * offset was replaced — the caller resets, visibly, and `gen` names the file
- * so an offset is never reused against another one. A line longer than the
- * whole window is skipped through its end, so a reader never stalls.
- * `allowTail` (the final drain) returns the unterminated tail after
- * finalization. Legacy text is cleaned again on the way out.
- */
 export function readLiveWindow(root, runId, from, allowTail = false) {
     if (!Number.isSafeInteger(from) || from < 0)
         return { ok: false, reason: "unreadable" };
@@ -291,7 +222,6 @@ export function readLiveWindow(root, runId, from, allowTail = false) {
         const stat = fstatSync(fd, { bigint: true });
         if (!stat.isFile())
             return { ok: false, reason: "unreadable" };
-        // Linux hands a removed file's inode straight to the next one made, so the birth time (ns) tells them apart too.
         const gen = `${format}:${stat.dev}:${stat.ino}:${stat.birthtimeNs}`;
         const size = Number(stat.size);
         if (size < from)
@@ -310,7 +240,6 @@ export function readLiveWindow(root, runId, from, allowTail = false) {
         const eofReached = from + offset >= size;
         const out = (text, next, eof) => ({
             ok: true,
-            // Raw: every reader cleans and redacts through liveWindowLines / liveWindowRecords, carrying the key state.
             text,
             nextOffset: next,
             eof,
@@ -320,7 +249,6 @@ export function readLiveWindow(root, runId, from, allowTail = false) {
         if (lastLf === -1) {
             if (allowTail && eofReached && offset > 0)
                 return out(chunk.toString("utf8"), from + offset, true);
-            // A whole window without an end of line: skip through its end (bounded), never stall on it.
             if (offset === READ_WINDOW + READ_LOOKAHEAD) {
                 const scan = Buffer.alloc(64 * 1024);
                 const limit = Math.min(size, from + SKIP_SCAN);
@@ -334,8 +262,6 @@ export function readLiveWindow(root, runId, from, allowTail = false) {
                         return { ok: true, text: cutLine(format), nextOffset: at + lf + 1, eof: at + lf + 1 >= size, format, gen };
                     at += read;
                 }
-                // No end within reach. A finished run's drain, or a line longer than any read looks, is cut where the
-                // look stopped, so reading always moves on; a live run's line may still be being written, so it waits.
                 if (allowTail || at >= from + SKIP_SCAN)
                     return { ok: true, text: cutLine(format), nextOffset: at, eof: at >= size, format, gen };
                 return { ok: true, text: "", nextOffset: from, eof: false, format, gen };
@@ -354,25 +280,16 @@ export function readLiveWindow(root, runId, from, allowTail = false) {
         closeSync(fd);
     }
 }
-/** A window's complete lines as the plain words the run page and `toolroll peek` show, whatever its format. `commands` is
- * the run's own captured answer (store.ts runLiveCommands), never the file's say. */
 export function liveWindowLines(read, commands, keys = { inKey: false }) {
     if (read.format === "records")
         return projectLiveText(withholdCommands(parseLiveRecords(read.text, keys), commands));
     return cleanLegacy(read.text, keys).split("\n").filter(one => one !== "");
 }
-/** A window as records, whatever its format: an older plain file's lines become the agent's words. Command text and
- * output show only when the run's own captured answer (`commands`) is on. */
 export function liveWindowRecords(read, commands, keys = { inKey: false }) {
     if (read.format === "records")
         return withholdCommands(parseLiveRecords(read.text, keys), commands);
     return cleanLegacy(read.text, keys).split("\n").filter(one => one !== "").map(line => ({ k: "say", at: "", t: [line] }));
 }
-/**
- * Enforce a run's captured "Show commands" answer on read: the file is build-writable, so an `open` record, a command
- * step's text or a step's output may say anything. With the answer off, every `open` reads the base tier, command steps
- * lose their text and steps lose their output. (The older plain-text format predates command detail and is unchanged.)
- */
 export function withholdCommands(records, commands) {
     if (commands)
         return records;
@@ -390,7 +307,6 @@ export function withholdCommands(records, commands) {
         return record;
     });
 }
-/** Legacy text lines, cleaned again on read: the file may have been altered after it was written. */
 function cleanLegacy(text, keys) {
     const lines = text.split("\n");
     const ended = lines.length > 0 && lines[lines.length - 1] === "";
@@ -399,11 +315,6 @@ function cleanLegacy(text, keys) {
     const shown = redactLiveLines(lines, keys);
     return ended ? `${shown.join("\n")}\n` : shown.join("\n");
 }
-/**
- * Enumerate the live directory for the reconcile sweep: names only. Pure listing — the CALLER settles which runs are
- * finalized before it measures anything; this module only refuses to guess. Non-run names are reported with runId
- * null (orphans from nothing this plane wrote; aged on mtime like everything else).
- */
 export function listLiveFiles(root) {
     let names;
     try {
@@ -412,18 +323,13 @@ export function listLiveFiles(root) {
     catch {
         return [];
     }
-    // A sweep's private claim (QUARANTINE_PREFIX) is never listed: it is the sweep's own, and one it couldn't restore
-    // stays for a person to look at rather than be aged out under a name nobody chose.
     return names.filter(name => !name.startsWith(QUARANTINE_PREFIX)).map(name => {
         const match = /^(\d{1,15})\.(jsonl|log|sub\.jsonl)$/.exec(name);
-        // The writer stops at its cap and adds one last record; anything far past it is no file this plane wrote.
         const cap = match === null ? null : (match[2] === "sub.jsonl" ? LIVE_SUB_FILE_CAP : LIVE_FILE_CAP) + 64 * 1024;
         return { runId: match === null ? null : Number(match[1]), fileName: name, cap };
     });
 }
-/** Remove one live file, silently: a sweep never throws over display state. True when it is gone now. */
 export function removeLiveFile(root, fileName, unlink = unlinkSync) {
-    // The name comes from listLiveFiles' own readdir, never from user input.
     if (fileName.includes("/") || fileName.includes("\\") || fileName.includes(".."))
         return false;
     try {
@@ -434,22 +340,7 @@ export function removeLiveFile(root, fileName, unlink = unlinkSync) {
         return error.code === "ENOENT";
     }
 }
-/** The prefix of a sweep's private claim on a file it is about to remove (never a name a writer uses). */
 const QUARANTINE_PREFIX = ".sweep-claim-";
-/**
- * The reconcile sweep (arc 1 §2): ACTIVE runs are exempt ABSOLUTELY — the
- * transport's no-truncation assumption depends on it — and a run's files
- * (its records, its subagents' file, an older text file) go together, as one.
- * A run is settled finished (or absent) BEFORE its files are measured.
- * Finalized runs age from finished_at; orphans (no run row, or a name this
- * plane never writes) age from mtime. Among the finalized-or-orphan: a file
- * far past its own cap goes at once, then the day's retention, then the
- * 500-run bound, then the total byte limit, oldest first, until each limit is
- * really met or nothing eligible is left. Each removal re-proves, under the
- * store's write lock (the one run admission takes), that the run is still
- * not active and the file is the very one measured; otherwise it is kept. A
- * file that can't be removed stays counted and never stops the rest.
- */
 export function sweepLiveLogs(store, root, now, io = {}) {
     const removed = [];
     const settled = (runId) => {
@@ -465,7 +356,6 @@ export function sweepLiveLogs(store, root, now, io = {}) {
     };
     const at = (name) => join(liveDir(root), name);
     const lstat = io.lstat ?? ((path) => lstatSync(path));
-    /** A file as it is now: measured, confirmed gone (ENOENT only), or unknown (any other failure: never taken as gone). */
     const measure = (fileName, runId, path = at(fileName)) => {
         try {
             const stat = lstat(path);
@@ -476,7 +366,6 @@ export function sweepLiveLogs(store, root, now, io = {}) {
         }
     };
     const same = (a, b) => a.dev === b.dev && a.ino === b.ino && a.size === b.size && a.mtimeMs === b.mtimeMs;
-    /** The run is still not active, proved under the store's write lock (the one run admission takes) — and only that. */
     const stillSweepable = (runId) => {
         const check = () => { const state = settled(runId); return state !== "active" && state !== "unknown"; };
         try {
@@ -486,20 +375,13 @@ export function sweepLiveLogs(store, root, now, io = {}) {
             return false;
         }
     };
-    /** Put a claimed file back under its name without overwriting whatever may be there now. */
     const restore = (claim, fileName) => {
         try {
             linkSync(at(claim), at(fileName));
             unlinkSync(at(claim));
         }
-        catch { /* the name is taken: the claim stays, unlisted */ }
+        catch { }
     };
-    /**
-     * Remove one measured file: its run still not active, then the name atomically claimed under a private name in the
-     * live directory, then the claim proved to be the very file measured (dev, inode, size, mtime) and the run still not
-     * active — and only then is the private claim deleted. A mismatch is put back without overwriting anything. The
-     * store's lock covers the run-state checks only; the filesystem work runs outside it.
-     */
     const remove = (file) => {
         if (file.failed === true)
             return false;
@@ -530,22 +412,17 @@ export function sweepLiveLogs(store, root, now, io = {}) {
         restore(claim, file.fileName);
         return done(false);
     };
-    // One group per finished run (keyed by id) or per orphan file, aged from the run's end or the file's mtime.
     const groups = new Map();
-    // Settle every listed run first, then list again and measure: a file a run wrote (or grew) before it finished is
-    // seen at its final size, and one its run created after the first listing is counted with it.
     const states = new Map();
     for (const entry of listLiveFiles(root))
         if (entry.runId !== null && !states.has(entry.runId))
             states.set(entry.runId, settled(entry.runId));
     for (const entry of listLiveFiles(root)) {
-        // A run first seen in this listing waits for the next pass: it was never settled before its files were listed.
         if (entry.runId !== null && !states.has(entry.runId))
             continue;
         const state = entry.runId === null ? null : states.get(entry.runId);
         if (state === "active" || state === "unknown")
-            continue; // live, or unknown this pass: kept, never guessed
-        // Measured only now, after the run is settled finished: its writer is done.
+            continue;
         const file = measure(entry.fileName, entry.runId);
         if (file === "gone" || file === "unknown")
             continue;
@@ -559,17 +436,14 @@ export function sweepLiveLogs(store, root, now, io = {}) {
         group.ageAnchorMs = Math.min(group.ageAnchorMs, anchor);
         groups.set(key, group);
     }
-    /** Remove a group's files; what can't be removed stays in it (and in every count after). True when it's empty. */
     const removeGroup = (group) => {
         group.files = group.files.filter(file => !remove(file));
         return group.files.length === 0;
     };
     const cutoff = now.getTime() - LIVE_RETAIN_MS;
     let kept = [...groups.values()].sort((a, b) => a.ageAnchorMs - b.ageAnchorMs).filter(group => group.ageAnchorMs > cutoff || !removeGroup(group));
-    // Oldest-first beyond the bound, continuing past any that can't go — still never touching an active run.
     let excess = kept.length - LIVE_FILE_BOUND;
     kept = kept.filter(group => excess <= 0 || !removeGroup(group) || (excess -= 1, false));
-    // Then the total, oldest first, counting only what is really still there.
     const bytesOf = (group) => group.files.reduce((sum, file) => sum + file.bytes, 0);
     let total = kept.reduce((sum, group) => sum + bytesOf(group), 0);
     for (const group of kept) {

package/dist/local-owner-acts.js

@@ -3,29 +3,12 @@ import { LOCAL_OWNER_LAPSED, localActNow } from "./local-owner.js";
 import { approverStanding, localWorkEligible, personApprovalOf } from "./scope.js";
 import { plannerContractOf, plannerSourceDigest } from "./planner-source.js";
 import { scopeApprovedForDispatch } from "./dispatch.js";
-/** The ledger act a local owner's plan request is kept under: the planning source it was bound to, and its transport. */
 export const LOCAL_PLAN_ACTION = "task plan (local owner)";
-/** What a stale screen hears: the task is not what it read. */
 export const LOCAL_TASK_CHANGED = "This task changed. Look at it again.";
-/**
- * The planning source a screen binds a plan request to (planner-source.ts): the digest over everything the planner
- * would be given, the filed scope when there is one and the title alone when there is none. Null when it can't be read.
- */
 export function planSourceOf(store, taskId) {
     const contract = plannerContractOf(store, taskId);
     return contract.ok ? plannerSourceDigest(contract.contract) : null;
 }
-/**
- * Ask for a plan, as the laptop's local owner, with no password (local-owner slice 2). In one transaction: the owner
- * acting now as exactly `request-plan`; its current reach into the task's project; the task not put away; the one work
- * rule for planning (no release, protected, two-person, escalated, coordinator, imported or unsandboxed work); no plan
- * pins saved on the task (a local request never plans with an agent someone chose; it refuses rather than ignoring or
- * clearing them, so what plans is exactly what the screen's terms say); and the planning source still the one the
- * screen read (`source`). A request already made, with that source unchanged, answers "already" and writes nothing.
- * Otherwise any unchanged-plan pre-authorization saved on the task is withdrawn (with its audit row), so the plan this
- * asks for can only be approved by a person's own yes; then requestPlan's own guards (queued, not planned, not
- * approved, no live claim); then the request's ledger row. It approves nothing, pins nothing and pre-authorizes nothing.
- */
 export function requestPlanAsLocalOwner(store, taskId, source, now) {
     try {
         return store.transact(() => {
@@ -47,9 +30,6 @@ export function requestPlanAsLocalOwner(store, taskId, source, now) {
             }
             if (planSourceOf(store, taskId) !== source)
                 return { ok: false, reason: "stale", message: LOCAL_TASK_CHANGED };
-            // An unchanged-plan pre-authorization on the task (a mode or a flow's grant armed it on this or an earlier request)
-            // never stands behind the local owner's "you'll approve it before anything is built": withdrawn here, in the same
-            // transaction and before the "already asked" answer below, and said in the ledger.
             const armed = store.handle.prepare("SELECT signed_by, basis FROM plan_authorization WHERE task_id = ?").get(taskId);
             if (armed !== undefined) {
                 store.handle.prepare("DELETE FROM plan_authorization WHERE task_id = ?").run(taskId);
@@ -57,7 +37,6 @@ export function requestPlanAsLocalOwner(store, taskId, source, now) {
                     action: "unchanged plan pre-authorization withdrawn", outcome: "withdrawn",
                     detail: JSON.stringify({ v: 1, signedBy: String(armed["signed_by"]), basis: String(armed["basis"]), why: "the local owner asked for the plan" }) });
             }
-            // Asked already (by anyone), with nothing about the task changed: the same answer, and nothing else written.
             if (ref.plan === "requested" || ref.plan === "drafted")
                 return { ok: true, replayed: true };
             const asked = store.requestPlan(ref.id, now);
@@ -71,29 +50,19 @@ export function requestPlanAsLocalOwner(store, taskId, source, now) {
     catch (error) {
         if (error instanceof Undone)
             return error.result;
-        // Store.transact's own re-check found the bound owner no longer standing: the same refusal, said, never a crash.
         if (error instanceof Error && error.message === LOCAL_OWNER_LAPSED)
             return { ok: false, reason: "local-owner", message: LOCAL_OWNER_LAPSED };
         throw error;
     }
 }
-// ---- Retry the owner's own approved build (slice 3) ---------------------------------------------------------------------
-/** The ledger act a local owner's retry is kept under: the build it retried, the exact seal it spent, and its transport. */
 export const LOCAL_RETRY_ACTION = "task requeue (local owner)";
-/** Local retries per task and exact seal: then a note (Send back) or a password. */
 export const LOCAL_RETRY_LIMIT = 3;
-/** The fourth local retry of one approval. */
 export const LOCAL_RETRY_SPENT = `You've retried this ${LOCAL_RETRY_LIMIT} times. Send it back with a note, or sign in with your password to retry again.`;
-/** What a retry hears while Toolroll can't yet prove the last build stopped. */
 export const LOCAL_RETRY_STOPPING = "The last build is still stopping. Try again in a moment.";
 const sameSeal = (a, b) => {
     const one = a;
     return one !== null && typeof one === "object" && one.by === b.by && one.at === b.at && one.digest === b.digest;
 };
-/**
- * What a Retry binds to (local-owner slice 3): the task's latest finished build and its approved scope digest, when the
- * task failed or finished and its scope is approved as it stands. What a screen offers only; the writer decides.
- */
 export function retryPinsOf(store, taskId) {
     const ref = store.lookupRef(taskId);
     const scope = store.getScope(taskId);
@@ -103,7 +72,6 @@ export function retryPinsOf(store, taskId) {
     const last = store.lastBuilderRun(ref.id);
     return last === null ? null : { run: last.id, digest: scope.digest };
 }
-/** This owner's earlier retries of this task under exactly this seal: the builds they retried. */
 function localRetriesOf(store, taskId, account, seal) {
     const rows = store.handle.prepare("SELECT run_id, detail FROM action_ledger WHERE action = ? AND task_id = ? AND actor = ? ORDER BY id")
         .all(LOCAL_RETRY_ACTION, taskId, `operator:${account}`);
@@ -122,24 +90,6 @@ function localRetriesOf(store, taskId, account, seal) {
     }
     return runs;
 }
-/**
- * Retry the local owner's own approved build after it stopped (a console restart, a model error), with no password
- * (local-owner slice 3). One transaction, in this order:
- * - the owner acting now as exactly `retry-build`, and its current reach into the task's project;
- * - the task's current approval is this owner's own person yes on the exact seal (personApprovalOf: the ceremony or a
- *   chat tap, a person's proof for those bytes — never a mode, grant, schedule, automatic or carried seal, the lead, or
- *   another person), still standing for dispatch, and on work the owner could approve again now (localWorkEligible);
- * - bound to what the screen read: `digest` is the approved scope digest, and `run` the latest finished build;
- * - the same request again (this owner's retry of `run` under this seal) answers "already" and writes nothing while
- *   that build is still the latest one;
- * - its own stop proof: no unfinished run of the task, no run after `run`, Toolroll's durable stop facts settled for
- *   every run (an expired claim alone proves nothing), no final result (accepted or published) in any task state, and a
- *   failed task or a finished one whose result wasn't accepted (requeueEligibility re-reads the claim and archive);
- * - at most three local retries of this task under this exact seal (a fresh approval, even of the same bytes, is a new
- *   seal), then the words that lead to a note or a password;
- * - then the requeue (incidents resolved, strikes cleared, as the console's Retry) and its ledger row.
- * Nothing about the scope, route, model, chain, budget or permissions is written.
- */
 export function retryAsLocalOwner(store, taskId, pins, now) {
     try {
         return store.transact(() => {
@@ -166,8 +116,6 @@ export function retryAsLocalOwner(store, taskId, pins, now) {
                 return { ok: false, reason: "refused", message: eligible.message };
             const latest = store.lastBuilderRun(ref.id);
             const retried = localRetriesOf(store, taskId, local.account, seal);
-            // The same request again: recognised from its own ledger row while that retry is still waiting or building, with
-            // the owner and approval proved above.
             const state = store.getTask(taskId).state;
             if (retried.includes(pins.run) && latest?.id === pins.run && (state === "queued" || state === "running"))
                 return { ok: true, replayed: true, retries: retried.length };
@@ -211,7 +159,6 @@ export function retryAsLocalOwner(store, taskId, pins, now) {
         throw error;
     }
 }
-/** A refusal found after a write began: thrown so the transaction rolls back, then answered. */
 class Undone extends Error {
     result;
     constructor(result) {