toolroll 0.9.56 → 0.9.57

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.9.57 — 2026-10-09
+
+- **Truthful status.** Finished tasks read Complete everywhere. With checks
+  off, criteria read "checked at release" instead of Needs you.
+- **No false finish.** Completing or deploying refuses a failed or missing
+  check, an unmet criterion, a serious review finding, or missing evidence.
+- **Clear revisions.** Revisions are named after their task: -v2, -v3.
+
 ## 0.9.56 — 2026-10-09
 
 - **One lead.** Your assistant in the console, on your phone, in chat and in

package/dist/assignment-adapters.d.ts

@@ -109,6 +109,11 @@ export declare function assignmentForCoordinator(store: Store, token: string, op
                 deployment: {
                     status: "not-recorded";
                 };
+                readiness: {
+                    verdict: import("./proof.js").ProofVerdict | null;
+                    checksOff: boolean;
+                    blockers: import("./task-status.js").CompletionBlocker[];
+                } | null;
             };
         }[];
         nextCursor: number;

package/dist/assignment.d.ts

@@ -1,10 +1,12 @@
 import { type Store, type ProofVerdictRow, type ProofAcceptanceRow } from "./store.js";
 import { type WorkAction, type WorkSummaryAccess } from "./work-summary.js";
 import { type VerifiedApprover } from "./principal.js";
+import { type ProofVerdict } from "./proof.js";
 import { type CheckLevel } from "./check-levels.js";
 import { type BuildReviewView } from "./review-switch.js";
 import { type NeedKey, type WaitKey } from "./needs-you.js";
-import { type ChecksBatch } from "./task-status.js";
+import { type ChecksBatch, type CompletionBlocker } from "./task-status.js";
+import { type ReleaseCoverage, type ReleaseMemo } from "./release-coverage.js";
 import { type LeadClaim } from "./lead-voice.js";
 export type AssignmentAccess = WorkSummaryAccess;
 export type AssignmentOwner = {
@@ -24,6 +26,8 @@ export type AssignmentChecks = {
     running?: "quick" | "full" | null;
     /** A batch check (batch-checks.ts): waiting for its batch, or how it was checked. */
     batch?: ChecksBatch | null;
+    /** Checks Off: the passing full release check that contains this commit (release-coverage.ts), read now, never sealed. */
+    release?: ReleaseCoverage | null;
 };
 export type AssignmentReceipt = {
     digest: string;
@@ -118,6 +122,13 @@ export type AssignmentSnapshot = {
     earlierActive?: number;
     /** Of those, how many are running rather than only queued; present with earlierActive. */
     earlierRunning?: number;
+    /** The result as it reads today (task-status.ts): the verdict it shows, whether its checks were deliberately Off, and
+     * what refuses Complete. Derived at read time; never part of the sealed receipt. Null without a result. */
+    readiness?: {
+        verdict: ProofVerdict | null;
+        checksOff: boolean;
+        blockers: CompletionBlocker[];
+    } | null;
 };
 /** Status-first handoff for routine reads. Fetch get_assignment only when
  * inspecting its exact evidence; do not repeat a full proof in every poll. */
@@ -169,9 +180,14 @@ export declare function assignmentBrief(assignment: AssignmentSnapshot | null):
     deployment: {
         status: "not-recorded";
     };
+    readiness: {
+        verdict: ProofVerdict | null;
+        checksOff: boolean;
+        blockers: CompletionBlocker[];
+    } | null;
 } | null;
 export declare function assignmentChecksForRun(store: Store, root: string | undefined, runId: number, now: Date): AssignmentChecks;
-export declare function assignmentOf(store: Store, taskId: string, now: Date, access: AssignmentAccess, root?: string): AssignmentSnapshot | null;
+export declare function assignmentOf(store: Store, taskId: string, now: Date, access: AssignmentAccess, root?: string, memo?: ReleaseMemo): AssignmentSnapshot | null;
 type MutationResult = {
     ok: true;
     assignment: AssignmentSnapshot;
@@ -203,7 +219,7 @@ type Finished = {
  * (no reason needed), or an exception a report that doesn't match its changes needs a reason for. Null when
  * Accept and finish is a plain completion: nothing is owed (no proof, a failed check, or a verified result),
  * or it was already accepted. */
-export declare function owedAcceptance(receipt: AssignmentReceipt | null): "person-check" | "exception" | null;
+export declare function owedAcceptance(receipt: AssignmentReceipt | null, blockers?: readonly CompletionBlocker[]): "person-check" | "exception" | null;
 /** Accept and finish: the person's acceptance of the exact result they read and its completion, in one
  * transaction. Whether an acceptance is owed is decided here, against the receipt as it stands: only a
  * person's own check or a reasoned exception records one (with its ledger act); an exception without its
@@ -278,6 +294,11 @@ export declare function assignmentUpdates(store: Store, now: Date, access: Assig
             deployment: {
                 status: "not-recorded";
             };
+            readiness: {
+                verdict: ProofVerdict | null;
+                checksOff: boolean;
+                blockers: CompletionBlocker[];
+            } | null;
         };
     }[];
     nextCursor: number;

package/dist/assignment.js

@@ -14,13 +14,14 @@ import { verificationEvidence } from "./verification-evidence.js";
 import { reproveApprover } from "./principal.js";
 import { noteAssignmentStatus } from "./assignment-status.js";
 import { historicalAssessmentReason } from "./assignment-presentation.js";
-import { manualReviewOnly } from "./proof.js";
+import { manualReviewOnly, shownVerdictOf } from "./proof.js";
 import { ACCEPT_NEEDS_REASON, cantAcceptYetOf } from "./result-acts.js";
-import { runCheckLevel } from "./check-levels.js";
+import { requiredCheckCommandFor, runCheckLevel } from "./check-levels.js";
 import { followUpChecksOf, withFollowUps } from "./result-follow-ups.js";
 import { buildReviewOf, findingWords } from "./review-switch.js";
 import { NEEDS, WAITS, processNeedOf, resultHoldUpSentence } from "./needs-you.js";
-import { assignmentStageOf } from "./task-status.js";
+import { assignmentStageOf, checkBackingOf, completionBlockersOf, requirementWordOf } from "./task-status.js";
+import { releaseCoverageOf } from "./release-coverage.js";
 import { leadClaimOf } from "./lead-voice.js";
 /** Status-first handoff for routine reads. Fetch get_assignment only when
  * inspecting its exact evidence; do not repeat a full proof in every poll. */
@@ -35,7 +36,7 @@ export function assignmentBrief(assignment) {
             base: receipt.base, head: receipt.head, completionKind: receipt.completionKind,
             checks: receipt.checks, proofAcceptance: receipt.proofAcceptance, verdict: receipt.proof?.verdict ?? null,
             criteria: { passed: receipt.proof?.matrix.filter(row => row.state === "pass").length ?? 0, total: receipt.proof?.matrix.length ?? 0 }, evidence: receipt.evidence },
-        publication: assignment.publication, review: assignment.review, deployment: assignment.deployment };
+        publication: assignment.publication, review: assignment.review, deployment: assignment.deployment, readiness: assignment.readiness ?? null };
 }
 const digest = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
 /** A lookup added with lead-quiet, read safely: a deploy proves completion with this code over the INSTALLED runtime's
@@ -51,7 +52,7 @@ function olderStoreSafe(read, absent) {
     }
 }
 /** A check as the receipt digest seals it: presentation-only fields (check-levels.ts) left out. */
-const sealedChecks = ({ level: _level, running: _running, batch: _batch, ...proof }) => proof;
+const sealedChecks = ({ level: _level, running: _running, batch: _batch, release: _release, ...proof }) => proof;
 const OWNER_ACTION = "assignment claimed";
 const CHECK_ACTION = COMPLETION_ACTION;
 const actorOf = (owner) => `${owner.kind}:${owner.id}`;
@@ -127,7 +128,7 @@ function buildChecks(store, root, runId) {
         return unavailable("Saved checks could not be read.");
     }
 }
-export function assignmentOf(store, taskId, now, access, root) {
+export function assignmentOf(store, taskId, now, access, root, memo) {
     const family = store.taskFamilyOf(taskId, access.repos, access.principal === "operator" && access.includeUnplaced === true);
     if (family === null)
         return null;
@@ -163,7 +164,10 @@ export function assignmentOf(store, taskId, now, access, root) {
     const reports = artifacts.filter(a => a.kind === "report");
     const unavailable = family.versions.flatMap(version => store.runsFor(version.refId).flatMap(run => store.artifactsFor(run.id).filter(artifact => root === undefined || !readVerifiedArtifact(root, artifact).ok)
         .map(artifact => `Saved ${artifact.kind} #${artifact.id} (run ${run.id}) is unavailable or changed.`)));
-    const checks = result === null ? null : assignmentChecksForRun(store, root, result.id, now);
+    const ownChecks = result === null ? null : assignmentChecksForRun(store, root, result.id, now);
+    // Checks Off: a passing full release check that contains this commit covers it, read now from the existing receipts.
+    const checks = ownChecks === null || ownChecks.level !== "off" || ownChecks.status === "passed" || ownChecks.status === "failed" ? ownChecks
+        : { ...ownChecks, release: releaseCoverageOf(store, root, current.repo, result.headRevision, memo === undefined ? {} : { memo }) };
     const finishedBuild = result?.role === "builder" && (result.outcome === "built" || result.outcome === "no-change") &&
         result.finishedAt !== null && /^[a-f0-9]{40}$/.test(result.headRevision ?? "");
     // Finished work returns to its lead or user. Strict terms and previous model
@@ -339,6 +343,7 @@ export function assignmentOf(store, taskId, now, access, root) {
                     attention, receipt: receipt?.digest ?? null }), acknowledged: false } : null;
     const publication = result === null ? null : store.publicationForRun(result.id);
     const lead = state === "complete" || state === "cancelled" || access.principal !== "operator" ? null : leadClaimOf(store, family.root.id, now, access.viewer);
+    const readiness = receipt === null ? null : readinessOf(store, receipt, current.repo, review);
     // Existing saved inputs and output, read only after family admission. Keep
     // polling briefs small; full reads disclose exactly which excerpts are shortened.
     const planId = result?.planRevision == null ? null : store.getPlanRevision(result.planRevision)?.artifact;
@@ -355,7 +360,21 @@ export function assignmentOf(store, taskId, now, access, root) {
     return { version: 1, rootId: family.root.id, activeTaskId: current.id, repo: current.repo, title: family.root.title,
         state, detail, primaryAction, attention: [...new Set(attention)], attempts, owner, receipt, savedContext, completion, handoff,
         publication: publication === null ? null : { state: publication.state, prUrl: publication.prUrl, remoteState: publication.remoteState },
-        review, deployment: { status: "not-recorded" }, ...(need === null ? {} : { need }), ...(lead === null ? {} : { lead }), ...(earlierActive.length === 0 ? {} : { earlierActive: earlierActive.length, earlierRunning }) };
+        review, deployment: { status: "not-recorded" }, readiness, ...(need === null ? {} : { need }), ...(lead === null ? {} : { lead }), ...(earlierActive.length === 0 ? {} : { earlierActive: earlierActive.length, earlierRunning }) };
+}
+/** The result's shown verdict and completion blockers (task-status.ts), from the receipt, the project's approved check
+ * and the automatic review. A HIGH finding a revision already took is resolved there. */
+function readinessOf(store, receipt, repo, review) {
+    const report = receipt.completionKind === "research-report";
+    const high = review === null || review.sentBackAs !== null || review.state !== "reviewed" ? 0 : review.high.length;
+    const checkRequired = olderStoreSafe(() => requiredCheckCommandFor(store, repo, receipt.taskId, receipt.checks.level), null) !== null;
+    const matrix = receipt.proof?.matrix ?? [];
+    const backing = checkBackingOf(receipt.checks);
+    const verdict = shownVerdictOf(receipt.proof?.verdict ?? null, { checkFailed: !report && receipt.checks.status === "failed", highFindings: high,
+        reviewPending: review?.state === "pending", criteriaPassed: matrix.every(row => requirementWordOf(row, null, backing) === "Met") });
+    const blockers = completionBlockersOf({ report, checks: receipt.checks, checkRequired, matrix, verdict: receipt.proof?.verdict ?? null,
+        accepted: receipt.proofAcceptance !== null, high });
+    return { verdict, checksOff: !report && receipt.checks.level === "off", blockers };
 }
 function admittedOwner(store, taskId, owner, now, root) {
     if (owner.kind !== "coordinator")
@@ -417,6 +436,10 @@ function acknowledgeCurrent(store, current, receiptDigest, actor, now, root, acc
     if (current.state !== "ready-to-check" && current.state !== "complete")
         return { ok: false, reason: "not-ready", message: "This assignment still has unresolved execution, scope or decisions." };
     if (current.state !== "complete") {
+        // The one readiness guard: a failed or missing required check, an unresolved requirement or HIGH finding refuses.
+        const blockers = current.readiness?.blockers ?? [];
+        if (blockers.length > 0)
+            return { ok: false, reason: "not-ready", message: blockers.map(one => one.message).join(" ") };
         // v102: declared paths are only a promise. A result whose actual diff reaches protected files, on a
         // scope one person approved, completes only by someone else — two people have then seen the work.
         const problem = store.protectedResultProblem(receipt.taskId, familyChangedFiles(store, receipt.taskId, receipt.runId, root), actor.startsWith("operator:") ? actor.slice("operator:".length) : null);
@@ -476,11 +499,14 @@ class Undone extends Error {
  * (no reason needed), or an exception a report that doesn't match its changes needs a reason for. Null when
  * Accept and finish is a plain completion: nothing is owed (no proof, a failed check, or a verified result),
  * or it was already accepted. */
-export function owedAcceptance(receipt) {
+export function owedAcceptance(receipt, blockers = []) {
     if (receipt === null || receipt.proofAcceptance !== null)
         return null;
     if (personCheckPending(receipt))
         return "person-check";
+    // An unresolved requirement is resolved only by an acceptance that says why.
+    if (blockers.some(one => one.key === "criteria"))
+        return "exception";
     return cantAcceptYetOf(receipt.proof?.verdict ?? null, receipt.proof?.reasons ?? [], false) === ACCEPT_NEEDS_REASON ? "exception" : null;
 }
 /** Accept and finish: the person's acceptance of the exact result they read and its completion, in one
@@ -505,7 +531,7 @@ export function acceptAndCompleteAsOperator(store, taskId, input, who, now, root
                 return { ok: false, reason: "stale", message: "This result changed. Open the current result before accepting it." };
             }
             // Already complete, or nothing owed: the plain completion of the receipt as read.
-            const owed = before.state === "ready-to-check" ? owedAcceptance(receipt) : null;
+            const owed = before.state === "ready-to-check" ? owedAcceptance(receipt, before.readiness?.blockers ?? []) : null;
             // An exception is accepted only with its reason: never a completion that skips it.
             if (owed === "exception" && input.note === null)
                 return { ok: false, reason: "needs-reason", message: `${ACCEPT_NEEDS_REASON}.` };

package/dist/browser-workspace.js

@@ -19,7 +19,7 @@ export function browserCrewOf(store, now, access, options = {}) {
         return { crew: [], crewTruncated: false };
     const limit = Number.isFinite(options.limit)
         ? Math.max(1, Math.min(BROWSER_CREW_LIMIT, Math.floor(options.limit))) : BROWSER_CREW_LIMIT;
-    const page = workIndexPage(store, now, access, { limit, project });
+    const page = workIndexPage(store, now, access, { limit, project, ...(options.evidenceRoot === undefined ? {} : { root: options.evidenceRoot }) });
     return browserCrewFromIndex(page);
 }
 /** Navigation input must already be admitted by the caller. No extra project

package/dist/chat-delivery.js

@@ -232,9 +232,9 @@ export async function processChatEvent(options) {
             if (command.kind === "help")
                 state.plan(event.id, [{ text: PHONE_HELP }], now_);
             else if (command.kind === "status")
-                state.plan(event.id, [{ text: phoneStatus(store, repos, now_, focusedTitle) }], now_);
+                state.plan(event.id, [{ text: phoneStatus(store, repos, now_, focusedTitle, options.evidenceRoot) }], now_);
             else if (command.kind === "tasks")
-                state.plan(event.id, [{ text: phoneTaskListText(phoneTaskChoices(store, repos, now_), focusedTitle) }], now_);
+                state.plan(event.id, [{ text: phoneTaskListText(phoneTaskChoices(store, repos, now_, null, 8, options.evidenceRoot), focusedTitle) }], now_);
             else if (command.kind === "lead") {
                 store.setChatFocus(surface, binding.id, null, now_);
                 state.plan(event.id, [{ text: PHONE_BACK_TO_LEAD }], now_);
@@ -243,7 +243,7 @@ export async function processChatEvent(options) {
                 const pick = resolvePhoneTask(store, repos, now_, command.id);
                 if (pick.kind === "one") {
                     store.setChatFocus(surface, binding.id, pick.id, now_);
-                    const view = phoneTaskView(store, repos, pick.view, now_);
+                    const view = phoneTaskView(store, repos, pick.view, now_, options.evidenceRoot);
                     // The status names its task (and result): a reply to it is about that task.
                     state.plan(event.id, [{ text: phoneFocusText(view.text), ...(view.link === null ? {} : { link: view.link }), task: pick.view, ...(view.run === null ? {} : { run: view.run }) }], now_);
                 }

package/dist/chat-voice.js

@@ -69,7 +69,7 @@ export function finishedLine(fact) {
             if (fact.checks === "passed")
                 return `${ready}. Your tests passed. ${fact.pullRequest === true ? "Merge it?" : "Accept and finish it?"}`;
             if (fact.checks === "off")
-                return `${ready}. Checks are off for this project, so look it over first.`;
+                return `${ready}. Its checks run at release, so look it over first.`;
             return `${ready}, but no tests ran. Look it over first.`;
         case "Failed":
             if (fact.leadOnIt === true)

package/dist/check-levels.d.ts

@@ -52,6 +52,9 @@ export declare function checkCommandFor(store: Store, repo: string, level: Check
     level: CheckLevel;
     command: VerifyCommand | null;
 };
+/** Readiness uses the result's level, falling back to the task/project for legacy
+ * runs. Quick's approved command (or its Full fallback) is required; Off is not. */
+export declare function requiredCheckCommandFor(store: Store, repo: string | null, taskId: string, level: CheckLevel | null | undefined): VerifyCommand | null;
 /** The builder records which level a run used, so its result says it honestly. */
 export declare function recordRunCheckLevel(store: Store, run: {
     id: number;

package/dist/check-levels.js

@@ -118,6 +118,11 @@ export function checkCommandFor(store, repo, level) {
     }
     return { level: "full", command: store.liveVerifyCommand(repo) };
 }
+/** Readiness uses the result's level, falling back to the task/project for legacy
+ * runs. Quick's approved command (or its Full fallback) is required; Off is not. */
+export function requiredCheckCommandFor(store, repo, taskId, level) {
+    return repo === null ? null : checkCommandFor(store, repo, level ?? effectiveCheckLevel(store, repo, taskId).level).command;
+}
 /** The builder records which level a run used, so its result says it honestly. */
 export function recordRunCheckLevel(store, run, level, from, now) {
     store.recordAction({ at: now.toISOString(), actor: "system", repo: run.repo, taskId: run.taskId, runId: run.id, action: RUN_LEVEL_ACTION, outcome: level, source: "work",

package/dist/dispose.js

@@ -707,10 +707,6 @@ export function maybeTriggerRepair(store, repo, evidenceRoot, sourceRunId, verdi
     };
     const briefBytes = Buffer.from(JSON.stringify(draftBrief, null, 2), "utf8");
     const key = writeEvidenceFile(evidenceRoot, sourceRunId, `repair-brief-${sourceRunId}-${attempt}.json`, briefBytes);
-    // Suffixes survive truncation (the CI-repair rule, verbatim): the prefix
-    // gives way, the identity-bearing tail never does.
-    const suffix = observation ? `-evidence-${attempt}` : `-fix-${attempt}`;
-    const draftId = `${rootTask.slice(0, 64 - suffix.length)}${suffix}`;
     // The draft files through the ONE revision boundary: the source's goal,
     // exclusions, touches, rubric, risk, quality, posture, budget, overrides
     // and pins are read from the SOURCE ROWS inside the seal — the scope
@@ -719,7 +715,6 @@ export function maybeTriggerRepair(store, repo, evidenceRoot, sourceRunId, verdi
         source: { task: ref.externalId, run: sourceRunId, scopeDigest: scope.digest },
         brief: { evidenceRoot, key, sha256: createHash("sha256").update(briefBytes).digest("hex"), bytes: briefBytes.length, capture: "machine-authored repair brief (exit 0)" },
         child: {
-            id: draftId,
             title: observation ? `Collect missing evidence for ${ref.externalId}` : verification === undefined ? `repair ${ref.externalId}: ${unresolved.length} criteri${unresolved.length === 1 ? "on" : "a"} unmet` : `Fix failed checks for ${ref.externalId}`,
             repair: observation ? `Collect only the missing observations for ${unresolved.join(", ")}. Keep the saved candidate unchanged. The machine runs supported focused test observations and reuses its intact passing gate; a fresh review assesses the added evidence.` : verification === undefined ? `repair exactly the unmet criteria named below; a comment cannot widen the scope. Unmet: ${unresolved.join(", ")}.` : "Diagnose the saved failed project check and repair within the original scope. Preserve the acceptance criteria and verification command; the revision brief binds the exact failure evidence.",
         },

package/dist/lead-status.d.ts

@@ -105,7 +105,7 @@ export declare function repairStaleStatuses(store: Store, now: Date): {
  * `repos`: the only projects to report (a remote person limited to some projects); null is the whole installation.
  * A limited report counts only those projects' tasks and leaves out what belongs to the installation as a whole:
  * the release check, plan windows and the lead line are empty, never another project's. */
-export declare function installationStatus(store: Store, now: Date, viewer?: string | null, repos?: readonly string[] | null): InstallationStatus;
+export declare function installationStatus(store: Store, now: Date, viewer?: string | null, repos?: readonly string[] | null, root?: string): InstallationStatus;
 /** `limited`: a report over some projects (installationStatus's `repos`), which has no release check or plan windows to state. */
 export declare function renderInstallationStatus(status: InstallationStatus, limited?: boolean): string[];
 export declare function renderTaskWait(snapshot: TaskWaitSnapshot, outcome?: string): string;

package/dist/lead-status.js

@@ -183,7 +183,7 @@ export function repairStaleStatuses(store, now) {
  * `repos`: the only projects to report (a remote person limited to some projects); null is the whole installation.
  * A limited report counts only those projects' tasks and leaves out what belongs to the installation as a whole:
  * the release check, plan windows and the lead line are empty, never another project's. */
-export function installationStatus(store, now, viewer = currentActor()?.account ?? null, repos = null) {
+export function installationStatus(store, now, viewer = currentActor()?.account ?? null, repos = null, root) {
     const admitted = (row) => repos === null || typeof row["repo"] === "string" && repos.includes(row["repo"]);
     const access = { principal: "operator", repos, includeUnplaced: repos === null };
     const runningRows = store.handle.prepare(`SELECT run.id, run.role, run.phase, ref.id AS task_ref, ref.external_id AS task, ref.repo
@@ -262,7 +262,7 @@ export function installationStatus(store, now, viewer = currentActor()?.account
             observedAt: String(row["observed_at"]),
         })),
         signIn: pauses.map(one => ({ provider: one.provider, reason: signInReason(one), command: signInCommand(one), since: one.openedAt })),
-        tasks: workIndexPage(store, now, { ...access, viewer }, { limit: 8 }).items
+        tasks: workIndexPage(store, now, { ...access, viewer }, { limit: 8, ...(root === undefined ? {} : { root }) }).items
             .map(one => ({ task: one.rootId, title: one.title, headline: one.status.label, sentence: one.status.detail })),
         lead: repos !== null ? null : (() => {
             // Only the asker's own lead: another person's lead is never "Your lead".

package/dist/operate.js

@@ -179,7 +179,7 @@ import { CHAT_APPROVE_ALL, presetTerms, modeTermsJson, modeDigestOf, modeTermsFr
 import { WorktreePool } from "./worktree.js";
 import { requestTaskStop, resumeTaskStop, taskControlOf } from "./task-control.js";
 import { worktreeAdoptionNotice } from "./worktree-notices.js";
-import { workIndexPage, WorkIndexCursorError } from "./work-index.js";
+import { workIndexPage, workIndexTask, WorkIndexCursorError } from "./work-index.js";
 import { readExecutorOf } from "./read-executor.js";
 import { parseWorkView } from "./workspace-ui.js";
 import { taskWorkSummaryOf } from "./work-summary.js";
@@ -8307,10 +8307,10 @@ async function statusCommand(positional, flags, context) {
     // that belongs to the installation or other projects (updates, integrations, builds by project, unsent replies).
     const lens = context.principal?.lens ?? null;
     if (lens !== null) {
-        const status = installationStatus(context.store, context.clock(), viewer, lens);
+        const status = installationStatus(context.store, context.clock(), viewer, lens, context.evidenceRoot);
         return succeed(context.write, context.json, command, { ...status, projects: [] }, () => renderInstallationStatus(status, true));
     }
-    const status = installationStatus(context.store, context.clock(), viewer);
+    const status = installationStatus(context.store, context.clock(), viewer, null, context.evidenceRoot);
     // One line, only when a newer Toolroll exists; offline or switched off says nothing.
     const current = PACKAGE_VERSION;
     const method = installMethod(context.installBin);
@@ -8927,6 +8927,7 @@ function listTasks(flags, context) {
         view: parseWorkView(rawView ?? null), limit, cursor: text(flags, 'cursor') ?? null,
         ...(wanted === undefined ? {} : { state: wanted }),
         ...(text(flags, 'repo') === undefined ? {} : { project: text(flags, 'repo') }),
+        root: context.evidenceRoot,
     };
     const refused = (error) => {
         if (!(error instanceof WorkIndexCursorError))
@@ -8990,10 +8991,18 @@ function showTask(positional, context) {
         const repo = store.lookupRef(blocker)?.repo;
         return repo != null && lens.includes(repo);
     });
+    const work = taskWorkSummaryOf(store, id, now, access);
+    const current = assignmentOf(store, id, now, access, context.evidenceRoot);
+    // Read the same saved facts and statusOf path as task list. File health remains
+    // in the assignment diagnostics and action-time guards; it cannot rewrite history.
+    const listed = workIndexTask(store, id, now, access, context.evidenceRoot);
+    const shared = listed === null ? null : { headline: listed.status.label, sentence: listed.status.detail };
+    const primaryAction = listed === null ? work?.primaryAction ?? null : listed.primaryAction;
     const detail = {
         task,
-        work: taskWorkSummaryOf(store, id, now, access),
-        assignment: assignmentBrief(assignmentOf(store, id, now, access, context.evidenceRoot)),
+        work: work === null || listed === null ? work : { ...work, status: { ...work.status, label: listed.status.label, detail: listed.status.detail, tone: listed.status.tone }, primaryAction },
+        status: shared === null ? null : { headline: shared.headline, sentence: shared.sentence },
+        assignment: assignmentBrief(current),
         ref: ref.id,
         // One phrase for every inaccessible blocker, so even their number stays private.
         blockedBy: visibleBlockers.length === blockers.length ? visibleBlockers : [...visibleBlockers, "a task in another project"],
@@ -9033,8 +9042,8 @@ function showTask(positional, context) {
         `${task.id}  ${task.state}${ref.deliverable === "report" ? "  (scout — delivers a report)" : ""}`,
         `  ${task.title}`,
         ...(detail.work === null ? [] : [
-            `  status: ${detail.work.status.label}`,
-            ...(detail.work.primaryAction === null ? [] : [`  next: ${detail.work.primaryAction.label}${detail.work.primaryAction.target.decisionId === null ? "" : ` — decision #${detail.work.primaryAction.target.decisionId}`}`]),
+            `  status: ${shared?.headline ?? detail.work.status.label}${shared === null ? "" : ` — ${shared.sentence}`}`,
+            ...(primaryAction === null ? [] : [`  next: ${primaryAction.label}${primaryAction.target.decisionId === null ? "" : ` — decision #${primaryAction.target.decisionId}`}`]),
         ]),
         // The closed machine-authored verdict (Priority 2), computed once at
         // completion — never re-derived here. Same words `verdictWords`
@@ -9042,7 +9051,7 @@ function showTask(positional, context) {
         ...(task.state !== "done" || detail.proofVerdict === null
             ? []
             : [
-                `  proof: ${proofVerdictWords(detail.proofVerdict, detail.proofReasons).word}${detail.proofAccepted ? " (accepted)" : ""}`,
+                `  proof: ${proofVerdictWords(current?.receipt?.runId === latestFinished?.id ? current?.readiness?.verdict ?? detail.proofVerdict : detail.proofVerdict, detail.proofReasons).word}${detail.proofAccepted ? " (accepted)" : ""}`,
                 ...(detail.proofReasons.length > 0 ? [`    ${detail.proofReasons.join("; ")}`] : []),
                 ...matrixWords(detail.proofMatrix),
                 ...(detail.semanticCoverage === null ? [] : coverageWords(detail.semanticCoverage).map(line => `  ${line}`)),

package/dist/proof.d.ts

@@ -437,6 +437,15 @@ export declare function matrixWords(matrix: readonly CriterionMatrixRow[]): stri
 /** One criterion's context standing in words — shared by the CLI matrix
  * and the console badge title so the two never drift. */
 export declare function coverageStateWords(coverage: CriterionCoverage): string;
+/** The verdict a result shows today, read from the stored one and the facts recorded since, never written back: a
+ * failed check or an unresolved HIGH review finding refutes; a pending review, or any acceptance criterion that has
+ * not passed, keeps it short. It only ever lowers the stored verdict. */
+export declare function shownVerdictOf(stored: ProofVerdict | null, facts: {
+    checkFailed: boolean;
+    highFindings: number;
+    reviewPending: boolean;
+    criteriaPassed: boolean;
+}): ProofVerdict | null;
 /** Plain words for a verdict, shared by every surface (the `summary.ts`
  * pattern) so the task page, run page, board, CLI, and chat cannot say
  * three different things about the same run. */

package/dist/proof.js

@@ -976,6 +976,18 @@ export function coverageStateWords(coverage) {
             return `GAP — inherited context is missing: ${coverage.gaps.join("; ")}${coverage.items.length > 0 ? ` (partial: ${coverage.items.join(", ")})` : ""}${prior}`;
     }
 }
+/** The verdict a result shows today, read from the stored one and the facts recorded since, never written back: a
+ * failed check or an unresolved HIGH review finding refutes; a pending review, or any acceptance criterion that has
+ * not passed, keeps it short. It only ever lowers the stored verdict. */
+export function shownVerdictOf(stored, facts) {
+    if (facts.checkFailed || facts.highFindings > 0 || stored === "refuted")
+        return "refuted";
+    if (stored === null)
+        return null;
+    if (facts.reviewPending || !facts.criteriaPassed)
+        return "short";
+    return stored;
+}
 /** Plain words for a verdict, shared by every surface (the `summary.ts`
  * pattern) so the task page, run page, board, CLI, and chat cannot say
  * three different things about the same run. */

package/dist/release-coverage.d.ts

@@ -0,0 +1,16 @@
+import type { Store } from "./store.js";
+export type ReleaseCoverage = {
+    run: number;
+    head: string;
+};
+/** How many of the newest passing release checks one read considers. */
+export declare const RELEASE_SCAN_LIMIT = 20;
+export type IsAncestor = (repo: string, ancestor: string, descendant: string) => boolean | null;
+/** `git merge-base --is-ancestor`: true, false, or null when Git couldn't say. */
+export declare const gitIsAncestor: IsAncestor;
+export type ReleaseMemo = Map<string, ReleaseCoverage[]>;
+/** The release check covering `head` in `repo`, or null. `memo` keeps one read's receipts. */
+export declare function releaseCoverageOf(store: Store, root: string | undefined, repo: string | null, head: string | null, options?: {
+    memo?: ReleaseMemo;
+    isAncestor?: IsAncestor;
+}): ReleaseCoverage | null;

package/dist/release-coverage.js

@@ -0,0 +1,92 @@
+/** Whether a release check already covers a result whose checks were Off: a
+ * passing FULL release check (run_check.release) on the same project whose
+ * checked commit contains the result's commit. Read at read time from the
+ * existing records and Git; nothing is written back, so no proof, receipt,
+ * scope digest or schema changes. Fails closed: a receipt that can't be read,
+ * a missing commit or any Git error leaves the result uncovered. */
+import { execFileSync } from "node:child_process";
+import { verificationEvidence } from "./verification-evidence.js";
+import { runCheckLevel } from "./check-levels.js";
+/** How many of the newest passing release checks one read considers. */
+export const RELEASE_SCAN_LIMIT = 20;
+const SHA = /^[a-f0-9]{40}$/;
+/** Ancestry between two fixed commits never changes, so a settled answer is kept; errors are not. */
+const ancestry = new Map();
+const ANCESTRY_LIMIT = 4096;
+/** `git merge-base --is-ancestor`: true, false, or null when Git couldn't say. */
+export const gitIsAncestor = (repo, ancestor, descendant) => {
+    if (!SHA.test(ancestor) || !SHA.test(descendant))
+        return null;
+    if (ancestor === descendant)
+        return true;
+    const key = `${repo}\0${ancestor}\0${descendant}`;
+    const known = ancestry.get(key);
+    if (known !== undefined)
+        return known;
+    let answer;
+    try {
+        execFileSync("git", ["-C", repo, "merge-base", "--is-ancestor", ancestor, descendant], { stdio: "ignore", timeout: 5_000 });
+        answer = true;
+    }
+    catch (error) {
+        // Exit 1 is Git's "no"; anything else (a missing object, no repository, a timeout) is no answer.
+        answer = error.status === 1 ? false : null;
+    }
+    if (answer !== null) {
+        if (ancestry.size >= ANCESTRY_LIMIT)
+            ancestry.clear();
+        ancestry.set(key, answer);
+    }
+    return answer;
+};
+/** The newest passing full release checks of one project, each with its sealed, verified commit. Read once per
+ * caller-held memo, so a list of results reads the receipts once. */
+function passingReleases(store, root, repo) {
+    let rows;
+    try {
+        rows = store.handle.prepare(`SELECT rc.run FROM run_check AS rc INDEXED BY run_check_release
+      JOIN run ON run.id = rc.run JOIN task_ref AS ref ON ref.id = run.task_ref
+      WHERE rc.release = 1 AND rc.status = 'passed' AND rc.exit_code = 0 AND ref.repo = ?
+      ORDER BY rc.run DESC LIMIT ${RELEASE_SCAN_LIMIT}`).all(repo);
+    }
+    catch {
+        return [];
+    }
+    return rows.flatMap(row => {
+        const run = Number(row["run"]);
+        try {
+            // Full only: a quick or Off release check covers nothing.
+            const level = runCheckLevel(store, run);
+            if (level !== null && level !== "full")
+                return [];
+            const gate = verificationEvidence(store, root, run);
+            if (!gate.ok || gate.bytes === null)
+                return [];
+            const receipt = JSON.parse(gate.bytes);
+            const head = store.getRun(run)?.headRevision ?? null;
+            if (receipt.run !== run || receipt.result?.ran !== true || receipt.result.exitCode !== 0)
+                return [];
+            if (typeof receipt.command?.repo === "string" && receipt.command.repo.startsWith("quick:"))
+                return [];
+            if (typeof receipt.head !== "string" || !SHA.test(receipt.head) || receipt.head !== head)
+                return [];
+            return [{ run, head: receipt.head }];
+        }
+        catch {
+            return [];
+        }
+    });
+}
+/** The release check covering `head` in `repo`, or null. `memo` keeps one read's receipts. */
+export function releaseCoverageOf(store, root, repo, head, options = {}) {
+    if (root === undefined || repo === null || head === null || !SHA.test(head))
+        return null;
+    const memo = options.memo ?? new Map();
+    let releases = memo.get(repo);
+    if (releases === undefined) {
+        releases = passingReleases(store, root, repo);
+        memo.set(repo, releases);
+    }
+    const isAncestor = options.isAncestor ?? gitIsAncestor;
+    return releases.find(one => isAncestor(repo, head, one.head) === true) ?? null;
+}

package/dist/server/chat.js

@@ -40,7 +40,7 @@ import { refuse, screen } from "./chrome.js";
 import { chatResultHref, chatReturnWithLatest, chatReturnWithSaid, projectChatHref, redirect, respond, safeChatReturn, safeReturn, taskChatHref, taskHref } from "./http.js";
 import { chatAckPage, chatPage, coordinatorProposalsSection, decisionsFor, leadAfterComposerHtml, leadChatVersion, leadMintCard, leadPage, leadThreadHtml, PHONE_CARD_FACT, TASK_COMPOSER_MODES, taskChatLiveRegion, teamProposalCardParts } from "./render-chat.js";
 import {} from "./render-pages.js";
-import { completionForm, homePhaseWords, owedAcceptanceOf, resultPanelHtml } from "./render-results.js";
+import { completionForm, hardBlockerOf, homePhaseWords, owedAcceptanceOf, resultPanelHtml } from "./render-results.js";
 import { browserCaller, oneLineUa } from "./session.js";
 export function createChatHandlers(runtime) {
     const { firstRunStepsNow, managedRepos, leadWords, store, options, phoneSetup, visible, liveTurns, leadSaid, evidenceRoot, clock, sessions, CHAT_CANDIDATE_TTL_MS, chatFetcher, CHAT_CANDIDATES_PER_APPROVER, chatCeilingDigest, workAccess, familyOf, firstTasks, leadPrincipal, taskChatFocus, chatScopeOf, leadConversationRows, demoLeadHere, sendScreen, chromeFor, teamBrowserReply, team, teamChatProvider, runVisible, runIsLive, resultDetailOf, pullRequestTargetOf, chatEnablement, startLeadConversation, projectFamilyPeek, needsYouBadge, liveRefreshSeconds, chatKeyFor, chatCatalog, providerHome, mintApprovalNonce, checkLocalAgents, agentSignInCommand, bustBadge, authenticateApprover, revisionDestination, armTaskResume, consumeApprovalNonce } = runtime;
@@ -185,7 +185,9 @@ export function createChatHandlers(runtime) {
         const roomId = url.searchParams.get('conversation');
         const resultLink = (href) => roomId ? href + '&conversation=' + encodeURIComponent(roomId) : href;
         // Accept and finish is here: the one act that accepts the person's own checks and finishes the task.
-        const finishes = resultRun !== null && who.role === 'approver' && focusTask?.assignment?.state === 'ready-to-check' && focusTask.assignment.receipt?.runId === resultRun.id;
+        // Never offered where Complete is refused whatever is accepted (a failed check, a HIGH finding).
+        const finishes = resultRun !== null && who.role === 'approver' && focusTask?.assignment?.state === 'ready-to-check' && focusTask.assignment.receipt?.runId === resultRun.id &&
+            hardBlockerOf(focusTask.assignment) === null;
         const resultPanel = resultRun === null
             ? null
             : html `${resultPanelHtml(resultDetailOf(resultRun, who, now), {
@@ -267,7 +269,7 @@ export function createChatHandlers(runtime) {
         if (repos.length > 0) {
             try {
                 fleetSnapshot = store.chatSnapshot(repos, now);
-                const summaries = workIndexPage(store, now, { principal: 'operator', repos, includeUnplaced: false, viewer: who.name }, { limit: 100 }).items;
+                const summaries = workIndexPage(store, now, { principal: 'operator', repos, includeUnplaced: false, viewer: who.name }, { limit: 100, root: evidenceRoot }).items;
                 fleetSnapshot.assignmentStates = Object.fromEntries(summaries.flatMap(value => [value.rootId, value.activeTaskId].map(id => [id, { state: value.assignmentState, label: value.status.label, detail: value.status.detail }])));
                 fleetSnapshot.attentionCount = needsYouBadge(null);
             }
@@ -1291,9 +1293,9 @@ export function createChatHandlers(runtime) {
                 agent: `${providerName(run.provider)} on ${run.runner}`, phase: homePhaseWords(run), project: run.repo === null ? null : projectName(run.repo), since: run.startedAt,
                 activity: runActivityOf(store, run, now) };
         });
-        const all = workIndexPage(store, now, access, { view: "all", limit: WORK_INDEX_MAX_LIMIT });
-        const needs = workIndexPage(store, now, access, { view: "needs-you", limit: WORK_INDEX_MAX_LIMIT });
-        const done = workIndexPage(store, now, access, { view: "completed", limit: WORK_INDEX_MAX_LIMIT });
+        const all = workIndexPage(store, now, access, { view: "all", limit: WORK_INDEX_MAX_LIMIT, root: evidenceRoot });
+        const needs = workIndexPage(store, now, access, { view: "needs-you", limit: WORK_INDEX_MAX_LIMIT, root: evidenceRoot });
+        const done = workIndexPage(store, now, access, { view: "completed", limit: WORK_INDEX_MAX_LIMIT, root: evidenceRoot });
         const weekAgo = new Date(now.getTime() - 7 * 86_400_000).toISOString();
         const counts = [
             { key: "working", label: "Working now", value: agents.length, href: "/work?view=running" },