Pick Option

The founder picks. THIS is the response reveal is populated in.

⛔presented_blind IS NEVER TAKEN FROM THE REQUEST. It is derived here, server-side, from queue.is_presented_blind(decision_id) -- exactly what /next and GET /{decision_id} used to decide whether to withhold the reveal in the first place -- and NEVER from anything the caller sent, the same rule _wire_decision's own docstring states for reading it. A caller that could assert its own blindness could manufacture blind-agreement evidence out of a sighted click.

The chosen option is validated against the decision's own options here, BEFORE service.choose is ever called, using the same option_id the web was handed (_option_id/_option_by_id) rather than a label a caller could misspell into a false negative. service.choose re-checks the label regardless -- belt and braces, never a reason to skip this one -- and its own guarded UPDATE is what actually holds under a race, surfaced below as 409 rather than swallowed.