toolroll 0.9.102 → 0.9.104

package/dist/release-approval.js

@@ -19,20 +19,19 @@ import { lstatSync, readdirSync, readFileSync, realpathSync } from "node:fs";
 import { join } from "node:path";
 import { permissionPlainWords } from "./chat-terms.js";
 import { approvalTermsOf, releaseAccessWords, releaseCardOf, releaseSealOf } from "./release-card.js";
-import { releaseCiHoldOf, releaseCiHoldWords } from "./release-ci-hold.js";
 import { approvalOf } from "./scope.js";
 import { releaseProgressFor } from "./store.js";
 import { taskArchived } from "./task-archive.js";
 import { cleanTerminalLine } from "./terminal-text.js";
+import { ciName, ciWords, refusalOf, releaseCiOf, RELEASE_CI_SEEN_ACTION } from "./release-refusal.js";
+// The CI reading and the refusals live in release-refusal.ts, so scope.ts approve() can read them without a cycle.
+export { ciWords, releaseApprovalRefusal, releaseCiOf, RELEASE_CI_SEEN_ACTION } from "./release-refusal.js";
 const SHA = /^[0-9a-f]{40}$/;
 const DIGEST = /^[0-9a-f]{64}$/;
 /** A scope digest as scope.ts writes it. */
 const SCOPE_DIGEST = /^[0-9a-f]{32,64}$/;
 const sha256 = (text) => createHash("sha256").update(text).digest("hex");
 // ---- GitHub CI as the coordinator read it -------------------------------------------------------------------------
-/** The ledger act holding the coordinator's latest reading of the pull request's CI on the exact candidate. */
-export const RELEASE_CI_SEEN_ACTION = "release CI observed";
-const ciName = (value) => cleanTerminalLine(String(value ?? "")).trim().slice(0, 120);
 /**
  * Record what the coordinator just read of the pull request's CI on `candidate` (its verdict and every check's newest
  * attempt), when it differs from the last reading recorded: the sheet and the CLI show it, and the card digest binds
@@ -58,60 +57,11 @@ export function recordReleaseCi(store, input) {
         action: RELEASE_CI_SEEN_ACTION, outcome: input.state, source: "work", detail });
     return true;
 }
-/** The coordinator's latest CI reading for this task on exactly `candidate`, or null (not read yet, or another commit). */
-export function releaseCiOf(store, taskId, candidate) {
-    const row = store.handle.prepare("SELECT detail, at FROM action_ledger WHERE task_id = ? AND action = ? ORDER BY id DESC LIMIT 1").get(taskId, RELEASE_CI_SEEN_ACTION);
-    if (row === undefined)
-        return null;
-    let parsed;
-    try {
-        parsed = JSON.parse(String(row["detail"]));
-    }
-    catch {
-        return null;
-    }
-    const one = parsed;
-    if (one.v !== 1 || one.candidate !== candidate || !["passed", "running", "failed"].includes(String(one.state)) || !Array.isArray(one.failed) || !Array.isArray(one.runs))
-        return null;
-    return { candidate, at: String(row["at"]), state: one.state, failed: one.failed.map(ciName),
-        runs: one.runs.map(run => { const r = run; return { id: typeof r["id"] === "number" ? r["id"] : null, name: ciName(r["name"]), status: ciName(r["status"]), conclusion: r["conclusion"] == null ? null : ciName(r["conclusion"]) }; }) };
-}
 /** What of a CI reading the card binds: its state and each check's attempt, whether it finished, and how. Queued and
  * in progress read alike (neither is finished); the time it was read is not bound. */
 export function ciBinding(ci) {
     return ci === null ? null : { candidate: ci.candidate, state: ci.state, failed: ci.failed, runs: ci.runs.map(run => [run.id, run.name, run.status === "completed", run.conclusion]) };
 }
-/** GitHub CI in one line, as the sheet and the CLI say it. */
-export function ciWords(ci, candidate) {
-    const short = candidate.slice(0, 7);
-    if (ci === null)
-        return `GitHub CI on ${short} hasn't been read yet.`;
-    if (ci.state === "passed")
-        return `GitHub CI passed on ${short}.`;
-    if (ci.state === "failed")
-        return `GitHub CI failed on ${short}: ${ci.failed.join(", ") || "a check"}.`;
-    const finished = ci.runs.filter(run => run.status === "completed").length;
-    return `GitHub CI is running on ${short}: ${finished} of ${ci.runs.length} checks finished.`;
-}
-/** The release check failed on this task already (the coordinator's record): nobody approves it again here. */
-function checkFailed(store, taskId) {
-    return store.handle.prepare("SELECT 1 FROM release_step WHERE task_id = ? AND step = 'check' AND state = 'failed' LIMIT 1").get(taskId) !== undefined;
-}
-/** Why a release can't be approved now, from the plane's own state, or null. */
-function refusalOf(store, taskId, scope, ci) {
-    if (taskArchived(store, taskId))
-        return "This release is put away. Restore it before approving.";
-    const hold = releaseCiHoldOf(store, taskId);
-    if (hold !== null)
-        return releaseCiHoldWords(hold);
-    if (ci?.state === "failed")
-        return `${ciWords(ci, scope.candidate)} Fix the branch or rerun the failed job on GitHub, then release again.`;
-    if (checkFailed(store, taskId))
-        return "The release check already failed on this commit. Fix the branch and release the new commit.";
-    if (scope.approvedAt !== null && scope.approvedDigest !== scope.digest)
-        return "The release's terms changed after an earlier approval. Read them again.";
-    return null;
-}
 /** A release task from the plane's own state: a sealed form (terms or a release check's purpose) whose repository is the
  * task's project and whose approved commit is the scope's candidate. Never from a title or a task id. */
 export function releaseTaskOf(store, taskId) {
@@ -380,3 +330,14 @@ export function waitingJournals(stateDir, expectedFile) {
     }
     return { journals, unreadable };
 }
+/** A release as Home names it (docs/plans/home-other-asks.md, part 1): its version, and why it can't take a yes now
+ * in the sheet's own words (`refusalOf`, the one source), or null when this isn't a release. Reads only; Home never
+ * approves one, it links to the sheet. */
+export function releaseAskOf(store, taskId) {
+    const found = releaseTaskOf(store, taskId);
+    if (found === null)
+        return null;
+    const { scope, seal } = found;
+    const refusal = approvalOf(scope).approved ? null : refusalOf(store, taskId, scope, releaseCiOf(store, taskId, scope.candidate));
+    return { version: seal.identity.packageVersion, refusal };
+}

package/dist/release-card.d.ts

@@ -82,10 +82,24 @@ export declare function releaseBaselineRecord(store: Store, repo: string): {
     recorded: true;
     sha: string | null;
 };
+/** How long the change list's settings check may take before the list is unread. */
+export declare const CONFIG_LIST_MS = 60000;
 /** The commits after `from` up to `to`, as verified Git objects only, from the project's recorded Git directory: the
  * release coordinator's checkout config allowlist first, then commit-extract's verified range (every commit hashed here,
  * a shallow boundary, grafts or replacement refs refused, and the range proved to stop only in the last release's own
- * history). Null when they can't be read, so a card never shows a shortened list. */
+ * history). When they can't be read, why, in Toolroll's own fixed words (never the repository's text), so a card says
+ * why it shows no list rather than a shortened one. */
+export declare function readCommitsBetween(repo: string, from: string, to: string): {
+    ok: true;
+    commits: {
+        sha: string;
+        subject: string;
+    }[];
+} | {
+    ok: false;
+    why: string;
+};
+/** readCommitsBetween's list, or null when it can't be read. */
 export declare function commitsBetween(repo: string, from: string, to: string): {
     sha: string;
     subject: string;

package/dist/release-card.js

@@ -207,32 +207,52 @@ export function releaseBaselineRecord(store, repo) {
     const ref = row["external_ref"];
     return { recorded: true, sha: typeof ref === "string" && SHA.test(ref) ? ref : null };
 }
+/** How long the change list's settings check may take before the list is unread. */
+export const CONFIG_LIST_MS = 60_000;
 /** The commits after `from` up to `to`, as verified Git objects only, from the project's recorded Git directory: the
  * release coordinator's checkout config allowlist first, then commit-extract's verified range (every commit hashed here,
  * a shallow boundary, grafts or replacement refs refused, and the range proved to stop only in the last release's own
- * history). Null when they can't be read, so a card never shows a shortened list. */
-export function commitsBetween(repo, from, to) {
+ * history). When they can't be read, why, in Toolroll's own fixed words (never the repository's text), so a card says
+ * why it shows no list rather than a shortened one. */
+export function readCommitsBetween(repo, from, to) {
     if (!SHA.test(from) || !SHA.test(to))
-        return null;
+        return { ok: false, why: "a commit id isn't a full id" };
     let gitDir;
     try {
         const named = join(realpathSync(repo), ".git");
         if (!lstatSync(named).isDirectory())
-            return null;
+            return { ok: false, why: "the project has no Git folder of its own" };
         gitDir = realpathSync(named);
     }
     catch {
-        return null;
+        return { ok: false, why: "the project's Git folder can't be read" };
     }
     const tools = releaseTools();
     const env = { ...releaseGitEnv(), PATH: RELEASE_PATH };
-    const listing = spawnSync(tools.git, [`--git-dir=${gitDir}`, "--no-optional-locks", "config", "--list", "--no-includes", "--show-scope", "-z"], { cwd: "/", env, encoding: "utf8", timeout: 15_000 });
-    if (listing.status !== 0 || releaseConfigProblem(listing.stdout) !== null)
-        return null;
+    // The list's first Git call took over 15 s on GitHub's busy macOS runners (2026-11-12, "timed out after 15 s"; the
+    // same call takes 0.1 s on an idle Mac), and the card lost its change list; the verified range's own Git calls allow
+    // far longer. One minute, then the list is unread, as before.
+    const listing = spawnSync(tools.git, [`--git-dir=${gitDir}`, "--no-optional-locks", "config", "--list", "--no-includes", "--show-scope", "-z"], { cwd: "/", env, encoding: "utf8", timeout: CONFIG_LIST_MS });
+    if (listing.status !== 0) {
+        const how = listing.error?.code === "ETIMEDOUT" ? `timed out after ${CONFIG_LIST_MS / 1000} s`
+            : listing.signal !== null ? `stopped by ${listing.signal}` : listing.error !== undefined ? "couldn't start" : `exited ${listing.status}`;
+        return { ok: false, why: `Git couldn't list the project's settings (${how})` };
+    }
+    // The key is the repository's own text: named only by kind, never echoed.
+    if (releaseConfigProblem(listing.stdout) !== null)
+        return { ok: false, why: "the project's Git settings hold an entry a release read refuses" };
     const range = verifiedRange(gitDir, from, to, { git: tools.git, env });
-    if (!range.ok)
-        return null;
-    return range.value.map(one => ({ sha: one.id, subject: subjectText(one.message) }));
+    // commit-extract's own words, made one control-free line like any shown text, in the card's lower-case clause form.
+    if (!range.ok) {
+        const said = subjectText(range.message).replace(/\.$/, "");
+        return { ok: false, why: /^[A-Z][a-z]/.test(said) ? said[0].toLowerCase() + said.slice(1) : said };
+    }
+    return { ok: true, commits: range.value.map(one => ({ sha: one.id, subject: subjectText(one.message) })) };
+}
+/** readCommitsBetween's list, or null when it can't be read. */
+export function commitsBetween(repo, from, to) {
+    const read = readCommitsBetween(repo, from, to);
+    return read.ok ? read.commits : null;
 }
 /** GitHub lists at most this many of a pull request's commits; a longer one is never shown as complete. */
 export const PULL_REQUEST_COMMITS_MAX = 250;
@@ -355,7 +375,10 @@ export function releaseChangeList(store, terms, read) {
     let source;
     let why;
     if (baseline !== null) {
-        commits = commitsBetween(terms.repo, baseline, terms.approvedSha);
+        const read = readCommitsBetween(terms.repo, baseline, terms.approvedSha);
+        commits = read.ok ? read.commits : null;
+        if (!read.ok)
+            why = read.why;
         source = commits === null ? "unread" : "recorded";
     }
     else {

package/dist/release-refusal.d.ts

@@ -0,0 +1,32 @@
+import type { Scope } from "./scope.js";
+import type { Store } from "./store.js";
+/** The ledger act holding the coordinator's latest reading of the pull request's CI on the exact candidate. */
+export declare const RELEASE_CI_SEEN_ACTION = "release CI observed";
+/** One check's newest attempt, as the coordinator's own gh read it. A re-run is a new check run id. */
+export type ReleaseCiRun = {
+    id: number | null;
+    name: string;
+    status: string;
+    conclusion: string | null;
+};
+export type ReleaseCiSnapshot = {
+    candidate: string;
+    at: string;
+    state: "passed" | "running" | "failed";
+    failed: string[];
+    runs: ReleaseCiRun[];
+};
+export declare const ciName: (value: unknown) => string;
+/** The coordinator's latest CI reading for this task on exactly `candidate`, or null (not read yet, or another commit). */
+export declare function releaseCiOf(store: Store, taskId: string, candidate: string): ReleaseCiSnapshot | null;
+/** GitHub CI in one line, as the sheet and the CLI say it. */
+export declare function ciWords(ci: ReleaseCiSnapshot | null, candidate: string): string;
+/** Why a release can't be approved now, from the plane's own state, or null. */
+export declare function refusalOf(store: Store, taskId: string, scope: Scope, ci: ReleaseCiSnapshot | null): string | null;
+/**
+ * The release refusals every approval road shares (scope.ts approve(), read inside its transaction): for a scope
+ * sealing release terms or a release check's purpose, the sheet's own reasons in the sheet's own words, so the task
+ * page, Home's in-place yes, chat and `toolroll task approve` refuse exactly what `/t/<id>/release` refuses. Null for
+ * every other scope, and for a release nothing stops. The sheet's card digest binding stays the sheet's.
+ */
+export declare function releaseApprovalRefusal(store: Store, taskId: string, scope: Scope): string | null;

package/dist/release-refusal.js

@@ -0,0 +1,73 @@
+/**
+ * Why a release can't be approved now, from the plane's own state (release-approval.ts re-exports all of it): the
+ * coordinator's GitHub CI reading on the exact candidate, and the one list of refusals the release sheet shows and every
+ * approval road applies (scope.ts approve() reads `releaseApprovalRefusal` inside its transaction). Kept apart from
+ * release-approval.ts so scope.ts reads it without importing the card machinery (an import cycle through store.ts).
+ */
+import { releaseCiHoldOf, releaseCiHoldWords } from "./release-ci-hold.js";
+import { taskArchived } from "./task-archive.js";
+import { cleanTerminalLine } from "./terminal-text.js";
+/** The ledger act holding the coordinator's latest reading of the pull request's CI on the exact candidate. */
+export const RELEASE_CI_SEEN_ACTION = "release CI observed";
+export const ciName = (value) => cleanTerminalLine(String(value ?? "")).trim().slice(0, 120);
+/** The coordinator's latest CI reading for this task on exactly `candidate`, or null (not read yet, or another commit). */
+export function releaseCiOf(store, taskId, candidate) {
+    const row = store.handle.prepare("SELECT detail, at FROM action_ledger WHERE task_id = ? AND action = ? ORDER BY id DESC LIMIT 1").get(taskId, RELEASE_CI_SEEN_ACTION);
+    if (row === undefined)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(String(row["detail"]));
+    }
+    catch {
+        return null;
+    }
+    const one = parsed;
+    if (one.v !== 1 || one.candidate !== candidate || !["passed", "running", "failed"].includes(String(one.state)) || !Array.isArray(one.failed) || !Array.isArray(one.runs))
+        return null;
+    return { candidate, at: String(row["at"]), state: one.state, failed: one.failed.map(ciName),
+        runs: one.runs.map(run => { const r = run; return { id: typeof r["id"] === "number" ? r["id"] : null, name: ciName(r["name"]), status: ciName(r["status"]), conclusion: r["conclusion"] == null ? null : ciName(r["conclusion"]) }; }) };
+}
+/** GitHub CI in one line, as the sheet and the CLI say it. */
+export function ciWords(ci, candidate) {
+    const short = candidate.slice(0, 7);
+    if (ci === null)
+        return `GitHub CI on ${short} hasn't been read yet.`;
+    if (ci.state === "passed")
+        return `GitHub CI passed on ${short}.`;
+    if (ci.state === "failed")
+        return `GitHub CI failed on ${short}: ${ci.failed.join(", ") || "a check"}.`;
+    const finished = ci.runs.filter(run => run.status === "completed").length;
+    return `GitHub CI is running on ${short}: ${finished} of ${ci.runs.length} checks finished.`;
+}
+/** The release check failed on this task already (the coordinator's record): nobody approves it again here. */
+function checkFailed(store, taskId) {
+    return store.handle.prepare("SELECT 1 FROM release_step WHERE task_id = ? AND step = 'check' AND state = 'failed' LIMIT 1").get(taskId) !== undefined;
+}
+/** Why a release can't be approved now, from the plane's own state, or null. */
+export function refusalOf(store, taskId, scope, ci) {
+    if (taskArchived(store, taskId))
+        return "This release is put away. Restore it before approving.";
+    const hold = releaseCiHoldOf(store, taskId);
+    if (hold !== null)
+        return releaseCiHoldWords(hold);
+    if (ci?.state === "failed")
+        return `${ciWords(ci, scope.candidate)} Fix the branch or rerun the failed job on GitHub, then release again.`;
+    if (checkFailed(store, taskId))
+        return "The release check already failed on this commit. Fix the branch and release the new commit.";
+    if (scope.approvedAt !== null && scope.approvedDigest !== scope.digest)
+        return "The release's terms changed after an earlier approval. Read them again.";
+    return null;
+}
+/**
+ * The release refusals every approval road shares (scope.ts approve(), read inside its transaction): for a scope
+ * sealing release terms or a release check's purpose, the sheet's own reasons in the sheet's own words, so the task
+ * page, Home's in-place yes, chat and `toolroll task approve` refuse exactly what `/t/<id>/release` refuses. Null for
+ * every other scope, and for a release nothing stops. The sheet's card digest binding stays the sheet's.
+ */
+export function releaseApprovalRefusal(store, taskId, scope) {
+    // A sealed form, as release-card.ts releaseSealOf reads it (release terms, or a release check's purpose).
+    if (scope.releaseTerms == null && scope.releaseCheck == null)
+        return null;
+    return refusalOf(store, taskId, scope, scope.candidate == null ? null : releaseCiOf(store, taskId, scope.candidate));
+}

package/dist/result-completion.d.ts

@@ -21,8 +21,12 @@ export declare function familyCompleted(store: Store, taskId: string): boolean;
 export declare function changedFilesOf(store: Store, runId: number, root: string): string[] | null;
 /** Everything a result's branch carries: this build's changes and every build of every task it revises (a
  * revision builds on its source's head, so its branch holds the source's commits too). null when any of
- * them can't be read whole. */
-export declare function familyChangedFiles(store: Store, taskId: string, runId: number, root: string): string[] | null;
+ * them can't be read whole. An earlier build with no recorded diff is skipped by default; with
+ * `missing: "unknown"` (the local owner's boundary) it is skipped only when its run record proves it committed
+ * nothing, and any other one makes the whole answer unknown. */
+export declare function familyChangedFiles(store: Store, taskId: string, runId: number, root: string, options?: {
+    missing?: "skip" | "unknown";
+}): string[] | null;
 /** Why a build's branch must wait before it's pushed (and so before any PR or merge): it (or a task it
  * revises) changed protected files on a one-person approval, and nobody but its approver and requesters
  * has marked it complete. */

package/dist/result-completion.js

@@ -42,10 +42,12 @@ export function changedFilesOf(store, runId, root) {
 }
 /** Everything a result's branch carries: this build's changes and every build of every task it revises (a
  * revision builds on its source's head, so its branch holds the source's commits too). null when any of
- * them can't be read whole. */
-export function familyChangedFiles(store, taskId, runId, root) {
+ * them can't be read whole. An earlier build with no recorded diff is skipped by default; with
+ * `missing: "unknown"` (the local owner's boundary) it is skipped only when its run record proves it committed
+ * nothing, and any other one makes the whole answer unknown. */
+export function familyChangedFiles(store, taskId, runId, root, options = {}) {
     const files = new Set();
-    const runs = new Set([runId]);
+    const runs = new Map([[runId, null]]);
     const chain = store.revisionAncestryStatus(taskId).chain;
     for (const id of chain.length === 0 ? [taskId] : chain) {
         const ref = store.lookupRef(id);
@@ -53,12 +55,16 @@ export function familyChangedFiles(store, taskId, runId, root) {
             continue;
         for (const run of store.runsFor(ref.id))
             if ((run.role === "builder" || run.role === "repair") && (id !== taskId || run.id === runId))
-                runs.add(run.id);
+                runs.set(run.id, run);
     }
-    for (const id of runs) {
+    for (const [id, run] of runs) {
         // A build that never recorded a diff contributed nothing to the branch; one whose diff can't be read counts as protected.
-        if (!store.artifactsFor(id).some(one => one.kind === "diff-stat") && id !== runId)
-            continue;
+        // Under "unknown", a missing inventory proves nothing by itself: only a finished run that committed nothing is skipped.
+        if (!store.artifactsFor(id).some(one => one.kind === "diff-stat") && id !== runId) {
+            if (options.missing !== "unknown" || (run?.committed === false && run.finishedAt !== null))
+                continue;
+            return null;
+        }
         const changed = changedFilesOf(store, id, root);
         if (changed === null)
             return null;

package/dist/scope.d.ts

@@ -1044,7 +1044,7 @@ export declare function releaseApprovalOf(store: Store, taskId: string, _now?: D
 /** When a password typed at `at` (ISO) stops standing in, for a page's words (ISO); null when `at` isn't a time. Words
  * only: freshnessFor decides whether it stands in, at the moment of use. */
 export declare function freshUntil(at: string): string | null;
-export type LocalApprovalRefusal = "local-mode-off" | "not-owner" | "no-scope" | "release" | "protected" | "escalated" | "coordinator" | "unsandboxed";
+export type LocalApprovalRefusal = "local-mode-off" | "not-owner" | "no-scope" | "release" | "protected" | "escalated" | "coordinator" | "unsandboxed" | "imported";
 /**
  * Whether the local owner may approve this task without a password (easy-start plan C5). ONE rule, read by the
  * preview (the task page's approve form and the chat review render no password field when it is ok), the chat
@@ -1065,3 +1065,34 @@ export declare function liveChainFromJson(json: string | null): ChainEntry[] | n
 /** The chain in full, the words a yes agrees to: order, agent, model, how it bills, what it may do, and whether Toolroll
  * can see it run out. Every approval surface shows these lines; empty for a scope with no chain. */
 export declare function chainTermsLines(scope: Pick<Scope, "proposedChainJson">): string[];
+/** The act a local owner's work rule is read for: approving a plan, or completing (accepting) a result whose build
+ * changed `changed` (the build's own diff; null when it can't be read, which counts as protected). */
+export type LocalWorkPurpose = {
+    act: "approve";
+} | {
+    act: "complete";
+    changed: readonly string[] | null;
+} | {
+    act: "plan";
+} | {
+    act: "retry";
+};
+/**
+ * Whether the local owner may do this act on this task without a password: ONE rule (easy-start C5, split out for
+ * local-owner slice 0), read inside the act's own transaction. Both acts refuse: local mode off or another person;
+ * release or deploy work; protected or two-person work; work a coordinator filed (or a task with no built-in record).
+ * Approving also refuses no plan, an escalated profile and a project stored as unsandboxed (what a build may do, which
+ * is what an approval agrees to). Completing reads release work from the release records too, and protected work from
+ * what the result actually changed as well as what its scope declared (v102's rule: declared paths are only a promise).
+ * Asking for a plan (local-owner slice 2) reads approve's rule for a task that may have no scope yet (no declared paths
+ * count as protected; the task's own permission mode counts as escalated), the release records too, and also refuses a
+ * task from outside (an imported issue): a new act, so no existing act changes. Retrying (slice 3) is approve's rule
+ * exactly (work the owner could approve again now), plus the release records and a task from outside.
+ */
+export declare function localWorkEligible(store: Store, by: string, taskId: string, purpose: LocalWorkPurpose): {
+    ok: true;
+} | {
+    ok: false;
+    reason: LocalApprovalRefusal;
+    message: string;
+};

package/dist/scope.js

@@ -54,6 +54,7 @@ import { parseContract } from "./contracts/contract.js";
 import { readAcceptance, readScopeTerms, storedRubricSchema } from "./contracts/scope.js";
 import { taskArchived, taskCancelled } from "./task-archive.js";
 import { releaseCiHoldOf, releaseCiHoldWords } from "./release-ci-hold.js";
+import { releaseApprovalRefusal } from "./release-refusal.js";
 import { NO_READINESS, exactModelId, legOf, projectRoute, routeDigestOf, routeFromJson, routeJsonProblem, routeWords, } from "./phase-routing.js";
 /** Same shape as a runner's credential, for the same reasons. */
 function mintToken() {
@@ -1117,6 +1118,11 @@ chat) {
         const scope = store.getScope(taskId);
         if (scope === null)
             return { ok: false, reason: "no-scope" };
+        // A release takes no yes the release sheet would refuse (put away, CI held or failed, its check failed on this
+        // commit, terms changed after an earlier yes), in the sheet's words, on every road: read here, before any vote.
+        const releaseRefusal = releaseApprovalRefusal(store, taskId, scope);
+        if (releaseRefusal !== null)
+            return { ok: false, reason: "policy", message: releaseRefusal };
         // A put-away task (v145) is restored first; sealScopeApproval refuses it too, on every road.
         if (taskArchived(store, taskId))
             return { ok: false, reason: "archived" };
@@ -1443,11 +1449,12 @@ function describeApproval(approval) {
 // ---- Only a person approves (docs/plans/approval-policy.md, phase 1). Kept last: the freshness tripwire pins places.
 export { personProof } from "./person-proof.js";
 import { personProof } from "./person-proof.js";
+import { isProtectedWork, protectedChanges } from "./approval-policy.js";
 import { permissionPlainWords } from "./chat-terms.js";
 import { limitRecognised } from "./exhaustion.js";
 import { SUBSCRIPTION_CAPABLE } from "./keys.js";
 import { releaseCheckPurposeDigest, releaseTermsDigest } from "./contracts/release-terms.js";
-import { CHECK_ACCESS_WIDTH, autoEvidenceOf, carriesUnsandboxed, newestReleaseGeneration, releaseAuthorityOfTask, releaseAutoApproves, releaseSealProblem, releaseStateAt } from "./release-authority.js";
+import { CHECK_ACCESS_WIDTH, autoEvidenceOf, belongsToRelease, carriesUnsandboxed, newestReleaseGeneration, releaseAuthorityOfTask, releaseAutoApproves, releaseSealProblem, releaseStateAt } from "./release-authority.js";
 /** Whether the command running now is a machine's: the lead (its token) or a remote API run. Trusted context only. */
 export const machineActing = () => currentActor()?.lead === true || activeRemote() !== null;
 /** A proof row's detail, either form: the legacy text (`<at> · generation <n> · digest <d>`) or the versioned record
@@ -1703,6 +1710,8 @@ const LOCAL_APPROVAL_WORDS = {
     escalated: "Work with wider permissions needs your password.",
     coordinator: "Work a coordinator filed needs your password.",
     unsandboxed: "This project's checks run without a sandbox, so approving needs your password.",
+    // Not an approve refusal (approve keeps today's rule); the type needs words for it.
+    imported: "A task from outside needs your password.",
 };
 /**
  * Whether the local owner may approve this task without a password (easy-start plan C5). ONE rule, read by the
@@ -1713,30 +1722,8 @@ const LOCAL_APPROVAL_WORDS = {
  * a scout proposed are allowed.
  */
 export function localApprovalEligible(store, by, taskId) {
-    const no = (reason) => ({ ok: false, reason, message: LOCAL_APPROVAL_WORDS[reason] });
-    if (!localModeOn(store))
-        return no("local-mode-off");
-    const owner = store.handle.prepare("SELECT owner FROM local_mode WHERE id = 1").get()?.["owner"];
-    if (owner !== by)
-        return no("not-owner");
-    const scope = store.getScope(taskId);
-    if (scope === null)
-        return no("no-scope");
-    if (deployGateScope(scope) || releaseCheckScope(scope))
-        return no("release");
-    const gate = store.approvalGate(taskId, by, "person");
-    if (gate.verdict !== "seal" || gate.protectedWork)
-        return no("protected");
-    if (scope.profile == null || levelOfProfile(scope.profile) === "escalated")
-        return no("escalated");
-    const ref = store.handle.prepare("SELECT repo, coordinator_cid FROM task_ref WHERE backend = 'built-in' AND external_id = ?").get(taskId);
-    if (ref === undefined || ref["coordinator_cid"] != null)
-        return no("coordinator");
-    // The stored level, never the launch cap: a project saved as unsandboxed is refused even though local mode confines it.
-    const stored = ref["repo"] == null ? undefined : store.handle.prepare("SELECT level FROM project_check_access WHERE repo = ?").get(ref["repo"])?.["level"];
-    if (stored === "unsandboxed" || scope.profile.checkAccess === "unsandboxed")
-        return no("unsandboxed");
-    return { ok: true };
+    // The one rule, shared with completing a result (localWorkEligible, below).
+    return localWorkEligible(store, by, taskId, { act: "approve" });
 }
 // ---- Fallback chains (fallback.ts). Kept last too.
 /** A chain that may dispatch: version 2, a base and at least one fallback. An older chain is history, never this. */
@@ -1762,3 +1749,107 @@ export function chainTermsLines(scope) {
         }),
     ];
 }
+// ---- Local owner, slice 0 (docs/plans/local-owner-acts.md): one work rule for a no-password act. Kept last.
+/** What a local owner hears when a result isn't one it may accept without a password. */
+const LOCAL_COMPLETION_WORDS = {
+    "local-mode-off": "Local mode is off, so accepting this result needs your password.",
+    "not-owner": "Only this computer's owner accepts results here without a password.",
+    "no-scope": "This task has no plan, so accepting its result needs your password.",
+    release: "Accepting a release needs your password.",
+    protected: "This result is protected work, so accepting it needs your password and a second person.",
+    escalated: "Work with wider permissions needs your password.",
+    coordinator: "Work a coordinator filed needs your password to accept.",
+    unsandboxed: "This project's checks run without a sandbox, so accepting needs your password.",
+    // Not a completion refusal (completion keeps slice 0's rule); the type needs words for it.
+    imported: "A task from outside needs your password to accept.",
+};
+/** What a local owner hears when a task isn't one it may ask a plan for without a password (local-owner slice 2). */
+const LOCAL_PLAN_WORDS = {
+    "local-mode-off": "Local mode is off, so asking for a plan needs your password.",
+    "not-owner": "Only this computer's owner asks for plans here without a password.",
+    "no-scope": "This task has nothing to plan yet.",
+    release: "Planning a release needs your password.",
+    protected: "This is protected work, so planning it needs your password.",
+    escalated: "Work with wider permissions needs your password to plan.",
+    coordinator: "Work a coordinator filed needs your password to plan.",
+    unsandboxed: "This project's checks run without a sandbox, so planning needs your password.",
+    imported: "A task from outside needs your password to plan.",
+};
+/** What a local owner hears when a build isn't one it may retry without a password (local-owner slice 3). */
+const LOCAL_RETRY_WORDS = {
+    "local-mode-off": "Local mode is off, so retrying needs your password.",
+    "not-owner": "Only this computer's owner retries builds here without a password.",
+    "no-scope": "This task has no approved plan to build again.",
+    release: "Retrying a release needs your password.",
+    protected: "This is protected work, so retrying it needs your password.",
+    escalated: "Work with wider permissions needs your password to retry.",
+    coordinator: "Work a coordinator filed needs your password to retry.",
+    unsandboxed: "This project's checks run without a sandbox, so retrying needs your password.",
+    imported: "A task from outside needs your password to retry.",
+};
+/**
+ * Whether the local owner may do this act on this task without a password: ONE rule (easy-start C5, split out for
+ * local-owner slice 0), read inside the act's own transaction. Both acts refuse: local mode off or another person;
+ * release or deploy work; protected or two-person work; work a coordinator filed (or a task with no built-in record).
+ * Approving also refuses no plan, an escalated profile and a project stored as unsandboxed (what a build may do, which
+ * is what an approval agrees to). Completing reads release work from the release records too, and protected work from
+ * what the result actually changed as well as what its scope declared (v102's rule: declared paths are only a promise).
+ * Asking for a plan (local-owner slice 2) reads approve's rule for a task that may have no scope yet (no declared paths
+ * count as protected; the task's own permission mode counts as escalated), the release records too, and also refuses a
+ * task from outside (an imported issue): a new act, so no existing act changes. Retrying (slice 3) is approve's rule
+ * exactly (work the owner could approve again now), plus the release records and a task from outside.
+ */
+export function localWorkEligible(store, by, taskId, purpose) {
+    const words = purpose.act === "approve" ? LOCAL_APPROVAL_WORDS : purpose.act === "complete" ? LOCAL_COMPLETION_WORDS : purpose.act === "plan" ? LOCAL_PLAN_WORDS : LOCAL_RETRY_WORDS;
+    const no = (reason) => ({ ok: false, reason, message: words[reason] });
+    if (!localModeOn(store))
+        return no("local-mode-off");
+    const owner = store.handle.prepare("SELECT owner FROM local_mode WHERE id = 1").get()?.["owner"];
+    if (owner !== by)
+        return no("not-owner");
+    const scope = store.getScope(taskId);
+    if ((purpose.act === "approve" || purpose.act === "retry") && scope === null)
+        return no("no-scope");
+    if (scope !== null && (deployGateScope(scope) || releaseCheckScope(scope)))
+        return no("release");
+    if (purpose.act !== "approve" && (belongsToRelease(store, taskId) || releaseAuthorityOfTask(store, taskId) !== null))
+        return no("release");
+    const ref = store.handle.prepare("SELECT repo, coordinator_cid, permission_mode FROM task_ref WHERE backend = 'built-in' AND external_id = ?").get(taskId);
+    // Retrying spends again under an existing yes: only on work the owner could approve again now (approve's own rule).
+    if (purpose.act === "approve" || purpose.act === "retry") {
+        const gate = store.approvalGate(taskId, by, "person");
+        if (gate.verdict !== "seal" || gate.protectedWork)
+            return no("protected");
+        if (scope.profile == null || levelOfProfile(scope.profile) === "escalated")
+            return no("escalated");
+    }
+    else if (purpose.act === "plan") {
+        // Approve's rule, read for a task that may have no scope yet: protected or two-person work (no declared paths count
+        // as protected), and an escalated profile or task-level permission mode.
+        const gate = store.approvalGate(taskId, by, "person");
+        if (gate.verdict !== "seal" || gate.protectedWork)
+            return no("protected");
+        if ((scope?.profile != null && levelOfProfile(scope.profile) === "escalated") || ref?.["permission_mode"] === "bypassPermissions")
+            return no("escalated");
+    }
+    else if (ref !== undefined && ref["repo"] != null) {
+        // Declared (no declared paths counts as protected) or actually changed (an unreadable diff counts as changed).
+        const rules = store.approvalRules(String(ref["repo"]));
+        if ((rules.protectProject || rules.protectedPaths.length > 0)
+            && (isProtectedWork(rules, scope?.touches ?? []) || purpose.changed === null || protectedChanges(rules, purpose.changed).length > 0))
+            return no("protected");
+    }
+    if (ref === undefined || ref["coordinator_cid"] != null)
+        return no("coordinator");
+    // What the build may do was agreed at its approval; a result already built is judged by what it is and changed.
+    if (purpose.act === "complete")
+        return { ok: true };
+    // Asking for a plan (a new act, so no behaviour changes): never a task from outside (a GitHub import, or a revision of one).
+    if ((purpose.act === "plan" || purpose.act === "retry") && issueImported(store, taskId))
+        return no("imported");
+    // The stored level, never the launch cap: a project saved as unsandboxed is refused even though local mode confines it.
+    const stored = ref["repo"] == null ? undefined : store.handle.prepare("SELECT level FROM project_check_access WHERE repo = ?").get(ref["repo"])?.["level"];
+    if (stored === "unsandboxed" || scope?.profile?.checkAccess === "unsandboxed")
+        return no("unsandboxed");
+    return { ok: true };
+}