@intentius/chant 0.124.8 → 0.124.10

package/src/lifecycle/gate-ledger.test.ts

@@ -441,3 +441,40 @@ describe("applied approvals on chant/lifecycle (#3784)", () => {
     });
   });
 });
+
+describe("gate ledger newline termination (#3849)", () => {
+  test("every append ends the file in a newline, with no blank or merged lines", async () => {
+    await withTestDir(async (dir) => {
+      await initRepo(dir);
+      await appendPendingGate({ op: "nl-op", gate: "g1", planDigest: "sha256:" + "a".repeat(64) } as never, { cwd: dir });
+      const one = await readBlobFromPath("_gates", "nl-op.jsonl", { cwd: dir });
+      expect(one!.endsWith("\n")).toBe(true);
+      await appendGateResolution(
+        { op: "nl-op", gate: "g1", resolvedBy: "alex", timestamp: "2026-01-01T00:00:00.000Z" },
+        { cwd: dir },
+      );
+      const raw = (await readBlobFromPath("_gates", "nl-op.jsonl", { cwd: dir }))!;
+      expect(raw.endsWith("\n")).toBe(true);
+      expect(raw.endsWith("\n\n")).toBe(false);
+      const lines = raw.slice(0, -1).split("\n");
+      expect(lines).toHaveLength(2);
+      for (const l of lines) expect(() => JSON.parse(l)).not.toThrow();
+      const { malformed } = await readGateLedger("nl-op", { cwd: dir });
+      expect(malformed).toBe(0);
+    });
+  });
+
+  test("a legacy ledger whose last line has no newline still reads and appends cleanly", async () => {
+    await withTestDir(async (dir) => {
+      await initRepo(dir);
+      await writeBlobToPath("_gates", "legacy.jsonl", JSON.stringify({ kind: "x" }), "seed", { cwd: dir });
+      await appendGateResolution(
+        { op: "legacy", gate: "g", resolvedBy: "alex", timestamp: "2026-01-01T00:00:00.000Z" },
+        { cwd: dir },
+      );
+      const raw = (await readBlobFromPath("_gates", "legacy.jsonl", { cwd: dir }))!;
+      expect(raw.endsWith("\n")).toBe(true);
+      expect(raw.split("\n").filter(Boolean)).toHaveLength(2);
+    });
+  });
+});

package/src/lifecycle/gate-ledger.ts

@@ -367,7 +367,7 @@ async function appendGateLine(
     try {
       const priorSha = await readPathSha(DIR, filename(record.op), opts);
       const existing = priorSha ? await readBlobBySha(priorSha, opts) : null;
-      const content = existing ? `${existing.replace(/\n$/, "")}\n${json}` : json;
+      const content = `${existing ? `${existing.replace(/\n$/, "")}\n` : ""}${json}\n`;
       return await writeBlobToPath(DIR, filename(record.op), content, message, {
         ...opts,
         expectPriorPathSha: priorSha,

package/src/lifecycle/git.ts

@@ -485,7 +485,7 @@ export async function appendReleaseRecordLine(
     try {
       const priorSha = await readPathSha(environment, filename, opts);
       const existing = priorSha ? await readBlobBySha(priorSha, opts) : null;
-      const content = existing ? `${existing.replace(/\n$/, "")}\n${recordJson}` : recordJson;
+      const content = `${existing ? `${existing.replace(/\n$/, "")}\n` : ""}${recordJson}\n`;
       return await writeBlobToPath(environment, filename, content, "Release record", {
         ...opts,
         expectPriorPathSha: priorSha,

package/src/lifecycle/override-ledger.ts

@@ -55,7 +55,7 @@ export async function recordOverridesApplied(records: readonly AppliedOverrideRe
     try {
       const priorSha = await readPathSha(APPLIED_DIR, APPLIED_FILE, opts);
       const existing = priorSha ? await readBlobBySha(priorSha, opts) : null;
-      const content = existing ? `${existing.replace(/\n$/, "")}\n${lines}` : lines;
+      const content = `${existing ? `${existing.replace(/\n$/, "")}\n` : ""}${lines}\n`;
       return await writeBlobToPath(APPLIED_DIR, APPLIED_FILE, content, `Applied under override: ${records.map((r) => r.gate).join(", ")}`, {
         ...opts,
         expectPriorPathSha: priorSha,

package/src/lifecycle/run-ledger.ts

@@ -160,7 +160,7 @@ export async function appendRunRecord(
     try {
       const priorSha = await readPathSha(record.env, filename, opts);
       const existing = priorSha ? await readBlobBySha(priorSha, opts) : null;
-      const content = existing ? `${existing.replace(/\n$/, "")}\n${json}` : json;
+      const content = `${existing ? `${existing.replace(/\n$/, "")}\n` : ""}${json}\n`;
       const commit = await writeBlobToPath(record.env, filename, content, `Op run record: ${record.op}`, {
         ...opts,
         expectPriorPathSha: priorSha,

package/src/lifecycle/work-lease.ts

@@ -408,7 +408,7 @@ async function appendLeaseHistory(record: LeaseHistoryRecord, opts: { cwd: strin
     try {
       const priorSha = await readPathSha(LEASES_DIR, file, opts);
       const existing = priorSha ? await readBlobBySha(priorSha, opts) : null;
-      const content = existing ? `${existing.replace(/\n$/, "")}\n${json}` : json;
+      const content = `${existing ? `${existing.replace(/\n$/, "")}\n` : ""}${json}\n`;
       commit = await writeBlobToPath(LEASES_DIR, file, content, `Work lease ${record.event}: ${record.item} (${record.holder})`, {
         ...opts,
         expectPriorPathSha: priorSha,

package/src/op/gate-review.test.ts

@@ -7,7 +7,7 @@ import { waveSetDigest } from "../gated-waves";
 import { sealGateApproval } from "../workspace/trust/seal";
 import { TestRepo, hasSshKeygen } from "../workspace/trust/test-repo";
 import type { GateResolutionRecord } from "../lifecycle/gate-ledger";
-import { memoryGateLedgerPort } from "./gate";
+import { gitGateLedgerPort, memoryGateLedgerPort } from "./gate";
 import { githubReviews, forgejoReviews, gitlabReviews, type MergedReview, type ReviewSource } from "./gate-review";
 import type { OpWavesSpec } from "./op-waves";
 import { recordOpWaveHeadPlans, runOpWave, type OpWaveExec, type OpWaveShowAtBase } from "./op-waves-run";
@@ -223,3 +223,55 @@ describe.skipIf(!hasSshKeygen)("a sealed wave (#3684)", () => {
     expect(await run([approval("alice", alice.file)])).toMatchObject({ exitCode: 0, applied: ["prod"], decision: { status: "approved", approvedBy: "alice" } });
   });
 });
+
+describe.skipIf(!hasSshKeygen)("identity.gates is read at the wave's --base (#3841)", () => {
+  const repo = new TestRepo("3841-base");
+  const alice = repo.key("alice");
+  afterAll(() => rmSync(join(repo.dir, ".."), { recursive: true, force: true }));
+  const GATE = "migrations-wave-1";
+  const waves = (approval: "ledger" | "sealed"): OpWavesSpec => ({ ...spec("sealed"), waves: [{ name: "prod", runs: [{ target: "prod" }], approval }] });
+  const workspace = (gates?: Record<string, object>) => JSON.stringify({ name: "acme", schema: 1, members: [], ...(gates ? { identity: { gates } } : {}) });
+
+  // Two commits on main: --base names the first, and main (the base a bare read falls back to) is the second.
+  function commits(atBase: string, atMain: string, approval: "ledger" | "sealed"): string {
+    repo.write("waves.json", JSON.stringify(waves(approval)));
+    repo.write(".chant/allowed_signers", `alice ${alice.pub}\n`);
+    repo.write("chant.workspace.json", atBase);
+    const base = repo.commit(`base (${approval})`);
+    repo.write("chant.workspace.json", atMain);
+    repo.commit(`main (${approval})`);
+    return base;
+  }
+
+  const plan = digest("a");
+  const set = waveSetDigest([{ member: "prod", planDigest: plan }]);
+  const approval = (by: string, keyFile?: string): GateResolutionRecord => {
+    const a = { op: "migrations", gate: GATE, resolvedBy: by, timestamp: "2026-10-10T00:00:00Z", planDigest: set };
+    return { version: 1, ...a, ...(keyFile ? { seal: sealGateApproval(keyFile, a) } : {}) };
+  };
+  const run = async (approvalMode: "ledger" | "sealed", base: string, resolutions: GateResolutionRecord[]) => {
+    const h = harness(plan, repo.dir);
+    const lines: string[] = [];
+    // The memory ledger, with the real port's identity.gates rule.
+    const gates = { ...memoryGateLedgerPort({ resolutions }), approvalRule: gitGateLedgerPort({ cwd: repo.dir }).approvalRule };
+    const result = await runOpWave({ spec: waves(approvalMode), specFile: "waves.json", wave: 1, base, cwd: repo.dir, exec: h.exec, gates, now: "2026-10-10T01:00:00Z", log: (l) => lines.push(l) });
+    return { result, lines };
+  };
+
+  test("a gate --base seals holds the wave, though main does not seal it, and the log says why", async () => {
+    const base = commits(workspace({ [GATE]: {} }), workspace(), "ledger");
+    expect(repo.head()).not.toBe(base);
+    const { result, lines } = await run("ledger", base, [approval("alice")]);
+    expect(result).toMatchObject({ exitCode: 3, applied: [], decision: { status: "waiting", base } });
+    expect(lines.join("\n")).toMatch(/the approval by alice at 2026-10-10T00:00:00Z does not count: .*not signed/);
+    // A seal by a signer at base passes both.
+    expect((await run("ledger", base, [approval("alice", alice.file)])).result).toMatchObject({ exitCode: 0, applied: ["prod"] });
+  });
+
+  test("a rule main adds does not judge a wave whose --base has none", async () => {
+    // At main the gate needs a class no pinned package supplies, which nothing passes.
+    const base = commits(workspace(), workspace({ [GATE]: { class: "operator" } }), "sealed");
+    const { result } = await run("sealed", base, [approval("alice", alice.file)]);
+    expect(result).toMatchObject({ exitCode: 0, applied: ["prod"], decision: { status: "approved", approvedBy: "alice" } });
+  });
+});

package/src/op/gate.ts

@@ -90,9 +90,11 @@ export interface GateLedgerPort {
   /**
    * The rule a workspace sets for approvals of `gate` (#3163, ws-080), or
    * null when none applies: the declaration's `identity.gates`, read at base.
+   * `at.base` names that commit, as an op wave reads every rule at its
+   * `--base` (#3841); absent, origin/HEAD, else `main`, else `master`.
    * Absent, every approval is judged as before.
    */
-  approvalRule?(gate: string): Promise<GateApprovalRule | null>;
+  approvalRule?(gate: string, at?: { base?: string }): Promise<GateApprovalRule | null>;
   /** The approvals a wave applied under (#3784), from `_gates/<op>/applied.jsonl`. Absent on a port that never spends approvals. */
   readApplied?(op: string): Promise<AppliedGateRecord[]>;
   /** Record that a wave is about to apply under an approval (#3784), which spends it. */
@@ -132,10 +134,10 @@ export function gitGateLedgerPort(opts?: { cwd?: string }): GateLedgerPort {
       const { resolutions, pending } = await readGateLedger(op, opts);
       return { resolutions, pending };
     },
-    async approvalRule(gate) {
+    async approvalRule(gate, at) {
       // Loaded on demand: the rule lives in the workspace modules, which import the Op modules.
       const { gateAdmission } = await import("../workspace/identity");
-      return gateAdmission(opts?.cwd ?? process.cwd(), gate);
+      return gateAdmission(opts?.cwd ?? process.cwd(), gate, at?.base);
     },
     async appendResolution(input) {
       const { record } = await appendGateResolution(input, opts);
@@ -355,8 +357,20 @@ export type GateCheck =
       mismatch?: GateDigestMismatch;
       /** Present on a gate with a quorum (#2508): who has approved this plan so far. */
       quorum?: GateQuorumProgress;
+      /**
+       * Approvals of this gate and plan, newer than the standing pending fact,
+       * that the port's approval rule did not count, and why (#3841), oldest
+       * first. Absent when there are none.
+       */
+      refused?: GateRefusedApproval[];
     };
 
+/** An approval the port's {@link GateLedgerPort.approvalRule} did not count, and why. */
+export interface GateRefusedApproval {
+  resolution: GateResolutionRecord;
+  reason: string;
+}
+
 /** How a recorded approval reads: its own `approver`, or for a record written before #2508, a human unless a model-authored channel wrote it. */
 export function approverOf(record: GateResolutionRecord): GateApprover {
   if (record.approver) return record.approver;
@@ -527,16 +541,24 @@ export async function evaluateGate(port: GateLedgerPort, input: GateCheckInput):
   const pending = env === undefined ? ledger.pending : ledger.pending.filter((p) => p.environment === env);
   // #3163: a gate the workspace's identity.gates names counts only signed approvals from its class.
   const rule = (await port.approvalRule?.(input.gate)) ?? null;
+  const standing = latestPendingGate(pending, input.gate);
+  const since = standing?.timestamp ?? EPOCH;
+  // #3841: an approval of this plan the rule refuses is named, so a wait says why.
+  const refused: GateRefusedApproval[] = [];
   const resolutions = (
     env === undefined
       ? ledger.resolutions
       : ledger.resolutions.filter((r) => r.environment === undefined || r.environment === env)
   )
-    .filter((r) => rule === null || r.gate !== input.gate || rule.refuses(r) === null)
-    .filter((r) => input.spent === undefined || r.gate !== input.gate || !isApprovalSpent(input.spent, r));
-
-  const standing = latestPendingGate(pending, input.gate);
-  const since = standing?.timestamp ?? EPOCH;
+    .filter((r) => input.spent === undefined || r.gate !== input.gate || !isApprovalSpent(input.spent, r))
+    .filter((r) => {
+      if (rule === null || r.gate !== input.gate) return true;
+      const reason = rule.refuses(r);
+      if (reason === null) return true;
+      if (samePlanDigest(r.planDigest, input.planDigest) && new Date(r.timestamp).getTime() >= new Date(since).getTime()) refused.push({ resolution: r, reason });
+      return false;
+    });
+  refused.sort((a, b) => new Date(a.resolution.timestamp).getTime() - new Date(b.resolution.timestamp).getTime());
 
   let mismatched: GateResolutionRecord | undefined;
   let quorum: GateQuorumProgress | undefined;
@@ -579,7 +601,7 @@ export async function evaluateGate(port: GateLedgerPort, input: GateCheckInput):
         ...(env !== undefined ? { environment: env } : {}),
       }
     : undefined;
-  const asMismatch = { ...(mismatch ? { mismatch } : {}), ...(quorum ? { quorum } : {}) };
+  const asMismatch = { ...(mismatch ? { mismatch } : {}), ...(quorum ? { quorum } : {}), ...(refused.length > 0 ? { refused } : {}) };
 
   // A standing fact only stands for the plan it was recorded against. When
   // the plan has moved, re-recording is what gives `chant approve` (which

package/src/op/op-waves-notify.ts

@@ -7,7 +7,8 @@
  * `refused`. A wave whose plan, apply or stage hook failed (exit 1) sends
  * `failed`. A wave the product's policy refused (exit 7, #3821) sends
  * `refused` with the runs it denied, and one whose apply was held by another
- * run (exit 5) sends `refused` with status `held`; one that stood down for a
+ * run (exit 5) sends `refused` with status `held`, and one whose decision
+ * point refused it (exit 8, #3836) sends `refused` with status `point`; one that stood down for a
  * newer run (exit 6) sends nothing. A share job of a waiting wave sends nothing, since its deciding
  * job already did, unless a hook in the share job itself held it (#3762). Delivery is `../notify.ts`: it never throws, and the job's exit code
  * is what the wave decided.
@@ -58,6 +59,17 @@ export function opWaveNotifyFields(spec: OpWavesSpec, k: number, outcome: OpWave
           : {}),
     };
   }
+  if (result.exitCode === 8 && decision?.refused?.reason === "point") {
+    // #3836: the gate's decision point was answered with an answer it does not pass on.
+    return {
+      ...base,
+      event: "refused",
+      status: "point",
+      summary: `${label} refused: decision point ${decision.point?.name ?? ""} answered ${JSON.stringify(decision.point?.answer?.answer ?? null)}`,
+      targets: decision.refused.runs,
+      ...(decision.refused.message ? { reason: decision.refused.message } : {}),
+    };
+  }
   if (result.exitCode === 7 && decision?.refused) {
     // #3821: the product's policy denied a run, and no override counts for it.
     return {

package/src/op/op-waves-point.test.ts

@@ -0,0 +1,254 @@
+/**
+ * A wave gate that asks a workspace decision point (#3836), against a stub
+ * asker and an in-memory gate ledger: the point is read at base, an open
+ * question waits (exit 3) with a pending fact citing it and the `points
+ * answer` line as `approve`, a passing answer for the set digest lets the
+ * wave apply under a resolution that cites it, any other answer refuses the
+ * wave (exit 8), and the waiting pending fact is what `chant run resume`
+ * resumes once the question is answered (#3835).
+ */
+
+import { afterEach, describe, expect, test, vi } from "vitest";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { assertOpWavesSpec, type OpWavesSpec } from "./op-waves";
+import { runOpWave, type OpWaveDecision, type OpWaveExec, type OpWaveShowAtBase } from "./op-waves-run";
+import { memoryGateLedgerPort } from "./gate";
+import { waveSetDigest } from "../gated-waves";
+import { pointGateResumable, type GatePointAsker, type GatePointQuestion, type GatePointRequest } from "../point-decision";
+import { resumeStanding } from "../cli/handlers/gate-resume";
+import { opWaveNotifyFields } from "./op-waves-notify";
+
+const digest = (n: string) => `sha256:${n.repeat(64)}`;
+const NOW = "2026-10-11T10:00:00.000Z";
+
+const spec: OpWavesSpec = {
+  name: "tf-apply",
+  op: "apply",
+  plan: ["tool", "plan", "{target}", "--out", "{plan}"],
+  apply: ["tool", "apply", "{target}", "--plan", "{plan}"],
+  point: { name: "prod-apply", timeout: "48h" },
+  waves: [
+    { name: "prod", runs: [{ target: "db" }, { target: "net" }], gate: "always" },
+    { name: "wide", runs: [{ target: "a" }, { target: "b" }], gate: "always", shares: 2 },
+  ],
+};
+
+/** A stub asker: each question's state comes from `answers`, by the plan digest it was asked about. */
+function stubAsker(answers: Map<string, Partial<GatePointQuestion>> = new Map()): GatePointAsker & { asked: GatePointRequest[] } {
+  const asked: GatePointRequest[] = [];
+  return {
+    asked,
+    async ask(request) {
+      asked.push(request);
+      const id = `${request.point}-${(request.facts.planDigest ?? "none").slice(7, 19)}`;
+      return {
+        id,
+        point: request.point,
+        path: `.chant/answers/${id}.md`,
+        state: "escalated",
+        answer: null,
+        decider: "quorum",
+        answeredBy: [],
+        subject: request.subject,
+        steward: null,
+        ...(answers.get(request.facts.planDigest ?? "") ?? {}),
+      };
+    },
+  };
+}
+
+function harness(atBase: OpWavesSpec | null = spec) {
+  const cwd = mkdtempSync(join(tmpdir(), "op-waves-point-"));
+  const calls: string[] = [];
+  const exec: OpWaveExec = (argv, dir) => {
+    calls.push(argv.join(" "));
+    if (argv[1] === "plan") writeFileSync(join(dir, argv[4]!), JSON.stringify({ planDigest: digest(argv[2]!.slice(0, 1)) }));
+    return 0;
+  };
+  const show: OpWaveShowAtBase = () => ({ sha: "b".repeat(40), text: atBase === null ? null : JSON.stringify(atBase) });
+  return { cwd, calls, exec, show, applied: () => calls.filter((c) => c.startsWith("tool apply")), done: () => rmSync(cwd, { recursive: true, force: true }) };
+}
+
+const prodSet = waveSetDigest([
+  { member: "db", planDigest: digest("d") },
+  { member: "net", planDigest: digest("n") },
+]);
+
+afterEach(() => vi.unstubAllEnvs());
+
+describe("a wave gate that asks a decision point (#3836)", () => {
+  test("the spec takes a point on the spec or a wave, and refuses a bad one", () => {
+    expect(() => assertOpWavesSpec(spec)).not.toThrow();
+    expect(() => assertOpWavesSpec({ ...spec, point: "prod-apply" })).not.toThrow();
+    expect(() => assertOpWavesSpec({ ...spec, point: { name: "Prod Apply" } })).toThrow(/decision point's name/);
+    expect(() => assertOpWavesSpec({ ...spec, point: { name: "prod-apply", timeout: "soon" } })).toThrow(/point.timeout/);
+    expect(() => assertOpWavesSpec({ ...spec, waves: [{ ...spec.waves[0]!, point: { name: "prod-apply", inputs: { "gate.planDigest": "x" } } }] })).toThrow(/wave "prod".*passes itself/);
+  });
+
+  test("a wave waits on the point's question, it is answered yes, and the wave applies under a resolution that cites the answer", async () => {
+    const h = harness();
+    const gates = memoryGateLedgerPort();
+    const answers = new Map<string, Partial<GatePointQuestion>>();
+    const asker = stubAsker(answers);
+
+    const waiting = await runOpWave({ spec, specFile: "waves.json", wave: 1, cwd: h.cwd, exec: h.exec, show: h.show, gates, points: asker, now: NOW, log: () => {} });
+    expect(waiting.exitCode).toBe(3);
+    expect(asker.asked[0]).toMatchObject({ point: "prod-apply", facts: { component: "tf-apply", name: "tf-apply-wave-1", planDigest: prodSet }, subject: "gate:tf-apply/tf-apply-wave-1" });
+    const id = asker.asked[0]!.point + "-" + prodSet.slice(7, 19);
+    expect(waiting.decision).toMatchObject({
+      status: "waiting",
+      digest: prodSet,
+      point: { name: "prod-apply", question: { id, state: "escalated" } },
+      approve: `chant workspace points answer ${id} --answer <answer> --by <your name>`,
+      pendingFact: { gate: "tf-apply-wave-1", planDigest: prodSet, answer: { point: "prod-apply", id } },
+    });
+    // The pending fact stands for 48h, as the point's timeout says.
+    expect(gates.appended[0]!.expiresAt).toBe("2026-10-13T10:00:00.000Z");
+    expect(h.applied()).toEqual([]);
+    expect(opWaveNotifyFields(spec, 1, { result: waiting })).toMatchObject({ event: "waiting", approve: { command: expect.stringContaining("points answer") } });
+
+    // A `chant approve` of the digest does not pass a gate that asks a point.
+    const approvedByHand = memoryGateLedgerPort({ resolutions: [{ version: 1, op: "tf-apply", gate: "tf-apply-wave-1", resolvedBy: "mallory", timestamp: NOW, planDigest: prodSet }] });
+    expect((await runOpWave({ spec, specFile: "waves.json", wave: 1, cwd: h.cwd, exec: h.exec, show: h.show, gates: approvedByHand, points: stubAsker(), now: NOW, log: () => {} })).exitCode).toBe(3);
+
+    answers.set(prodSet, { state: "answered", answer: true, answeredBy: ["alice"] });
+    const passed = await runOpWave({ spec, specFile: "waves.json", wave: 1, cwd: h.cwd, exec: h.exec, show: h.show, gates, points: asker, now: NOW, log: () => {} });
+    expect(passed).toMatchObject({ exitCode: 0, applied: ["db", "net"], decision: { status: "approved", via: "point", approvedBy: "alice", point: { answer: { id, answer: true } } } });
+    expect(gates.resolved).toHaveLength(1);
+    expect(gates.resolved[0]).toMatchObject({ gate: "tf-apply-wave-1", planDigest: prodSet, answer: { point: "prod-apply", id, answer: true } });
+
+    // Asked again for the same plan, the resolution already stands: none is written twice.
+    await runOpWave({ spec, specFile: "waves.json", wave: 1, cwd: h.cwd, exec: h.exec, show: h.show, gates, points: asker, now: NOW, log: () => {} });
+    expect(gates.resolved).toHaveLength(1);
+    h.done();
+  });
+
+  test("each plan is its own question: a yes for one set digest does not pass another", async () => {
+    const h = harness();
+    const other = digest("z");
+    const asker = stubAsker(new Map([[other, { state: "answered", answer: true, answeredBy: ["alice"] }]]));
+    const result = await runOpWave({ spec, specFile: "waves.json", wave: 1, cwd: h.cwd, exec: h.exec, show: h.show, gates: memoryGateLedgerPort(), points: asker, now: NOW, log: () => {} });
+    expect(result.exitCode).toBe(3);
+    h.done();
+  });
+
+  test("an answer the gate does not pass on refuses the wave with exit 8, and nothing applies", async () => {
+    const h = harness();
+    const asker = stubAsker(new Map([[prodSet, { state: "answered", answer: false, answeredBy: ["bob"] }]]));
+    const logs: string[] = [];
+    const refused = await runOpWave({ spec, specFile: "waves.json", wave: 1, cwd: h.cwd, exec: h.exec, show: h.show, gates: memoryGateLedgerPort(), points: asker, now: NOW, log: (l) => logs.push(l) });
+    expect(refused).toMatchObject({
+      exitCode: 8,
+      applied: [],
+      decision: { status: "refused", refused: { reason: "point", runs: ["db", "net"] }, point: { answer: { answer: false } } },
+    });
+    expect(refused.decision!.refused!.message).toMatch(/answered false .* passes only on true/);
+    expect(h.applied()).toEqual([]);
+    expect(opWaveNotifyFields(spec, 1, { result: refused })).toMatchObject({ event: "refused", status: "point", targets: ["db", "net"] });
+    h.done();
+  });
+
+  test("a wide wave's shares refuse with exit 8 when the deciding job's point said no", async () => {
+    const h = harness();
+    const set = waveSetDigest([
+      { member: "a", planDigest: digest("a") },
+      { member: "b", planDigest: digest("b") },
+    ]);
+    const asker = stubAsker(new Map([[set, { state: "answered", answer: false, answeredBy: ["bob"] }]]));
+    const decided = await runOpWave({ spec, specFile: "waves.json", wave: 2, decide: true, cwd: h.cwd, exec: h.exec, show: h.show, gates: memoryGateLedgerPort(), points: asker, now: NOW, log: () => {} });
+    expect(decided.exitCode).toBe(8);
+    const record = JSON.parse(readFileSync(join(h.cwd, ".chant/op-waves/tf-apply/wave-2.json"), "utf-8")) as OpWaveDecision;
+    expect(record.refused?.reason).toBe("point");
+    const share = await runOpWave({ spec, specFile: "waves.json", wave: 2, share: 1, cwd: h.cwd, exec: h.exec, show: h.show, log: () => {} });
+    expect(share.exitCode).toBe(8);
+    expect(h.applied()).toEqual([]);
+    h.done();
+  });
+
+  test("the point is read at base: a change can neither add one nor drop one for its own gate", async () => {
+    const bare: OpWavesSpec = { ...spec, point: undefined };
+    // The change adds a point, the base has none: the ledger decides.
+    const added = harness(bare);
+    const ledgerApproved = memoryGateLedgerPort({ resolutions: [{ version: 1, op: "tf-apply", gate: "tf-apply-wave-1", resolvedBy: "alice", timestamp: NOW, planDigest: prodSet }] });
+    const asker = stubAsker();
+    const logs: string[] = [];
+    const viaLedger = await runOpWave({ spec, specFile: "waves.json", wave: 1, cwd: added.cwd, exec: added.exec, show: added.show, gates: ledgerApproved, points: asker, now: NOW, log: (l) => logs.push(l) });
+    expect(viaLedger).toMatchObject({ exitCode: 0, decision: { status: "approved", via: "ledger" } });
+    expect(asker.asked).toHaveLength(0);
+    expect(logs.some((l) => l.includes("the one at base holds"))).toBe(true);
+    added.done();
+
+    // The change drops the point the base has: the point still decides.
+    const dropped = harness(spec);
+    const still = await runOpWave({ spec: bare, specFile: "waves.json", wave: 1, cwd: dropped.cwd, exec: dropped.exec, show: dropped.show, gates: ledgerApproved, points: asker, now: NOW, log: () => {} });
+    expect(still.exitCode).toBe(3);
+    expect(asker.asked).toHaveLength(1);
+    dropped.done();
+
+    // A wave's own point wins over the spec's.
+    const own: OpWavesSpec = { ...spec, waves: [{ ...spec.waves[0]!, point: { name: "db-apply", pass: ["apply"] } }, spec.waves[1]!] };
+    const mine = harness(own);
+    const ownAsker = stubAsker(new Map([[prodSet, { state: "answered", answer: "apply", answeredBy: ["carol"] }]]));
+    expect(await runOpWave({ spec: own, specFile: "waves.json", wave: 1, cwd: mine.cwd, exec: mine.exec, show: mine.show, gates: memoryGateLedgerPort(), points: ownAsker, now: NOW, log: () => {} })).toMatchObject({
+      exitCode: 0,
+      decision: { via: "point", approvedBy: "carol" },
+    });
+    expect(ownAsker.asked[0]!.point).toBe("db-apply");
+    mine.done();
+
+    // A point at base no gate could ask fails the wave rather than fall back to the ledger.
+    const broken = harness({ ...spec, point: { name: "Not A Point" } });
+    const failed = await runOpWave({ spec, specFile: "waves.json", wave: 1, cwd: broken.cwd, exec: broken.exec, show: broken.show, gates: ledgerApproved, points: asker, now: NOW, log: () => {} });
+    expect(failed.exitCode).toBe(1);
+    expect(broken.calls).toEqual([]);
+    broken.done();
+  });
+
+  test("a policy that lets the wave through asks nothing", async () => {
+    const free: OpWavesSpec = { ...spec, waves: [{ ...spec.waves[0]!, gate: "never" }, spec.waves[1]!] };
+    const h = harness(free);
+    const asker = stubAsker();
+    expect(await runOpWave({ spec: free, specFile: "waves.json", wave: 1, cwd: h.cwd, exec: h.exec, show: h.show, gates: memoryGateLedgerPort(), points: asker, log: () => {} })).toMatchObject({
+      exitCode: 0,
+      decision: { status: "not-required" },
+    });
+    expect(asker.asked).toHaveLength(0);
+    h.done();
+  });
+
+  test("resume picks up the waiting wave once its question is answered (#3835)", async () => {
+    vi.stubEnv("GITLAB_CI", "");
+    vi.stubEnv("GITHUB_ACTIONS", "true");
+    vi.stubEnv("GITHUB_REPOSITORY", "acme/infra");
+    vi.stubEnv("GITHUB_RUN_ID", "4242");
+    vi.stubEnv("GITHUB_RUN_ATTEMPT", "1");
+    vi.stubEnv("FORGEJO_ACTIONS", "");
+    vi.stubEnv("GITEA_ACTIONS", "");
+    const h = harness();
+    const gates = memoryGateLedgerPort();
+    const waiting = await runOpWave({ spec, specFile: "waves.json", wave: 1, cwd: h.cwd, exec: h.exec, show: h.show, gates, points: stubAsker(), now: NOW, log: () => {} });
+    expect(waiting.exitCode).toBe(3);
+    const fact = gates.appended[0]!;
+    expect(fact.resume).toMatchObject({ forge: "github", repo: "acme/infra", run: "4242" });
+    const id = fact.answer!.id;
+
+    const open = { id, state: "escalated" as const, answer: null, answeredBy: [], answeredOn: null };
+    expect(pointGateResumable(fact, open)).toMatchObject({ resumable: false, why: "open" });
+    expect(await resumeStanding(fact, [], { questions: new Map([[id, open]]), dryRun: true })).toMatchObject({ status: "not-approved" });
+
+    const no = { ...open, state: "answered" as const, answer: false, answeredBy: ["bob"], answeredOn: NOW };
+    expect(pointGateResumable(fact, no)).toMatchObject({ resumable: false, why: "refused" });
+
+    const yes = { ...open, state: "answered" as const, answer: true, answeredBy: ["alice"], answeredOn: NOW };
+    expect(await resumeStanding(fact, [], { questions: new Map([[id, yes]]), dryRun: true })).toMatchObject({
+      op: "tf-apply",
+      gate: "tf-apply-wave-1",
+      status: "skipped",
+      approvedBy: "alice",
+      message: expect.stringContaining("would resume github run 4242"),
+    });
+    h.done();
+  });
+});