toolroll 0.9.102 → 0.9.103

package/dist/browser-workspace.d.ts

@@ -1725,8 +1725,9 @@ export type BrowserHomeView = {
         value: number;
         href: string;
     }[];
-    /** What needs you, by what is asked, in this order: approve, answer, wrong, review, other (anything none of the four
-     * fits). `count` is the exact total for that ask, past the rows listed. */
+    /** What needs you, by what is asked, in this order: release, approve, answer, flow, wrong, review, setup, other
+     * (anything none of the others fits; docs/plans/home-other-asks.md). `count` is the exact total for that ask, past the
+     * rows listed. */
     groups: {
         key: BrowserHomeAsk;
         label: string;
@@ -1761,9 +1762,10 @@ export type BrowserHomeView = {
     /** While the first run is open (no first result yet): the welcome's address, linked as Finish setup. */
     setup?: string | null;
 };
-/** What a waiting row asks (work-index.ts WorkAskGroup). */
-export type BrowserHomeAsk = 'approve' | 'answer' | 'wrong' | 'review' | 'other';
+/** What a waiting row asks (work-index.ts WorkAskGroup), plus a flow card waiting on you and a first-run step. */
+export type BrowserHomeAsk = 'release' | 'approve' | 'answer' | 'flow' | 'wrong' | 'review' | 'setup' | 'other';
 export type BrowserHomeRow = {
+    /** A task row's family id; a row that isn't a task is namespaced (`release:<task>`, `flow:<card>`, `setup:<step>`). */
     id: string;
     title: string;
     href: string;
@@ -1777,7 +1779,8 @@ export type BrowserHomeRow = {
     reason: string | null;
     /** One line: what it asks, or what the agent is doing now. */
     line: string | null;
-    /** The one act that resolves it (a link), or null. */
+    /** The one act that resolves it (a link), or null. A release, a flow card or a setup step is never acted on at
+     * Home: its one link opens its own page. */
     action: {
         label: string;
         href: string;

package/dist/desktop-update.d.ts

@@ -97,13 +97,13 @@ export declare function sqliteLock(file: string, busyTimeoutMs?: number): Databa
 export declare function lockHeld(file: string): boolean;
 export declare const installationLock: (j: UpdateJournal) => DatabaseSync | null;
 export declare function desktopUpdateStatus(stateDir: string): {
-    error?: never;
     active: boolean;
     phase: string;
     detail: string;
     running: boolean;
     canResume: boolean;
     canCancel: boolean;
+    error?: never;
     automaticRecovery?: never;
     recoveryAttempts?: never;
     recoveryRepairs?: never;

package/dist/flow-engine.d.ts

@@ -9,6 +9,9 @@ export type FlowAdvance = {
 export declare function flowDefinitionOf(flow: FlowRow): FlowDefinition | null;
 /** Where a card's link opens: the flow's canvas with the card selected. */
 export declare const flowCardHref: (flow: number, card: number) => string;
+/** A reply wait that timed out with nowhere to send the card asks its owner (or the flow's owner) to move it on: the
+ * card's waiting words end with this (flows-ui.ts flowCardWaitsOn reads it). */
+export declare const NO_REPLY_MOVE_ON = "Move the card on when you're ready.";
 /** Where a confirmed flow action may point: a flow's canvas, maybe with one card open. */
 export declare const FLOW_HREF: RegExp;
 /** Advance every active card in one project's flows. */

package/dist/flow-engine.js

@@ -36,6 +36,9 @@ export function flowDefinitionOf(flow) {
 }
 /** Where a card's link opens: the flow's canvas with the card selected. */
 export const flowCardHref = (flow, card) => `/flows/${flow}?card=${card}`;
+/** A reply wait that timed out with nowhere to send the card asks its owner (or the flow's owner) to move it on: the
+ * card's waiting words end with this (flows-ui.ts flowCardWaitsOn reads it). */
+export const NO_REPLY_MOVE_ON = "Move the card on when you're ready.";
 /** Where a confirmed flow action may point: a flow's canvas, maybe with one card open. */
 export const FLOW_HREF = /^\/flows\/[1-9][0-9]{0,9}(\?card=[1-9][0-9]{0,9})?$/;
 const ACCEPTANCE = FLOW_ACCEPTANCE;
@@ -173,7 +176,7 @@ function advanceCard(store, flow, definition, card, now, options, outcome) {
                     outcome.moved++;
                 return;
             }
-            const waiting = `No reply after ${words}. Move the card on when you're ready.`;
+            const waiting = `No reply after ${words}. ${NO_REPLY_MOVE_ON}`;
             if (card.waiting !== waiting) {
                 store.updateFlowCard(card.id, { waiting }, now);
                 notifyPeople(store, card, [card.owner ?? flow.owner], null, { key: `no-reply:${card.entry}`, subject: `No reply to “${card.title}” after ${words}`, body: `It's waiting in ${stage.title}.`, attention: true }, now);

package/dist/flows-ui.d.ts

@@ -1,5 +1,6 @@
 import type { BrowserFlowView } from "./browser-workspace.js";
-import type { FlowRow, Store } from "./store.js";
+import { type FlowStage } from "./flows.js";
+import type { FlowCardRow, FlowRow, Store, SubagentQuestionRow } from "./store.js";
 import { type FlowFile, type FlowImportPlan } from "./flow-share.js";
 import { type Html } from "./html.js";
 /** The flow page's fallback rules, plus the Flows list and the import preview (kit pieces; only layout here). */
@@ -24,6 +25,35 @@ export declare function flowImportHtml(input: {
     previewed: string;
     problem: string | null;
 }): Html;
+/** Why a card waits on this person now (docs/plans/home-other-asks.md part 4, v2.3): the one rule the flow page's
+ * Decide and Home's Flow decisions both read, so they never disagree. Each needs approver standing:
+ * - `decide`: an approval zone it is theirs to decide (the zone's decider, the flow's owner for "to owner", any approver
+ *   when none is named), and no subagent of the zone deciding it first;
+ * - `choose`: a "Person chooses" zone waiting on them (flow-send.ts flowChoiceAt);
+ * - `answer`: its subagent's open question or tool-call request asked of them;
+ * - `browser`: a check zone waiting for browser use, which only an approver with every project may allow;
+ * - `reply`: a reply wait that ran out with nowhere to go, asking the card's owner (else the flow's) to move it on.
+ * `reads` passes what the caller already read (a missing key is read here). */
+export type FlowCardWait = {
+    decide: boolean;
+    choose: boolean;
+    answer: boolean;
+    browser: boolean;
+    reply: boolean;
+};
+export declare function flowCardWaitsOn(store: Store, flow: FlowRow, card: FlowCardRow, viewer: {
+    name: string;
+    approver: boolean;
+}, reads?: {
+    stage?: FlowStage | undefined;
+    asked?: SubagentQuestionRow | null;
+    choosing?: {
+        person: string;
+    } | null;
+    browser?: {
+        status: string;
+    } | null;
+}): FlowCardWait;
 /** One flow's canvas for one person. */
 export declare function flowView(store: Store, flow: FlowRow, viewer: {
     name: string;

package/dist/flows-ui.js

@@ -1,7 +1,7 @@
 /** Flows in the console: the list of a person's flows, and one flow's canvas
  * (the React view's data, plus a plain fallback page the view replaces). */
 import { liveAttemptOf, steerControlsFor } from "./steer-controls.js";
-import { draftFor, flowDefinitionOf } from "./flow-engine.js";
+import { draftFor, flowDefinitionOf, NO_REPLY_MOVE_ON } from "./flow-engine.js";
 import { describeStandingOrder } from "./flow-schedule.js";
 import { describeTrigger, triggerHeadline, FLOW_TRIGGER_KINDS, FLOW_TRIGGER_WORDS, githubRepoOf, HOOK_PATH, hookReady, planeStatusLink, readHooksBase, readLinearKey, senderOf, takesDeliveries, triggerConfigOf } from "./flow-triggers.js";
 import { SENDER_WORDS } from "./webhook-signing.js";
@@ -14,7 +14,7 @@ import { parseSortDecision, sortChip } from "./flow-sort.js";
 import { flowSecretNames, readEmailSettings, sendingReady } from "./flow-actions.js";
 import { projectToolsOf, secretsSetFor, toolStanding } from "./project-tools.js";
 import { flowFingerprint } from "./flow-live.js";
-import { flowChoiceAt, readFlowSend } from "./flow-send.js";
+import { flowChoiceAt, flowPersonOf, readFlowSend } from "./flow-send.js";
 import { itemCaption, whyLines } from "./flow-items.js";
 import { FLOW_FILE_MAX_BYTES } from "./flow-share.js";
 import { googleConnected } from "./google-mail.js";
@@ -224,6 +224,37 @@ const historyText = (event, title, sorts = new Set()) => {
         default: return `Moved to ${title(event.toStage)}${who}${note}`;
     }
 };
+export function flowCardWaitsOn(store, flow, card, viewer, reads = {}) {
+    const none = { decide: false, choose: false, answer: false, browser: false, reply: false };
+    if (!viewer.approver || card.state !== "active")
+        return none;
+    const stage = "stage" in reads ? reads.stage : flowDefinitionOf(flow)?.stages.find(one => one.id === card.stage);
+    // Its subagent's open question is the person's to answer whatever zone it is in, even one since removed from the flow
+    // (the flow page shows it and takes the answer).
+    const asked = "asked" in reads ? reads.asked ?? null : store.openSubagentQuestionOn(card.id, card.entry);
+    const answer = asked !== null && asked.state === "open" && asked.askedOf === viewer.name && store.getSubagent(asked.subagent) !== null;
+    if (stage === undefined)
+        return { ...none, answer };
+    const decider = stage.kind === "approval" ? deciderOf(stage, flow) : null;
+    // While its subagent is deciding (v92), the card isn't anyone else's to decide yet.
+    const subagentDeciding = stage.subagent !== undefined && card.waiting !== null && card.waiting.endsWith(" is deciding");
+    const choosing = stage.kind !== "choose" ? null : "choosing" in reads ? reads.choosing ?? null : flowChoiceAt(store, card.id, card.entry);
+    const browser = stage.kind !== "check" || stage.browser !== true ? null : "browser" in reads ? reads.browser ?? null : browserViewOf(store, flow);
+    const wait = stage.wait ?? { for: "reply" };
+    return {
+        decide: stage.kind === "approval" && (decider === null || decider === viewer.name) && !subagentDeciding,
+        choose: choosing !== null && choosing.person === viewer.name,
+        answer,
+        browser: browserWaitOn(card, stage, browser) && store.accountOf(viewer.name)?.projects === null,
+        reply: stage.kind === "wait" && wait.for === "reply" && card.waiting !== null && card.waiting.startsWith("No reply after ") && card.waiting.endsWith(NO_REPLY_MOVE_ON)
+            && flowPersonOf(card, flow) === viewer.name,
+    };
+}
+/** A check zone's card waiting for browser use (flow-browser.ts): the flow's browser isn't allowed and the card says so. */
+function browserWaitOn(card, stage, browser) {
+    return card.state === "active" && stage?.kind === "check" && stage.browser === true && browser !== null && browser.status !== "allowed"
+        && card.waiting !== null && card.waiting.startsWith(`${stage.title} starts a browser`);
+}
 /** One flow's canvas for one person. */
 export function flowView(store, flow, viewer, selectedCard, setup = { dir: null, repos: [] }) {
     const definition = flowDefinitionOf(flow);
@@ -249,10 +280,12 @@ export function flowView(store, flow, viewer, selectedCard, setup = { dir: null,
         const canReadTask = taskRepo !== null && (taskRepo === flow.repo || (setup.repos.includes(taskRepo) && store.accountCanAccess(viewer.name, taskRepo)));
         const discussion = store.flowComments(card.id);
         const watchers = store.flowCardWatchers(card.id);
-        const decider = stage?.kind === "approval" ? deciderOf(stage, flow) : null;
-        // While its subagent is deciding (v92), the card isn't anyone else's to decide yet.
-        const subagentDeciding = stage?.subagent !== undefined && card.waiting !== null && card.waiting.endsWith(" is deciding");
-        const canDecide = viewer.approver && card.state === "active" && stage?.kind === "approval" && (decider === null || decider === viewer.name) && !subagentDeciding;
+        // Its open question: one of its own, or (v94) a tool call waiting for approval.
+        const asked = card.state === "active" ? store.openSubagentQuestionOn(card.id, card.entry) : null;
+        // "Person chooses" (flow-send.ts): what was sent, and the options, for the person it waits on; the latest send otherwise.
+        const choosing = card.state === "active" && stage?.kind === "choose" ? flowChoiceAt(store, card.id, card.entry) : null;
+        // Who may decide it here: the one rule Home reads too (flowCardWaitsOn).
+        const canDecide = flowCardWaitsOn(store, flow, card, viewer, { stage, asked, choosing, browser: browserNow }).decide;
         // History reads moves and ownership together, newest first.
         const owned = discussion.filter(one => one.kind === "owner").map(one => ({ text: one.body === "" ? `${one.author} left it without an owner` : one.body === one.author ? `${one.author} took it on` : `${one.author} made ${one.body} the owner`, at: one.at }));
         const moves = store.flowEvents(card.id).map(event => ({ text: historyText(event, title, sortZones), at: event.at }));
@@ -266,8 +299,6 @@ export function flowView(store, flow, viewer, selectedCard, setup = { dir: null,
             at: until.toISOString(),
             label: stage.wait !== undefined && stage.wait.for !== "hours" ? (stage.wait.for === "reply" ? "No reply by" : "Moves on at") : stage.limit.to !== null ? `Moves to ${title(stage.limit.to)} at` : "Reminder at",
         };
-        // Its open question: one of its own, or (v94) a tool call waiting for approval.
-        const asked = card.state === "active" ? store.openSubagentQuestionOn(card.id, card.entry) : null;
         const pending = asked?.toolCall == null ? null : store.subagentCall(asked.toolCall);
         // A decision its subagent handed over carries what the subagent said (v92).
         const turn = card.state === "active" && stage?.kind === "approval" && stage.subagent !== undefined ? store.flowStepRun(card.id, card.entry) : null;
@@ -284,8 +315,6 @@ export function flowView(store, flow, viewer, selectedCard, setup = { dir: null,
             }
         }
         const asker = asked === null || asked.state !== "open" ? null : store.getSubagent(asked.subagent);
-        // "Person chooses" (flow-send.ts): what was sent, and the options, for the person it waits on; the latest send otherwise.
-        const choosing = card.state === "active" && stage?.kind === "choose" ? flowChoiceAt(store, card.id, card.entry) : null;
         const latest = store.flowSends(card.id)[0] ?? null;
         const sentContent = latest === null ? null : readFlowSend(latest.contentJson);
         // On the card itself: where it came from (the card's title is right above), and only the links the panel doesn't already have.
@@ -295,8 +324,7 @@ export function flowView(store, flow, viewer, selectedCard, setup = { dir: null,
             // After research: the same numbered items the message carried, each beside its screenshot.
             ...(content.items === undefined ? {} : { items: content.items.map((item, index) => ({ number: index + 1, title: item.title, lines: whyLines(item.why), source: item.source, url: item.url,
                     image: item.shot === null || content.shots === null ? null : { src: `/r/${content.shots.run}/evidence/${item.shot}`, caption: itemCaption(index + 1, item) } })) }) });
-        const browserWait = card.state === "active" && stage?.kind === "check" && stage.browser === true && browser !== null && browser.status !== "allowed"
-            && card.waiting !== null && card.waiting.startsWith(`${stage.title} starts a browser`);
+        const browserWait = browserWaitOn(card, stage, browser);
         return {
             id: card.id, title: card.title, description: card.description, stage: card.stage, state: card.state,
             waiting: card.state === "active" && card.task !== null && (stage?.kind === "task" || stage?.kind === "report")

package/dist/project-knowledge.d.ts

@@ -24,10 +24,10 @@ export declare function knowledgeVersion(store: Store, repo: string, actor: stri
 export declare function conversationKnowledge(store: Store, repo: string, actor: string, reference?: string, decision?: number): {
     title?: never;
     content?: never;
-    history?: never;
     revision: number;
     stale: boolean;
     notice: string;
+    history?: never;
     instructions?: never;
     references?: never;
     decisions?: never;
@@ -35,7 +35,6 @@ export declare function conversationKnowledge(store: Store, repo: string, actor:
 } | {
     title?: never;
     content?: never;
-    history?: never;
     stale?: never;
     decision: {
         repo: string;
@@ -54,17 +53,18 @@ export declare function conversationKnowledge(store: Store, repo: string, actor:
     afterwards?: string;
     notice: string;
     revision?: never;
+    history?: never;
     instructions?: never;
     references?: never;
     decisions?: never;
     waiting?: never;
 } | {
-    history?: never;
     stale?: never;
     revision: number;
     title: string;
     content: string;
     notice: string;
+    history?: never;
     instructions?: never;
     references?: never;
     decisions?: never;

package/dist/release-approval.d.ts

@@ -1,22 +1,8 @@
 import { type PullRequestReader, type ReleaseCard, type ReleaseSeal, type TermLine } from "./release-card.js";
 import { type ApproveResult, type Scope } from "./scope.js";
 import { type Notification, type Store } from "./store.js";
-/** The ledger act holding the coordinator's latest reading of the pull request's CI on the exact candidate. */
-export declare const RELEASE_CI_SEEN_ACTION = "release CI observed";
-/** One check's newest attempt, as the coordinator's own gh read it. A re-run is a new check run id. */
-export type ReleaseCiRun = {
-    id: number | null;
-    name: string;
-    status: string;
-    conclusion: string | null;
-};
-export type ReleaseCiSnapshot = {
-    candidate: string;
-    at: string;
-    state: "passed" | "running" | "failed";
-    failed: string[];
-    runs: ReleaseCiRun[];
-};
+import { type ReleaseCiSnapshot } from "./release-refusal.js";
+export { ciWords, releaseApprovalRefusal, releaseCiOf, RELEASE_CI_SEEN_ACTION, type ReleaseCiRun, type ReleaseCiSnapshot } from "./release-refusal.js";
 /**
  * Record what the coordinator just read of the pull request's CI on `candidate` (its verdict and every check's newest
  * attempt), when it differs from the last reading recorded: the sheet and the CLI show it, and the card digest binds
@@ -35,13 +21,9 @@ export declare function recordReleaseCi(store: Store, input: {
     }[];
     now: Date;
 }): boolean;
-/** The coordinator's latest CI reading for this task on exactly `candidate`, or null (not read yet, or another commit). */
-export declare function releaseCiOf(store: Store, taskId: string, candidate: string): ReleaseCiSnapshot | null;
 /** What of a CI reading the card binds: its state and each check's attempt, whether it finished, and how. Queued and
  * in progress read alike (neither is finished); the time it was read is not bound. */
 export declare function ciBinding(ci: ReleaseCiSnapshot | null): unknown;
-/** GitHub CI in one line, as the sheet and the CLI say it. */
-export declare function ciWords(ci: ReleaseCiSnapshot | null, candidate: string): string;
 export type ReleaseApprovalCard = {
     taskId: string;
     taskRef: number;
@@ -189,3 +171,10 @@ export declare function waitingJournals(stateDir: string, expectedFile: (branch:
     journals: WaitingJournal[];
     unreadable: string[];
 };
+/** A release as Home names it (docs/plans/home-other-asks.md, part 1): its version, and why it can't take a yes now
+ * in the sheet's own words (`refusalOf`, the one source), or null when this isn't a release. Reads only; Home never
+ * approves one, it links to the sheet. */
+export declare function releaseAskOf(store: Store, taskId: string): {
+    version: string;
+    refusal: string | null;
+} | null;

package/dist/release-approval.js

@@ -19,20 +19,19 @@ import { lstatSync, readdirSync, readFileSync, realpathSync } from "node:fs";
 import { join } from "node:path";
 import { permissionPlainWords } from "./chat-terms.js";
 import { approvalTermsOf, releaseAccessWords, releaseCardOf, releaseSealOf } from "./release-card.js";
-import { releaseCiHoldOf, releaseCiHoldWords } from "./release-ci-hold.js";
 import { approvalOf } from "./scope.js";
 import { releaseProgressFor } from "./store.js";
 import { taskArchived } from "./task-archive.js";
 import { cleanTerminalLine } from "./terminal-text.js";
+import { ciName, ciWords, refusalOf, releaseCiOf, RELEASE_CI_SEEN_ACTION } from "./release-refusal.js";
+// The CI reading and the refusals live in release-refusal.ts, so scope.ts approve() can read them without a cycle.
+export { ciWords, releaseApprovalRefusal, releaseCiOf, RELEASE_CI_SEEN_ACTION } from "./release-refusal.js";
 const SHA = /^[0-9a-f]{40}$/;
 const DIGEST = /^[0-9a-f]{64}$/;
 /** A scope digest as scope.ts writes it. */
 const SCOPE_DIGEST = /^[0-9a-f]{32,64}$/;
 const sha256 = (text) => createHash("sha256").update(text).digest("hex");
 // ---- GitHub CI as the coordinator read it -------------------------------------------------------------------------
-/** The ledger act holding the coordinator's latest reading of the pull request's CI on the exact candidate. */
-export const RELEASE_CI_SEEN_ACTION = "release CI observed";
-const ciName = (value) => cleanTerminalLine(String(value ?? "")).trim().slice(0, 120);
 /**
  * Record what the coordinator just read of the pull request's CI on `candidate` (its verdict and every check's newest
  * attempt), when it differs from the last reading recorded: the sheet and the CLI show it, and the card digest binds
@@ -58,60 +57,11 @@ export function recordReleaseCi(store, input) {
         action: RELEASE_CI_SEEN_ACTION, outcome: input.state, source: "work", detail });
     return true;
 }
-/** The coordinator's latest CI reading for this task on exactly `candidate`, or null (not read yet, or another commit). */
-export function releaseCiOf(store, taskId, candidate) {
-    const row = store.handle.prepare("SELECT detail, at FROM action_ledger WHERE task_id = ? AND action = ? ORDER BY id DESC LIMIT 1").get(taskId, RELEASE_CI_SEEN_ACTION);
-    if (row === undefined)
-        return null;
-    let parsed;
-    try {
-        parsed = JSON.parse(String(row["detail"]));
-    }
-    catch {
-        return null;
-    }
-    const one = parsed;
-    if (one.v !== 1 || one.candidate !== candidate || !["passed", "running", "failed"].includes(String(one.state)) || !Array.isArray(one.failed) || !Array.isArray(one.runs))
-        return null;
-    return { candidate, at: String(row["at"]), state: one.state, failed: one.failed.map(ciName),
-        runs: one.runs.map(run => { const r = run; return { id: typeof r["id"] === "number" ? r["id"] : null, name: ciName(r["name"]), status: ciName(r["status"]), conclusion: r["conclusion"] == null ? null : ciName(r["conclusion"]) }; }) };
-}
 /** What of a CI reading the card binds: its state and each check's attempt, whether it finished, and how. Queued and
  * in progress read alike (neither is finished); the time it was read is not bound. */
 export function ciBinding(ci) {
     return ci === null ? null : { candidate: ci.candidate, state: ci.state, failed: ci.failed, runs: ci.runs.map(run => [run.id, run.name, run.status === "completed", run.conclusion]) };
 }
-/** GitHub CI in one line, as the sheet and the CLI say it. */
-export function ciWords(ci, candidate) {
-    const short = candidate.slice(0, 7);
-    if (ci === null)
-        return `GitHub CI on ${short} hasn't been read yet.`;
-    if (ci.state === "passed")
-        return `GitHub CI passed on ${short}.`;
-    if (ci.state === "failed")
-        return `GitHub CI failed on ${short}: ${ci.failed.join(", ") || "a check"}.`;
-    const finished = ci.runs.filter(run => run.status === "completed").length;
-    return `GitHub CI is running on ${short}: ${finished} of ${ci.runs.length} checks finished.`;
-}
-/** The release check failed on this task already (the coordinator's record): nobody approves it again here. */
-function checkFailed(store, taskId) {
-    return store.handle.prepare("SELECT 1 FROM release_step WHERE task_id = ? AND step = 'check' AND state = 'failed' LIMIT 1").get(taskId) !== undefined;
-}
-/** Why a release can't be approved now, from the plane's own state, or null. */
-function refusalOf(store, taskId, scope, ci) {
-    if (taskArchived(store, taskId))
-        return "This release is put away. Restore it before approving.";
-    const hold = releaseCiHoldOf(store, taskId);
-    if (hold !== null)
-        return releaseCiHoldWords(hold);
-    if (ci?.state === "failed")
-        return `${ciWords(ci, scope.candidate)} Fix the branch or rerun the failed job on GitHub, then release again.`;
-    if (checkFailed(store, taskId))
-        return "The release check already failed on this commit. Fix the branch and release the new commit.";
-    if (scope.approvedAt !== null && scope.approvedDigest !== scope.digest)
-        return "The release's terms changed after an earlier approval. Read them again.";
-    return null;
-}
 /** A release task from the plane's own state: a sealed form (terms or a release check's purpose) whose repository is the
  * task's project and whose approved commit is the scope's candidate. Never from a title or a task id. */
 export function releaseTaskOf(store, taskId) {
@@ -380,3 +330,14 @@ export function waitingJournals(stateDir, expectedFile) {
     }
     return { journals, unreadable };
 }
+/** A release as Home names it (docs/plans/home-other-asks.md, part 1): its version, and why it can't take a yes now
+ * in the sheet's own words (`refusalOf`, the one source), or null when this isn't a release. Reads only; Home never
+ * approves one, it links to the sheet. */
+export function releaseAskOf(store, taskId) {
+    const found = releaseTaskOf(store, taskId);
+    if (found === null)
+        return null;
+    const { scope, seal } = found;
+    const refusal = approvalOf(scope).approved ? null : refusalOf(store, taskId, scope, releaseCiOf(store, taskId, scope.candidate));
+    return { version: seal.identity.packageVersion, refusal };
+}

package/dist/release-refusal.d.ts

@@ -0,0 +1,32 @@
+import type { Scope } from "./scope.js";
+import type { Store } from "./store.js";
+/** The ledger act holding the coordinator's latest reading of the pull request's CI on the exact candidate. */
+export declare const RELEASE_CI_SEEN_ACTION = "release CI observed";
+/** One check's newest attempt, as the coordinator's own gh read it. A re-run is a new check run id. */
+export type ReleaseCiRun = {
+    id: number | null;
+    name: string;
+    status: string;
+    conclusion: string | null;
+};
+export type ReleaseCiSnapshot = {
+    candidate: string;
+    at: string;
+    state: "passed" | "running" | "failed";
+    failed: string[];
+    runs: ReleaseCiRun[];
+};
+export declare const ciName: (value: unknown) => string;
+/** The coordinator's latest CI reading for this task on exactly `candidate`, or null (not read yet, or another commit). */
+export declare function releaseCiOf(store: Store, taskId: string, candidate: string): ReleaseCiSnapshot | null;
+/** GitHub CI in one line, as the sheet and the CLI say it. */
+export declare function ciWords(ci: ReleaseCiSnapshot | null, candidate: string): string;
+/** Why a release can't be approved now, from the plane's own state, or null. */
+export declare function refusalOf(store: Store, taskId: string, scope: Scope, ci: ReleaseCiSnapshot | null): string | null;
+/**
+ * The release refusals every approval road shares (scope.ts approve(), read inside its transaction): for a scope
+ * sealing release terms or a release check's purpose, the sheet's own reasons in the sheet's own words, so the task
+ * page, Home's in-place yes, chat and `toolroll task approve` refuse exactly what `/t/<id>/release` refuses. Null for
+ * every other scope, and for a release nothing stops. The sheet's card digest binding stays the sheet's.
+ */
+export declare function releaseApprovalRefusal(store: Store, taskId: string, scope: Scope): string | null;

package/dist/release-refusal.js

@@ -0,0 +1,73 @@
+/**
+ * Why a release can't be approved now, from the plane's own state (release-approval.ts re-exports all of it): the
+ * coordinator's GitHub CI reading on the exact candidate, and the one list of refusals the release sheet shows and every
+ * approval road applies (scope.ts approve() reads `releaseApprovalRefusal` inside its transaction). Kept apart from
+ * release-approval.ts so scope.ts reads it without importing the card machinery (an import cycle through store.ts).
+ */
+import { releaseCiHoldOf, releaseCiHoldWords } from "./release-ci-hold.js";
+import { taskArchived } from "./task-archive.js";
+import { cleanTerminalLine } from "./terminal-text.js";
+/** The ledger act holding the coordinator's latest reading of the pull request's CI on the exact candidate. */
+export const RELEASE_CI_SEEN_ACTION = "release CI observed";
+export const ciName = (value) => cleanTerminalLine(String(value ?? "")).trim().slice(0, 120);
+/** The coordinator's latest CI reading for this task on exactly `candidate`, or null (not read yet, or another commit). */
+export function releaseCiOf(store, taskId, candidate) {
+    const row = store.handle.prepare("SELECT detail, at FROM action_ledger WHERE task_id = ? AND action = ? ORDER BY id DESC LIMIT 1").get(taskId, RELEASE_CI_SEEN_ACTION);
+    if (row === undefined)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(String(row["detail"]));
+    }
+    catch {
+        return null;
+    }
+    const one = parsed;
+    if (one.v !== 1 || one.candidate !== candidate || !["passed", "running", "failed"].includes(String(one.state)) || !Array.isArray(one.failed) || !Array.isArray(one.runs))
+        return null;
+    return { candidate, at: String(row["at"]), state: one.state, failed: one.failed.map(ciName),
+        runs: one.runs.map(run => { const r = run; return { id: typeof r["id"] === "number" ? r["id"] : null, name: ciName(r["name"]), status: ciName(r["status"]), conclusion: r["conclusion"] == null ? null : ciName(r["conclusion"]) }; }) };
+}
+/** GitHub CI in one line, as the sheet and the CLI say it. */
+export function ciWords(ci, candidate) {
+    const short = candidate.slice(0, 7);
+    if (ci === null)
+        return `GitHub CI on ${short} hasn't been read yet.`;
+    if (ci.state === "passed")
+        return `GitHub CI passed on ${short}.`;
+    if (ci.state === "failed")
+        return `GitHub CI failed on ${short}: ${ci.failed.join(", ") || "a check"}.`;
+    const finished = ci.runs.filter(run => run.status === "completed").length;
+    return `GitHub CI is running on ${short}: ${finished} of ${ci.runs.length} checks finished.`;
+}
+/** The release check failed on this task already (the coordinator's record): nobody approves it again here. */
+function checkFailed(store, taskId) {
+    return store.handle.prepare("SELECT 1 FROM release_step WHERE task_id = ? AND step = 'check' AND state = 'failed' LIMIT 1").get(taskId) !== undefined;
+}
+/** Why a release can't be approved now, from the plane's own state, or null. */
+export function refusalOf(store, taskId, scope, ci) {
+    if (taskArchived(store, taskId))
+        return "This release is put away. Restore it before approving.";
+    const hold = releaseCiHoldOf(store, taskId);
+    if (hold !== null)
+        return releaseCiHoldWords(hold);
+    if (ci?.state === "failed")
+        return `${ciWords(ci, scope.candidate)} Fix the branch or rerun the failed job on GitHub, then release again.`;
+    if (checkFailed(store, taskId))
+        return "The release check already failed on this commit. Fix the branch and release the new commit.";
+    if (scope.approvedAt !== null && scope.approvedDigest !== scope.digest)
+        return "The release's terms changed after an earlier approval. Read them again.";
+    return null;
+}
+/**
+ * The release refusals every approval road shares (scope.ts approve(), read inside its transaction): for a scope
+ * sealing release terms or a release check's purpose, the sheet's own reasons in the sheet's own words, so the task
+ * page, Home's in-place yes, chat and `toolroll task approve` refuse exactly what `/t/<id>/release` refuses. Null for
+ * every other scope, and for a release nothing stops. The sheet's card digest binding stays the sheet's.
+ */
+export function releaseApprovalRefusal(store, taskId, scope) {
+    // A sealed form, as release-card.ts releaseSealOf reads it (release terms, or a release check's purpose).
+    if (scope.releaseTerms == null && scope.releaseCheck == null)
+        return null;
+    return refusalOf(store, taskId, scope, scope.candidate == null ? null : releaseCiOf(store, taskId, scope.candidate));
+}

package/dist/scope.js

@@ -54,6 +54,7 @@ import { parseContract } from "./contracts/contract.js";
 import { readAcceptance, readScopeTerms, storedRubricSchema } from "./contracts/scope.js";
 import { taskArchived, taskCancelled } from "./task-archive.js";
 import { releaseCiHoldOf, releaseCiHoldWords } from "./release-ci-hold.js";
+import { releaseApprovalRefusal } from "./release-refusal.js";
 import { NO_READINESS, exactModelId, legOf, projectRoute, routeDigestOf, routeFromJson, routeJsonProblem, routeWords, } from "./phase-routing.js";
 /** Same shape as a runner's credential, for the same reasons. */
 function mintToken() {
@@ -1117,6 +1118,11 @@ chat) {
         const scope = store.getScope(taskId);
         if (scope === null)
             return { ok: false, reason: "no-scope" };
+        // A release takes no yes the release sheet would refuse (put away, CI held or failed, its check failed on this
+        // commit, terms changed after an earlier yes), in the sheet's words, on every road: read here, before any vote.
+        const releaseRefusal = releaseApprovalRefusal(store, taskId, scope);
+        if (releaseRefusal !== null)
+            return { ok: false, reason: "policy", message: releaseRefusal };
         // A put-away task (v145) is restored first; sealScopeApproval refuses it too, on every road.
         if (taskArchived(store, taskId))
             return { ok: false, reason: "archived" };

package/dist/server/home-asks.d.ts

@@ -0,0 +1,45 @@
+import type { FirstRunStep } from "../first-run.js";
+import type { Store } from "../store.js";
+import type { WorkSummaryAccess } from "../work-summary.js";
+/** One row Home lists that isn't a task's own row. `id` is namespaced so it never meets a task's id; `at` (when it
+ * started waiting) gives its age, or null for a setup step; `repo` its project. */
+export type HomeAskRow = {
+    id: string;
+    title: string;
+    href: string;
+    repo: string | null;
+    at: string | null;
+    line: string | null;
+    action: {
+        label: string;
+        href: string;
+    };
+};
+export type HomeAsks = {
+    /** A release's line for an approver (its version, or why the sheet can't take a yes now); null when it isn't one. */
+    release: (taskId: string) => string | null;
+    /** Releases whose publication waits for a person, one per family, only where that family isn't already a row. */
+    held: HomeAskRow[];
+    /** Flow cards waiting on this person. */
+    flows: HomeAskRow[];
+    /** First-run steps still to do, keyed by step. */
+    setup: (HomeAskRow & {
+        key: FirstRunStep["key"];
+    })[];
+};
+export declare const NO_HOME_ASKS: HomeAsks;
+/** The release sheet: where a release is read and approved, never Home. */
+export declare const releaseSheetHref: (taskId: string) => string;
+/** A release's line (its version, or the sheet's refusal) and every held publication in view. Approvers only: the sheet
+ * mints its approval only for them; anyone else reads a release as an ordinary task row. */
+export declare function releaseAsks(store: Store, now: Date, access: WorkSummaryAccess, project: string | null, approver: boolean): Pick<HomeAsks, "release" | "held">;
+/** Every active card, in a flow of a project this person may see, that waits on them (flows-ui.ts flowCardWaitsOn, the
+ * flow page's own rule). Newest wait first. */
+export declare function flowAsks(store: Store, repos: readonly string[], viewer: {
+    name: string;
+    approver: boolean;
+}, project: string | null): HomeAskRow[];
+/** The first-run steps (first-run.ts, with the builder step) still to do, for an approver. A step that is done, or only
+ * being checked (no answer yet, so no action), is not a row. Null steps (a restricted console, the demo, after the first
+ * success) are none. */
+export declare function setupAsks(steps: readonly FirstRunStep[] | null, approver: boolean): HomeAsks["setup"];