toolroll 0.9.41 → 0.9.43

package/dist/serve.js

@@ -56,6 +56,7 @@ import { addCardToFlow, advanceFlows, cancelFlowCard, crossProjectProblem, decid
 import { chooseFlowCard } from "./flow-send.js";
 import { FlowContractError, FLOW_TEMPLATES, validateFlowDefinition, withZoneNames } from "./flows.js";
 import { stageReferenceProblems } from "./contracts/stage-output.js";
+import { CONSOLE_FORMS, checkResponse, readForm } from "./contracts/console-api.js";
 import { TOOL_CATALOG, addToolTo, catalogTool, discoverTools, localAppOf, projectToolsOf, removeToolFrom, secretsSetFor, setToolSecret, splitCommandLine, testToolOf } from "./project-tools.js";
 import { changeLearning, learningView } from "./project-learning.js";
 import { applySavedKnowledge, changeKnowledge, knowledgeView, knowledgeVersion, readKnowledgeSnapshot } from "./project-knowledge.js";
@@ -153,6 +154,7 @@ import { MODELS_CSS, modelsHtml, modelsScript } from "./models-ui.js";
 import { ASSISTANTS, modelChoices, detectPreparation, previewProjectInstructions, addProjectInstructions } from "./setup-guide.js";
 import { previewSetup, approveSetup } from "./control-setup.js";
 import { controlSetupHtml, setupPreviewHtml, connectionHtml, connectionWords, hiddenFields } from "./control-ui.js";
+import { ALL_PROJECTS as CHAT_APPROVAL_ALL, chatApprovalWords, setChatApproval } from "./chat-approval.js";
 import { composerSchedule, scheduleEditorHtml, scheduleEditorScript } from "./task-composer.js";
 import { listCoordinators } from "./coordinator.js";
 import { diagnoseTaskDispatch, withDispatchDiagnoses } from "./dispatch.js";
@@ -1412,7 +1414,7 @@ export function createDecisionServer(options) {
             if (setupAttemptsLeft <= 0) {
                 return page(response, 403, signupPage("too many wrong codes — restart the server to get a fresh code", 0));
             }
-            const body = await form(request);
+            const body = readForm(await form(request), CONSOLE_FORMS.signup);
             const code = (body.get("code") ?? "").trim();
             const name = (body.get("name") ?? "").trim();
             const password = body.get("password") ?? "";
@@ -1451,7 +1453,7 @@ export function createDecisionServer(options) {
             return redirect(response, "/");
         }
         if (url.pathname === "/login" && method === "POST") {
-            const body = await form(request);
+            const body = readForm(await form(request), CONSOLE_FORMS.login);
             const name = body.get("name");
             const token = body.get("token");
             // The destination a deep link asked for rides the form as a same-site
@@ -1528,7 +1530,7 @@ export function createDecisionServer(options) {
             }
             let body;
             try {
-                body = await form(request);
+                body = readForm(await form(request), CONSOLE_FORMS.join);
             }
             catch {
                 return respond(response, 413, "text/plain; charset=utf-8", "body too large");
@@ -1607,7 +1609,7 @@ export function createDecisionServer(options) {
             return freshIdentitySignIn.run({ actor: requestFacts.sso?.fresh === true ? who.name : null }, () => requestContext.run(requestFacts, async () => {
                 const taskTextForm = url.pathname === "/tasks/add" || /^\/t\/[^/]+\/scope$/.test(url.pathname);
                 const body = method === "POST" ? await form(request, url.pathname === "/settings/skills/import" ? 2 * 1024 * 1024 : url.pathname === "/flows/import" ? 1024 * 1024 : taskTextForm ? TASK_FORM_BODY_CAP : BODY_CAP) : null;
-                const target = actionTarget(url, who, request, body);
+                const target = actionTarget(url, who, request, body === null ? null : readForm(body, CONSOLE_FORMS.ledgerTarget));
                 const execute = async () => {
                     if (!projectRequestAllowed(url, who, request, response))
                         return;
@@ -1720,7 +1722,7 @@ export function createDecisionServer(options) {
             const ref = run === null ? null : store.refForId(run.taskRef);
             return { repo: ref?.repo ?? null, taskId: ref?.externalId ?? null, runId, action: `${resource[1] === "d" ? "decision" : resource[1] === "i" ? "incident" : "run"} ${resource[3] ?? "view"}` };
         }
-        const known = new Set(["/recipes/prepare", "/recipes/preview", "/recipes/import", "/recipes/save", "/recipes/launch", "/tasks/add", "/queue/move", "/queue/note", "/routines/add", "/people/invite", "/people/invite-revoke", "/people/revoke", "/people/projects", "/projects/select", "/projects/open", "/mode/confirm", "/mode/sign", "/mode/revoke"]);
+        const known = new Set(["/recipes/prepare", "/recipes/preview", "/recipes/import", "/recipes/save", "/recipes/launch", "/tasks/add", "/queue/move", "/queue/note", "/routines/add", "/people/invite", "/people/invite-revoke", "/people/revoke", "/people/projects", "/projects/select", "/projects/open", "/mode/confirm", "/mode/sign", "/mode/revoke", "/settings/chat-approval/save", "/settings/chat-approval/off"]);
         const placed = ["/tasks/add", "/routines/add"].includes(url.pathname) ? body?.get("repo")?.trim() : null;
         return { repo: url.pathname.startsWith("/people/") ? null : placed ? canonicalProject(placed) ?? placed : projectOf(who, request) ?? null, taskId: null, runId: null,
             action: known.has(url.pathname) ? url.pathname.slice(1).replaceAll("/", " ") : "console request" };
@@ -1748,6 +1750,9 @@ export function createDecisionServer(options) {
         if ((request.method === "GET" && path === "/settings/telegram") ||
             (request.method === "POST" && ["/settings/telegram/pair", "/settings/telegram/unpair", "/settings/telegram/retry"].includes(path)))
             return true;
+        // A person's own chat-approval setting; the route proves each project it names.
+        if (request.method === "POST" && ["/settings/chat-approval/confirm", "/settings/chat-approval/save", "/settings/chat-approval/off"].includes(path))
+            return true;
         // Coding routes require an instance operator, then prove saved ownership and project access.
         if (path === "/code" || path.startsWith("/code/"))
             return true;
@@ -2633,7 +2638,7 @@ export function createDecisionServer(options) {
                 latest: operator && latest !== null ? latest : null, csrf: operator ? who.session.csrf : null, today: now.toISOString().slice(0, 10) };
             const rows = store.actionLedger({ ...query, ...(before === null ? {} : { before: Number(before) }), limit: 51 });
             if (url.searchParams.get("format") === "json")
-                return respond(response, 200, "application/json; charset=utf-8", JSON.stringify({ chain: { ok: report.ok, entries: report.entries, through: report.through, head: report.head, problem: report.problem }, entries: rows.slice(0, 50), nextBefore: rows.length > 50 ? rows[49].id : null }));
+                return respond(response, 200, "application/json; charset=utf-8", JSON.stringify(checkResponse("ledgerPage", { chain: { ok: report.ok, entries: report.entries, through: report.through, head: report.head, problem: report.problem }, entries: rows.slice(0, 50), nextBefore: rows.length > 50 ? rows[49].id : null })));
             return sendScreen(response, 200, screen("Action ledger", ledgerBody(rows, projects, url.searchParams, chainView), { chrome: chromeFor(chosen === "" ? null : chosen, "ledger", undefined, chosen === "" ? "all" : "project") }));
         }
         if (url.pathname === "/activity") {
@@ -3010,7 +3015,7 @@ export function createDecisionServer(options) {
             if (url.searchParams.get("format") === "json") {
                 response.writeHead(200, { "content-type": "application/json; charset=utf-8", "content-disposition": `attachment; filename="evidence-${family.root.id.replace(/[^A-Za-z0-9._-]/g, "_")}.json"`,
                     "cache-control": "no-store", "x-content-type-options": "nosniff" });
-                return void response.end(JSON.stringify(pack, null, 2));
+                return void response.end(JSON.stringify(checkResponse("evidencePack", pack), null, 2));
             }
             return sendScreen(response, 200, screen(`Evidence pack · ${family.root.id}`, evidencePackHtml(pack), { chrome: chromeFor(family.root.repo, "tasks") }));
         }
@@ -3358,7 +3363,7 @@ export function createDecisionServer(options) {
             const view = flowView(store, flow, { name: who.name, approver: who.via === "cookie" && who.role === "approver" }, Number.isSafeInteger(selected) && selected > 0 ? selected : null, { dir: options.configDir ?? null, repos: consoleProjects(), startTrigger: Number.isSafeInteger(start) && start > 0 ? start : null,
                 sortReady: keyStatus("openrouter", providerHome).set, toolHome });
             if (url.searchParams.get("format") === "json")
-                return respond(response, 200, "application/json; charset=utf-8", JSON.stringify(view));
+                return respond(response, 200, "application/json; charset=utf-8", JSON.stringify(checkResponse("flowView", view)));
             return sendScreen(response, 200, screen(flow.name, `<p><a href="/flows">Flows</a></p><h1>${escape(flow.name)}</h1>${flowFallbackHtml(view)}`, { chrome: chromeFor(flow.repo, "flows"), workspace: { view } }));
         }
         if (url.pathname === "/recipes" || url.pathname.startsWith("/recipes/")) {
@@ -6611,7 +6616,7 @@ export function createDecisionServer(options) {
         }
         return respond(response, 200, "application/json; charset=utf-8", JSON.stringify({ ok: true, beaten }));
     }
-    async function handlePost(url, who, request, response, body) {
+    async function handlePost(url, who, request, response, posted) {
         // The attended beat answers BEFORE the shared mutation guard (v28): it
         // carries no parameters, so there is no csrf token to check — its OWN
         // guard is complete and STRICTER for the browsers this console
@@ -6623,12 +6628,13 @@ export function createDecisionServer(options) {
         if (url.pathname === "/session/attended-beats") {
             return attendedBeats(who, request, response, clock());
         }
-        const denied = authorizeMutation(request, who, body);
+        const denied = authorizeMutation(request, who, readForm(posted, CONSOLE_FORMS.mutationGuard));
         if (denied !== null)
             return refuse(response, who, denied.status, denied.message);
         // The scripted demo lead's acts: ask, approve, change a plan, complete or send back a result.
         const demoAct = /^\/chat\/demo\/(?:ask|([0-9]{1,9})\/(approve|change|revise|complete))$/.exec(url.pathname);
         if (demoAct !== null) {
+            const body = readForm(posted, CONSOLE_FORMS.demo);
             const lead = demoLeadHere();
             if (lead === null || who.via !== "cookie")
                 return refuse(response, who, 404, "There's no page at this address.", "/chat");
@@ -6677,6 +6683,7 @@ export function createDecisionServer(options) {
         }
         // The update notice is dismissed per browser and per version: a newer release shows it again.
         if (url.pathname === "/settings/updates/dismiss") {
+            const body = readForm(posted, CONSOLE_FORMS.updatesDismiss);
             const version = body.get("version") ?? "";
             if (!/^[0-9A-Za-z.-]{1,60}$/.test(version))
                 return refuse(response, who, 400, "Choose a version to dismiss.", "/settings#updates");
@@ -6690,6 +6697,7 @@ export function createDecisionServer(options) {
         }
         // The daily check's switch: an installation setting, so an operator's. (Its own address: POST /settings/updates starts an update.)
         if (url.pathname === "/settings/updates/checks") {
+            const body = readForm(posted, CONSOLE_FORMS.updatesChecks);
             if (options.configDir === undefined)
                 return refuse(response, who, 404, "Updates are not set up on this console.", "/settings");
             if (!store.isInstanceOperator(who.name))
@@ -6699,6 +6707,7 @@ export function createDecisionServer(options) {
             return redirect(response, `/settings?said=${encodeURIComponent(on ? "Toolroll looks for a newer version once a day." : "Update checks are off.")}#updates`);
         }
         if (url.pathname === '/code' || url.pathname.startsWith('/code/')) {
+            const body = readForm(posted, CONSOLE_FORMS.code);
             const wantsJson = request.headers.accept?.includes('application/json') === true;
             const fail = (status, message, delivery = 'rejected', sessionId) => wantsJson
                 ? respond(response, status, 'application/json', JSON.stringify({ ok: false, error: message, delivery, ...(sessionId ? { sessionId } : {}) }))
@@ -6707,7 +6716,7 @@ export function createDecisionServer(options) {
                 return fail(403, 'Coding sessions require installation-wide operator access. You can manage project tasks in Work.');
             if (!coding)
                 return fail(409, codingProblem || 'Open Toolroll on the machine with your installed coding agent.');
-            if ([...new Set(body.keys())].some(key => body.getAll(key).length !== 1))
+            if ([...new Set(body.keys())].some(key => body.sent.getAll(key).length !== 1))
                 return fail(400, 'Submit one value for each field.');
             const actor = { name: who.name, generation: who.session.generation };
             const permitted = (repo) => visible(repo) && codingProjectAllowed(repo);
@@ -6779,7 +6788,7 @@ export function createDecisionServer(options) {
                 if (ship && !wantsJson) {
                     try {
                         const preview = codingHandoffPreview(store, { sessionId: ship[1], actor: who.name });
-                        return sendScreen(response, 409, screen('Review for shipping', codingShippingHtml(preview, who.session.csrf, body, message), { chrome: chromeFor(preview.repo, 'code') }));
+                        return sendScreen(response, 409, screen('Review for shipping', codingShippingHtml(preview, who.session.csrf, body.sent, message), { chrome: chromeFor(preview.repo, 'code') }));
                     }
                     catch { }
                 }
@@ -6789,7 +6798,7 @@ export function createDecisionServer(options) {
         if (!projectRequestAllowed(url, who, request, response))
             return;
         if (restricted()) {
-            const repos = body.getAll("repo");
+            const repos = readForm(posted, CONSOLE_FORMS.projectCeiling).getAll("repo");
             if (repos.length > 1 || repos.some(repo => repo.trim() !== "" && !visible(repo.trim())))
                 return refuse(response, who, 403, "That project is outside your access.", "/projects");
         }
@@ -6809,6 +6818,7 @@ export function createDecisionServer(options) {
         // re-counts within five seconds either way, this just makes it exact.
         bustBadge();
         if (url.pathname === "/settings/skills/revise") {
+            const body = readForm(posted, CONSOLE_FORMS.skillsRevise);
             if (who.via !== 'cookie' || who.role !== 'approver')
                 return refuse(response, who, 403, 'Sign in to revise a test.', '/settings/skills');
             try {
@@ -6828,12 +6838,13 @@ export function createDecisionServer(options) {
             }
         }
         if (url.pathname === "/settings/skills/import" || url.pathname === "/settings/skills/change") {
+            const body = readForm(posted, CONSOLE_FORMS.skillsChange);
             if (who.via !== 'cookie' || who.role !== 'approver')
                 return refuse(response, who, 403, 'Sign in as an approver to manage skills.', '/settings/skills');
             const repo = body.get('repo') ?? '', back = `/settings/skills?repo=${encodeURIComponent(repo)}`;
             if (!visible(repo) || !consoleProjects().includes(repo))
                 return refuse(response, who, 403, 'That project is outside your access.', '/projects');
-            if ([...new Set(body.keys())].some(k => body.getAll(k).length !== 1))
+            if ([...new Set(body.keys())].some(k => body.sent.getAll(k).length !== 1))
                 return refuse(response, who, 400, 'Invalid skills form.', back);
             try {
                 const view = skillsView(store, repo, who.name);
@@ -6883,6 +6894,7 @@ export function createDecisionServer(options) {
         // setting a starter kit up, trying its sample card, and bringing GitHub issues in.
         const kitPost = /^\/kits\/([a-z-]{1,40})\/(setup|sample|github)$/.exec(url.pathname);
         if (kitPost !== null) {
+            const body = readForm(posted, CONSOLE_FORMS.kit);
             const now = clock();
             if (who.via !== "cookie" || who.role !== "approver")
                 return refuse(response, who, 403, "Sign in as an approver to set kits up.", "/kits");
@@ -6914,6 +6926,7 @@ export function createDecisionServer(options) {
         const teammatePost = url.pathname === "/teammates/new" ? ["", "0", "new"] : /^\/teammates\/([1-9][0-9]{0,9})\/(soul|state|note|settings|summary|tools|memory|routines|week)$/.exec(url.pathname);
         const questionPost = /^\/teammates\/questions\/([1-9][0-9]{0,9})\/answer$/.exec(url.pathname);
         if (teammatePost !== null || questionPost !== null) {
+            const body = readForm(posted, CONSOLE_FORMS.teammates);
             const now = clock();
             const wantsJson = (request.headers.accept ?? "").includes("application/json");
             if (who.via !== "cookie")
@@ -6989,7 +7002,7 @@ export function createDecisionServer(options) {
                 const grant = store.teammateGrant(mate.id, tool);
                 const changed = op === "grant" ? await grantTool(store, mate, tool, who.name, now, { toolHome })
                     : op === "revoke" ? revokeTool(store, mate, tool, who.name, now)
-                        : grant === null ? { ok: false, said: `${nameOf(mate)} doesn't use ${tool}.` } : setToolRules(store, mate, tool, rulesFromForm(grant, key => body.get(key)), who.name, now);
+                        : grant === null ? { ok: false, said: `${nameOf(mate)} doesn't use ${tool}.` } : setToolRules(store, mate, tool, rulesFromForm(grant, key => body.sent.get(key)), who.name, now);
                 return redirect(response, `${back}?${changed.ok ? "said" : "problem"}=${encodeURIComponent(changed.said)}#tools`);
             }
             const done = action === "state" ? setTeammateState(store, mate, body.get("state") === "removed" ? "removed" : body.get("state") === "paused" ? "paused" : "active", who.name, now)
@@ -7003,6 +7016,7 @@ export function createDecisionServer(options) {
         // Flows → New → a template: preview these answers, or create exactly what was previewed.
         const galleryPost = /^\/flows\/new\/([a-z-]{1,40})$/.exec(url.pathname);
         if (galleryPost !== null) {
+            const body = readForm(posted, CONSOLE_FORMS.galleryUse);
             const template = galleryTemplateOf(galleryPost[1]);
             const projects = consoleProjects();
             if (template === null)
@@ -7034,6 +7048,7 @@ export function createDecisionServer(options) {
         const flowPost = /^\/flows\/([1-9][0-9]{0,9})\/(save|cards|archive|triggers|linear-key|hooks-address|scripts|secrets)$/.exec(url.pathname) ?? /^\/flows\/([1-9][0-9]{0,9})\/cards\/([1-9][0-9]{0,9})\/(move|decide|choose|cancel|comment|assign|watch)$/.exec(url.pathname);
         const triggerPost = /^\/flows\/([1-9][0-9]{0,9})\/triggers\/([1-9][0-9]{0,9})\/(pause|resume|remove|check|press|renew|secret|share|unshare)$/.exec(url.pathname);
         if (url.pathname === "/flows/new" || url.pathname === "/flows/example" || url.pathname === "/flows/import" || flowPost !== null || triggerPost !== null) {
+            const body = readForm(posted, CONSOLE_FORMS.flows);
             const now = clock();
             const answer = (status, payload) => respond(response, status, "application/json; charset=utf-8", JSON.stringify(payload));
             const projects = consoleProjects();
@@ -7276,7 +7291,7 @@ export function createDecisionServer(options) {
                 const note = (body.get("note") ?? "").trim() || null;
                 if (note !== null && note.length > LIMITS.note)
                     return answer(400, { ok: false, said: `Keep the note to ${LIMITS.note.toLocaleString("en-US")} characters; this is ${note.length.toLocaleString("en-US")}.` });
-                const decided = decideFlowCard(store, { card: target.id, decision, note, actor: who.name, repos: projects, evidenceRoot, draft: body.get("draft") }, now);
+                const decided = decideFlowCard(store, { card: target.id, decision, note, actor: who.name, repos: projects, evidenceRoot, draft: body.get("draft"), where: "the console" }, now);
                 return decided.ok ? settle(decided.said) : answer(409, { ok: false, said: decided.message });
             }
             if (verb === "choose") {
@@ -7305,6 +7320,7 @@ export function createDecisionServer(options) {
         // v103: an instance operator records a checkpoint of the ledger chain (its head, to copy off the machine).
         // v105: set or remove a monthly budget. An instance operator, with a step-up; the ledger keeps before → after.
         if (url.pathname === "/spend/budget") {
+            const body = readForm(posted, CONSOLE_FORMS.spendBudget);
             if (who.via !== "cookie" || !store.isInstanceOperator(who.name))
                 return refuse(response, who, 403, "An instance operator sets budgets.", "/spend");
             const back = (key, words) => redirect(response, `/spend?${key}=${encodeURIComponent(words)}`);
@@ -7336,6 +7352,7 @@ export function createDecisionServer(options) {
         // Delete a project, in two steps: its name, then what goes and the password. An instance operator; the ledger keeps who and what.
         // Settings → Project → Builds at once: an approver for the project sets it; the ledger keeps before → after.
         if (url.pathname === "/settings/project/concurrency") {
+            const body = readForm(posted, CONSOLE_FORMS.projectConcurrency);
             const repo = body.get("repo") ?? "";
             const known = consoleProjects();
             if (!known.includes(repo))
@@ -7355,6 +7372,7 @@ export function createDecisionServer(options) {
             return back("said", changed.before === changed.after ? "Nothing changed." : `Saved. Up to ${n} at once.`);
         }
         if (url.pathname === "/settings/project/delete") {
+            const body = readForm(posted, CONSOLE_FORMS.projectDelete);
             if (who.via !== "cookie" || !store.isInstanceOperator(who.name))
                 return refuse(response, who, 403, "An instance operator deletes projects.", "/settings/project");
             const repo = body.get("repo") ?? "";
@@ -7395,6 +7413,7 @@ export function createDecisionServer(options) {
         }
         // Sprint 8: an instance operator saves the organisation policy, with a step-up; the ledger keeps each rule's before → after.
         if (url.pathname === "/settings/policy") {
+            const body = readForm(posted, CONSOLE_FORMS.policy);
             if (who.via !== "cookie" || !store.isInstanceOperator(who.name))
                 return refuse(response, who, 403, "An instance operator sets the policy.", "/settings/policy");
             const back = (key, words) => redirect(response, `/settings/policy?${key}=${encodeURIComponent(words)}`);
@@ -7411,6 +7430,7 @@ export function createDecisionServer(options) {
         }
         // v102: an instance operator changes a project's approval rules, with a step-up; the ledger keeps before → after.
         if (url.pathname === "/settings/approval") {
+            const body = readForm(posted, CONSOLE_FORMS.approval);
             if (who.via !== "cookie" || !store.isInstanceOperator(who.name))
                 return refuse(response, who, 403, "An instance operator sets approval rules.", "/settings/approval");
             const repo = body.get("repo") ?? "";
@@ -7431,6 +7451,7 @@ export function createDecisionServer(options) {
             return back("said", `Saved. ${rulesSummary(next)}`);
         }
         if (url.pathname === "/settings/sessions") {
+            const body = readForm(posted, CONSOLE_FORMS.sessions);
             if (who.via !== "cookie")
                 return refuse(response, who, 403, "Sign in in a browser to manage sessions and tokens.", "/settings");
             const operator = store.isInstanceOperator(who.name);
@@ -7489,6 +7510,7 @@ export function createDecisionServer(options) {
             return back("problem", "Choose an action.");
         }
         if (url.pathname === "/settings/sign-in") {
+            const body = readForm(posted, CONSOLE_FORMS.signIn);
             if (who.via !== "cookie" || !store.isInstanceOperator(who.name) || !options.configDir)
                 return refuse(response, who, 403, "An instance operator sets up sign-in.", "/settings");
             const back = (key, words) => redirect(response, `/settings/sign-in?${key}=${encodeURIComponent(words)}`);
@@ -7526,6 +7548,7 @@ export function createDecisionServer(options) {
         }
         // Settings → Updates: start the `toolroll update` job. A step-up; the job writes the ledger entries.
         if (url.pathname === "/settings/updates" || url.pathname === "/settings/updates/seen" || url.pathname === "/settings/updates/cancel") {
+            const body = readForm(posted, CONSOLE_FORMS.updates);
             const databaseFile = store.databaseFile();
             if (who.via !== "cookie" || !store.isInstanceOperator(who.name) || databaseFile === null)
                 return refuse(response, who, 403, "An instance operator updates Toolroll.", "/settings");
@@ -7572,6 +7595,7 @@ export function createDecisionServer(options) {
         }
         // v105: change how long each kind of data is kept. A step-up; the ledger keeps before → after for each kind.
         if (url.pathname === "/settings/retention") {
+            const body = readForm(posted, CONSOLE_FORMS.retention);
             if (who.via !== "cookie" || !store.isInstanceOperator(who.name))
                 return refuse(response, who, 403, "An instance operator sets retention.", "/settings");
             const back = (key, words) => redirect(response, `/settings/retention?${key}=${encodeURIComponent(words)}`);
@@ -7591,6 +7615,7 @@ export function createDecisionServer(options) {
         // Settings → Storage: when a finished task's clean checkout goes, cleaning up what the preview showed, and throwing
         // away a checkout kept for its changes. Each takes the password; the ledger keeps every change and removal.
         if (url.pathname === "/settings/storage" || url.pathname === "/settings/storage/clean" || url.pathname === "/settings/storage/discard") {
+            const body = readForm(posted, CONSOLE_FORMS.storage);
             const databaseFile = store.databaseFile();
             if (who.via !== "cookie" || !store.isInstanceOperator(who.name) || databaseFile === null)
                 return refuse(response, who, 403, "An instance operator looks after storage.", "/settings");
@@ -7624,6 +7649,7 @@ export function createDecisionServer(options) {
         // Pull requests for one project: turn on (the checks run again and must match what the page showed), merge
         // settings, or turn off. Each takes the password and lands in the ledger.
         if (url.pathname === "/settings/pull-requests") {
+            const body = readForm(posted, CONSOLE_FORMS.pullRequests);
             const repo = body.get("repo") ?? "";
             const known = [...new Set([...managedRepos(), ...store.knownRepos(), ...store.listProjects().map(one => one.path)])];
             if (who.via !== "cookie" || !known.includes(repo) || !visible(repo))
@@ -7661,6 +7687,7 @@ export function createDecisionServer(options) {
         // Checks for one project: the level, or the quick command (approved like `verify set --quick`). Each takes
         // the password and lands in the ledger.
         if (url.pathname === "/settings/checks") {
+            const body = readForm(posted, CONSOLE_FORMS.checks);
             const repo = body.get("repo") ?? "";
             const known = [...new Set([...managedRepos(), ...store.knownRepos(), ...store.listProjects().map(one => one.path)])];
             if (who.via !== "cookie" || !known.includes(repo) || !visible(repo))
@@ -7722,6 +7749,7 @@ export function createDecisionServer(options) {
         }
         // Sprint 8: change the backup schedule. A step-up; the ledger keeps before → after.
         if (url.pathname === "/settings/backups") {
+            const body = readForm(posted, CONSOLE_FORMS.backups);
             const databaseFile = store.databaseFile();
             if (who.via !== "cookie" || !store.isInstanceOperator(who.name) || databaseFile === null)
                 return refuse(response, who, 403, "An instance operator looks after backups.", "/settings");
@@ -7748,6 +7776,7 @@ export function createDecisionServer(options) {
         }
         // v105: download everything as a .zip. An instance operator, with a step-up; the ledger records it.
         if (url.pathname === "/settings/data") {
+            const body = readForm(posted, CONSOLE_FORMS.data);
             if (who.via !== "cookie" || !store.isInstanceOperator(who.name))
                 return refuse(response, who, 403, "An instance operator exports data.", "/settings");
             if (!authenticateApprover(store, who.name, body.get("password") ?? "").ok) {
@@ -7762,6 +7791,7 @@ export function createDecisionServer(options) {
         }
         // Settings → Flows → Switch on: a starter flow's zones and trigger, made together.
         if (url.pathname === "/settings/flows/on") {
+            const body = readForm(posted, CONSOLE_FORMS.flowsOn);
             const repo = body.get("repo") ?? "";
             const back = (key, words) => redirect(response, `/settings/flows?repo=${encodeURIComponent(repo)}&${key}=${encodeURIComponent(words)}`);
             const known = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])];
@@ -7777,6 +7807,7 @@ export function createDecisionServer(options) {
         }
         // Settings → Integrations → Send test: one harmless read-only check of one integration, now.
         if (url.pathname === "/settings/integrations/test") {
+            const body = readForm(posted, CONSOLE_FORMS.integrationsTest);
             if (who.via !== "cookie" || who.role !== "approver" || restricted() || !options.configDir)
                 return refuse(response, who, 403, "An installation approver tests integrations.", "/settings");
             const key = body.get("key") ?? "";
@@ -7789,6 +7820,7 @@ export function createDecisionServer(options) {
         }
         // v104: change where monitoring goes. A step-up; the ledger keeps before → after (addresses, never secrets).
         if (url.pathname === "/settings/monitoring") {
+            const body = readForm(posted, CONSOLE_FORMS.monitoring);
             if (who.via !== "cookie" || !store.isInstanceOperator(who.name) || !options.configDir)
                 return refuse(response, who, 403, "An instance operator sets up monitoring.", "/settings");
             const back = (key, words) => redirect(response, `/settings/monitoring?${key}=${encodeURIComponent(words)}`);
@@ -7812,6 +7844,7 @@ export function createDecisionServer(options) {
             return back("said", "Saved. Deliveries start within a few seconds.");
         }
         if (url.pathname === "/settings/tools/connect") {
+            const body = readForm(posted, CONSOLE_FORMS.toolsConnect);
             if (who.via !== "cookie" || who.role !== "approver")
                 return refuse(response, who, 403, "Sign in as an approver to connect tools.", "/settings/tools");
             const repo = body.get("repo") ?? "";
@@ -7887,6 +7920,7 @@ export function createDecisionServer(options) {
             return goOutside(response, started.go, `Going to ${service.label} to sign in…`, { state: started.state, path: CONNECT_CALLBACK, secure: origin.startsWith("https:") });
         }
         if (url.pathname === "/settings/tools/change") {
+            const body = readForm(posted, CONSOLE_FORMS.toolsChange);
             if (who.via !== "cookie" || who.role !== "approver")
                 return refuse(response, who, 403, "Sign in as an approver to manage tools.", "/settings/tools");
             const repo = body.get("repo") ?? "";
@@ -7974,6 +8008,7 @@ export function createDecisionServer(options) {
             }
         }
         if (url.pathname === "/settings/appearance") {
+            const body = readForm(posted, CONSOLE_FORMS.appearance);
             // A per-browser preference, not a shared setting: it lives in this
             // person's own cookie and never in the database.
             const accentField = body.get("accent");
@@ -8002,6 +8037,7 @@ export function createDecisionServer(options) {
             return redirect(response, back);
         }
         if (url.pathname.startsWith("/settings/models/")) {
+            const body = readForm(posted, CONSOLE_FORMS.models);
             if (who.via !== "cookie" || who.role !== "approver")
                 return refuse(response, who, 403, "Sign in as an approver to change models.", "/settings/models");
             const back = (said, bad = false) => redirect(response, `/settings/models?${bad ? "problem" : "said"}=${encodeURIComponent(said)}`);
@@ -8056,6 +8092,7 @@ export function createDecisionServer(options) {
             return refuse(response, who, 404, "No such models action.", "/settings/models");
         }
         if (url.pathname === "/settings/knowledge/refresh") {
+            const body = readForm(posted, CONSOLE_FORMS.knowledgeRefresh);
             if (who.via !== 'cookie' || who.role !== 'approver')
                 return refuse(response, who, 403, 'Sign in as an approver to refresh project context.', '/settings/knowledge');
             const repo = body.get('repo') ?? '';
@@ -8065,6 +8102,7 @@ export function createDecisionServer(options) {
             return sendScreen(response, refreshed.index.status === 'ready' ? 200 : 503, screen('Project context', `<h1>Project context</h1><p>${refreshed.index.status === 'ready' ? 'Code index refreshed.' : 'The index is unavailable. Source search still works.'}</p><a class="button-link" href="/settings/knowledge?repo=${encodeURIComponent(repo)}">Open knowledge</a>`, { chrome: chromeFor(repo, 'settings') }));
         }
         if (url.pathname === "/settings/knowledge/proposal") {
+            const body = readForm(posted, CONSOLE_FORMS.knowledgeProposal);
             if (who.via !== 'cookie' || who.role !== 'approver')
                 return refuse(response, who, 403, 'Sign in as an approver to decide memory proposals.', '/settings/knowledge');
             const repo = body.get('repo') ?? '', decision = body.get('decision') ?? '';
@@ -8081,6 +8119,7 @@ export function createDecisionServer(options) {
             return redirect(response, `/settings/knowledge?repo=${encodeURIComponent(repo)}&saved=1`);
         }
         if (url.pathname === "/settings/knowledge/decision") {
+            const body = readForm(posted, CONSOLE_FORMS.knowledgeDecision);
             if (who.via !== 'cookie' || who.role !== 'approver')
                 return refuse(response, who, 403, 'Sign in as an approver to change project decisions.', '/settings/knowledge');
             const repo = body.get('repo') ?? '', action = body.get('action') ?? '';
@@ -8108,6 +8147,7 @@ export function createDecisionServer(options) {
             return redirect(response, `/settings/knowledge?repo=${encodeURIComponent(repo)}&saved=1`);
         }
         if (url.pathname === "/settings/knowledge/change") {
+            const body = readForm(posted, CONSOLE_FORMS.knowledgeChange);
             if (who.via !== 'cookie' || who.role !== 'approver')
                 return refuse(response, who, 403, 'Sign in as an approver to change project knowledge.', '/settings/knowledge');
             const repo = body.get('repo') ?? '', action = body.get('action') ?? '';
@@ -8133,6 +8173,7 @@ export function createDecisionServer(options) {
             return redirect(response, `/settings/knowledge?repo=${encodeURIComponent(repo)}&saved=1`);
         }
         if (url.pathname === "/settings/learning/change") {
+            const body = readForm(posted, CONSOLE_FORMS.learningChange);
             if (who.via !== "cookie")
                 return refuse(response, who, 403, "Sign in to change learning.", "/settings/learning");
             const repo = body.get("repo") ?? "", action = body.get("action") ?? "";
@@ -8149,6 +8190,7 @@ export function createDecisionServer(options) {
             return redirect(response, `/settings/learning?repo=${encodeURIComponent(repo)}`);
         }
         if (["/control/setup-preview", "/control/setup-approve", "/control/instructions-preview", "/control/instructions-approve"].includes(url.pathname)) {
+            const body = readForm(posted, CONSOLE_FORMS.projectSetup);
             const project = projectOf(who, request);
             if (project == null || body.get("repo") !== project || !visible(project))
                 return refuse(response, who, 409, "The selected project changed. Open project setup again.", "/control");
@@ -8188,6 +8230,7 @@ export function createDecisionServer(options) {
             return redirect(response, "/control");
         }
         if (["connect", "pair", "unpair", "disconnect", "alerts"].some(action => url.pathname === `/settings/slack/${action}`)) {
+            const body = readForm(posted, CONSOLE_FORMS.slack);
             if (who.via !== "cookie" || who.role !== "approver" || restricted() || !options.configDir)
                 return refuse(response, who, 403, "An installation approver can connect Slack.", "/settings");
             const dir = options.configDir, state = new SlackState(store), action = url.pathname.split("/").at(-1);
@@ -8248,7 +8291,53 @@ export function createDecisionServer(options) {
             store.retryTelegramReplies(who.name, now);
             return redirect(response, "/settings/telegram");
         }
+        // Approving from chat, as the person's lasting setting (chat-approval.ts): for all their projects or one. Turning it
+        // on or changing its limits is the mode's ceremony (the exact terms, a single-use nonce bound to them, the password
+        // typed again); turning it off is one step, csrf only. Every change is a ledger line.
+        if (url.pathname === "/settings/chat-approval/confirm" || url.pathname === "/settings/chat-approval/save" || url.pathname === "/settings/chat-approval/off") {
+            const body = readForm(posted, CONSOLE_FORMS.chatApproval);
+            if (who.via !== "cookie" || who.role !== "approver")
+                return refuse(response, who, 403, "An approver turns on approving from their own chat.", "/settings");
+            if (["scope", "full-access", "cap-usd", "nonce", "digest", "token"].some(key => body.getAll(key).length > 1))
+                return refuse(response, who, 400, "Submit one value for each field.", "/settings");
+            const given = (body.get("scope") ?? "all").trim();
+            const scope = given === "all" || given === "" ? CHAT_APPROVAL_ALL : canonicalProject(given) ?? given;
+            if (scope !== CHAT_APPROVAL_ALL && !(visible(scope) && store.accountCanAccess(who.name, scope)))
+                return refuse(response, who, 403, "That isn't one of your projects.", "/settings");
+            const where = scope === CHAT_APPROVAL_ALL ? "all your projects" : projectName(scope);
+            if (url.pathname.endsWith("/off")) {
+                const saved = setChatApproval(store, { approver: who.name, scope, enabled: false, via: "the console" }, now);
+                return saved.ok ? redirect(response, `/settings?said=${encodeURIComponent(saved.said)}`) : refuse(response, who, 400, saved.message, "/settings");
+            }
+            const usd = (body.get("cap-usd") ?? "").trim();
+            const cap = usd === "" ? null : Number(usd);
+            if (cap !== null && !(Number.isFinite(cap) && cap >= 0 && cap <= 10_000))
+                return refuse(response, who, 400, "Give the attempt limit in dollars, like 5.", "/settings");
+            const limits = { fullAccess: body.get("full-access") === "1", capMicrousd: cap === null ? null : Math.round(cap * 1_000_000) };
+            const digest = createHash("sha256").update(JSON.stringify({ scope, ...limits })).digest("hex");
+            if (url.pathname.endsWith("/confirm")) {
+                const nonce = mintApprovalNonce(who.name, "chat-approval", digest);
+                const html = `<h1 style="overflow-wrap:anywhere">Approve from chat in ${escape(where)}</h1>` +
+                    `<form method="post" action="/settings/chat-approval/save" class="card approve-form">` +
+                    hiddenFields({ csrf: who.session.csrf, nonce, digest, scope: scope === CHAT_APPROVAL_ALL ? "all" : scope, "full-access": limits.fullAccess ? "1" : "", "cap-usd": usd }) +
+                    `<p>Your own taps in your paired chat approve plans and merges until you turn this off. It doesn't expire.</p>` +
+                    `<p class="recap">Limits: ${escape(chatApprovalWords(limits))}.</p>` +
+                    `<p class="recap">Plans written for you, protected paths, two-person rules and your organisation's policy still open in Toolroll.</p>` +
+                    `<label>Your password<input type="password" name="token" autocomplete="current-password" required></label>` +
+                    `<div class="sticky-actions"><button type="submit">Turn on</button></div></form>` +
+                    `<p class="meta"><a href="/settings">Back</a></p>`;
+                return sendScreen(response, 200, screen("Approve from chat", html, { chrome: chromeFor(projectOf(who, request) ?? null, "settings") }));
+            }
+            if (!consumeApprovalNonce(body.get("nonce") ?? "", who.name, "chat-approval", body.get("digest") ?? "") || body.get("digest") !== digest)
+                return refuse(response, who, 409, "That form is stale. Read the terms again.", "/settings");
+            const proved = authenticateAccount(store, who.name, body.get("token") ?? "");
+            if (!proved.ok || proved.role !== "approver" || proved.generation !== who.session.generation)
+                return refuse(response, who, 403, "Turning on approving from chat takes your password, typed again.", "/settings");
+            const saved = setChatApproval(store, { approver: who.name, scope, enabled: true, limits, via: "the console" }, now);
+            return saved.ok ? redirect(response, `/settings?said=${encodeURIComponent(saved.said)}`) : refuse(response, who, 400, saved.message, "/settings");
+        }
         if (url.pathname === "/settings/telegram/pair" || url.pathname === "/settings/telegram/unpair") {
+            const body = readForm(posted, CONSOLE_FORMS.telegramPair);
             // The person's own pairing, under their password: a code minted for
             // them alone, or their own chats revoked. Teammates' pairings are
             // never touched from here.
@@ -8274,6 +8363,7 @@ export function createDecisionServer(options) {
             return sendScreen(response, 200, screen("Pair Telegram", telegramSettingsHtml(store, botId, who.name, who.session.csrf, { code }), { chrome: chromeFor(projectOf(who, request) ?? null, "settings"), forceSensitive: true }));
         }
         if (["connect", "pair", "unpair", "disconnect", "alerts"].some(action => url.pathname === `/settings/teams/${action}`)) {
+            const body = readForm(posted, CONSOLE_FORMS.teams);
             if (who.via !== "cookie" || who.role !== "approver" || restricted() || !options.configDir)
                 return refuse(response, who, 403, "An installation approver can connect Teams.", "/settings");
             const dir = options.configDir, state = new ChatState(store, "teams"), action = url.pathname.split("/").at(-1);
@@ -8328,6 +8418,7 @@ export function createDecisionServer(options) {
             return redirect(response, "/settings/teams");
         }
         if (["connect", "pair", "unpair", "disconnect", "alerts"].some(action => url.pathname === `/settings/discord/${action}`)) {
+            const body = readForm(posted, CONSOLE_FORMS.discord);
             if (who.via !== "cookie" || who.role !== "approver" || restricted() || !options.configDir)
                 return refuse(response, who, 403, "An installation approver can connect Discord.", "/settings");
             const dir = options.configDir, state = new ChatState(store, "discord"), action = url.pathname.split("/").at(-1);
@@ -8382,6 +8473,7 @@ export function createDecisionServer(options) {
             return redirect(response, "/settings/discord");
         }
         if (url.pathname === "/settings/messaging" && options.configDir !== undefined && options.telegramTokenFile !== undefined) {
+            const body = readForm(posted, CONSOLE_FORMS.messaging);
             const wanted = (body.get("primary") ?? "").trim();
             const facts = effectivePrimary(process.env, options.configDir, loadBotToken(process.env, options.telegramTokenFile) !== null);
             // Only a CONFIGURED service may page — choosing silence is not a
@@ -8393,6 +8485,7 @@ export function createDecisionServer(options) {
             return redirect(response, "/settings");
         }
         if (url.pathname === "/settings/permission-default" && options.telegramTokenFile !== undefined) {
+            const body = readForm(posted, CONSOLE_FORMS.permissionDefault);
             const wanted = body.get("permission-mode");
             if (wanted !== "auto" && wanted !== "bypassPermissions") {
                 return refuse(response, who, 400, "permissions must be Auto or Full access", "/settings");
@@ -8403,6 +8496,7 @@ export function createDecisionServer(options) {
                 : "New tasks now start with Auto. Approved tasks keep their setting.")}`);
         }
         if (url.pathname === "/settings/quality-default" && options.telegramTokenFile !== undefined) {
+            const body = readForm(posted, CONSOLE_FORMS.qualityDefault);
             const wanted = body.get("quality-mode");
             if (!isQualityMode(wanted)) {
                 return refuse(response, who, 400, "quality must be Default or Strict / release", "/settings");
@@ -8413,6 +8507,7 @@ export function createDecisionServer(options) {
                 : "New tasks now use Default quality. Approved tasks keep their setting.")}`);
         }
         if (url.pathname === "/settings/notifications") {
+            const body = readForm(posted, CONSOLE_FORMS.notifications);
             // Each person's own choice: a closed list of modes and a 24-hour HH:MM, or off.
             const mode = body.get("mode"), time = (body.get("digest") ?? "").trim(), shots = body.get("screenshots");
             if (mode !== null && mode !== "quiet" && mode !== "all")
@@ -8432,6 +8527,7 @@ export function createDecisionServer(options) {
             return redirect(response, `/settings?said=${encodeURIComponent(said)}`);
         }
         if (url.pathname === "/settings/notifications/mute") {
+            const body = readForm(posted, CONSOLE_FORMS.notificationsMute);
             // Each person's own pings: a muted project stays in Tasks and the evening digest.
             const repo = body.get("repo") ?? "";
             const project = notificationProjects(store, who.name).find(one => one.repo === repo);
@@ -8442,6 +8538,7 @@ export function createDecisionServer(options) {
             return redirect(response, `/settings?said=${encodeURIComponent(muted ? `${project.name} muted. It still shows in Tasks and your evening digest.` : `${project.name} pings you again.`)}#notifications`);
         }
         if (url.pathname === "/settings/telegram-digest" && options.telegramTokenFile !== undefined) {
+            const body = readForm(posted, CONSOLE_FORMS.telegramDigest);
             // The cadence is a closed list of minutes — never a free number from
             // a form; "off" clears it. Any approver session may set it.
             const wanted = (body.get("every") ?? "").trim();
@@ -8453,6 +8550,7 @@ export function createDecisionServer(options) {
             return redirect(response, `/settings?said=${encodeURIComponent(minutes === null ? "Digest off: each update arrives as it happens." : `Digest every ${minutes >= 60 ? `${minutes / 60}h` : `${minutes}m`}. Anything that needs you still arrives at once.`)}`);
         }
         if (url.pathname === "/settings/provider-key" || url.pathname === "/settings/provider-key-clear") {
+            const body = readForm(posted, CONSOLE_FORMS.providerKey);
             // The central gate already required an ACTIVE approver; the value is
             // write-only from here — status pages say set/not-set, never bytes.
             const provider = body.get("provider") ?? "";
@@ -8505,6 +8603,7 @@ export function createDecisionServer(options) {
             return redirect(response, `/settings?said=${encodeURIComponent((verdict.ok ? `${stored} and verified — it works` : `${stored}. ${verdictWords(provider, verdict)}`) + modeNote)}`);
         }
         if (url.pathname === "/settings/telegram-token" && options.telegramTokenFile !== undefined) {
+            const body = readForm(posted, CONSOLE_FORMS.telegramToken);
             const value = body.get("token") ?? "";
             const saved = saveBotToken(options.telegramTokenFile, value);
             if (!saved.ok) {
@@ -8520,6 +8619,7 @@ export function createDecisionServer(options) {
         }
         // v87: the mail server Send email steps use, and a test email to its own address.
         if ((url.pathname === "/settings/email" || url.pathname === "/settings/email-test" || url.pathname === "/settings/email-read-test") && who.role === "approver" && options.configDir !== undefined) {
+            const body = readForm(posted, CONSOLE_FORMS.email);
             const said = (words) => redirect(response, `/settings?said=${encodeURIComponent(words)}#email`);
             if (url.pathname === "/settings/email") {
                 const saved = saveEmailSettings(options.configDir, { host: body.get("host"), port: body.get("port"), secure: body.get("secure"), user: body.get("user"), from: body.get("from"), password: body.get("password"), imapHost: body.get("imapHost"), imapPort: body.get("imapPort") });
@@ -8542,6 +8642,7 @@ export function createDecisionServer(options) {
         }
         // v89: a Google account for email: save the OAuth client and go to Google's consent screen, or disconnect.
         if ((url.pathname === "/settings/google" || url.pathname === "/settings/google/disconnect") && who.role === "approver" && options.configDir !== undefined) {
+            const body = readForm(posted, CONSOLE_FORMS.google);
             const said = (words) => redirect(response, `/settings?said=${encodeURIComponent(words)}#email`);
             if (url.pathname === "/settings/google/disconnect") {
                 await disconnectGoogle(options.configDir, options.googleFetch ?? fetch);
@@ -8561,6 +8662,7 @@ export function createDecisionServer(options) {
             return goOutside(response, consent.url, "Going to Google to sign in…", { state: consent.visit.state, path: GOOGLE_CALLBACK, secure: origin.startsWith("https:") });
         }
         if (url.pathname === "/projects/select") {
+            const body = readForm(posted, CONSOLE_FORMS.projectsSelect);
             // Session-only project switching (E2): reads the registry, writes
             // ONLY session.project — the durable upsert lives in /projects/open,
             // which stays an approver's act. This is the one project verb a
@@ -8579,6 +8681,7 @@ export function createDecisionServer(options) {
             return redirect(response, safeReturn(body.get("return")));
         }
         if (url.pathname === "/projects/remove") {
+            const body = readForm(posted, CONSOLE_FORMS.projectsRemove);
             // The reversible remove: off every list and the builder; tasks, results and settings stay. Deleting is
             // Settings → Project → Delete project. The same admission code as `repos remove` (project-admission.ts).
             if (who.via !== "cookie" || !store.isInstanceOperator(who.name))
@@ -8598,6 +8701,7 @@ export function createDecisionServer(options) {
             return redirect(response, `/settings/project?said=${encodeURIComponent(`Removed ${projectName(repo)}. Its tasks and results stay saved.`)}`);
         }
         if (url.pathname === "/projects/open") {
+            const body = readForm(posted, CONSOLE_FORMS.projectsOpen);
             // Sessions only: a bearer caller names its project per request and has
             // no session to mutate — refusing here keeps that boundary legible.
             if (who.via !== "cookie") {
@@ -8637,6 +8741,7 @@ export function createDecisionServer(options) {
             return redirect(response, safeReturn(body.get("return")));
         }
         if (url.pathname === "/tasks/add") {
+            const body = readForm(posted, CONSOLE_FORMS.tasksAdd);
             const project = projectOf(who, request);
             if (project === undefined) {
                 return refuse(response, who, 403, "that project is outside what this server was configured to show");
@@ -8734,7 +8839,7 @@ export function createDecisionServer(options) {
             });
             if (!made.ok) {
                 const csrf = who.via === "cookie" ? who.session.csrf : "";
-                return sendScreen(response, made.reason === "backlog-full" ? 429 : 400, tasksPage(chromeFor(project, "tasks"), familyTasksInView(project).slice(0, 200), null, csrf, made.message, project, { title, goal, not: notThis, touches: body.get("touches") ?? "", acceptance: body.get("acceptance") ?? "", values: body }, store.permissionDefault().mode, store.qualityDefault().mode, store.replacements()));
+                return sendScreen(response, made.reason === "backlog-full" ? 429 : 400, tasksPage(chromeFor(project, "tasks"), familyTasksInView(project).slice(0, 200), null, csrf, made.message, project, { title, goal, not: notThis, touches: body.get("touches") ?? "", acceptance: body.get("acceptance") ?? "", values: body.sent }, store.permissionDefault().mode, store.qualityDefault().mode, store.replacements()));
             }
             const actionContext = requestContext.getStore();
             if (actionContext !== undefined)
@@ -8748,6 +8853,7 @@ export function createDecisionServer(options) {
             return redirect(response, taskHref(made.id));
         }
         if (url.pathname === "/queue/move" || url.pathname === "/queue/note") {
+            const body = readForm(posted, CONSOLE_FORMS.queue);
             const project = projectOf(who, request);
             if (project === undefined) {
                 return refuse(response, who, 403, "that project is outside what this server was configured to show");
@@ -8862,6 +8968,7 @@ export function createDecisionServer(options) {
         // hash — the page that shows it renders no self-refreshing script, so
         // the token is never re-rendered.
         if (url.pathname === "/fleet/runner/register") {
+            const body = readForm(posted, CONSOLE_FORMS.runnerRegister);
             if (who.via !== "cookie")
                 return refuse(response, who, 403, "runner registration is a browser surface");
             const token = body.get("token") ?? "";
@@ -8891,6 +8998,7 @@ export function createDecisionServer(options) {
             return sendScreen(response, 200, tokenScreen);
         }
         if (url.pathname === "/mode/confirm" || url.pathname === "/mode/sign") {
+            const body = readForm(posted, CONSOLE_FORMS.mode);
             if (who.via !== "cookie")
                 return refuse(response, who, 403, "signing a mode is a browser ceremony");
             const project = projectOf(who, request);
@@ -8991,6 +9099,7 @@ export function createDecisionServer(options) {
             return redirect(response, ended ? "/mode?said=the%20mode%20is%20ended%20—%20every%20act%20falls%20back%20to%20its%20own%20ceremony" : "/mode");
         }
         if (url.pathname === "/people/projects") {
+            const body = readForm(posted, CONSOLE_FORMS.peopleProjects);
             if (who.via !== "cookie" || !store.isInstanceOperator(who.name))
                 return refuse(response, who, 403, "An instance operator manages project access.", "/people");
             if (!authenticateApprover(store, who.name, body.get("token") ?? "", null).ok)
@@ -9005,6 +9114,7 @@ export function createDecisionServer(options) {
             return redirect(response, "/people?said=Project%20access%20saved");
         }
         if (url.pathname === "/people/invite") {
+            const body = readForm(posted, CONSOLE_FORMS.peopleInvite);
             if (who.via !== "cookie")
                 return refuse(response, who, 403, "inviting is a browser surface");
             const token = body.get("token") ?? "";
@@ -9035,6 +9145,7 @@ export function createDecisionServer(options) {
             return sendScreen(response, 200, linkScreen);
         }
         if (url.pathname === "/people/invite-revoke") {
+            const body = readForm(posted, CONSOLE_FORMS.peopleInviteRevoke);
             if (who.via !== "cookie")
                 return refuse(response, who, 403, "inviting is a browser surface");
             const token = body.get("token") ?? "";
@@ -9046,6 +9157,7 @@ export function createDecisionServer(options) {
             return redirect(response, `/people?said=${encodeURIComponent(revoked ? "the invite is cancelled — its link is dead" : "that invite was already gone")}`);
         }
         if (url.pathname === "/people/revoke") {
+            const body = readForm(posted, CONSOLE_FORMS.peopleRevoke);
             if (who.via !== "cookie")
                 return refuse(response, who, 403, "removing a person is a browser surface");
             const token = body.get("token") ?? "";
@@ -9065,6 +9177,7 @@ export function createDecisionServer(options) {
             return redirect(response, `/people?said=${encodeURIComponent(`${name} can no longer sign in — their sessions, invites, and signed modes ended with them; history stays`)}`);
         }
         if (url.pathname === "/fleet/runner/retire") {
+            const body = readForm(posted, CONSOLE_FORMS.runnerRetire);
             if (who.via !== "cookie")
                 return refuse(response, who, 403, "runner retirement is a browser surface");
             const token = body.get("token") ?? "";
@@ -9079,6 +9192,7 @@ export function createDecisionServer(options) {
         }
         const answer = /^\/d\/([0-9]{1,15})\/answer$/.exec(url.pathname);
         if (answer !== null) {
+            const body = readForm(posted, CONSOLE_FORMS.decisionAnswer);
             const id = Number(answer[1]);
             const requestedReturn = body.get("return");
             const decisionBack = requestedReturn === "next"
@@ -9118,6 +9232,7 @@ export function createDecisionServer(options) {
         }
         const contestAct = /^\/contest\/([0-9]{1,15})\/(arm|pick|abandon)$/.exec(url.pathname);
         if (contestAct !== null) {
+            const body = readForm(posted, CONSOLE_FORMS.contest);
             const contestId = Number(contestAct[1]);
             const verb = contestAct[2];
             const data = contestData(contestId);
@@ -9192,10 +9307,11 @@ export function createDecisionServer(options) {
         }
         const attendAct = matchTaskPath(url.pathname, "/(attend-preview|attend|attend-revoke)$");
         if (attendAct !== null) {
-            return attendMutation(response, who, attendAct.taskId, attendAct.verb, body, now);
+            return attendMutation(response, who, attendAct.taskId, attendAct.verb, readForm(posted, CONSOLE_FORMS.attend), now);
         }
         const act = matchTaskPath(url.pathname, "/(hold|unhold|requeue|cancel|scope|approve|plan|plan-edit|block|unblock|repair-dependency|next|reopen|steer|follow-up|accept-proof|accept-revision|reject-revision|route|retry-review|complete|merge|confirm-stopped|stop|resume-arm|resume)$");
         if (act !== null && act.verb === "confirm-stopped") {
+            const body = readForm(posted, CONSOLE_FORMS.confirmStopped);
             // Confirming a finished build stopped is an approver's act behind the password, typed again — the same
             // record as `toolroll run settle`, refused while anything of the run may still be running.
             const back = taskHref(act.taskId);
@@ -9227,6 +9343,7 @@ export function createDecisionServer(options) {
             return redirect(response, body.get("return") ? to : back);
         }
         if (act !== null && act.verb === "merge") {
+            const body = readForm(posted, CONSOLE_FORMS.merge);
             // Merging is a person's act behind their password, typed again: a browser session, an approver, the exact
             // result's pull request. The flow re-reads GitHub before merging and records who merged in the ledger.
             if (who.via !== "cookie" || who.role !== "approver")
@@ -9248,9 +9365,10 @@ export function createDecisionServer(options) {
             return redirect(response, `${taskHref(act.taskId)}#merge`);
         }
         if (act !== null) {
-            return taskMutation(response, who, act.taskId, act.verb, body, now);
+            return taskMutation(response, who, act.taskId, act.verb, posted, now);
         }
         if (url.pathname === "/projects/onboard-preview" || url.pathname === "/projects/onboard-confirm") {
+            const body = readForm(posted, CONSOLE_FORMS.onboard);
             // Repo onboarding (findings 1-39): bearer and demo refuse BEFORE any
             // gh call; the console flow exists only on root-configured serves.
             if (who.via !== "cookie")
@@ -9375,6 +9493,7 @@ export function createDecisionServer(options) {
                 : `${admitted} is ready and open`, 200);
         }
         if (url.pathname === "/push/subscribe") {
+            const body = readForm(posted, CONSOLE_FORMS.pushSubscribe);
             // Enrolling a durable notification sink is a CEREMONY (arc 3 finding
             // 6): browser session + CSRF + the password typed again; bearer
             // identities are machines and are refused outright.
@@ -9414,6 +9533,7 @@ export function createDecisionServer(options) {
             return redirect(response, `/settings?said=${encodeURIComponent("this device now gets a buzz when the plane needs a person")}`);
         }
         if (url.pathname === "/push/remove") {
+            const body = readForm(posted, CONSOLE_FORMS.pushRemove);
             if (who.via !== "cookie")
                 return refuse(response, who, 403, "push removal is a browser session's act");
             const id = Number(body.get("id") ?? "");
@@ -9424,6 +9544,7 @@ export function createDecisionServer(options) {
             return redirect(response, `/settings?said=${encodeURIComponent("removed — that device stops receiving pushes")}`);
         }
         if (url.pathname === "/onboarding/phone/dismiss") {
+            const body = readForm(posted, CONSOLE_FORMS.phoneDismiss);
             if (who.via !== "cookie" || who.role !== "approver")
                 return refuse(response, who, 403, "An approver puts this away.", "/chat");
             store.recordInstallationFact(PHONE_CARD_FACT, who.name, now);
@@ -9433,6 +9554,7 @@ export function createDecisionServer(options) {
         // conversation it needs no second password; the full form (Advanced) still asks for one.
         // Settings → Lead: the name and persona this person's lead speaks with.
         if (url.pathname === "/settings/lead/identity") {
+            const body = readForm(posted, CONSOLE_FORMS.leadIdentity);
             if (who.via !== "cookie" || who.role !== "approver")
                 return refuse(response, who, 403, "An approver names their lead.", "/settings/lead");
             const checked = checkLeadIdentity(body.get("name") ?? "", body.get("persona") ?? "");
@@ -9443,6 +9565,7 @@ export function createDecisionServer(options) {
         }
         // Settings → Lead: what this person's lead knows about them, one line each.
         if (url.pathname === "/settings/lead/about") {
+            const body = readForm(posted, CONSOLE_FORMS.leadAbout);
             if (who.via !== "cookie" || who.role !== "approver")
                 return refuse(response, who, 403, "An approver edits what their lead knows about them.", "/settings/lead");
             const checked = checkAboutYou(body.get("about") ?? "");
@@ -9453,6 +9576,7 @@ export function createDecisionServer(options) {
         }
         // Settings → Lead: stop the lead following up on one of your promises.
         if (url.pathname === "/settings/lead/promise/cancel") {
+            const body = readForm(posted, CONSOLE_FORMS.leadPromiseCancel);
             if (who.via !== "cookie" || who.role !== "approver")
                 return refuse(response, who, 403, "An approver manages the lead's promises.", "/settings/lead");
             const id = Number(body.get("promise"));
@@ -9471,6 +9595,7 @@ export function createDecisionServer(options) {
             return redirect(response, "/chat");
         }
         if (url.pathname === "/chat/config") {
+            const body = readForm(posted, CONSOLE_FORMS.chatConfig);
             // The console's own door into `config set chat` (operator request:
             // chat lives mainly in the web UI). Same ceremony weight as the CLI
             // verb: the password typed again authenticates the approver, the
@@ -9549,6 +9674,7 @@ export function createDecisionServer(options) {
         }
         // ---- the mate (mate arc §5) ------------------------------------------
         if (url.pathname === "/chat/mate/mint") {
+            const body = readForm(posted, CONSOLE_FORMS.mateMint);
             if (who.via !== "cookie")
                 return refuse(response, who, 403, "the mate is a browser surface");
             const back = safeChatReturn(body.get("return"));
@@ -9573,6 +9699,7 @@ export function createDecisionServer(options) {
             return redirect(response, back);
         }
         if (url.pathname === "/chat/mate/follow") {
+            const body = readForm(posted, CONSOLE_FORMS.mateFollow);
             if (who.via !== "cookie")
                 return refuse(response, who, 403, "Open the conversation to change automatic updates.");
             const principal = matePrincipal(who), session = store.activeMateSession(who.name), thread = store.liveMateThreadFor(who.name);
@@ -9581,6 +9708,7 @@ export function createDecisionServer(options) {
             return redirect(response, safeChatReturn(body.get("return")));
         }
         if (url.pathname === "/chat/mate/end") {
+            const body = readForm(posted, CONSOLE_FORMS.mateEnd);
             if (who.via !== "cookie")
                 return refuse(response, who, 403, "the mate is a browser surface");
             const back = safeChatReturn(body.get("return"));
@@ -9593,6 +9721,7 @@ export function createDecisionServer(options) {
             return redirect(response, back);
         }
         if (url.pathname === "/chat/mate/stop") {
+            const body = readForm(posted, CONSOLE_FORMS.mateStop);
             if (who.via !== "cookie")
                 return refuse(response, who, 403, "the mate is a browser surface");
             const back = safeChatReturn(body.get("return"));
@@ -9611,6 +9740,7 @@ export function createDecisionServer(options) {
         }
         const mateProposal = /^\/chat\/proposal\/([0-9]{1,15})\/(confirm|dismiss)$/.exec(url.pathname);
         if (mateProposal !== null) {
+            const body = readForm(posted, CONSOLE_FORMS.mateProposal);
             if (who.via !== "cookie")
                 return refuse(response, who, 403, "the mate is a browser surface");
             const back = safeChatReturn(body.get("return"));
@@ -9696,6 +9826,7 @@ export function createDecisionServer(options) {
         // ceiling admits the repo; the card lives on /chat and on the task.
         const coordinatorProposal = /^\/proposals\/([0-9]{1,15})\/(confirm|dismiss)$/.exec(url.pathname);
         if (coordinatorProposal !== null) {
+            const body = readForm(posted, CONSOLE_FORMS.coordinatorProposal);
             if (who.via !== "cookie")
                 return refuse(response, who, 403, "proposals are confirmed from the browser or the CLI");
             const principal = matePrincipal(who);
@@ -9715,6 +9846,7 @@ export function createDecisionServer(options) {
             return redirect(response, outcome.ok || outcome.reason !== "needs-confirm" ? back : `${back}${back.includes("?") ? "&" : "?"}said=${encodeURIComponent(outcome.said)}`);
         }
         if (url.pathname === "/chat") {
+            const body = readForm(posted, CONSOLE_FORMS.chat);
             if (who.via !== "cookie")
                 return refuse(response, who, 403, "chat is a browser surface");
             const requestedTask = body.get("task");
@@ -9860,6 +9992,7 @@ export function createDecisionServer(options) {
         }
         const chatFile = /^\/chat\/file\/([0-9a-f]{32})$/.exec(url.pathname);
         if (chatFile !== null) {
+            const body = readForm(posted, CONSOLE_FORMS.chatFile);
             if (who.via !== "cookie")
                 return refuse(response, who, 403, "chat is a browser surface");
             const key = chatFile[1];
@@ -9933,6 +10066,7 @@ export function createDecisionServer(options) {
         }
         const chatAckPost = /^\/chat\/ack\/([0-9]{1,15})$/.exec(url.pathname);
         if (chatAckPost !== null) {
+            const body = readForm(posted, CONSOLE_FORMS.chatAck);
             if (who.via !== "cookie")
                 return refuse(response, who, 403, "acknowledgement is a browser ceremony");
             const turn = store.getChatTurn(Number(chatAckPost[1]));
@@ -9952,6 +10086,7 @@ export function createDecisionServer(options) {
             return redirect(response, "/chat");
         }
         if (["/recipes/prepare", "/recipes/preview", "/recipes/import", "/recipes/launch", "/recipes/save"].includes(url.pathname)) {
+            const body = readForm(posted, CONSOLE_FORMS.recipes);
             const project = projectOf(who, request);
             try {
                 if (project === null || project === undefined || !visible(project))
@@ -9964,7 +10099,7 @@ export function createDecisionServer(options) {
                 const rootMode = !unscopedMode && ceiling.roots.length > 0;
                 if (rootMode && !(await authorizedProject(liveCeiling(), project)))
                     throw new RecipeError("The project is outside this server's access.", 403);
-                const rechecked = authorizeMutation(request, who, body);
+                const rechecked = authorizeMutation(request, who, readForm(posted, CONSOLE_FORMS.mutationGuard));
                 if (rechecked !== null)
                     throw new RecipeError(rechecked.message, rechecked.status);
                 if (projectOf(who, request) !== project)
@@ -9979,13 +10114,13 @@ export function createDecisionServer(options) {
                     if (recipe === null || recipe.repo === null)
                         throw new RecipeError("This recipe is not available in this project.", 404);
                     try {
-                        const preview = prepareRecipeRun(store, who.name, project, id, Number(version), recipeAnswersFromForm(body), now);
+                        const preview = prepareRecipeRun(store, who.name, project, id, Number(version), recipeAnswersFromForm(body.sent), now);
                         return redirect(response, `/recipes/preview?preview=${preview.token}`);
                     }
                     catch (error) {
                         if (!(error instanceof RecipeError))
                             throw error;
-                        return sendScreen(response, error.status, screen("Use recipe", recipeRunHtml(recipe, project, csrf, revision, error.message, body), { chrome: chromeFor(project, "recipes"), functional: { script: recipeScript() } }));
+                        return sendScreen(response, error.status, screen("Use recipe", recipeRunHtml(recipe, project, csrf, revision, error.message, body.sent), { chrome: chromeFor(project, "recipes"), functional: { script: recipeScript() } }));
                     }
                 }
                 if (url.pathname === "/recipes/import") {
@@ -10005,13 +10140,13 @@ export function createDecisionServer(options) {
                         throw new RecipeError("That recipe version is not available in this project.", 404);
                     let document;
                     try {
-                        document = recipeFromForm(body);
+                        document = recipeFromForm(body.sent);
                     }
                     catch (error) {
                         if (!(error instanceof RecipeError))
                             throw error;
                         const fallback = original ?? { ...starterRecipes().find(one => one.id === "small-feature"), id: source };
-                        return sendScreen(response, error.status, screen("Customize recipe", recipeEditorHtml(fallback, project, csrf, revision, error.message, body, purpose === "recipe"), { chrome: chromeFor(project, "recipes"), functional: { script: recipeScript() } }));
+                        return sendScreen(response, error.status, screen("Customize recipe", recipeEditorHtml(fallback, project, csrf, revision, error.message, body.sent, purpose === "recipe"), { chrome: chromeFor(project, "recipes"), functional: { script: recipeScript() } }));
                     }
                     const preview = createWorkflowPreview(store, who.name, project, document, source, now);
                     return redirect(response, `/recipes/preview?preview=${preview.token}${purpose === "recipe" || document.version === 2 ? "&purpose=recipe" : ""}`);
@@ -10040,6 +10175,7 @@ export function createDecisionServer(options) {
             }
         }
         if (url.pathname === "/routines/add") {
+            const body = readForm(posted, CONSOLE_FORMS.routinesAdd);
             // A standing order files into the OPEN project — never a typed path,
             // so the ceiling question never even arises — and lands on its own
             // screen where the approval step-up already lives: filing is cheap,
@@ -10075,11 +10211,11 @@ export function createDecisionServer(options) {
             // 7): the service validates, canonicalizes, digests, and stamps
             // provenance; the admission list makes the ceiling explicit even
             // though `project` was already proved inside it.
-            const scheduled = body.has("repeat") ? composerSchedule(body) : { ok: true, schedule: (body.get("schedule") ?? "").trim() };
+            const scheduled = body.has("repeat") ? composerSchedule(body.sent) : { ok: true, schedule: (body.get("schedule") ?? "").trim() };
             if (!scheduled.ok || scheduled.schedule === null) {
                 return sendScreen(response, 400, routinesPage(chromeFor(project, "routines"), store.routineTracks(project, now).filter(track => visible(track.routine.repo)), {
                     csrf: who.via === "cookie" ? who.session.csrf : "", revision: who.via === "cookie" ? who.session.projectRevision : 0,
-                    problem: scheduled.ok ? "Choose a recurring schedule." : scheduled.message, values: body,
+                    problem: scheduled.ok ? "Choose a recurring schedule." : scheduled.message, values: body.sent,
                 }));
             }
             const created = fileRoutineProposal(store, {
@@ -10102,17 +10238,18 @@ export function createDecisionServer(options) {
                 return sendScreen(response, created.reason === "duplicate" ? 409 : 400, routinesPage(chromeFor(project, "routines"), tracks, {
                     csrf: who.via === "cookie" ? who.session.csrf : "",
                     revision: who.via === "cookie" ? who.session.projectRevision : 0,
-                    problem: created.message, values: body,
+                    problem: created.message, values: body.sent,
                 }));
             }
             return redirect(response, `/routines/${created.id}`);
         }
         const routineAct = /^\/routines\/([0-9]{1,15})\/(approve|refresh|pause|resume|run-now)$/.exec(url.pathname);
         if (routineAct !== null) {
-            return routineMutation(response, who, Number(routineAct[1]), routineAct[2], body, now);
+            return routineMutation(response, who, Number(routineAct[1]), routineAct[2], readForm(posted, CONSOLE_FORMS.routine), now);
         }
         const runNote = /^\/r\/([0-9]{1,15})\/note$/.exec(url.pathname);
         if (runNote !== null) {
+            const body = readForm(posted, CONSOLE_FORMS.runNote);
             // An operator's verdict beside the machine's record (M6): immutable,
             // bounded by the same validator as decision notes, ceiling-checked
             // like every run resource. Ordinary authenticated mutation — no
@@ -10130,6 +10267,7 @@ export function createDecisionServer(options) {
         }
         const diffComment = /^\/r\/([0-9]{1,15})\/comment$/.exec(url.pathname);
         if (diffComment !== null) {
+            const body = readForm(posted, CONSOLE_FORMS.diffComment);
             // A review comment on the IMMUTABLE terminal diff (M6.8): bound to
             // the exact artifact and its hash. Ordinary authenticated mutation —
             // the nonce belongs to the approval screen that later restates the
@@ -10216,6 +10354,7 @@ export function createDecisionServer(options) {
             return redirect(response, `${back}${back.includes("?") ? "&" : "?"}noted=${receipt}#request-changes`);
         }
         if (url.pathname === "/session/editor-links") {
+            const body = readForm(posted, CONSOLE_FORMS.editorLinks);
             // The session half of the editor-link activation (arc 6, finding 1):
             // only the person at the browser can say "this device holds the
             // worktrees". Per-session, dies with the session, grants nothing —
@@ -10230,6 +10369,7 @@ export function createDecisionServer(options) {
         }
         const turnAct = /^\/r\/([0-9]{1,15})\/turn$/.exec(url.pathname);
         if (turnAct !== null) {
+            const body = readForm(posted, CONSOLE_FORMS.turn);
             // The operator's turn (Phase 2E, v2 S1g): cookie-only — a watching
             // person, never a bearer machine — and every hard gate (custody,
             // lease, cap, budget, open decision, single flight) re-proves
@@ -10266,6 +10406,7 @@ export function createDecisionServer(options) {
         }
         const revise = /^\/r\/([0-9]{1,15})\/revise$/.exec(url.pathname);
         if (revise !== null) {
+            const body = readForm(posted, CONSOLE_FORMS.revise);
             // Seal the live comment batch into ONE unapproved revision task with
             // an immutable brief (M6.8). Deterministic — no model reads anything
             // here — and every revision takes its own approval: comments can
@@ -10288,6 +10429,7 @@ export function createDecisionServer(options) {
         // approved command once and seals the log), or file a task to add tests.
         const followUp = /^\/r\/([0-9]{1,15})\/(checks|add-tests)$/.exec(url.pathname);
         if (followUp !== null) {
+            const body = readForm(posted, CONSOLE_FORMS.followUp);
             const id = Number(followUp[1]);
             const found = store.getRun(id);
             if (found === null || !visible(taskRepoOf(found.taskRef)))
@@ -10385,6 +10527,7 @@ export function createDecisionServer(options) {
         }
         const resolve = /^\/i\/([0-9]{1,15})\/resolve$/.exec(url.pathname);
         if (resolve !== null) {
+            const body = readForm(posted, CONSOLE_FORMS.resolveIncident);
             const id = Number(resolve[1]);
             // The ceiling applies to incident mutation exactly as to every other
             // resource (v3 review, finding 3): resolve incident → run → task, and
@@ -10668,7 +10811,7 @@ export function createDecisionServer(options) {
         store.beatAuthorization(minted.authorization.id, now);
         return redirect(response, taskHref(taskId));
     }
-    function taskMutation(response, who, taskId, verb, body, now) {
+    function taskMutation(response, who, taskId, verb, posted, now) {
         const ref = store.lookupRef(taskId);
         if (ref === null || store.getTask(taskId) === null) {
             return refuse(response, who, 404, "no such task", "/tasks");
@@ -10678,6 +10821,7 @@ export function createDecisionServer(options) {
         }
         switch (verb) {
             case "steer": {
+                const body = readForm(posted, CONSOLE_FORMS.taskSteer);
                 // Steering is a browser session's act, explicitly (arc 1 v2 §3):
                 // identify() accepts bearer credentials generically, and those are
                 // for machines — a person watching steers, cookie + CSRF only.
@@ -10699,6 +10843,7 @@ export function createDecisionServer(options) {
                 return redirect(response, taskHref(taskId));
             }
             case "hold": {
+                const body = readForm(posted, CONSOLE_FORMS.taskHold);
                 const reason = (body.get("reason") ?? "").trim() || "held from the console";
                 if (reason.length > 200 || hasForbiddenControls(reason)) {
                     return taskScreen(response, who, taskId, "that reason will not render, so it will not store", 400);
@@ -10710,6 +10855,7 @@ export function createDecisionServer(options) {
                 return redirect(response, taskHref(taskId));
             }
             case "block": {
+                const body = readForm(posted, CONSOLE_FORMS.taskBlock);
                 // Chains are scheduling, not authority (chains-and-next review,
                 // finding 2): the edge decides WHEN the ready set admits the task;
                 // approval still decides WHAT may build. Both ends are re-proved
@@ -10731,6 +10877,7 @@ export function createDecisionServer(options) {
                 return redirect(response, taskHref(taskId));
             }
             case "unblock": {
+                const body = readForm(posted, CONSOLE_FORMS.taskBlock);
                 const on = (body.get("on") ?? "").trim();
                 if (store.openContestFor(ref.id) !== null) {
                     return taskScreen(response, who, taskId, "a tournament is running on this task — let it finish, then pick or abandon it", 409);
@@ -10742,6 +10889,7 @@ export function createDecisionServer(options) {
                 return redirect(response, taskHref(taskId));
             }
             case "repair-dependency": {
+                const body = readForm(posted, CONSOLE_FORMS.taskRepairDependency);
                 const blocker = (body.get("blocker") ?? "").trim();
                 const operation = (body.get("operation") ?? "").trim();
                 const blockerTask = blocker === "" || !store.blockers(taskId).includes(blocker) ? null : store.getTask(blocker);
@@ -10785,6 +10933,7 @@ export function createDecisionServer(options) {
                 return taskScreen(response, who, taskId, "choose whether to try that task again, wait for a different task, or continue without it", 400);
             }
             case "next": {
+                const body = readForm(posted, CONSOLE_FORMS.taskNext);
                 if (body.get("undo") !== null) {
                     const cleared = store.clearTaskPriority(taskId);
                     if (!cleared.ok)
@@ -10805,6 +10954,7 @@ export function createDecisionServer(options) {
                 return redirect(response, taskHref(taskId));
             }
             case "reopen": {
+                const body = readForm(posted, CONSOLE_FORMS.taskReopen);
                 // Authenticated like every approving act: the session alone may
                 // read; resuming external work takes the password, typed again.
                 const token = (body.get("token") ?? "").trim();
@@ -10834,6 +10984,7 @@ export function createDecisionServer(options) {
                 return redirect(response, taskHref(taskId));
             }
             case "requeue": {
+                const body = readForm(posted, CONSOLE_FORMS.taskRequeue);
                 // Retry may carry a note for the next attempt: the same steering note, checked before anything changes.
                 const note = (body.get("note") ?? "").trim();
                 if (note !== "" && who.via !== "cookie")
@@ -10853,6 +11004,7 @@ export function createDecisionServer(options) {
                 return redirect(response, body.get("return") === "inbox" ? "/inbox" : body.get("return") === "next" ? "/next" : taskHref(taskId));
             }
             case "follow-up": {
+                const body = readForm(posted, CONSOLE_FORMS.taskFollowUp);
                 // A scout's proposed follow-up, filed by the operator's tap (mate
                 // arc §10): the ONE filing door, this task's repository, the scope
                 // text stamped as the scout's — mode coverage never seals it.
@@ -10910,6 +11062,7 @@ export function createDecisionServer(options) {
                 return redirect(response, taskHref(taskId));
             }
             case "plan-edit": {
+                const body = readForm(posted, CONSOLE_FORMS.taskPlanEdit);
                 if (who.via !== "cookie") {
                     return refuse(response, who, 403, "editing a plan is a browser session's act");
                 }
@@ -10967,6 +11120,7 @@ export function createDecisionServer(options) {
             }
             case "accept-revision":
             case "reject-revision": {
+                const body = readForm(posted, CONSOLE_FORMS.taskRevision);
                 // Adaptive execution plans (v44): resolving a revision the builder
                 // filed while its authority snapshot no longer matched the run it
                 // started under — the ONLY road a 'blocked' plan_revision reaches,
@@ -10997,6 +11151,7 @@ export function createDecisionServer(options) {
                 return redirect(response, taskHref(taskId));
             }
             case "cancel": {
+                const body = readForm(posted, CONSOLE_FORMS.taskCancel);
                 const reason = body.get("reason") ?? undefined;
                 const cancelled = withActor({ account: who.name, lead: false }, () => store.cancelTask(taskId, now, reason));
                 if (!cancelled.ok) {
@@ -11010,6 +11165,7 @@ export function createDecisionServer(options) {
                 return redirect(response, taskHref(taskId));
             }
             case "route": {
+                const body = readForm(posted, CONSOLE_FORMS.taskRoute);
                 // THE AGENTS EDIT (v47): an approver's session declares the risk,
                 // overrides one role to an exact agent, or clears an override — ONE
                 // authenticated transaction in the store that CAS-checks the scope
@@ -11095,6 +11251,7 @@ export function createDecisionServer(options) {
                 return redirect(response, toChat ? target : `${target}#agents`);
             }
             case "scope": {
+                const body = readForm(posted, CONSOLE_FORMS.taskScope);
                 const sawDigest = body.get("sawDigest");
                 const permissionGiven = body.get("permission-mode");
                 if (permissionGiven !== null && permissionGiven !== "" && permissionGiven !== "auto" && permissionGiven !== "bypassPermissions") {
@@ -11290,7 +11447,7 @@ export function createDecisionServer(options) {
                 if (!saved.ok) {
                     // Refused because the plan moved on: the draft comes back with the version now on file, so saving it
                     // again (having read the reason) can succeed instead of being refused the same way.
-                    const draft = new URLSearchParams(body);
+                    const draft = new URLSearchParams(body.sent);
                     if (saved.status === 409)
                         draft.set("sawDigest", store.getScope(taskId)?.digest ?? "");
                     return taskScreen(response, who, taskId, saved.message, saved.status, draft);
@@ -11298,6 +11455,7 @@ export function createDecisionServer(options) {
                 return redirect(response, taskHref(taskId));
             }
             case "approve": {
+                const body = readForm(posted, CONSOLE_FORMS.taskApprove);
                 const requestedReturn = body.get("return");
                 const approvalBack = requestedReturn === "next"
                     ? "/next"
@@ -11384,6 +11542,7 @@ export function createDecisionServer(options) {
                 return redirect(response, approvalBack);
             }
             case "accept-proof": {
+                const body = readForm(posted, CONSOLE_FORMS.taskAcceptProof);
                 // Accepting is a person's act, like approving a scope (Priority
                 // 2): a cookie session only, never a bearer credential.
                 if (who.via !== "cookie") {
@@ -11420,6 +11579,7 @@ export function createDecisionServer(options) {
                 return redirect(response, body.get("return") === null ? taskHref(taskId) : safeReturn(body.get("return")));
             }
             case "complete": {
+                const body = readForm(posted, CONSOLE_FORMS.taskComplete);
                 if (who.via !== "cookie" || who.role !== "approver")
                     return refuse(response, who, 403, "Only an approver can mark a result complete.");
                 const principal = matePrincipal(who);
@@ -11465,6 +11625,7 @@ export function createDecisionServer(options) {
                 return taskScreen(response, who, taskId, "Separate agent reviews have retired. Open the saved result to mark it complete or request a revision.", 410);
             }
             case "stop": {
+                const body = readForm(posted, CONSOLE_FORMS.taskStop);
                 // The exact-run stop (v52): a browser session's act, an approver's
                 // act, naming ONE run. The store's transaction proves the run is
                 // this task's current live attempt and records who asked before
@@ -11496,9 +11657,11 @@ export function createDecisionServer(options) {
                 return redirect(response, back === "chat" ? `${taskChatHref(taskId)}#task-control` : `${taskHref(taskId)}#task-control`);
             }
             case "resume-arm": {
+                const body = readForm(posted, CONSOLE_FORMS.taskResume);
                 return armTaskResume(response, who, taskId, (body.get("run") ?? "").trim(), body.get("return") === "chat" ? "chat" : "task", now);
             }
             case "resume": {
+                const body = readForm(posted, CONSOLE_FORMS.taskResume);
                 // The resume itself (v52): password typed again + the durable nonce
                 // consumed INSIDE the store's resume transaction against the digest
                 // re-derived from live state. A replay finds the nonce spent; a