toolroll 0.9.67 → 0.9.69

package/dist/operate.js

@@ -9,7 +9,7 @@ import { checkPublicCommand } from "./public-check.js";
 import { leadNameOf } from "./lead-identity.js";
 import { maybeTriggerRepair } from "./dispose.js";
 import { CHECK_LEVEL_HINTS, CHECK_LEVEL_WORDS, isCheckLevel, liveQuickCommand, projectCheckLevel, quickVerifyKey, setProjectCheckLevel, setTaskCheckLevel, suggestQuickCommand } from "./check-levels.js";
-import { fileAddTestsTask, followUpChecksOf, requestFollowUpChecks, runFollowUpCheck, runWaitingChecks } from "./result-follow-ups.js";
+import { fileAddTestsTask, requestFollowUpChecks, runFollowUpCheck, runWaitingChecks } from "./result-follow-ups.js";
 import { runBatchChecks } from "./batch-checks.js";
 import { BATCH_HINT, BATCH_WINDOW_MS, projectBatchChecks, setProjectBatchChecks } from "./batch-policy.js";
 import { buildReviewPass } from "./build-review.js";
@@ -97,13 +97,13 @@ import { taskReviewBrief, renderReviewBrief } from "./task-review-brief.js";
 import { homedir, hostname } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
 import { releaseStalledUpdate, waitingUpdate } from "./toolroll-update.js";
-import { openStore, openStoreNoMigrate, CONCURRENT_WRITER_WAIT_MS, isDatabaseBusy, databasePath, BUILT_IN, DEFAULT_ACTOR, parseCapabilityKey, verifiedAuthor, isDigestTime, RESULT_SCREENSHOTS, } from "./store.js";
+import { openStore, openStoreNoMigrate, CONCURRENT_WRITER_WAIT_MS, isDatabaseBusy, databasePath, BUILT_IN, parseCapabilityKey, verifiedAuthor, isDigestTime, RESULT_SCREENSHOTS, } from "./store.js";
 import { createHash, randomBytes, randomInt, randomUUID } from "node:crypto";
 import { claimInstance, clearInstance, openInstanceSocket } from "./console-instance.js";
 import { authorizePlanUnderMode } from "./plan-auto.js";
 import { ghDispatchAdapter, mirrorTaskId, syncPass } from "./sync.js";
 import { LIVE_FILE_BOUND, LIVE_RETAIN_MS, sweepLiveLogs } from "./live.js";
-import { configPath, addRepos, removeRepos, updateRepos, loadRepos, loadProjectRegistry, updateProjectRegistry } from "./repos.js";
+import { addRepos, removeRepos, updateRepos, loadRepos, loadProjectRegistry, updateProjectRegistry } from "./repos.js";
 import { deleteProject, holdingsWords, projectHoldings, projectRunning } from "./project-delete.js";
 import { pushPass } from "./push.js";
 import { chmodSync, closeSync, constants as fsConstants, existsSync, fstatSync, fsyncSync, openSync, readFileSync, readSync, realpathSync, renameSync, unlinkSync, writeSync, writeFileSync } from "node:fs";
@@ -112,6 +112,8 @@ import { claimActor, currentActor, withActor } from "./actor.js";
 import { parseLeadToken } from "./api-tokens.js";
 import { MAX_NETWORK_HOSTS, normalizeHost } from "./egress.js";
 import { isWritesMode, writesWords } from "./writes-mode.js";
+import { linuxFenceAvailable, macosFenceAvailable } from "./agent-fence.js";
+import { CHECK_ACCESS_WARNINGS, checkAccessRunsAs, checkAccessWords, isCheckAccess, signInHostsMissing, signInsUnavailableWords, widerThan } from "./check-access.js";
 import { CLI_PASSWORD_SOURCE, withPasswordSource } from "./sign-in-guard.js";
 import { admissionRecorded, admitProject, commandLineActor } from "./project-admission.js";
 import { leadClaim, leadSay, noteLeadWork } from "./lead-voice.js";
@@ -120,7 +122,7 @@ import { spawn as spawnChild } from "node:child_process";
 // Every envelope is checked against its command's schema (logged, never refused), then serialized unchanged.
 import { checkedEnvelopeJson as envelopeJson } from "./contracts/cli.js";
 import { auditCommand } from "./audit-cli.js";
-import { closedQuestionWords, hasDisguisedText, hasForbiddenControls, validateNote } from "./decision.js";
+import { closedQuestionWords, hasDisguisedText, validateNote } from "./decision.js";
 import { readVerifiedArtifact, readVerifiedReport, storeEvidence } from "./evidence.js";
 import { contractChangesOf, decodePlanContractRecord, describeContractChanges, encodePlannerSource, plannerSourceOf } from "./planner-source.js";
 /**
@@ -162,7 +164,7 @@ function planContractLines(store, evidenceRoot, taskId) {
     ];
 }
 import { verdictWords as proofVerdictWords, matrixWords, semanticCoverage, coverageWords } from "./proof.js";
-import { probeRepo, isVerified } from "./probe.js";
+import { probeRepo } from "./probe.js";
 import { diagnoseTaskDispatch, diagnosisIsDispatchable, scopeApprovedForDispatch, } from "./dispatch.js";
 import { createDecisionServer } from "./serve.js";
 import { readTailnetNames } from "./tailnet.js";
@@ -178,7 +180,7 @@ import { activeRemote, REMOTE_MESSAGES, REMOTE_REFUSED_FLAGS, REMOTE_SCOPES, Rem
 import { projectAuthority } from "./project-access.js";
 import { authorizedProject, canonicalProject, projectName, resolveCeiling } from "./project.js";
 import { tally, spendLine } from "./summary.js";
-import { bodyHashOf, describePublicationGrant, observeChecks, publicationBody, publishPass, sweepMerges, } from "./publish.js";
+import { describePublicationGrant, observeChecks, publishPass, sweepMerges, } from "./publish.js";
 import { checkPublishing, publishingOf, savePublishing, followPullRequests, newestPullRequestOf } from "./pull-request-flow.js";
 import { starterOf, startersFor, switchOnStarter } from "./flow-starters.js";
 import { acquire, acquireIfReady, heartbeat, release, reap, currentClaim, DEFAULT_LEASE_MS, SYNC_MAX_AGE_MS, finalize, } from "./claim.js";
@@ -189,7 +191,7 @@ import { register, authenticate, heartbeat as heartbeatRunner, isAlive, recoverD
 import { mintCoordinator, revokeCoordinator, listCoordinators } from "./coordinator.js";
 import { serveMcp } from "./mcp.js";
 import { createInterface } from "node:readline";
-import { propose, approve, addApprover, authenticateAccount, authenticateApprover as passwordApprover, describeScope, approvalOf, hashToken as hashApproverToken, fileAndSealUnderMode, modeFilingCoverage, acceptanceLinesToInput, parseAcceptanceCriteria, splitAcceptanceRubric, rubricIsPlaceholder, isCommitSha, credentialProof, rememberedLogin } from "./scope.js";
+import { propose, approve, addApprover, authenticateAccount, authenticateApprover as passwordApprover, describeScope, approvalOf, hashToken as hashApproverToken, modeFilingCoverage, acceptanceLinesToInput, parseAcceptanceCriteria, splitAcceptanceRubric, rubricIsPlaceholder, isCommitSha, credentialProof, rememberedLogin } from "./scope.js";
 import { CHAT_APPROVE_ALL, presetTerms, modeTermsJson, modeDigestOf, modeTermsFromJson, modeWords, MODE_MAX_DAYS } from "./modes.js";
 import { WorktreePool } from "./worktree.js";
 import { baseStandingWords, freshBaseFor, taskBaseOf } from "./task-base.js";
@@ -217,7 +219,7 @@ import { plan as planTask } from "./planner.js";
 import { attachTmux, elapsedWords, openInTmux, PEEK_TAIL_LINES, runPeek, snapshotLiveRuns } from "./peek-cli.js";
 import { scout as scoutTask } from "./scout.js";
 import { profileDigestOf } from "./scope.js";
-import { PROVIDER_KEY_ENV, SUBSCRIPTION_CAPABLE, clearProviderKey, keyStatus, readAuthMode, readAuthModeStrict, readProviderKey, saveProviderKey, setAuthMode, verifyProviderKey, verdictWords } from "./keys.js";
+import { PROVIDER_KEY_ENV, clearProviderKey, keyStatus, readAuthMode, readAuthModeStrict, readProviderKey, saveProviderKey, setAuthMode, verifyProviderKey, verdictWords } from "./keys.js";
 import { run, terminateLiveProviders, run as execRun } from "./exec.js";
 import { containmentNotice, containmentStatus, currentContainment, describeContainment, resolveContainment } from "./containment.js";
 import { readPulls } from "./pulls.js";
@@ -265,6 +267,9 @@ export const OPERATE_HELP = `toolroll — operating the queue
                                         where the project's builds may write: only their checkout, caches and temp
                                         (workspace, the default), or anywhere outside Toolroll's fenced folders;
                                         an approver changes it (new scopes seal it; approved ones keep theirs)
+  toolroll project check-access --repo <p> [sandboxed|sign-ins|unsandboxed]
+                                        how far the project's checks reach: sandboxed (the default), with model
+                                        and GitHub sign-ins, or not sandboxed; an instance operator widens it
   toolroll config unconfined-agents [allow|refuse]
                                         whether builds run where this machine can't confine them (instance operator)
   toolroll project concurrency [<n>] --repo <p>
@@ -916,6 +921,8 @@ async function dispatchOn(command, positional, flags, repoList, base, options, e
             ...(options.flowTriggerIo === undefined ? {} : { flowTriggerIo: options.flowTriggerIo }),
             ...(options.flowStepIo === undefined ? {} : { flowStepIo: options.flowStepIo }),
             ...(options.flowEveryMs === undefined ? {} : { flowEveryMs: options.flowEveryMs }),
+            ...(options.platform === undefined ? {} : { platform: options.platform }),
+            ...(options.fenceAvailable === undefined ? {} : { fenceAvailable: options.fenceAvailable }),
             ...(options.flowFetch === undefined ? {} : { flowFetch: options.flowFetch }),
             ...(options.integrationIo === undefined ? {} : { integrationIo: options.integrationIo }),
             ...(options.shouldStop === undefined ? {} : { shouldStop: options.shouldStop }),
@@ -1171,6 +1178,8 @@ async function dispatch(command, positional, flags, context) {
                 return projectNetworkCommand(positional, flags, context);
             if (positional[0] === "writes")
                 return projectWritesCommand(positional, flags, context);
+            if (positional[0] === "check-access")
+                return projectCheckAccessCommand(positional, flags, context);
             if (positional[0] === "checks")
                 return projectChecksCommand(positional, flags, context);
             if (positional[0] === "demo")
@@ -1356,9 +1365,8 @@ async function readyCommand(flags, context) {
     if (backendName !== BUILT_IN) {
         const repo = repoFrom(flags);
         const backend = openBackend(backendName, store, repo);
-        if (backend === null) {
+        if (backend === null)
             return fail(write, json, "ready", "usage", `no backend \`${backendName}\``, EXIT.usage);
-        }
         const result = await backend.listReady();
         if (!result.ok)
             return fail(write, json, "ready", result.reason, result.message, EXIT.failed);
@@ -1443,17 +1451,14 @@ function claimCommand(positional, flags, context) {
     // protects those leases would be protecting the wrong thing. This is what
     // "auth from the first commit" is for — it is only cheap now.
     const token = text(flags, "token");
-    if (token === undefined) {
+    if (token === undefined)
         return fail(write, json, "claim", "usage", "--token proves the runner is who it says", EXIT.usage);
-    }
     const auth = authenticate(store, runner, token);
-    if (!auth.ok) {
+    if (!auth.ok)
         return fail(write, json, "claim", auth.reason, describeAuth(auth.reason, runner), EXIT.refused);
-    }
     const backend = text(flags, "backend") ?? BUILT_IN;
-    if (backend === BUILT_IN && store.getTask(id) === null) {
+    if (backend === BUILT_IN && store.getTask(id) === null)
         return fail(write, json, "claim", "unknown-task", `no task \`${id}\``, EXIT.refused);
-    }
     const ttl = readTtl(flags);
     if (ttl === null)
         return fail(write, json, "claim", "usage", "--ttl takes whole seconds", EXIT.usage);
@@ -1475,9 +1480,8 @@ function claimCommand(positional, flags, context) {
             // tasks" while letting the asker declare which those are is not a rule.
             origin: store.originOf(backend, id),
         });
-        if (!verdict.ok) {
+        if (!verdict.ok)
             return fail(write, json, "claim", verdict.reason, verdict.message, EXIT.refused);
-        }
     }
     const ref = store.refFor(backend, id);
     const result = acquire(store, ref.id, runner, {
@@ -1489,9 +1493,8 @@ function claimCommand(positional, flags, context) {
     if (!result.ok) {
         // Two distinct refusals: somebody HOLDS it right now, or it is
         // RESERVED for a specific worker whoever asks (queue columns, v19).
-        if (result.reason === "reserved") {
+        if (result.reason === "reserved")
             return fail(write, json, "claim", "reserved", `${id} is reserved for ${result.reservedFor} — only that worker takes it`, EXIT.refused, { reservedFor: result.reservedFor });
-        }
         if (result.reason === "external") {
             const said = {
                 "stale-mirror": "this tracker item has not been seen recently — run `toolroll sync` first",
@@ -1503,24 +1506,18 @@ function claimCommand(positional, flags, context) {
                 detail: result.detail,
             });
         }
-        if (result.reason === "mode-ended") {
+        if (result.reason === "mode-ended")
             return fail(write, json, "claim", "mode-ended", result.message, EXIT.refused);
-        }
-        if (result.reason === "unauthenticated") {
+        if (result.reason === "unauthenticated")
             return fail(write, json, "claim", "unauthenticated", describeAuth(result.detail, runner), EXIT.refused);
-        }
-        if (result.reason === "unplaced") {
+        if (result.reason === "unplaced")
             return fail(write, json, "claim", "unplaced", "this task has no repository — preserve its history and file a replacement with `task add <title> --repo <path>`, then approve the new scope", EXIT.refused);
-        }
-        if (result.reason === "unauthorized-repo") {
+        if (result.reason === "unauthorized-repo")
             return fail(write, json, "claim", "unauthorized-repo", `this runner is not bound to ${result.repo} — \`runner bind\` adds it`, EXIT.refused);
-        }
-        if (result.reason === "coordinator-filed") {
+        if (result.reason === "coordinator-filed")
             return fail(write, json, "claim", "coordinator-filed", "a coordinator filed this — nothing runs until the operator signs its scope", EXIT.refused);
-        }
-        if (result.reason === "sweep-limit") {
+        if (result.reason === "sweep-limit")
             return fail(write, json, "claim", "sweep-limit", `its sweep already has ${result.limit} running at once — it starts when one finishes`, EXIT.refused, { sweep: result.sweep, limit: result.limit });
-        }
         return fail(write, json, "claim", result.reason, `held by ${result.by} until ${result.until}`, EXIT.refused, { holder: result.by, until: result.until });
     }
     // Taking a task is what makes it running; leaving that to the caller would
@@ -1640,9 +1637,8 @@ async function runnerCommand(positional, flags, context) {
             return fail(write, json, "runner register", "usage", "`runner register <name> --repo <path> --as <you> --token <t>` — minting runner authority is an operator act", EXIT.usage);
         }
         const authenticated = credentialApprover(store, acting.name, acting.token);
-        if (!authenticated.ok) {
+        if (!authenticated.ok)
             return fail(write, json, "runner register", authenticated.reason, describeApproveFailure(authenticated.reason, name), EXIT.refused);
-        }
         const repos = context.repoList ?? [];
         if (repos.length === 0) {
             return fail(write, json, "runner register", "usage", "--repo names at least one repository this runner may build — authority binds at the mint", EXIT.usage);
@@ -1652,9 +1648,8 @@ async function runnerCommand(positional, flags, context) {
         // a worker, no paste step. The file must not already exist: a second
         // mint never silently overwrites a credential a running watch holds.
         const tokenFile = text(flags, "token-file");
-        if (tokenFile !== undefined && existsSync(tokenFile)) {
+        if (tokenFile !== undefined && existsSync(tokenFile))
             return fail(write, json, "runner register", "token-file-exists", `${tokenFile} already exists — remove it first if that worker is gone, or name another file`, EXIT.refused);
-        }
         const { runner, token, reclaimed } = register(store, {
             name,
             host: hostname(),
@@ -1694,13 +1689,11 @@ async function runnerCommand(positional, flags, context) {
     }
     if (action === "heartbeat") {
         const token = text(flags, "token");
-        if (name === undefined || token === undefined) {
+        if (name === undefined || token === undefined)
             return fail(write, json, "runner heartbeat", "usage", "`runner heartbeat <name> --token <token>`", EXIT.usage);
-        }
         const result = heartbeatRunner(store, name, token, now);
-        if (!result.ok) {
+        if (!result.ok)
             return fail(write, json, "runner heartbeat", result.reason, describeAuth(result.reason, name), EXIT.refused);
-        }
         return succeed(write, json, "runner heartbeat", { runner: result.runner }, () => [
             `${name} checked in.`,
         ]);
@@ -1735,22 +1728,16 @@ async function runnerCommand(positional, flags, context) {
         return EXIT.ok;
     }
     if (action === "retire") {
-        if (name === undefined) {
+        if (name === undefined)
             return fail(write, json, "runner retire", "usage", "which runner?", EXIT.usage);
-        }
         // Retiring is revoking authority — the same operator act as minting it.
         const acting = await askCredentials(flags, context);
-        if (acting === null) {
-            return fail(write, json, "runner retire", "usage", "`runner retire <name> --as <you> --token <t>` — revoking runner authority is an operator act", EXIT.usage);
-        }
-        const authenticated = authenticateApprover(store, acting.name, acting.token);
-        if (!authenticated.ok) {
-            return fail(write, json, "runner retire", authenticated.reason, describeApproveFailure(authenticated.reason, name), EXIT.refused);
-        }
+        const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
+        if (acting === null || !verified?.ok)
+            return refuseApprover(context, "runner retire", verified, "`runner retire <name> --as <you> --token <t>` — revoking runner authority is an operator act", name);
         const retired = store.retireRunner(name, now, mutationFrom(flags, now));
-        if (!retired) {
+        if (!retired)
             return fail(write, json, "runner retire", "unknown", `no runner \`${name}\``, EXIT.refused);
-        }
         return succeed(write, json, "runner retire", { name }, () => [`${name} is retired.`]);
     }
     if (action === "bind") {
@@ -1766,17 +1753,15 @@ async function runnerCommand(positional, flags, context) {
             return fail(write, json, "runner bind", "usage", "`runner bind <name> --repo <path> --as <you> --token <t>` — binding repositories is an operator act", EXIT.usage);
         }
         const authenticated = credentialApprover(store, acting.name, acting.token);
-        if (!authenticated.ok) {
+        if (!authenticated.ok)
             return fail(write, json, "runner bind", authenticated.reason, describeApproveFailure(authenticated.reason, name), EXIT.refused);
-        }
         const repos = context.repoList ?? [];
         if (repos.length === 0) {
             return fail(write, json, "runner bind", "usage", "--repo names at least one repository", EXIT.usage);
         }
         const bound = store.bindRunnerRepos(name, canonicalRepos(repos), now);
-        if (!bound.ok) {
+        if (!bound.ok)
             return fail(write, json, "runner bind", bound.reason, describeAuth(bound.reason, name), EXIT.refused);
-        }
         return succeed(write, json, "runner bind", { name, repos: bound.repos }, () => [
             `${name} may build in:`,
             ...bound.repos.map(one => `  ${one}`),
@@ -1787,22 +1772,18 @@ async function runnerCommand(positional, flags, context) {
         // ledger as before → after. It never stops running work: claims already
         // held keep going, and the new number applies at the next claim.
         const given = positional[2];
-        if (name === undefined || given === undefined || positional.length > 3) {
+        if (name === undefined || given === undefined || positional.length > 3)
             return fail(write, json, "runner capacity", "usage", "`runner capacity <name> <n> --as <you> --token <t>`", EXIT.usage);
-        }
         const capacity = parseRunnerCapacity(given, { allowZero: true });
-        if (capacity === null) {
+        if (capacity === null)
             return fail(write, json, "runner capacity", "usage", `capacity is a whole number of tasks, 0 to ${RUNNER_CAPACITY_MAX}; 0 stops new builds`, EXIT.usage);
-        }
         const acting = await askCredentials(flags, context);
         const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
-        if (acting === null || verified === null || !verified.ok || !store.isInstanceOperator(acting.name)) {
+        if (acting === null || !verified?.ok || !store.isInstanceOperator(acting.name))
             return fail(write, json, "runner capacity", "refused", "An instance operator changes a worker's capacity: pass --as and --token (or use the remembered login).", EXIT.refused);
-        }
         const changed = store.setRunnerCapacity(name, capacity, acting.name, now);
-        if (!changed.ok) {
+        if (!changed.ok)
             return fail(write, json, "runner capacity", changed.reason, changed.reason === "retired" ? `${name} is retired` : `no runner \`${name}\``, EXIT.refused);
-        }
         const running = store.liveClaimCount(name, now);
         if (changed.after === 0) {
             return succeed(write, json, "runner capacity", { name, before: changed.before, after: changed.after, running }, () => [
@@ -1852,9 +1833,8 @@ async function coordinatorCommand(positional, flags, context) {
             return fail(write, json, "coordinator mint", "usage", "`coordinator mint <name> --repo <path> --as <you> --token <t>` — minting filing authority is an operator act", EXIT.usage);
         }
         const authenticated = credentialApprover(store, acting.name, acting.token);
-        if (!authenticated.ok) {
+        if (!authenticated.ok)
             return fail(write, json, "coordinator mint", authenticated.reason, describeApproveFailure(authenticated.reason, name), EXIT.refused);
-        }
         const repos = context.repoList ?? [];
         if (repos.length === 0) {
             return fail(write, json, "coordinator mint", "usage", "--repo names at least one repository this coordinator may file into", EXIT.usage);
@@ -1892,17 +1872,12 @@ async function coordinatorCommand(positional, flags, context) {
         ]);
     }
     if (action === "revoke") {
-        if (name === undefined) {
+        if (name === undefined)
             return fail(write, json, "coordinator revoke", "usage", "which coordinator? (`coordinator list` shows cids)", EXIT.usage);
-        }
         const acting = await askCredentials(flags, context);
-        if (acting === null) {
-            return fail(write, json, "coordinator revoke", "usage", "`coordinator revoke <cid> --as <you> --token <t>` — revoking is an operator act", EXIT.usage);
-        }
-        const authenticated = authenticateApprover(store, acting.name, acting.token);
-        if (!authenticated.ok) {
-            return fail(write, json, "coordinator revoke", authenticated.reason, describeApproveFailure(authenticated.reason, name), EXIT.refused);
-        }
+        const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
+        if (acting === null || !verified?.ok)
+            return refuseApprover(context, "coordinator revoke", verified, "`coordinator revoke <cid> --as <you> --token <t>` — revoking is an operator act", name);
         const revoked = revokeCoordinator(store, name, acting.name, now);
         if (!revoked.ok) {
             const said = revoked.reason === "unknown" ? `no coordinator \`${name}\` — \`coordinator list\` shows cids` : "already revoked";
@@ -2066,19 +2041,16 @@ async function buildCommand(positional, flags, context) {
     const runner = text(flags, "runner");
     const token = text(flags, "token");
     const branch = text(flags, "branch");
-    if (id === undefined || runner === undefined || token === undefined || branch === undefined) {
+    if (id === undefined || runner === undefined || token === undefined || branch === undefined)
         return fail(write, json, "build", "usage", "`toolroll build <id> --runner <name> --token <t> --branch <b> --repo <path>`", EXIT.usage);
-    }
     const auth = authenticate(store, runner, token);
-    if (!auth.ok) {
+    if (!auth.ok)
         return fail(write, json, "build", auth.reason, describeAuth(auth.reason, runner), EXIT.refused);
-    }
     const repo = repoFrom(flags);
     // Standalone build proves membership BEFORE leasing anything (MCP spec
     // v6, round-4 finding 2): the caller's --repo is a claim, not authority.
-    if (!auth.runner.repos.includes(canonicalProject(repo) ?? resolve(repo))) {
+    if (!auth.runner.repos.includes(canonicalProject(repo) ?? resolve(repo)))
         return fail(write, json, "build", "unauthorized-repo", `${runner} is not bound to ${repo} — \`runner bind\` adds it`, EXIT.refused);
-    }
     // Only a task that exists: a lookup must never register an id before the task is filed (its ledger history would be the task's).
     if (store.getTask(id) === null)
         return fail(write, json, "build", "unknown-task", `No task ${id}.`, EXIT.refused);
@@ -2093,9 +2065,8 @@ async function buildCommand(positional, flags, context) {
         now,
         ...(text(flags, "base") === undefined ? {} : { base: text(flags, "base") }),
     });
-    if (!leased.ok) {
+    if (!leased.ok)
         return fail(write, json, "build", leased.reason, leased.message, EXIT.refused);
-    }
     // The standalone road records its attempt and carries its exact lease the
     // same as tick's — a park sealed here goes through the same fenced
     // transaction, because a gate one road bypasses is a suggestion. No claim
@@ -2274,22 +2245,19 @@ async function tickCommand(flags, context) {
         return demoFence;
     const runner = text(flags, "runner");
     const token = text(flags, "token");
-    if (runner === undefined || token === undefined) {
+    if (runner === undefined || token === undefined)
         return fail(write, json, "tick", "usage", "`toolroll tick --runner <name> --token <t> --repo <path> [--max <n>] [--base <ref>]`", EXIT.usage);
-    }
     // Heartbeat rather than bare auth: a pass that is about to hold leases for
     // half an hour should also be on record as alive.
     const auth = heartbeatRunner(store, runner, token, clock());
-    if (!auth.ok) {
+    if (!auth.ok)
         return fail(write, json, "tick", auth.reason, describeAuth(auth.reason, runner), EXIT.refused);
-    }
     if (updateAdmissionPaused(store.raw()))
         return fail(write, json, "tick", "updating", UPDATE_PAUSED, EXIT.refused);
     const maxGiven = text(flags, "max");
     const maxAsked = maxGiven === undefined ? 1 : Number(maxGiven);
-    if (!Number.isInteger(maxAsked) || maxAsked <= 0) {
+    if (!Number.isInteger(maxAsked) || maxAsked <= 0)
         return fail(write, json, "tick", "usage", "--max takes a whole number of tasks", EXIT.usage);
-    }
     // The service's build lanes (project-concurrency.ts): a lane over its
     // project's fair share still runs its housekeeping but starts no
     // unattended build this pass; an extra lane only builds.
@@ -2297,17 +2265,15 @@ async function tickCommand(flags, context) {
     const buildsOnly = flags.has("builds-only");
     const syncAgeGiven = text(flags, "sync-max-age");
     const syncMaxAgeMs = syncAgeGiven === undefined ? SYNC_MAX_AGE_MS : Number(syncAgeGiven) * 1000;
-    if (!Number.isInteger(syncMaxAgeMs) || syncMaxAgeMs <= 0) {
+    if (!Number.isInteger(syncMaxAgeMs) || syncMaxAgeMs <= 0)
         return fail(write, json, "tick", "usage", "--sync-max-age takes whole seconds", EXIT.usage);
-    }
     const repo = repoFrom(flags);
     // THE PRE-I/O MEMBERSHIP CHECK (MCP spec v6, round-4 finding 1): the
     // pass proves its canonical repo is in the runner's BOUND list before
     // any git access, probe, or schedule fires. The --repo flag stops being
     // authority on every runner road, not only at the claim.
-    if (!auth.runner.repos.includes(canonicalProject(repo) ?? resolve(repo))) {
+    if (!auth.runner.repos.includes(canonicalProject(repo) ?? resolve(repo)))
         return fail(write, json, "tick", "unauthorized-repo", `${runner} is not bound to ${repo} — \`runner bind\` adds it`, EXIT.refused);
-    }
     const pool = text(flags, "pool") ?? join(dirname(databasePath(process.env, homedir())), "worktrees");
     const model = text(flags, "model");
     const repairModel = text(flags, "repair-model");
@@ -2342,9 +2308,8 @@ async function tickCommand(flags, context) {
     let base = text(flags, "base");
     if (base === undefined) {
         const head = await git("git", ["symbolic-ref", "--short", "-q", "HEAD"], { cwd: repo });
-        if (head.code !== 0 || head.stdout.trim() === "") {
+        if (head.code !== 0 || head.stdout.trim() === "")
             return fail(write, json, "tick", "git", `${repo} has no branch checked out — say --base explicitly`, EXIT.refused);
-        }
         base = head.stdout.trim();
     }
     // Probes run at every checkpoint (§3): a key revoked overnight is caught
@@ -3669,9 +3634,8 @@ async function briefCommand(flags, context) {
     // (§6): the last watch episode's window and runner, instead of "the last
     // 24 hours" — which can mix two windows, or none.
     const episode = flags.has("latest-watch") ? store.latestWatchEpisode(repo) : null;
-    if (flags.has("latest-watch") && episode === null) {
+    if (flags.has("latest-watch") && episode === null)
         return fail(write, json, "brief", "no-watch", "no watch episode recorded for this repo yet — run `toolroll watch` first", EXIT.refused);
-    }
     const since = episode?.startedAt ??
         text(flags, "since") ??
         new Date(clock().getTime() - 24 * 60 * 60_000).toISOString();
@@ -3841,13 +3805,11 @@ async function decideCommand(positional, flags, context) {
         return EXIT.refused;
     }
     const id = Number(idText);
-    if (!Number.isInteger(id) || id <= 0) {
+    if (!Number.isInteger(id) || id <= 0)
         return fail(write, json, "decide", "usage", "`toolroll decide [<id>] [--choose <option>]`", EXIT.usage);
-    }
     const decision = store.getDecision(id);
-    if (decision === null) {
+    if (decision === null)
         return fail(write, json, "decide", "unknown-decision", `no decision ${id}`, EXIT.refused);
-    }
     const choice = text(flags, "choose");
     if (choice === undefined) {
         const evidence = store.evidenceFor(id);
@@ -3892,14 +3854,10 @@ async function decideCommand(positional, flags, context) {
         return EXIT.ok;
     }
     const acting = await askCredentials(flags, context);
-    if (acting === null) {
-        return fail(write, json, "decide", "usage", "answering takes `--as <you> --token <t>` — who decided is recorded, not asserted", EXIT.usage);
-    }
+    const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
+    if (acting === null || !verified?.ok)
+        return refuseApprover(context, "decide", verified, "answering takes `--as <you> --token <t>` — who decided is recorded, not asserted", String(id));
     const { name: asWho, token } = acting;
-    const authenticated = authenticateApprover(store, asWho, token);
-    if (!authenticated.ok) {
-        return fail(write, json, "decide", authenticated.reason, describeApproveFailure(authenticated.reason, String(id)), EXIT.refused);
-    }
     const note = text(flags, "note");
     const answered = store.answerDecision({ id, choice, by: asWho, via: "cli", ...(note === undefined ? {} : { note }) }, clock(), mutationFrom(flags, clock()));
     if (!answered.ok) {
@@ -3999,9 +3957,8 @@ async function serveCommand(flags, context) {
     const port = Number(portGiven ?? 4180);
     // Validated like demo's --port — a NaN handed to listen() surfaced as a
     // baffling bind failure instead of a usage answer (round-4 finding 11).
-    if (portGiven !== undefined && (!Number.isInteger(port) || port < 1 || port >= 65536)) {
+    if (portGiven !== undefined && (!Number.isInteger(port) || port < 1 || port >= 65536))
         return fail(write, json, "serve", "usage", "--port is a whole number under 65536", EXIT.usage);
-    }
     const host = text(flags, "host") ?? "127.0.0.1";
     const allow = text(flags, "allow-host");
     // The authorization ceiling: --repo (comma-separable) names repos this
@@ -4020,12 +3977,10 @@ async function serveCommand(flags, context) {
     // allow-list of one, and which is meaningless without the machine's
     // runner assertion — links bind to runs this machine owns.
     const editor = text(flags, "editor");
-    if (editor !== undefined && editor !== "vscode") {
+    if (editor !== undefined && editor !== "vscode")
         return fail(write, json, "serve", "usage", "--editor supports: vscode", EXIT.usage);
-    }
-    if (editor !== undefined && localRunner === undefined) {
+    if (editor !== undefined && localRunner === undefined)
         return fail(write, json, "serve", "usage", "--editor needs --runner <name> — links bind to the worktrees this machine's runner owns", EXIT.usage);
-    }
     // The first-account road (setup review): with no approver, the login
     // page offers to create one, gated by this code — printed below, once.
     const setupCode = store.listApprovers().length === 0 ? String(randomInt(100_000, 1_000_000)) : undefined;
@@ -4076,18 +4031,13 @@ async function serveCommand(flags, context) {
 async function requeueTask(positional, flags, context) {
     const { store, write, json, clock } = context;
     const [id] = positional;
-    if (id === undefined) {
+    if (id === undefined)
         return fail(write, json, "task requeue", "usage", "`toolroll task requeue <id> --as <you> --token <t>`", EXIT.usage);
-    }
     const acting = await askCredentials(flags, context);
-    if (acting === null) {
-        return fail(write, json, "task requeue", "usage", "requeueing takes `--as <you> --token <t>` — who overrode the stall is recorded, not asserted", EXIT.usage);
-    }
+    const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
+    if (acting === null || !verified?.ok)
+        return refuseApprover(context, "task requeue", verified, "requeueing takes `--as <you> --token <t>` — who overrode the stall is recorded, not asserted", id);
     const { name: asWho, token } = acting;
-    const authenticated = authenticateApprover(store, asWho, token);
-    if (!authenticated.ok) {
-        return fail(write, json, "task requeue", authenticated.reason, describeApproveFailure(authenticated.reason, id), EXIT.refused);
-    }
     const result = store.requeueTask(id, asWho, clock());
     if (!result.ok) {
         const why = {
@@ -4116,17 +4066,12 @@ async function requeueTask(positional, flags, context) {
 async function regateTaskCommand(positional, flags, context) {
     const { store, write, json, clock } = context;
     const [id] = positional;
-    if (id === undefined) {
+    if (id === undefined)
         return fail(write, json, "task regate", "usage", "`toolroll task regate <id> --as <you> --token <t>`", EXIT.usage);
-    }
     const acting = await askCredentials(flags, context);
-    if (acting === null) {
-        return fail(write, json, "task regate", "usage", "rerunning the check takes `--as <you> --token <t>` — the rerun scope is approved in your name", EXIT.usage);
-    }
-    const authenticated = authenticateApprover(store, acting.name, acting.token);
-    if (!authenticated.ok) {
-        return fail(write, json, "task regate", authenticated.reason, describeApproveFailure(authenticated.reason, id), EXIT.refused);
-    }
+    const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
+    if (acting === null || !verified?.ok)
+        return refuseApprover(context, "task regate", verified, "rerunning the check takes `--as <you> --token <t>` — the rerun scope is approved in your name", id);
     const result = regateTask(store, id, clock(), { kind: "operator", name: acting.name, token: acting.token });
     if (!result.ok)
         return fail(write, json, "task regate", result.reason, result.message, EXIT.refused);
@@ -4143,49 +4088,39 @@ async function regateTaskCommand(positional, flags, context) {
 async function planTaskCommand(positional, flags, context) {
     const { store, write, json, clock } = context;
     const [id] = positional;
-    if (id === undefined) {
+    if (id === undefined)
         return fail(write, json, "task plan", "usage", "`toolroll task plan <id> --as <you> --token <t>`", EXIT.usage);
-    }
     const acting = await askCredentials(flags, context);
-    if (acting === null) {
-        return fail(write, json, "task plan", "usage", "planning takes `--as <you> --token <t>` — it dispatches an agent that spends", EXIT.usage);
-    }
-    const authenticated = authenticateApprover(store, acting.name, acting.token);
-    if (!authenticated.ok) {
-        return fail(write, json, "task plan", authenticated.reason, describeApproveFailure(authenticated.reason, id), EXIT.refused);
-    }
-    if (store.getTask(id) === null) {
+    const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
+    if (acting === null || !verified?.ok)
+        return refuseApprover(context, "task plan", verified, "planning takes `--as <you> --token <t>` — it dispatches an agent that spends", id);
+    if (store.getTask(id) === null)
         return fail(write, json, "task plan", "refused", `no task ${id}`, EXIT.refused);
-    }
     const ref = store.refFor(BUILT_IN, id);
     // Plan pins (P2/C7): a named pair binds the PLAN phase only, refused
     // while a live plan claim is spending on the previous answer.
     const pinProvider = text(flags, "provider");
     const pinModel = text(flags, "model");
     if (pinProvider !== undefined) {
-        if (!isProviderId(pinProvider)) {
+        if (!isProviderId(pinProvider))
             return fail(write, json, "task plan", "usage", `unknown provider \`${pinProvider}\``, EXIT.usage);
-        }
         // A plan pin is an exact pair (v47): the route freezes model ids, and
         // a pin with no model would bind nothing exact.
-        if (pinModel === undefined || pinModel === "") {
+        if (pinModel === undefined || pinModel === "")
             return fail(write, json, "task plan", "usage", "a plan pin names an exact --model with --provider — approvals bind exact routing", EXIT.usage);
-        }
         const valid = validateSpec({ provider: pinProvider, model: pinModel });
         if (!valid.ok)
             return fail(write, json, "task plan", "invalid", valid.problem, EXIT.usage);
         const pinned = store.setPlanPins(ref.id, pinProvider, pinModel, clock());
-        if (!pinned.ok) {
+        if (!pinned.ok)
             return fail(write, json, "task plan", "refused", "a planner holds this task right now — the pin would reroute a live spend", EXIT.refused);
-        }
     }
     else if (pinModel !== undefined) {
         return fail(write, json, "task plan", "usage", "--model rides --provider for a plan pin", EXIT.usage);
     }
     const result = store.requestPlan(ref.id, clock());
-    if (!result.ok) {
+    if (!result.ok)
         return fail(write, json, "task plan", "refused", result.reason, EXIT.refused);
-    }
     const autoPlan = authorizePlanUnderMode(store, id, acting.name, clock());
     return succeed(write, json, "task plan", { id, autoPlan, ...(pinProvider === undefined ? {} : { planProvider: pinProvider, planModel: pinModel ?? null }) }, () => [
         `${id} will be planned before it is built: the next pass dispatches a planner${pinProvider === undefined ? "" : ` on ${pinProvider}${pinModel === undefined ? "" : ` \u00b7 ${pinModel}`}`}.`,
@@ -4224,9 +4159,8 @@ async function reviewTaskCommand(positional, flags, context) {
         return fail(write, json, "task review", "usage", "--run and --all require --brief.", EXIT.usage);
     const [runText] = positional;
     const runId = Number(runText ?? "");
-    if (runText === undefined || !Number.isInteger(runId) || runId < 1) {
+    if (runText === undefined || !Number.isInteger(runId) || runId < 1)
         return fail(write, json, "task review", "usage", "`toolroll task review <run-id>`", EXIT.usage);
-    }
     // Read-only: the run's one automatic review, when it had one.
     const review = buildReviewOf(store, runId);
     if (review !== null) {
@@ -4261,26 +4195,19 @@ async function incidentCommand(positional, flags, context) {
         write("  → toolroll incident resolve <id> --as <you> --token <t>");
         return EXIT.refused;
     }
-    if (action !== "resolve") {
+    if (action !== "resolve")
         return fail(write, json, "incident", "usage", "`toolroll incident [list|resolve <id>]`", EXIT.usage);
-    }
     const id = Number(idText);
-    if (!Number.isInteger(id) || id <= 0) {
+    if (!Number.isInteger(id) || id <= 0)
         return fail(write, json, "incident resolve", "usage", "`toolroll incident resolve <id> --as <you> --token <t>`", EXIT.usage);
-    }
     const acting = await askCredentials(flags, context);
-    if (acting === null) {
-        return fail(write, json, "incident resolve", "usage", "resolving takes `--as <you> --token <t>` — who looked is recorded, not asserted", EXIT.usage);
-    }
+    const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
+    if (acting === null || !verified?.ok)
+        return refuseApprover(context, "incident resolve", verified, "resolving takes `--as <you> --token <t>` — who looked is recorded, not asserted", String(id));
     const { name: asWho, token } = acting;
-    const authenticated = authenticateApprover(store, asWho, token);
-    if (!authenticated.ok) {
-        return fail(write, json, "incident resolve", authenticated.reason, describeApproveFailure(authenticated.reason, String(id)), EXIT.refused);
-    }
     const resolved = store.resolveIncident(id, asWho, clock());
-    if (!resolved) {
+    if (!resolved)
         return fail(write, json, "incident resolve", "unknown-or-resolved", `no unresolved incident ${id}`, EXIT.refused);
-    }
     return succeed(write, json, "incident resolve", { id, by: asWho }, () => [
         `Resolved incident ${id}, as ${asWho}. The task's hold is lifted; the next tick may take it.`,
     ]);
@@ -4314,21 +4241,18 @@ async function webhookCommand(positional, _flags, context) {
         return EXIT.ok;
     }
     if (action === "primary") {
-        if (which === undefined || !isMessagingChannel(which)) {
+        if (which === undefined || !isMessagingChannel(which))
             return fail(write, json, "webhook primary", "usage", "primary is one of telegram, slack, discord", EXIT.usage);
-        }
         const primary = effectivePrimary(process.env, dir, telegramConfigured);
-        if (!primary.configured.includes(which)) {
+        if (!primary.configured.includes(which))
             return fail(write, json, "webhook primary", "unconfigured", `${which} is not configured — set it up first, then choose it`, EXIT.refused);
-        }
         savePrimary(dir, which);
         return succeed(write, json, "webhook primary", { primary: which }, () => [
             `Alerts now go to ${which}. ${which === "telegram" ? "Buttons and replies work there as always." : "Telegram (if configured) still accepts taps and replies — it just stops sending alerts."}`,
         ]);
     }
-    if (action !== "set" || which !== "console-url" || value === undefined) {
+    if (action !== "set" || which !== "console-url" || value === undefined)
         return fail(write, json, "webhook", "usage", "`toolroll webhook [status|primary <service>|set console-url <url>]`", EXIT.usage);
-    }
     const saved = saveConsoleUrl(dir, value);
     if (!saved.ok)
         return fail(write, json, "webhook set", "invalid", saved.message, EXIT.usage);
@@ -4344,9 +4268,8 @@ function resumeProviderCommand(positional, flags, context) {
     const { store, write, json } = context;
     const command = "providers resume";
     const provider = positional[0];
-    if (provider === undefined || !isProviderId(provider) || positional.length > 1) {
+    if (provider === undefined || !isProviderId(provider) || positional.length > 1)
         return fail(write, json, command, "usage", `Use \`toolroll providers resume <${PROVIDER_IDS.join("|")}>\`.`, EXIT.usage);
-    }
     const who = text(flags, "as") ?? process.env["USER"] ?? "operator";
     const lifted = liftAuthPause(store, provider, "person", who, context.clock());
     if (lifted === null)
@@ -4440,14 +4363,12 @@ async function providersCommand(flags, context) {
     if (flags.has("report")) {
         const runnerName = text(flags, "runner");
         const runnerToken = text(flags, "token");
-        if (runnerName === undefined || runnerToken === undefined) {
+        if (runnerName === undefined || runnerToken === undefined)
             return fail(write, json, "providers", "usage", "`toolroll providers --report --runner <name> --token <t>` records readiness under that runner", EXIT.usage);
-        }
         const observed = await observeProviderReadiness((file, args, options) => probe(file, args, { timeoutMs: options?.timeoutMs ?? 5_000, ...(options?.omitEnv === undefined ? {} : { omitEnv: options.omitEnv }) }), process.env, PROVIDER_IDS, provider => store.acpAttestationFor(provider, runnerName));
         const reported = reportProviderReadinessAuthed(store, { name: runnerName, token: runnerToken, observations: observed }, context.clock());
-        if (!reported.ok) {
+        if (!reported.ok)
             return fail(write, json, "providers", reported.reason, describeAuth(reported.reason, runnerName), EXIT.refused);
-        }
         recorded = observed;
     }
     if (json) {
@@ -4594,9 +4515,8 @@ async function agentsCommand(positional, flags, context) {
 async function keysCommand(positional, flags, context) {
     const { write, json } = context;
     const [action, provider, ...rest] = positional;
-    if (action === undefined || !KEYS_ACTIONS.includes(action)) {
+    if (action === undefined || !KEYS_ACTIONS.includes(action))
         return fail(write, json, "keys", "usage", `unknown \`keys ${action ?? ""}\` — try ${KEYS_ACTIONS.join(", ")}`, EXIT.usage);
-    }
     if (action === "status") {
         // ACP agents sign in their own way: Toolroll keeps no key for them, so they aren't listed here.
         const rows = PROVIDER_IDS.filter(isKeyedProvider).map(one => ({
@@ -4622,12 +4542,10 @@ async function keysCommand(positional, flags, context) {
         write("  → `keys auth <provider> subscription|api-key` switches; stored keys are kept either way");
         return EXIT.ok;
     }
-    if (provider === undefined || !isProviderId(provider)) {
+    if (provider === undefined || !isProviderId(provider))
         return fail(write, json, `keys ${action}`, "usage", `which provider? ${PROVIDER_IDS.filter(isKeyedProvider).join(", ")}`, EXIT.usage);
-    }
-    if (!isKeyedProvider(provider)) {
+    if (!isKeyedProvider(provider))
         return fail(write, json, `keys ${action}`, "refused", `${ACP_AGENTS[provider].name} signs in its own way (\`${ACP_AGENTS[provider].signIn}\`) — Toolroll keeps no key for it`, EXIT.refused);
-    }
     if (action === "clear") {
         const cleared = clearProviderKey(provider);
         const mode = readAuthMode(provider);
@@ -4641,21 +4559,18 @@ async function keysCommand(positional, flags, context) {
     }
     if (action === "verify") {
         const stored = readProviderKey(provider);
-        if (stored === null) {
+        if (stored === null)
             return fail(write, json, "keys verify", "refused", `no stored ${provider} key to verify`, EXIT.refused);
-        }
         const verdict = await verifyProviderKey(provider, stored);
         return succeed(write, json, "keys verify", { provider, verdict }, () => [verdictWords(provider, verdict)]);
     }
     if (action === "auth") {
         const [wanted] = rest;
-        if (wanted !== "subscription" && wanted !== "api-key") {
+        if (wanted !== "subscription" && wanted !== "api-key")
             return fail(write, json, "keys auth", "usage", `\`toolroll keys auth ${provider} subscription|api-key\``, EXIT.usage);
-        }
         const set = setAuthMode(provider, wanted);
-        if (!set.ok) {
+        if (!set.ok)
             return fail(write, json, "keys auth", "refused", `${provider} has no subscription login — it is api-key only`, EXIT.refused);
-        }
         return succeed(write, json, "keys auth", { provider, mode: wanted }, () => [
             wanted === "subscription"
                 ? `${provider} now uses its own login; its stored key is kept as the fallback you can switch to.`
@@ -4673,18 +4588,16 @@ async function keysCommand(positional, flags, context) {
         }
     }
     else {
-        if (process.stdin.isTTY) {
+        if (process.stdin.isTTY)
             return fail(write, json, "keys set", "usage", "pipe the key in (\`toolroll keys set gemini < key.txt\` or via --key-file) — a key on an argv is visible to every process list", EXIT.usage);
-        }
         const chunks = [];
         for await (const chunk of process.stdin)
             chunks.push(chunk);
         value = Buffer.concat(chunks).toString("utf8");
     }
     const saved = saveProviderKey(provider, value);
-    if (!saved.ok) {
+    if (!saved.ok)
         return fail(write, json, "keys set", "implausible", "that does not look like an API key — check the paste", EXIT.refused);
-    }
     // Save is instant (shape-checked); verification is a live credential
     // check that spends no tokens — skip it with --no-verify for an offline
     // machine or a provider you cannot reach right now.
@@ -4704,9 +4617,8 @@ async function keysCommand(positional, flags, context) {
 async function peopleCommand(positional, flags, context) {
     const { store, write, json, clock } = context;
     const [action, ...rest] = positional;
-    if (action === undefined || !PEOPLE_ACTIONS.includes(action)) {
+    if (action === undefined || !PEOPLE_ACTIONS.includes(action))
         return fail(write, json, "people", "usage", `unknown \`people ${action ?? ""}\` — try ${PEOPLE_ACTIONS.join(", ")}`, EXIT.usage);
-    }
     if (action === "list") {
         const accounts = store.accountFacts();
         const invites = store.openInvites(clock());
@@ -4728,14 +4640,12 @@ async function peopleCommand(positional, flags, context) {
         return EXIT.ok;
     }
     const acting = await askCredentials(flags, context);
-    if (acting === null) {
+    if (acting === null)
         return fail(write, json, `people ${action}`, "usage", `\`toolroll people ${action} … --as <you> --token <t>\``, EXIT.usage);
-    }
     // Inviting and widening access are credential acts; revoking only narrows.
     const authenticated = (action === "revoke" ? authenticateApprover(store, acting.name, acting.token) : credentialApprover(store, acting.name, acting.token));
-    if (!authenticated.ok) {
+    if (!authenticated.ok)
         return fail(write, json, `people ${action}`, authenticated.reason, describeApproveFailure(authenticated.reason, acting.name), EXIT.refused);
-    }
     const repoGiven = text(flags, "repo");
     const allProjects = flags.has("all-projects");
     const noProjects = flags.has("no-projects");
@@ -4756,9 +4666,8 @@ async function peopleCommand(positional, flags, context) {
     }
     if (action === "invite") {
         const roleFlag = text(flags, "role") ?? "viewer";
-        if (roleFlag !== "viewer" && roleFlag !== "approver") {
+        if (roleFlag !== "viewer" && roleFlag !== "approver")
             return fail(write, json, "people invite", "usage", "--role viewer|approver (viewer is the default)", EXIT.usage);
-        }
         if (noProjects)
             return fail(write, json, "people invite", "usage", "An invitation needs --repo <path> or all-project access.", EXIT.usage);
         const minted = store.mintInvite(roleFlag, acting.name, clock(), undefined, projects);
@@ -4769,9 +4678,8 @@ async function peopleCommand(positional, flags, context) {
         ]);
     }
     const [name] = rest;
-    if (name === undefined || name.trim() === "") {
+    if (name === undefined || name.trim() === "")
         return fail(write, json, "people revoke", "usage", "`toolroll people revoke <name> --as <you> --token <t>`", EXIT.usage);
-    }
     const severed = store.revokeAccount(name.trim(), acting.name, clock());
     if (!severed.ok) {
         const words = severed.reason === "last-approver"
@@ -4836,16 +4744,14 @@ async function chatApprovalCommand(positional, flags, context) {
 async function modeCommand(positional, flags, context) {
     const { store, write, json, clock } = context;
     const [action] = positional;
-    if (action === undefined || !MODE_ACTIONS.includes(action)) {
+    if (action === undefined || !MODE_ACTIONS.includes(action))
         return fail(write, json, "mode", "usage", `unknown \`mode ${action ?? ""}\` — try ${MODE_ACTIONS.join(", ")}`, EXIT.usage);
-    }
     const repoGiven = text(flags, "repo");
     // The same canonical string every other road stores for the repository
     // (a symlinked path — /var vs /private/var — must name the same mode).
     const repo = repoGiven === undefined ? undefined : canonicalProject(repoGiven) ?? resolve(repoGiven);
-    if (repo === undefined) {
+    if (repo === undefined)
         return fail(write, json, "mode", "usage", "`mode` needs --repo <canonical path> — a mode is per-repository", EXIT.usage);
-    }
     const now = clock();
     if (action === "show") {
         const mode = store.activeMode(repo, now);
@@ -4860,14 +4766,12 @@ async function modeCommand(positional, flags, context) {
         ]);
     }
     const acting = await askCredentials(flags, context);
-    if (acting === null) {
+    if (acting === null)
         return fail(write, json, "mode", "usage", "signing or revoking a mode takes `--as <you> --token <t>`", EXIT.usage);
-    }
     // Signing a mode that lets a chat app approve is a credential act; any other mode signing or revoking is ordinary.
     const authed = (flag(flags, "chat-approve") ? credentialApprover(store, acting.name, acting.token) : authenticateApprover(store, acting.name, acting.token));
-    if (!authed.ok) {
+    if (!authed.ok)
         return fail(write, json, "mode", authed.reason, "that is not an active approver, or the token does not match", EXIT.refused);
-    }
     if (action === "revoke") {
         // Lowering authority is one click for ANY approver (v4 doctrine).
         const revoked = store.revokeMode(repo, acting.name, "operator", now);
@@ -4877,13 +4781,11 @@ async function modeCommand(positional, flags, context) {
     }
     // set: RAISING authority — the password ceremony above already ran.
     const nameGiven = text(flags, "name") ?? "standard";
-    if (nameGiven !== "standard" && nameGiven !== "hands-off") {
+    if (nameGiven !== "standard" && nameGiven !== "hands-off")
         return fail(write, json, "mode set", "usage", "--name is standard or hands-off", EXIT.usage);
-    }
     const daysGiven = Number(text(flags, "days") ?? "1");
-    if (!Number.isInteger(daysGiven) || daysGiven < 1 || daysGiven > MODE_MAX_DAYS) {
+    if (!Number.isInteger(daysGiven) || daysGiven < 1 || daysGiven > MODE_MAX_DAYS)
         return fail(write, json, "mode set", "usage", `--days is 1 to ${MODE_MAX_DAYS} (a mode always expires)`, EXIT.usage);
-    }
     const expiry = new Date(now.getTime() + daysGiven * 24 * 60 * 60_000).toISOString();
     const terms = presetTerms(nameGiven, expiry);
     // Explicit term overrides ride the same flags (all optional):
@@ -4895,12 +4797,10 @@ async function modeCommand(positional, flags, context) {
         terms.autoApproveFiling = true;
     if (flag(flags, "plan-auto"))
         terms.planAuto = true;
-    if (["review-auto", "review-retry-auto", "repair-auto", "repair-max-attempts"].some(name => flags.has(name))) {
+    if (["review-auto", "review-retry-auto", "repair-auto", "repair-max-attempts"].some(name => flags.has(name)))
         return fail(write, json, "mode set", "invalid", "Separate model review and automatic correction loops have been removed; finished work goes to the lead or user.", EXIT.refused);
-    }
-    if (terms.planAuto && !terms.autoApproveFiling) {
+    if (terms.planAuto && !terms.autoApproveFiling)
         return fail(write, json, "mode set", "invalid", "--plan-auto requires automatic filing approval", EXIT.refused);
-    }
     // Approving plans and merges from the signer's paired chat: never a preset default, only this flag.
     // The signature names every chat app it covers: a grant signed before that named Telegram alone, and stays so.
     if (flag(flags, "chat-approve")) {
@@ -4908,9 +4808,8 @@ async function modeCommand(positional, flags, context) {
         terms.chatApproveChats = CHAT_APPROVE_ALL;
     }
     // Automerge requires a live merge-capable grant on the repo (D1).
-    if (terms.publication === "automerge" && !store.hasMergeCapableGrant(repo, now)) {
+    if (terms.publication === "automerge" && !store.hasMergeCapableGrant(repo, now))
         return fail(write, json, "mode set", "no-grant", "automerge needs a merge-capable publication grant on this repo — file one first", EXIT.refused);
-    }
     const digest = modeDigestOf(terms);
     const id = store.signMode({ repo, name: nameGiven, termsJson: modeTermsJson(terms), digest, signedBy: acting.name, absoluteExpiry: expiry, publication: terms.publication }, now);
     return succeed(write, json, "mode set", { repo, id, digest, terms }, () => [
@@ -4921,9 +4820,8 @@ async function modeCommand(positional, flags, context) {
 async function configCommand(positional, flags, context) {
     const { store, write, json, clock } = context;
     const [action, phase] = positional;
-    if (action !== undefined && !CONFIG_ACTIONS.includes(action)) {
+    if (action !== undefined && !CONFIG_ACTIONS.includes(action))
         return fail(write, json, "config", "usage", `unknown \`config ${action}\` — try ${CONFIG_ACTIONS.join(", ")}`, EXIT.usage);
-    }
     const repoGiven = text(flags, "repo");
     const scope = repoGiven === undefined ? INSTALLATION_SCOPE : canonicalProject(repoGiven) ?? resolve(repoGiven);
     if (action === undefined || action === "show") {
@@ -4992,21 +4890,18 @@ async function configCommand(positional, flags, context) {
         }
         return EXIT.ok;
     }
-    if (action !== "set" && action !== "clear") {
+    if (action !== "set" && action !== "clear")
         return fail(write, json, "config", "usage", "`toolroll config [show|set <phase> --provider <p> [--model <m>]|clear <phase>] [--repo <path>] --as <you> --token <t>`", EXIT.usage);
-    }
     // Global dollar thresholds (v15, operator request): defaults for filings
     // and an installation-wide backstop. Authenticated like every spend
     // routing act; the per-task digest stays the authority.
     if (phase === "budgets") {
         const acting = await askCredentials(flags, context);
-        if (acting === null) {
+        if (acting === null)
             return fail(write, json, `config ${action}`, "usage", "changing spend defaults takes `--as <you> --token <t>`", EXIT.usage);
-        }
         const authedBudget = authenticateApprover(store, acting.name, acting.token);
-        if (!authedBudget.ok) {
+        if (!authedBudget.ok)
             return fail(write, json, `config ${action}`, "unauthenticated", "that is not an approver, or the token does not match", EXIT.refused);
-        }
         if (action === "clear") {
             store.setSpendDefaults({ buildPerRunMicrousd: null }, acting.name, clock());
             return succeed(write, json, "config clear", { budgets: null }, () => ["Spend defaults cleared — filings state their own numbers again."]);
@@ -5019,9 +4914,8 @@ async function configCommand(positional, flags, context) {
             return Number.isFinite(value) && value > 0 ? Math.round(value * 1_000_000) : false;
         };
         const build = parseUsd("build-usd");
-        if (build === false) {
+        if (build === false)
             return fail(write, json, "config set", "usage", "--build-usd is a positive dollar amount", EXIT.usage);
-        }
         store.setSpendDefaults({ buildPerRunMicrousd: build }, acting.name, clock());
         return succeed(write, json, "config set", { budgets: store.getSpendDefaults() }, () => [
             "Spend defaults set. New filings pre-fill from these; every approval still restates its own numbers:",
@@ -5033,17 +4927,14 @@ async function configCommand(positional, flags, context) {
     // Installation-scoped only — a per-repo chat would splinter the spend
     // ceiling that makes the ledger a ceiling at all.
     if (phase === "chat") {
-        if (repoGiven !== undefined) {
+        if (repoGiven !== undefined)
             return fail(write, json, `config ${action}`, "usage", "chat is installation-scoped — no --repo", EXIT.usage);
-        }
         const acting = await askCredentials(flags, context);
-        if (acting === null) {
+        if (acting === null)
             return fail(write, json, `config ${action}`, "usage", "changing chat spend takes `--as <you> --token <t>`", EXIT.usage);
-        }
         const authedChat = authenticateApprover(store, acting.name, acting.token);
-        if (!authedChat.ok) {
+        if (!authedChat.ok)
             return fail(write, json, `config ${action}`, "unauthenticated", "that is not an approver, or the token does not match", EXIT.refused);
-        }
         if (action === "clear") {
             store.clearChatConfig();
             return succeed(write, json, "config clear", { chat: null }, () => ["Chat is off — the config row is gone."]);
@@ -5052,31 +4943,25 @@ async function configCommand(positional, flags, context) {
         const requestedModel = text(flags, "model");
         const weeklyUsd = text(flags, "weekly-usd");
         const dailyGiven = text(flags, "daily-turns");
-        if (provider !== "anthropic-api" && provider !== "openrouter-api" && provider !== "claude-subscription" && provider !== "codex-subscription") {
+        if (provider !== "anthropic-api" && provider !== "openrouter-api" && provider !== "claude-subscription" && provider !== "codex-subscription")
             return fail(write, json, "config set", "usage", "chat provider is one of claude-subscription, codex-subscription, anthropic-api, openrouter-api", EXIT.usage);
-        }
         const model = requestedModel ?? (isSubscriptionChatProvider(provider) ? "default" : "");
-        if (!validModelId(model)) {
+        if (!validModelId(model))
             return fail(write, json, "config set", "usage", "--model must be 1–128 letters, digits, dots, slashes, colons, underscores, or dashes", EXIT.usage);
-        }
         const priced = isDirectChatProvider(provider) ? livePin(store, provider, model) ?? priceOf(model) : null;
-        if (isDirectChatProvider(provider) && priced === null) {
+        if (isDirectChatProvider(provider) && priced === null)
             return fail(write, json, "config set", "unpriced-model", `chat reserves worst-case spend up front, so the model needs a price — run "toolroll models check" to load live prices, or pick one priced today: ${PRICED_MODELS.join(", ")}`, EXIT.refused);
-        }
         const weekly = Number(weeklyUsd);
-        if (isDirectChatProvider(provider) && (weeklyUsd === undefined || !Number.isFinite(weekly) || weekly <= 0)) {
+        if (isDirectChatProvider(provider) && (weeklyUsd === undefined || !Number.isFinite(weekly) || weekly <= 0))
             return fail(write, json, "config set", "usage", "--weekly-usd <dollars> is required — chat without a ceiling is not configured, it is unbounded", EXIT.usage);
-        }
         const daily = dailyGiven === undefined ? 50 : Number(dailyGiven);
-        if (!Number.isInteger(daily) || daily <= 0 || daily > 1_000) {
+        if (!Number.isInteger(daily) || daily <= 0 || daily > 1_000)
             return fail(write, json, "config set", "usage", "--daily-turns is a whole number between 1 and 1000", EXIT.usage);
-        }
         // The CLI pins from the compiled table (the console additionally offers
         // OpenRouter's live catalog — priced by the party that bills it).
         const pinned = isDirectChatProvider(provider) ? priced : { inMicrousd: 0, outMicrousd: 0 };
-        if (pinned === null) {
+        if (pinned === null)
             return fail(write, json, "config set", "unpriced-model", `no compiled price for ${model}`, EXIT.refused);
-        }
         store.setChatConfig({
             provider,
             model,
@@ -5097,42 +4982,33 @@ async function configCommand(positional, flags, context) {
                 : []),
         ]);
     }
-    if (phase === undefined || !["plan", "build", "repair", "review"].includes(phase)) {
+    if (phase === undefined || !["plan", "build", "repair", "review"].includes(phase))
         return fail(write, json, `config ${action}`, "usage", "which phase? plan, build, repair, review — or chat", EXIT.usage);
-    }
     const acting = await askCredentials(flags, context);
-    if (acting === null) {
-        return fail(write, json, `config ${action}`, "usage", "changing spend routing takes `--as <you> --token <t>`", EXIT.usage);
-    }
-    const authenticated = authenticateApprover(store, acting.name, acting.token);
-    if (!authenticated.ok) {
-        return fail(write, json, `config ${action}`, authenticated.reason, describeApproveFailure(authenticated.reason, phase), EXIT.refused);
-    }
+    const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
+    if (acting === null || !verified?.ok)
+        return refuseApprover(context, `config ${action}`, verified, "changing spend routing takes `--as <you> --token <t>`", phase);
     // The STRONG tier (v47): a second, named row per phase the routing policy
     // reaches for when size, quality, evidence, or publication demand it.
     // Authenticated and audited exactly like the routine row; existing
     // approvals are untouched — a sealed route never re-resolves.
     // The LIGHT tier (v2): the fast agent a small change builds on.
     const tierGiven = text(flags, "tier");
-    if (tierGiven !== undefined && tierGiven !== "strong" && tierGiven !== "light") {
+    if (tierGiven !== undefined && tierGiven !== "strong" && tierGiven !== "light")
         return fail(write, json, `config ${action}`, "usage", "--tier is `light` or `strong` — the routine tier is the plain phase row", EXIT.usage);
-    }
     // A light planner would never run (a small change makes no plan): refused rather than kept and ignored.
     // Clearing one left from before stays possible.
-    if (tierGiven === "light" && phase !== "build" && !(action === "clear" && phase === "plan" && !flag(flags, "also"))) {
+    if (tierGiven === "light" && phase !== "build" && !(action === "clear" && phase === "plan" && !flag(flags, "also")))
         return fail(write, json, `config ${action}`, "usage", "--tier light is for build only — a small change makes no plan, and repairs resume the builder's session", EXIT.usage);
-    }
     // Another provider's candidate on the same tier (`--also`): one per provider, and at filing the one whose plan
     // has more room runs.
     if (flag(flags, "also")) {
-        if (phase !== "plan" && phase !== "build") {
+        if (phase !== "plan" && phase !== "build")
             return fail(write, json, `config ${action}`, "usage", "--also is for plan or build — repairs follow the build's provider", EXIT.usage);
-        }
         const tier = (tierGiven ?? "routine");
         const alsoProvider = text(flags, "provider");
-        if (alsoProvider !== undefined && !isProviderId(alsoProvider)) {
+        if (alsoProvider !== undefined && !isProviderId(alsoProvider))
             return fail(write, json, `config ${action}`, "usage", `--provider is one of ${PROVIDER_IDS.join(", ")}`, EXIT.usage);
-        }
         if (action === "clear") {
             const removed = store.clearPhaseTierAlternates(scope, phase, tier, alsoProvider ?? null);
             return succeed(write, json, "config clear", { scope, phase, tier, also: true, provider: alsoProvider ?? null, cleared: removed }, () => [
@@ -5140,9 +5016,8 @@ async function configCommand(positional, flags, context) {
             ]);
         }
         const alsoModel = text(flags, "model");
-        if (alsoProvider === undefined || alsoModel === undefined) {
+        if (alsoProvider === undefined || alsoModel === undefined)
             return fail(write, json, "config set", "usage", "--also names an exact --provider and --model — approvals bind exact routing", EXIT.usage);
-        }
         const alsoValid = validateSpec({ provider: alsoProvider, model: alsoModel });
         if (!alsoValid.ok)
             return fail(write, json, "config set", "invalid", alsoValid.problem, EXIT.usage);
@@ -5175,18 +5050,15 @@ async function configCommand(positional, flags, context) {
         ]);
     }
     const providerGiven = text(flags, "provider");
-    if (providerGiven === undefined || !isProviderId(providerGiven)) {
+    if (providerGiven === undefined || !isProviderId(providerGiven))
         return fail(write, json, "config set", "usage", `--provider is one of ${PROVIDER_IDS.join(", ")}`, EXIT.usage);
-    }
     const modelGiven = text(flags, "model") ?? null;
     const valid = validateSpec({ provider: providerGiven, model: modelGiven });
-    if (!valid.ok) {
+    if (!valid.ok)
         return fail(write, json, "config set", "invalid", valid.problem, EXIT.usage);
-    }
     if (tierGiven === "light") {
-        if (modelGiven === null) {
+        if (modelGiven === null)
             return fail(write, json, "config set", "usage", `a light ${phase} agent names an exact --model — approvals bind exact routing`, EXIT.usage);
-        }
         store.setPhaseTierConfig(scope, phase, "light", providerGiven, modelGiven, acting.name, clock());
         return succeed(write, json, "config set", { scope, phase, tier: "light", provider: providerGiven, model: modelGiven }, () => [
             `light ${phase} at ${scope === INSTALLATION_SCOPE ? "the installation" : scope} is ${providerGiven} · ${modelGiven}, set by ${acting.name}.`,
@@ -5194,12 +5066,10 @@ async function configCommand(positional, flags, context) {
         ]);
     }
     if (tierGiven === "strong") {
-        if (phase === "review" && providerGiven === "gemini") {
+        if (phase === "review" && providerGiven === "gemini")
             return fail(write, json, "config set", "invalid", "gemini has no isolation posture for the review phase yet — name claude or codex as the strong reviewer", EXIT.usage);
-        }
-        if (modelGiven === null) {
+        if (modelGiven === null)
             return fail(write, json, "config set", "usage", `a strong ${phase} agent names an exact --model — approvals bind exact routing`, EXIT.usage);
-        }
         store.setPhaseTierConfig(scope, phase, "strong", providerGiven, modelGiven, acting.name, clock());
         return succeed(write, json, "config set", { scope, phase, tier: "strong", provider: providerGiven, model: modelGiven }, () => [
             `strong ${phase} at ${scope === INSTALLATION_SCOPE ? "the installation" : scope} is ${providerGiven}${modelGiven === null ? "" : ` · ${modelGiven}`}, set by ${acting.name}.`,
@@ -5238,9 +5108,8 @@ async function setupCommand(positional, flags, context) {
     const action = positional[0] ?? "show";
     const repo = text(flags, "repo");
     if (action === "show") {
-        if (repo === undefined) {
+        if (repo === undefined)
             return fail(write, json, "setup show", "usage", "which repo? --repo <path>", EXIT.usage);
-        }
         const live = store.liveWorktreeSetup(repo);
         if (json) {
             write(envelopeJson({ ok: true, command: "setup show", repo, setup: live }));
@@ -5251,20 +5120,14 @@ async function setupCommand(positional, flags, context) {
             : `${repo} runs before every agent:\n  ${live.command}\n  timeout ${Math.round(live.timeoutMs / 1000)}s · digest ${live.digest} · approved by ${live.approvedBy} at ${live.approvedAt}`);
         return EXIT.ok;
     }
-    if (action !== "set" && action !== "clear") {
+    if (action !== "set" && action !== "clear")
         return fail(write, json, "setup", "usage", "`toolroll setup [show|set --command <cmd> [--timeout-seconds <n>] --yes|clear] --repo <path> --as <you> --token <t>`", EXIT.usage);
-    }
-    if (repo === undefined) {
+    if (repo === undefined)
         return fail(write, json, `setup ${action}`, "usage", "which repo? --repo <path>", EXIT.usage);
-    }
     const acting = await askCredentials(flags, context);
-    if (acting === null) {
-        return fail(write, json, `setup ${action}`, "usage", "an approved setup runs unattended in every future worktree — changing it takes `--as <you> --token <t>`", EXIT.usage);
-    }
-    const authenticated = authenticateApprover(store, acting.name, acting.token);
-    if (!authenticated.ok) {
-        return fail(write, json, `setup ${action}`, authenticated.reason, describeApproveFailure(authenticated.reason, repo), EXIT.refused);
-    }
+    const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
+    if (acting === null || !verified?.ok)
+        return refuseApprover(context, `setup ${action}`, verified, "an approved setup runs unattended in every future worktree — changing it takes `--as <you> --token <t>`", repo);
     if (action === "clear") {
         const cleared = store.clearWorktreeSetup(repo, acting.name, clock());
         return succeed(write, json, "setup clear", { repo, cleared }, () => [
@@ -5272,25 +5135,21 @@ async function setupCommand(positional, flags, context) {
         ]);
     }
     const command = text(flags, "command");
-    if (command === undefined || command.trim() === "") {
+    if (command === undefined || command.trim() === "")
         return fail(write, json, "setup set", "usage", "--command <cmd> is what every fresh checkout will run", EXIT.usage);
-    }
-    if (command.length > 2000 || hasDisguisedText(command)) {
+    if (command.length > 2000 || hasDisguisedText(command))
         return fail(write, json, "setup set", "invalid", "the command must be under 2000 characters with no control or bidi characters", EXIT.usage);
-    }
     // Literal credentials never become standing rows (audit IV-5): a command
     // that embeds a token is stored forever in plain text. Reference an
     // environment variable the runner already exports instead. `$TOKEN` is
     // a reference and passes; `=secret123` is a value and refuses.
     const credentialShaped = /([A-Za-z0-9_-]*(?:token|secret|password|passwd|apikey|api_key|authorization|bearer|credential)[A-Za-z0-9_-]*\s*[=:]\s*)(?![$"']?\$)\S+/i.test(command) ||
         /\/\/[^\s/@]+:[^\s/@]+@/.test(command);
-    if (credentialShaped) {
+    if (credentialShaped)
         return fail(write, json, "setup set", "credential-shaped", "the command appears to embed a credential — reference an environment variable the runner exports (e.g. $NPM_TOKEN) instead of a literal value", EXIT.usage);
-    }
     const timeoutSeconds = Number(text(flags, "timeout-seconds") ?? "300");
-    if (!Number.isInteger(timeoutSeconds) || timeoutSeconds < 1 || timeoutSeconds > 3600) {
+    if (!Number.isInteger(timeoutSeconds) || timeoutSeconds < 1 || timeoutSeconds > 3600)
         return fail(write, json, "setup set", "invalid", "--timeout-seconds is 1..3600", EXIT.usage);
-    }
     if (flags.get("yes") !== true) {
         if (json) {
             write(envelopeJson({ ok: false, command: "setup set", reason: "unconfirmed", repo, setupCommand: command, timeoutSeconds }));
@@ -5330,9 +5189,8 @@ async function verifyCommand(positional, flags, context) {
     const action = positional[0] ?? "show";
     const repo = text(flags, "repo");
     if (action === "show") {
-        if (repo === undefined) {
+        if (repo === undefined)
             return fail(write, json, "verify show", "usage", "which repo? --repo <path>", EXIT.usage);
-        }
         const live = store.liveVerifyCommand(repo);
         const quick = liveQuickCommand(store, repo);
         const level = projectCheckLevel(store, repo);
@@ -5372,24 +5230,18 @@ async function verifyCommand(positional, flags, context) {
             ...(wanted !== "full" ? ["The full check still runs when a pull request opens, and Merge waits for it unless a person merges anyway."] : []),
         ]);
     }
-    if (action !== "set" && action !== "clear") {
+    if (action !== "set" && action !== "clear")
         return fail(write, json, "verify", "usage", "`toolroll verify [show|level quick|full|off|set --command <cmd>|--quick <cmd> [--timeout-seconds <n>] [--self-heal --setup-digest <shown>] --yes|clear [--level quick]] --repo <path> --as <you> --token <t>`", EXIT.usage);
-    }
     // The quick command is its own approved grant beside the full one.
     const quickValue = text(flags, "quick");
     const quickClear = action === "clear" && text(flags, "level") === "quick";
     const grantKey = repo === undefined ? undefined : quickValue !== undefined || quickClear ? quickVerifyKey(repo) : repo;
-    if (repo === undefined) {
+    if (repo === undefined)
         return fail(write, json, `verify ${action}`, "usage", "which repo? --repo <path>", EXIT.usage);
-    }
     const acting = await askCredentials(flags, context);
-    if (acting === null) {
-        return fail(write, json, `verify ${action}`, "usage", "an approved verification command runs unattended after every future build — changing it takes `--as <you> --token <t>`", EXIT.usage);
-    }
-    const authenticated = authenticateApprover(store, acting.name, acting.token);
-    if (!authenticated.ok) {
-        return fail(write, json, `verify ${action}`, authenticated.reason, describeApproveFailure(authenticated.reason, repo), EXIT.refused);
-    }
+    const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
+    if (acting === null || !verified?.ok)
+        return refuseApprover(context, `verify ${action}`, verified, "an approved verification command runs unattended after every future build — changing it takes `--as <you> --token <t>`", repo);
     if (action === "clear") {
         const cleared = store.clearVerifyCommand(grantKey, acting.name, clock());
         if (quickClear)
@@ -5401,38 +5253,30 @@ async function verifyCommand(positional, flags, context) {
         ]);
     }
     const command = quickValue ?? text(flags, "command");
-    if (quickValue !== undefined && text(flags, "command") !== undefined) {
+    if (quickValue !== undefined && text(flags, "command") !== undefined)
         return fail(write, json, "verify set", "usage", "give the quick command with --quick \"<cmd>\" or the full one with --command, not both", EXIT.usage);
-    }
-    if (quickValue !== undefined && flags.get("self-heal") === true) {
+    if (quickValue !== undefined && flags.get("self-heal") === true)
         return fail(write, json, "verify set", "usage", "--self-heal applies to the full command only", EXIT.usage);
-    }
-    if (command === undefined || command.trim() === "") {
+    if (command === undefined || command.trim() === "")
         return fail(write, json, "verify set", "usage", "--command <cmd> is what the plane re-runs after every commit", EXIT.usage);
-    }
-    if (command.length > 2000 || hasDisguisedText(command)) {
+    if (command.length > 2000 || hasDisguisedText(command))
         return fail(write, json, "verify set", "invalid", "the command must be under 2000 characters with no control or bidi characters", EXIT.usage);
-    }
     // Same rule as an approved setup command (audit IV-5): a command that
     // embeds a literal credential is stored forever in plain text.
     const credentialShaped = /([A-Za-z0-9_-]*(?:token|secret|password|passwd|apikey|api_key|authorization|bearer|credential)[A-Za-z0-9_-]*\s*[=:]\s*)(?![$"']?\$)\S+/i.test(command) ||
         /\/\/[^\s/@]+:[^\s/@]+@/.test(command);
-    if (credentialShaped) {
+    if (credentialShaped)
         return fail(write, json, "verify set", "credential-shaped", "the command appears to embed a credential — reference an environment variable the runner exports (e.g. $NPM_TOKEN) instead of a literal value", EXIT.usage);
-    }
     const timeoutSeconds = Number(text(flags, "timeout-seconds") ?? "300");
-    if (!Number.isInteger(timeoutSeconds) || timeoutSeconds < 1 || timeoutSeconds > 3600) {
+    if (!Number.isInteger(timeoutSeconds) || timeoutSeconds < 1 || timeoutSeconds > 3600)
         return fail(write, json, "verify set", "invalid", "--timeout-seconds is 1..3600", EXIT.usage);
-    }
     const selfHeal = flags.get("self-heal") === true;
     const expectedSetupDigest = text(flags, "setup-digest");
-    if (!selfHeal && expectedSetupDigest !== undefined) {
+    if (!selfHeal && expectedSetupDigest !== undefined)
         return fail(write, json, "verify set", "usage", "--setup-digest is only valid with --self-heal", EXIT.usage);
-    }
     const recoverySetup = selfHeal ? store.liveWorktreeSetup(repo) : null;
-    if (selfHeal && recoverySetup === null) {
+    if (selfHeal && recoverySetup === null)
         return fail(write, json, "verify set", "setup-required", "self-healing needs an approved project setup first — set the exact preparation command, then approve verification again with --self-heal", EXIT.refused);
-    }
     if (flags.get("yes") !== true) {
         if (json) {
             write(envelopeJson({
@@ -5476,12 +5320,10 @@ async function verifyCommand(positional, flags, context) {
         }
         return EXIT.refused;
     }
-    if (selfHeal && expectedSetupDigest === undefined) {
+    if (selfHeal && expectedSetupDigest === undefined)
         return fail(write, json, "verify set", "setup-digest-required", `confirm self-healing with --setup-digest ${recoverySetup?.digest} exactly as previewed`, EXIT.refused);
-    }
-    if (selfHeal && expectedSetupDigest !== recoverySetup?.digest) {
+    if (selfHeal && expectedSetupDigest !== recoverySetup?.digest)
         return fail(write, json, "verify set", "stale-approval", `the approved setup changed after preview — expected ${expectedSetupDigest}, current ${recoverySetup?.digest}; preview verification again before approving`, EXIT.refused);
-    }
     const saved = store.setVerifyCommand({
         repo: grantKey,
         command,
@@ -5547,13 +5389,9 @@ async function intakeCommand(positional, flags, context) {
     }
     if (action === "grant" || action === "clear") {
         const acting = await askCredentials(flags, context);
-        if (acting === null) {
-            return fail(write, json, `intake ${action}`, "usage", "an intake grant is standing authority — it takes `--as <you> --token <t>`", EXIT.usage);
-        }
-        const authenticated = authenticateApprover(store, acting.name, acting.token);
-        if (!authenticated.ok) {
-            return fail(write, json, `intake ${action}`, authenticated.reason, describeApproveFailure(authenticated.reason, repo), EXIT.refused);
-        }
+        const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
+        if (acting === null || !verified?.ok)
+            return refuseApprover(context, `intake ${action}`, verified, "an intake grant is standing authority — it takes `--as <you> --token <t>`", repo);
         if (action === "clear") {
             const cleared = store.clearIntakeGrant(repo, acting.name, clock());
             return succeed(write, json, "intake clear", { repo, cleared }, () => [
@@ -5562,12 +5400,10 @@ async function intakeCommand(positional, flags, context) {
         }
         const github = text(flags, "github");
         const label = text(flags, "label");
-        if (github === undefined || !GITHUB_REPO_SHAPE.test(github)) {
+        if (github === undefined || !GITHUB_REPO_SHAPE.test(github))
             return fail(write, json, "intake grant", "usage", "--github <owner/name> names the repository on GitHub", EXIT.usage);
-        }
-        if (label === undefined || !LABEL_SHAPE.test(label)) {
+        if (label === undefined || !LABEL_SHAPE.test(label))
             return fail(write, json, "intake grant", "usage", "--label <label> names the exact label that nominates an issue", EXIT.usage);
-        }
         const reviewersRaw = text(flags, "reviewers");
         const reviewers = reviewersRaw === undefined
             ? null
@@ -5598,13 +5434,11 @@ async function intakeCommand(positional, flags, context) {
             `Granted: issues in ${github} labeled "${label}" become unapproved proposals for ${repo}.`,
         ]);
     }
-    if (action !== "preview" && action !== "run" && action !== "pr-comments") {
+    if (action !== "preview" && action !== "run" && action !== "pr-comments")
         return fail(write, json, "intake", "usage", "`toolroll intake [show|grant|clear|preview|run|pr-comments] --repo <path> …`", EXIT.usage);
-    }
     const grant = store.liveIntakeGrant(repo);
-    if (grant === null) {
+    if (grant === null)
         return fail(write, json, `intake ${action}`, "no-grant", `no intake grant for ${repo} — \`toolroll intake grant\` states the terms`, EXIT.refused);
-    }
     if (action === "pr-comments") {
         // PR review comments become LOCAL diff comments (M8.17): own PRs only
         // (the publication table IS the list of ours), named reviewers only,
@@ -5612,9 +5446,8 @@ async function intakeCommand(positional, flags, context) {
         // shared validator. Nothing here authorizes a spawn — ingested
         // comments wait on the run page for the same one-tap seal and the
         // same scope approval as comments typed in the console.
-        if (grant.reviewers === null || grant.reviewers.length === 0) {
+        if (grant.reviewers === null || grant.reviewers.length === 0)
             return fail(write, json, "intake pr-comments", "no-reviewers", "the grant names no reviewers — `intake grant --reviewers <logins>` is the authority for this", EXIT.refused);
-        }
         const publications = store
             .openedPublications()
             .filter(one => one.prNumber !== null &&
@@ -5695,9 +5528,8 @@ async function intakeCommand(positional, flags, context) {
     }
     const limit = Math.min(Math.max(Number(text(flags, "limit") ?? "50"), 1), 200);
     const asked = await gh("gh", ["issue", "list", "--repo", grant.github, "--label", grant.label, "--state", "open", "--limit", String(limit), "--json", "number,title,updatedAt"], { timeoutMs: 20_000 });
-    if (asked.code !== 0) {
+    if (asked.code !== 0)
         return fail(write, json, `intake ${action}`, "github-unreachable", `gh could not list ${grant.github}: ${(asked.stderr.split("\n")[0] ?? "").slice(0, 200)}`, EXIT.failed);
-    }
     let issues;
     try {
         issues = JSON.parse(asked.stdout);
@@ -5818,16 +5650,13 @@ function templateCommand(positional, flags, context) {
         write("`toolroll template show <name>` · `template apply <name> --repo <path>`");
         return EXIT.ok;
     }
-    if (action !== "show" && action !== "apply") {
+    if (action !== "show" && action !== "apply")
         return fail(write, json, `template ${action}`, "usage", "`toolroll template list | show <name> | apply <name> --repo <path> [--file]`", EXIT.usage);
-    }
-    if (name === undefined) {
+    if (name === undefined)
         return fail(write, json, `template ${action}`, "usage", "which template? `toolroll template list` names them", EXIT.usage);
-    }
     const template = templateByName(name);
-    if (template === null) {
+    if (template === null)
         return fail(write, json, `template ${action}`, "unknown", `no template named ${name} — \`toolroll template list\``, EXIT.refused);
-    }
     if (action === "show") {
         if (json) {
             write(envelopeJson({ ok: true, command: "template show", template }));
@@ -5868,13 +5697,11 @@ function templateCommand(positional, flags, context) {
         return EXIT.ok;
     }
     // apply
-    if (template.kind === "recipe") {
+    if (template.kind === "recipe")
         return fail(write, json, "template apply", "recipe", `${template.name} cannot be applied: ${template.why} \`toolroll template show ${template.name}\` walks the ceremonies.`, EXIT.refused);
-    }
     const repoGiven = text(flags, "repo");
-    if (repoGiven === undefined) {
+    if (repoGiven === undefined)
         return fail(write, json, "template apply", "usage", "which repository? --repo <path> — a template never guesses where work lands", EXIT.usage);
-    }
     const goal = text(flags, "goal") ?? template.goal;
     const outOfScope = text(flags, "not") ?? template.outOfScope;
     const touches = text(flags, "touches") === undefined
@@ -6015,22 +5842,18 @@ async function daemonCommand(positional, flags, context) {
         const runnerName = text(flags, "runner");
         const inlineToken = text(flags, "token");
         const tokenPath = text(flags, "token-file");
-        if (inlineToken !== undefined && tokenPath !== undefined) {
+        if (inlineToken !== undefined && tokenPath !== undefined)
             return fail(write, json, "daemon install", "usage", "choose one credential source: --token or --token-file", EXIT.usage);
-        }
         const token = inlineToken ?? readTokenFile(tokenPath);
-        if (runnerName === undefined || token === undefined) {
+        if (runnerName === undefined || token === undefined)
             return fail(write, json, "daemon install", "usage", "`toolroll daemon install --runner <name> (--token <t> | --token-file <path>) --repo <path>` (plus any watch flags to bake in)", EXIT.usage);
-        }
         const auth = authenticate(store, runnerName, token);
-        if (!auth.ok) {
+        if (!auth.ok)
             return fail(write, json, "daemon install", auth.reason, describeAuth(auth.reason, runnerName), EXIT.refused);
-        }
         const heartbeatBefore = store.getRunner(runnerName)?.runner.heartbeatAt ?? null;
         const located = await resolveBin();
-        if (located === null) {
+        if (located === null)
             return fail(write, json, "daemon install", "no-bin", "`toolroll` is not on the PATH the service would use — run `toolroll link` first, or pass --bin <absolute path>", EXIT.refused);
-        }
         const watchFlags = [];
         for (const name of ["pool", "model", "repair-model", "provider", "plan-model", "plan-provider", "max", "turns", "tick-every", "bridge-every", "reconcile-every", "max-open-decisions", "containment"]) {
             const value = text(flags, name);
@@ -6067,15 +5890,13 @@ async function daemonCommand(positional, flags, context) {
             return EXIT.ok;
         }
         const installed = await installReplacingLegacy(plan, token, legacy, supervise);
-        if (!installed.ok) {
+        if (!installed.ok)
             return fail(write, json, "daemon install", "supervisor", installed.message, EXIT.failed);
-        }
         // The legacy watch beat for this runner until it stopped: only a beat after that proves the new one.
         const readySince = legacy === null ? heartbeatBefore : store.getRunner(runnerName)?.runner.heartbeatAt ?? null;
         const started = await daemonStatus(plan, supervise);
-        if (started.state !== "running") {
+        if (started.state !== "running")
             return fail(write, json, "daemon install", "not-running", `the service was installed but did not stay running (${started.detail}) — read ${plan.logPath}; no work will be claimed until this is fixed`, EXIT.failed);
-        }
         // A supervisor PID is necessary but not sufficient: macOS can leave a
         // process stuck behind a protected-folder access check before it ever
         // opens the queue. The credentialed runner heartbeat is the end-to-end
@@ -6725,15 +6546,13 @@ async function watchCommand(flags, context) {
         return demoFence;
     const runner = text(flags, "runner");
     const token = text(flags, "token") ?? readTokenFile(text(flags, "token-file"));
-    if (runner === undefined || token === undefined) {
+    if (runner === undefined || token === undefined)
         return fail(write, json, "watch", "usage", "`toolroll watch --runner <name> --token <t>|--token-file <path> --repo <path> [--for <ms>]`", EXIT.usage);
-    }
     // Passes built from these flags authenticate with the resolved token.
     flags.set("token", token);
     const auth = authenticate(store, runner, token);
-    if (!auth.ok) {
+    if (!auth.ok)
         return fail(write, json, "watch", auth.reason, describeAuth(auth.reason, runner), EXIT.refused);
-    }
     const repo = repoFrom(flags);
     // The envelope contract holds for long commands too (Codex M5-M8 audit,
     // C-1): in --json mode every progress line goes to stderr, and stdout
@@ -7028,9 +6847,8 @@ async function onboardCommand(flags, context) {
     const seams = context.onboardSeams ?? {};
     const portGiven = text(flags, "port");
     const port = Number(portGiven ?? 4180);
-    if (portGiven !== undefined && (!Number.isInteger(port) || port < 1 || port >= 65536)) {
+    if (portGiven !== undefined && (!Number.isInteger(port) || port < 1 || port >= 65536))
         return fail(write, json, "onboard", "usage", "--port is a whole number under 65536", EXIT.usage);
-    }
     // The console where `up` last served, unless --port says otherwise.
     const served = portGiven === undefined ? readUpConsoleUrl(dirname(context.databaseFile)) : null;
     const home = seams.home ?? homedir();
@@ -7123,32 +6941,26 @@ async function upCommand(flags, context) {
     // 1. Validation, before anything at all.
     const portGiven = text(flags, "port");
     const port = Number(portGiven ?? 4180);
-    if (portGiven !== undefined && (!Number.isInteger(port) || port < 1 || port >= 65536)) {
+    if (portGiven !== undefined && (!Number.isInteger(port) || port < 1 || port >= 65536))
         return fail(write, json, "up", "usage", "--port is a whole number under 65536", EXIT.usage);
-    }
     const editorGiven = text(flags, "editor");
-    if (editorGiven !== undefined && editorGiven !== "vscode") {
+    if (editorGiven !== undefined && editorGiven !== "vscode")
         return fail(write, json, "up", "usage", "--editor supports: vscode", EXIT.usage);
-    }
     const forGiven = text(flags, "for");
-    if (forGiven !== undefined && (!Number.isInteger(Number(forGiven)) || Number(forGiven) <= 0)) {
+    if (forGiven !== undefined && (!Number.isInteger(Number(forGiven)) || Number(forGiven) <= 0))
         return fail(write, json, "up", "usage", "--for takes a positive whole number of milliseconds", EXIT.usage);
-    }
     const capacityGiven = text(flags, "capacity");
     const capacityFlag = capacityGiven === undefined ? null : parseRunnerCapacity(capacityGiven);
-    if (capacityGiven !== undefined && capacityFlag === null) {
+    if (capacityGiven !== undefined && capacityFlag === null)
         return fail(write, json, "up", "usage", `--capacity is a whole number of tasks, 1 to ${RUNNER_CAPACITY_MAX}`, EXIT.usage);
-    }
     const runnerFlag = text(flags, "runner");
-    if (runnerFlag !== undefined && !validRunnerName(runnerFlag)) {
+    if (runnerFlag !== undefined && !validRunnerName(runnerFlag))
         return fail(write, json, "up", "usage", `a worker name is 1–${RUNNER_NAME_MAX} characters with no control characters`, EXIT.usage);
-    }
     // --host / --allow-host (setup review): `up` reaches a phone over a
     // tailnet exactly as `serve` does, so one process is the whole install.
     const hostFlag = text(flags, "host") ?? "127.0.0.1";
-    if (!/^[A-Za-z0-9.:-]{1,253}$/.test(hostFlag)) {
+    if (!/^[A-Za-z0-9.:-]{1,253}$/.test(hostFlag))
         return fail(write, json, "up", "usage", "--host is an address or a name", EXIT.usage);
-    }
     const allowFlag = text(flags, "allow-host");
     // --public-url: `up` serves a real domain exactly as `serve` does (one process is the whole team server).
     const publicUrlFlag = text(flags, "public-url");
@@ -7166,9 +6978,8 @@ async function upCommand(flags, context) {
     // person must repeat on every start.
     const registryPath = registryPathOf(context);
     const loadedRegistry = await loadProjectRegistry(registryPath);
-    if ("error" in loadedRegistry) {
+    if ("error" in loadedRegistry)
         return fail(write, json, "up", "registry", loadedRegistry.error, EXIT.refused);
-    }
     const gitRun = context.gitRunner ?? ((file, args, opts) => run(file, [...args], { ...(opts?.cwd === undefined ? {} : { cwd: opts.cwd }), timeoutMs: 10_000 }));
     const rootInputs = (text(flags, "project-root") ?? "")
         .split(",")
@@ -7177,9 +6988,8 @@ async function upCommand(flags, context) {
     const explicitRoots = [];
     for (const input of rootInputs) {
         const canonical = canonicalProject(input);
-        if (canonical === null) {
+        if (canonical === null)
             return fail(write, json, "up", "project-root", `${input} is not a directory this machine can use`, EXIT.refused);
-        }
         if (!explicitRoots.includes(canonical))
             explicitRoots.push(canonical);
     }
@@ -7216,9 +7026,8 @@ async function upCommand(flags, context) {
     if (explicitRepos.length > 0) {
         for (const input of explicitRepos) {
             const root = await proveRepo(input);
-            if (root === null) {
+            if (root === null)
                 return fail(write, json, "up", "not-a-repository", `${input} is not inside a git repository — choose a repository, set a projects folder once with \`--project-root <dir>\`, or try the sandbox with \`toolroll demo\``, EXIT.refused);
-            }
             if (!repos.includes(root))
                 repos.push(root);
             pinnedRepos.add(root);
@@ -7231,9 +7040,8 @@ async function upCommand(flags, context) {
         if (cwdRepo !== null)
             pinnedRepos.add(cwdRepo);
     }
-    if (repos.length === 0 && projectRoots.length === 0) {
+    if (repos.length === 0 && projectRoots.length === 0)
         return fail(write, json, "up", "no-projects", "choose where your projects live once: `toolroll up --project-root <dir>`", EXIT.refused);
-    }
     // A person at a terminal reads three lines (onboarding); the folders are for --verbose, a service log, or an agent.
     const quietStart = !json && !flags.has("verbose") && (context.upSeams?.terminal ?? process.stdout.isTTY === true) && !underAgent(context.upSeams?.env ?? process.env);
     if (!quietStart) {
@@ -7249,9 +7057,8 @@ async function upCommand(flags, context) {
         probe.once("error", () => resolveProbe(false));
         probe.listen(port, "127.0.0.1", () => resolveProbe(true));
     });
-    if (!reserved) {
+    if (!reserved)
         return fail(write, json, "up", "port-busy", `port ${port} is taken — another \`up\` or \`serve\` may already be running; stop it, or pick a different --port`, EXIT.refused);
-    }
     // Under a coding agent nothing is asked and no secret is printed, even in a real terminal: what is shown lands in
     // its transcript.
     const agentRunning = underAgent(context.upSeams?.env ?? process.env);
@@ -7262,9 +7069,8 @@ async function upCommand(flags, context) {
     try {
         // 4. The approver (findings 2/8/17/21/27/29/32).
         const approverPlan = await resolveUpApprover(context, flags, canPrompt);
-        if ("refusal" in approverPlan) {
+        if ("refusal" in approverPlan)
             return fail(write, json, "up", "login", approverPlan.refusal, EXIT.refused);
-        }
         approver = approverPlan;
         for (const note of approverPlan.notes)
             progress(note);
@@ -7272,9 +7078,8 @@ async function upCommand(flags, context) {
         // recovering runner authority on an UNVERIFIED operator identity was a
         // registration road around the ceremony. No verified password, no
         // runner — the login file or another approver restores the road.
-        if (!approverPlan.verified) {
+        if (!approverPlan.verified)
             return fail(write, json, "up", "login", `${approverPlan.approver}'s password could not be verified — a runner only registers under a proven operator. Type it correctly, restore ${UP_LOGIN_FILE}, or have another approver re-add you.`, EXIT.refused);
-        }
         // 5. The runner, through the atomic door (findings 1/16/26/31), with
         // the suffix budget (finding 24) for generated names only.
         const base = runnerFlag ?? normalizeRunnerName(hostname());
@@ -7759,9 +7564,8 @@ async function bridgeCommand(positional, flags, context) {
     if (demoFence !== null)
         return demoFence;
     const [channel, action] = positional;
-    if (channel !== "telegram") {
+    if (channel !== "telegram")
         return fail(write, json, "bridge", "usage", "`toolroll bridge telegram [pair|unpair|token|status|digest|retry]`", EXIT.usage);
-    }
     if (action === "retry") {
         // Replies already written and fenced on the pairing like every send: this only moves their next attempt to now.
         const retried = store.retryTelegramReplies(null, clock());
@@ -7777,9 +7581,8 @@ async function bridgeCommand(positional, flags, context) {
                 removed ? "Token file removed." : "There was no token file to remove.",
             ]);
         }
-        if (value === undefined) {
+        if (value === undefined)
             return fail(write, json, "bridge token", "usage", "`toolroll bridge telegram token <bot-token>` (from @BotFather), or --clear", EXIT.usage);
-        }
         const saved = saveBotToken(context.telegramTokenFile, value);
         if (!saved.ok)
             return fail(write, json, "bridge token", "bad-token", saved.message, EXIT.refused);
@@ -7806,13 +7609,11 @@ async function bridgeCommand(positional, flags, context) {
             ]);
         }
         const parsed = /^([1-9][0-9]{0,3})(m|h)$/.exec(every);
-        if (parsed === null) {
+        if (parsed === null)
             return fail(write, json, "bridge digest", "usage", "--every takes minutes or hours: 30m, 2h, 24h — or --off", EXIT.usage);
-        }
         const everyMs = Number(parsed[1]) * (parsed[2] === "h" ? 3_600_000 : 60_000);
-        if (everyMs < 5 * 60_000 || everyMs > 7 * 24 * 3_600_000) {
+        if (everyMs < 5 * 60_000 || everyMs > 7 * 24 * 3_600_000)
             return fail(write, json, "bridge digest", "usage", "the digest cadence is between 5 minutes and 7 days", EXIT.usage);
-        }
         store.setTelegramDigest(everyMs, "cli", clock());
         return succeed(write, json, "bridge digest", { everyMs }, () => [
             `Digest every ${digestWords(everyMs)}. Routine facts are held and sent together; decisions and anything that needs you now still page at once.`,
@@ -7847,18 +7648,15 @@ async function bridgeCommand(positional, flags, context) {
     }
     if (action === "pair" || action === "unpair") {
         const acting = await askCredentials(flags, context);
-        if (acting === null) {
+        if (acting === null)
             return fail(write, json, `bridge ${action}`, "usage", "`--as <you> --token <your password>` — pairing hands your authority to a chat, so it takes your credential", EXIT.usage);
-        }
         const { name: asWho, token } = acting;
         const authenticated = (action === "pair" ? credentialApprover(store, asWho, token) : authenticateApprover(store, asWho, token));
-        if (!authenticated.ok) {
+        if (!authenticated.ok)
             return fail(write, json, `bridge ${action}`, authenticated.reason, describeApproveFailure(authenticated.reason, asWho), EXIT.refused);
-        }
         if (action === "unpair") {
-            if (source === null) {
+            if (source === null)
                 return fail(write, json, "bridge unpair", "no-token", "no bot token, so no bot to unpair", EXIT.refused);
-            }
             const revoked = store.unpairTelegram(source.botId, asWho, clock());
             return succeed(write, json, "bridge unpair", { revoked }, () => [
                 revoked
@@ -7877,13 +7675,11 @@ async function bridgeCommand(positional, flags, context) {
             "chat only, and the chat will answer as you — treat it accordingly.",
         ]);
     }
-    if (action !== undefined) {
+    if (action !== undefined)
         return fail(write, json, "bridge", "usage", "`toolroll bridge telegram [pair|unpair|token|status]`", EXIT.usage);
-    }
     // The pass.
-    if (source === null) {
+    if (source === null)
         return fail(write, json, "bridge", "no-token", `no bot token — set ${TOKEN_ENV}, run \`toolroll bridge telegram token <t>\`, or use the serve settings card`, EXIT.refused);
-    }
     const fenced = networkFence(context.telegramEnv ?? (context.telegramTransport === undefined ? process.env : {}));
     if (fenced !== null)
         return fail(write, json, "bridge", "network-fenced", networkFenceLine(fenced), EXIT.refused);
@@ -7948,9 +7744,8 @@ async function bridgeCommand(positional, flags, context) {
         clock,
         ...(flags.has("inbound-only") ? { deliver: false } : {}),
     });
-    if (!passed.ok) {
+    if (!passed.ok)
         return fail(write, json, "bridge", passed.reason, passed.message, EXIT.refused);
-    }
     const { report } = passed;
     const broke = report.problems.length > 0;
     const idle = report.sent === 0 && report.answered === 0 && report.paired === 0 && (report.statusReplies ?? 0) === 0
@@ -7960,12 +7755,10 @@ async function bridgeCommand(positional, flags, context) {
         ...(report.backlog ? ["Telegram still holds more updates than one pass's budget — run it again."] : []),
         ...report.problems.map(problem => `  problem: ${problem}`),
     ];
-    if (broke) {
+    if (broke)
         return fail(write, json, "bridge", "telegram-transport", lines().join("\n"), EXIT.failed, { report });
-    }
-    if (idle) {
+    if (idle)
         return fail(write, json, "bridge", "idle", "nothing to send, nothing arrived", EXIT.refused, { report });
-    }
     return succeed(write, json, "bridge", { report }, lines);
 }
 // ---- publication -----------------------------------------------------------
@@ -7993,14 +7786,12 @@ async function publishCommand(positional, flags, context) {
     const [action] = positional;
     // Bare `publish` IS an action: the publication pass (push branches,
     // open PRs, sweep merges) — only a NAMED unknown action refuses.
-    if (action !== undefined && !PUBLISH_ACTIONS.includes(action)) {
+    if (action !== undefined && !PUBLISH_ACTIONS.includes(action))
         return fail(write, json, "publish", "usage", `unknown \`publish ${action}\` — try ${PUBLISH_ACTIONS.join(", ")}, or bare \`publish\` for the publication pass`, EXIT.usage);
-    }
     if (action === "setup") {
         const mergeMethod = text(flags, "merge-method") ?? "squash";
-        if (!["squash", "merge", "rebase"].includes(mergeMethod)) {
+        if (!["squash", "merge", "rebase"].includes(mergeMethod))
             return fail(write, json, "publish setup", "usage", "--merge-method is squash, merge or rebase", EXIT.usage);
-        }
         const checked = await checkPublishing(repo, context.publishExec === undefined ? {} : { exec: context.publishExec });
         if (!checked.ok)
             return fail(write, json, "publish setup", checked.reason, checked.message, EXIT.refused);
@@ -8022,26 +7813,20 @@ async function publishCommand(positional, flags, context) {
             return EXIT.refused;
         }
         const acting = await askCredentials(flags, context);
-        if (acting === null) {
-            return fail(write, json, "publish setup", "usage", "turning on pull requests takes --as <you> --token <your password>", EXIT.usage);
-        }
-        const authenticated = authenticateApprover(store, acting.name, acting.token, repo);
-        if (!authenticated.ok) {
-            return fail(write, json, "publish setup", authenticated.reason, describeApproveFailure(authenticated.reason, acting.name), EXIT.refused);
-        }
+        const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token, repo);
+        if (acting === null || !verified?.ok)
+            return refuseApprover(context, "publish setup", verified, "turning on pull requests takes --as <you> --token <your password>", acting?.name);
         savePublishing(store, plan, acting.name, settings, clock());
         return succeed(write, json, "publish setup", { publishing: publishingOf(store, repo) }, () => ["Pull requests are on.", ...terms]);
     }
     if (action === "grant") {
         const github = text(flags, "github");
-        if (github === undefined || !/^[\w.-]+\/[\w.-]+$/.test(github)) {
+        if (github === undefined || !/^[\w.-]+\/[\w.-]+$/.test(github))
             return fail(write, json, "publish grant", "usage", "`--github <owner/name>` is required, exactly", EXIT.usage);
-        }
         const wantsMerge = flags.has("allow-merge");
         const mergeMethod = text(flags, "merge-method");
-        if (wantsMerge && (mergeMethod === undefined || !["squash", "merge", "rebase"].includes(mergeMethod))) {
+        if (wantsMerge && (mergeMethod === undefined || !["squash", "merge", "rebase"].includes(mergeMethod)))
             return fail(write, json, "publish grant", "usage", "--allow-merge names its method: --merge-method squash|merge|rebase", EXIT.usage);
-        }
         const spec = {
             repo,
             githubRepo: github,
@@ -8082,14 +7867,10 @@ async function publishCommand(positional, flags, context) {
             return EXIT.refused;
         }
         const acting = await askCredentials(flags, context);
-        if (acting === null) {
-            return fail(write, json, "publish grant", "usage", "granting takes --as <you> --token <your password> — pushing your repos is a person's yes", EXIT.usage);
-        }
+        const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
+        if (acting === null || !verified?.ok)
+            return refuseApprover(context, "publish grant", verified, "granting takes --as <you> --token <your password> — pushing your repos is a person's yes", acting?.name);
         const { name: asWho, token } = acting;
-        const authenticated = authenticateApprover(store, asWho, token);
-        if (!authenticated.ok) {
-            return fail(write, json, "publish grant", authenticated.reason, describeApproveFailure(authenticated.reason, asWho), EXIT.refused);
-        }
         store.savePublicationGrant({ ...spec, grantedBy: asWho }, clock());
         return succeed(write, json, "publish grant", { granted: true, grant: spec }, () => [
             `Granted by ${asWho}:`,
@@ -8099,14 +7880,10 @@ async function publishCommand(positional, flags, context) {
     }
     if (action === "revoke") {
         const acting = await askCredentials(flags, context);
-        if (acting === null) {
-            return fail(write, json, "publish revoke", "usage", "`--as <you> --token <your password>`", EXIT.usage);
-        }
+        const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
+        if (acting === null || !verified?.ok)
+            return refuseApprover(context, "publish revoke", verified, "`--as <you> --token <your password>`", acting?.name);
         const { name: asWho, token } = acting;
-        const authenticated = authenticateApprover(store, asWho, token);
-        if (!authenticated.ok) {
-            return fail(write, json, "publish revoke", authenticated.reason, describeApproveFailure(authenticated.reason, asWho), EXIT.refused);
-        }
         const revoked = store.revokePublicationGrant(repo, asWho, clock());
         return succeed(write, json, "publish revoke", { revoked }, () => [
             revoked
@@ -8131,25 +7908,18 @@ async function publishCommand(positional, flags, context) {
     if (action === "merge" || action === "refire") {
         const prGiven = positional[1];
         const pr = Number(prGiven);
-        if (prGiven === undefined || !Number.isInteger(pr) || pr <= 0) {
+        if (prGiven === undefined || !Number.isInteger(pr) || pr <= 0)
             return fail(write, json, `publish ${action}`, "usage", `\`toolroll publish ${action} <pr> --as <you> --token <t>\``, EXIT.usage);
-        }
         const acting = await askCredentials(flags, context);
-        if (acting === null) {
-            return fail(write, json, `publish ${action}`, "usage", "authorizing a merge takes `--as <you> --token <t>` — who said yes is recorded, not asserted", EXIT.usage);
-        }
-        const authenticated = authenticateApprover(store, acting.name, acting.token);
-        if (!authenticated.ok) {
-            return fail(write, json, `publish ${action}`, authenticated.reason, describeApproveFailure(authenticated.reason, acting.name), EXIT.refused);
-        }
+        const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
+        if (acting === null || !verified?.ok)
+            return refuseApprover(context, `publish ${action}`, verified, "authorizing a merge takes `--as <you> --token <t>` — who said yes is recorded, not asserted", acting?.name);
         const publication = store.openedPublications().find(one => one.prNumber === pr);
-        if (publication === undefined) {
+        if (publication === undefined)
             return fail(write, json, `publish ${action}`, "unknown", `no open publication holds PR #${pr}`, EXIT.refused);
-        }
         const intent = store.mergeIntentFor(publication.id);
-        if (intent === null) {
+        if (intent === null)
             return fail(write, json, `publish ${action}`, "no-intent", `PR #${pr} has no merge intent yet — the sweep writes one when a merge-capable grant covers it`, EXIT.refused);
-        }
         if (action === "merge") {
             // The EXACT-INTENT ceremony (E1): the yes covers this head and no
             // other — a moved head refuses rather than authorizing the unseen.
@@ -8178,21 +7948,15 @@ async function publishCommand(positional, flags, context) {
     if (action === "unblock" || action === "rearm") {
         const prGiven = positional[1];
         const pr = Number(prGiven);
-        if (prGiven === undefined || !Number.isInteger(pr) || pr <= 0) {
+        if (prGiven === undefined || !Number.isInteger(pr) || pr <= 0)
             return fail(write, json, `publish ${action}`, "usage", `\`toolroll publish ${action} <pr> --as <you> --token <t>\``, EXIT.usage);
-        }
         const acting = await askCredentials(flags, context);
-        if (acting === null) {
-            return fail(write, json, `publish ${action}`, "usage", `${action === "unblock" ? "lifting a repair hold" : "re-arming a refused merge"} takes \`--as <you> --token <t>\` — who decided is recorded, not asserted`, EXIT.usage);
-        }
-        const authenticated = authenticateApprover(store, acting.name, acting.token);
-        if (!authenticated.ok) {
-            return fail(write, json, `publish ${action}`, authenticated.reason, describeApproveFailure(authenticated.reason, acting.name), EXIT.refused);
-        }
+        const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
+        if (acting === null || !verified?.ok)
+            return refuseApprover(context, `publish ${action}`, verified, `${action === "unblock" ? "lifting a repair hold" : "re-arming a refused merge"} takes \`--as <you> --token <t>\` — who decided is recorded, not asserted`, acting?.name);
         const publication = store.openedPublications().find(one => one.prNumber === pr);
-        if (publication === undefined) {
+        if (publication === undefined)
             return fail(write, json, `publish ${action}`, "unknown", `no open publication holds PR #${pr}`, EXIT.refused);
-        }
         if (action === "unblock") {
             const lifted = store.liftMergeBlocker(publication.id, acting.name, context.clock());
             store.resolveEpisodes(`merge-attn:${publication.id}`, context.clock());
@@ -8210,9 +7974,8 @@ async function publishCommand(positional, flags, context) {
                 : `PR #${pr} had no refused merge to re-arm.`,
         ]);
     }
-    if (action !== undefined) {
+    if (action !== undefined)
         return fail(write, json, "publish", "usage", "`toolroll publish [grant|revoke|status|unblock|rearm]`", EXIT.usage);
-    }
     // The pass.
     const report = await publishPass(store, {
         repo,
@@ -8234,12 +7997,10 @@ async function publishCommand(positional, flags, context) {
         ...report.problems.map(problem => `  problem: ${problem}`),
         ...merges.problems.map(problem => `  merge: ${problem}`),
     ];
-    if (report.problems.length > 0) {
+    if (report.problems.length > 0)
         return fail(write, json, "publish", "publish-problems", lines().join("\n"), EXIT.failed, { report });
-    }
-    if (idle) {
+    if (idle)
         return fail(write, json, "publish", "idle", "nothing owed — no pending publications", EXIT.refused, { report });
-    }
     return succeed(write, json, "publish", { report }, lines);
 }
 // ---- the outbox -----------------------------------------------------------
@@ -8263,9 +8024,8 @@ async function peekCommand(positional, flags, context) {
     }
     const linesGiven = text(flags, "lines");
     const lines = linesGiven === undefined ? 12 : Number(linesGiven);
-    if (!Number.isInteger(lines) || lines < 1 || lines > PEEK_TAIL_LINES) {
+    if (!Number.isInteger(lines) || lines < 1 || lines > PEEK_TAIL_LINES)
         return fail(write, json, "peek", "usage", `--lines is a whole number from 1 to ${PEEK_TAIL_LINES}`, EXIT.usage);
-    }
     const interactive = !json && process.stdout.isTTY === true && process.stdin.isTTY === true;
     if (flags.has("tmux")) {
         if (!interactive)
@@ -8322,9 +8082,8 @@ async function outboxCommand(positional, flags, context) {
         if (demoFence !== null)
             return demoFence;
         const command = text(flags, "cmd");
-        if (command === undefined) {
+        if (command === undefined)
             return fail(write, json, "outbox deliver", "usage", "--cmd says how: it runs once per notification, reading $TOOLROLL_KIND, $TOOLROLL_SUBJECT, $TOOLROLL_BODY", EXIT.usage);
-        }
         // The exact command owns a leased destination receipt, including across concurrent CLI invocations.
         const owner = `outbox-${randomUUID()}`;
         // Push delivery has independent receipts and must keep working if this command fails.
@@ -8397,28 +8156,23 @@ async function enrollCommand(positional, flags, context) {
     const repo = positional[0] === undefined ? process.cwd() : resolve(positional[0]);
     const backend = text(flags, "backend") ?? BUILT_IN;
     const mutations = readMutations(flags);
-    if (mutations === null) {
+    if (mutations === null)
         return fail(write, json, "enroll", "usage", `--allow takes ${MUTATION_CLASSES.join(", ")}`, EXIT.usage);
-    }
     const selectorFlag = text(flags, "selector") ?? "ours";
-    if (selectorFlag !== "ours" && selectorFlag !== "all") {
+    if (selectorFlag !== "ours" && selectorFlag !== "all")
         return fail(write, json, "enroll", "usage", "--selector is `ours` or `all`", EXIT.usage);
-    }
     const paths = readPaths(flags, backend);
-    if (paths.length === 0) {
+    if (paths.length === 0)
         return fail(write, json, "enroll", "usage", `--paths says what may be written for backend \`${backend}\``, EXIT.usage);
-    }
     // External dispatch (v20): its own explicit yes, never in any default.
     // A dispatch grant binds EXACTLY ONE remote repository and mints this
     // plane's marker identity.
     const wantsDispatch = flags.has("allow-dispatch");
     const dispatchRepo = text(flags, "github");
-    if (wantsDispatch && backend !== "github-issues") {
+    if (wantsDispatch && backend !== "github-issues")
         return fail(write, json, "enroll", "usage", "--allow-dispatch is a github-issues authority in this release", EXIT.usage);
-    }
-    if (wantsDispatch && (dispatchRepo === undefined || !GITHUB_REPO_SHAPE.test(dispatchRepo))) {
+    if (wantsDispatch && (dispatchRepo === undefined || !GITHUB_REPO_SHAPE.test(dispatchRepo)))
         return fail(write, json, "enroll", "usage", "--allow-dispatch binds exactly one tracker: name it with `--github <owner/name>`", EXIT.usage);
-    }
     const grant = await proposeGrant({
         repo,
         backend,
@@ -8509,17 +8263,14 @@ function grantsCommand(context) {
     return EXIT.ok;
 }
 function checkProgressCommand(positional, context) {
-    if (positional.length !== 1 || !/^[1-9][0-9]{0,14}$/.test(positional[0] ?? "")) {
+    if (positional.length !== 1 || !/^[1-9][0-9]{0,14}$/.test(positional[0] ?? ""))
         return fail(context.write, context.json, "check-progress", "usage", "use check-progress <run>", EXIT.usage);
-    }
     const run = Number(positional[0]);
-    if (!Number.isSafeInteger(run) || context.store.getRun(run) === null) {
+    if (!Number.isSafeInteger(run) || context.store.getRun(run) === null)
         return fail(context.write, context.json, "check-progress", "unknown-run", "no such run", EXIT.refused);
-    }
     const progress = context.store.checkProgress(run);
-    if (progress === null) {
+    if (progress === null)
         return fail(context.write, context.json, "check-progress", "no-progress", "this run has no saved check progress", EXIT.refused);
-    }
     return succeed(context.write, context.json, "check-progress", { run, progress }, () => [progress.line]);
 }
 function revokeCommand(positional, flags, context) {
@@ -8535,9 +8286,8 @@ function revokeCommand(positional, flags, context) {
     if (revoked && outgoing?.dispatch === true && outgoing.remoteRepo != null) {
         void ghDispatchAdapter().deleteMarker(outgoing.remoteRepo);
     }
-    if (!revoked) {
+    if (!revoked)
         return fail(write, json, "revoke", "no-grant", `${repo} was not enrolled for ${backend}`, EXIT.refused);
-    }
     return succeed(write, json, "revoke", { repo, backend }, () => [
         `Revoked. ${backend} in ${repo} is read-only again.`,
     ]);
@@ -8675,14 +8425,12 @@ async function waitTask(positional, flags, context) {
         if (!allowed.has(name))
             return fail(context.write, context.json, command, "usage", `--${name} is not a task wait option.`, EXIT.usage);
     }
-    if (positional.length !== 1) {
+    if (positional.length !== 1)
         return fail(context.write, context.json, command, "usage", "Use `toolroll task wait <id> [--timeout <seconds>]`.", EXIT.usage);
-    }
     const givenTimeout = text(flags, "timeout");
     const timeoutSeconds = givenTimeout === undefined ? null : Number(givenTimeout);
-    if (timeoutSeconds !== null && (!Number.isFinite(timeoutSeconds) || timeoutSeconds < 0)) {
+    if (timeoutSeconds !== null && (!Number.isFinite(timeoutSeconds) || timeoutSeconds < 0))
         return fail(context.write, context.json, command, "usage", "--timeout must be zero or a positive number of seconds.", EXIT.usage);
-    }
     const task = positional[0];
     const startedAt = Date.now();
     const timeoutMs = timeoutSeconds === null ? null : timeoutSeconds * 1_000;
@@ -8836,15 +8584,13 @@ async function addTask(positional, flags, context) {
     // A scout task lives in the built-in backend (v4 review, finding 2):
     // the deliverable is a column on OUR task_ref, stamped in the same
     // transaction as the filing — a tracker's item has no such promise.
-    if (flags.has("report") && backendName !== BUILT_IN) {
+    if (flags.has("report") && backendName !== BUILT_IN)
         return fail(write, json, "task add", "usage", "--report files a scout task in the built-in backend only — drop --backend", EXIT.usage);
-    }
     if (backendName !== BUILT_IN) {
         const repo = repoFrom(flags);
         const backend = openBackend(backendName, store, repo);
-        if (backend === null) {
+        if (backend === null)
             return fail(write, json, "task add", "usage", `no backend \`${backendName}\``, EXIT.usage);
-        }
         const created = await backend.create({ title });
         if (!created.ok) {
             // A denial is a refusal, not a breakage: the tool worked exactly as
@@ -8890,9 +8636,8 @@ async function addTask(positional, flags, context) {
     const id = text(flags, "id") ?? (activeRemote() === null ? slug(title, now) : `task-${randomBytes(16).toString("hex")}`);
     // Re-filing: the new task replaces an earlier one, which is cancelled and reads "Replaced by <id>".
     const replaces = text(flags, "replaces");
-    if (replaces !== undefined && (replaces === id || store.getTask(replaces) === null)) {
+    if (replaces !== undefined && (replaces === id || store.getTask(replaces) === null))
         return fail(write, json, "task add", "unknown-task", `no task \`${replaces}\` to replace`, EXIT.refused);
-    }
     noteActingPerson(flags, context);
     // The existence check goes *inside* the replayed body. Outside it, a retry
     // with the same key hits "already exists" and reports failure for a task the
@@ -8907,9 +8652,8 @@ async function addTask(positional, flags, context) {
         // branch task.
         return { ok: true, task: store.createTask({ id, title, ...(flags.has("report") ? { deliverable: "report" } : {}) }, now) };
     }, result => result.ok);
-    if (!outcome.ok) {
+    if (!outcome.ok)
         return fail(write, json, "task add", "exists", `\`${id}\` already exists`, EXIT.refused);
-    }
     const filedId = outcome.task.id;
     const remote = activeRemote();
     if (remote !== null && filedId !== id) {
@@ -8926,9 +8670,8 @@ async function addTask(positional, flags, context) {
     const placedIn = text(flags, "repo");
     if (placedIn !== undefined) {
         const placed = store.placeTask(store.refFor(BUILT_IN, filedId).id, canonicalProject(placedIn) ?? resolve(placedIn));
-        if (typeof placed === "object" && !placed.ok) {
+        if (typeof placed === "object" && !placed.ok)
             return fail(write, json, "task add", "scoped", "this task already has a scope — placement is immutable once somebody could have approved it", EXIT.refused);
-        }
     }
     if (replaces !== undefined)
         store.setTaskState(replaces, "cancelled", now, {}, undefined, outcome.task.id);
@@ -9029,17 +8772,14 @@ function requireTask(positional, flags, context) {
     const { store, write, json, now } = context;
     const id = positional[0];
     const given = text(flags, "cap");
-    if (id === undefined || given === undefined) {
+    if (id === undefined || given === undefined)
         return fail(write, json, "task require", "usage", "`toolroll task require <id> --cap <kind:name>[,<kind:name>]` — or --cap none to clear", EXIT.usage);
-    }
-    if (store.getTask(id) === null) {
+    if (store.getTask(id) === null)
         return fail(write, json, "task require", "unknown-task", `no task \`${id}\``, EXIT.refused);
-    }
     const keys = given === "none" ? [] : given.split(",").map(one => one.trim()).filter(Boolean);
     for (const key of keys) {
-        if (parseCapabilityKey(key) === null) {
+        if (parseCapabilityKey(key) === null)
             return fail(write, json, "task require", "usage", `\`${key}\` is not a capability key — say kind:name, like env:SUPABASE_KEY or cli:gh`, EXIT.usage);
-        }
     }
     store.setRequirements(store.refFor(BUILT_IN, id).id, keys, mutationFrom(flags, now));
     return succeed(write, json, "task require", { id, requirements: keys }, () => [
@@ -9062,21 +8802,18 @@ async function capCommand(positional, flags, context) {
     const [action, name] = positional;
     const repo = repoFrom(flags);
     if (action === "add") {
-        if (name === undefined) {
+        if (name === undefined)
             return fail(write, json, "cap add", "usage", "`toolroll cap add <name> [--kind env|cli|mcp|ci|other] [--probe <cmd>] [--expires <iso>]`", EXIT.usage);
-        }
         const kind = (text(flags, "kind") ?? "env");
-        if (!["env", "cli", "mcp", "ci", "other"].includes(kind)) {
+        if (!["env", "cli", "mcp", "ci", "other"].includes(kind))
             return fail(write, json, "cap add", "usage", "--kind takes env, cli, mcp, ci or other", EXIT.usage);
-        }
         // An env capability can have its probe synthesized from a fixed template
         // — but only over a validated identifier, because the name lands inside
         // a shell line. Anything else the operator writes explicitly.
         let probe = text(flags, "probe") ?? null;
         if (probe === null && kind === "env") {
-            if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {
+            if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))
                 return fail(write, json, "cap add", "usage", `\`${name}\` is not an environment variable name — give --probe explicitly`, EXIT.usage);
-            }
             probe = `test -n "$${name}"`;
         }
         const expires = text(flags, "expires") ?? null;
@@ -9161,16 +8898,14 @@ async function capCommand(positional, flags, context) {
     if (action === "probe") {
         const only = positional.slice(1);
         for (const key of only) {
-            if (parseCapabilityKey(key) === null) {
+            if (parseCapabilityKey(key) === null)
                 return fail(write, json, "cap probe", "usage", `\`${key}\` is not a capability key — say kind:name`, EXIT.usage);
-            }
         }
         const outcomes = await probeRepo(store, repo, `operator@${hostname()}`, clock(), {
             ...(only.length === 0 ? {} : { only: new Set(only) }),
         });
-        if (outcomes.length === 0) {
+        if (outcomes.length === 0)
             return fail(write, json, "cap probe", "empty", `nothing to probe for ${repo}`, EXIT.refused);
-        }
         const unverified = outcomes.filter(one => one.status !== "verified");
         const lines = () => outcomes.map(one => `  ${`${one.kind}:${one.name}`.padEnd(32)} ${one.status}${one.detail === undefined ? "" : `  ${one.detail}`}`);
         if (json) {
@@ -9191,9 +8926,8 @@ function listTasks(flags, context) {
     const rawView = text(flags, 'view');
     const rawLimit = text(flags, 'limit');
     const limit = rawLimit === undefined ? 40 : Number(rawLimit);
-    if (wanted !== undefined && !STATES.includes(wanted)) {
+    if (wanted !== undefined && !STATES.includes(wanted))
         return fail(write, json, 'task list', 'usage', `--state takes one of ${STATES.join(', ')}`, EXIT.usage);
-    }
     if (rawView !== undefined && !['all', 'needs-you', 'running', 'completed'].includes(rawView) ||
         !Number.isSafeInteger(limit) || limit < 1 || limit > 100) {
         return fail(write, json, 'task list', 'usage', '--view takes all, needs-you, running or completed; --limit takes 1–100', EXIT.usage);
@@ -9444,19 +9178,14 @@ async function acceptTaskProof(positional, flags, context) {
     if (task === null)
         return fail(write, json, "task accept", "unknown-task", `no task \`${id}\``, EXIT.refused);
     const acting = await askCredentials(flags, context);
-    if (acting === null) {
-        return fail(write, json, "task accept", "usage", "accepting incomplete proof is a person's act — it takes `--as <you> --token <t>`", EXIT.usage);
-    }
-    const authenticated = authenticateApprover(store, acting.name, acting.token);
-    if (!authenticated.ok) {
-        return fail(write, json, "task accept", authenticated.reason, describeApproveFailure(authenticated.reason, id), EXIT.refused);
-    }
+    const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
+    if (acting === null || !verified?.ok)
+        return refuseApprover(context, "task accept", verified, "accepting incomplete proof is a person's act — it takes `--as <you> --token <t>`", id);
     const ref = store.refFor(BUILT_IN, id);
     // v40 fix: a reviewer run is never the attempt whose proof is accepted.
     const latest = store.runsFor(ref.id).find(one => one.finishedAt !== null && (one.role === "builder" || one.role === "scout"));
-    if (latest === undefined) {
+    if (latest === undefined)
         return fail(write, json, "task accept", "no-run", `${id} has no finished attempt to accept`, EXIT.refused);
-    }
     const rawNote = text(flags, "note");
     let note = null;
     if (rawNote !== undefined && rawNote.trim() !== "") {
@@ -9481,9 +9210,8 @@ async function repairTaskCommand(positional, flags, context) {
     const { store, write, json, clock } = context;
     const [runText] = positional;
     const runId = Number(runText ?? "");
-    if (runText === undefined || !Number.isInteger(runId) || runId < 1) {
+    if (runText === undefined || !Number.isInteger(runId) || runId < 1)
         return fail(write, json, "task repair", "usage", "`toolroll task repair <run-id> [--yes] --as <you> --token <t>`", EXIT.usage);
-    }
     let chain = store.repairChainFor(runId);
     if (chain === null && flags.get("yes") === true) {
         const acting = await askCredentials(flags, context);
@@ -9500,12 +9228,10 @@ async function repairTaskCommand(positional, flags, context) {
             chain = store.repairChainFor(runId);
         }
     }
-    if (chain === null) {
+    if (chain === null)
         return fail(write, json, "task repair", "unknown-task", `run ${runId} has no drafted repair — a repair is only drafted after a review names unmet criteria`, EXIT.refused);
-    }
-    if (chain.draftTask === null) {
+    if (chain.draftTask === null)
         return fail(write, json, "task repair", "refused", `no draft was ever made for run ${runId} — the chain stopped at ${chain.outcome} before drafting one`, EXIT.refused);
-    }
     const draftId = chain.draftTask;
     const yes = flags.get("yes") === true;
     if (!yes) {
@@ -9516,21 +9242,15 @@ async function repairTaskCommand(positional, flags, context) {
         ]);
     }
     const acting = await askCredentials(flags, context);
-    if (acting === null) {
-        return fail(write, json, "task repair", "usage", "approving a repair draft is a person's act — it takes `--as <you> --token <t>`", EXIT.usage);
-    }
-    const authenticated = authenticateApprover(store, acting.name, acting.token);
-    if (!authenticated.ok) {
-        return fail(write, json, "task repair", authenticated.reason, describeApproveFailure(authenticated.reason, draftId), EXIT.refused);
-    }
+    const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
+    if (acting === null || !verified?.ok)
+        return refuseApprover(context, "task repair", verified, "approving a repair draft is a person's act — it takes `--as <you> --token <t>`", draftId);
     const draftScope = store.getScope(draftId);
-    if (draftScope === null) {
+    if (draftScope === null)
         return fail(write, json, "task repair", "no-scope", `${draftId} has no scope to approve`, EXIT.refused);
-    }
     const approved = approve(store, draftId, acting.name, clock(), draftScope.digest, acting.token);
-    if (!approved.ok) {
+    if (!approved.ok)
         return fail(write, json, "task repair", approved.reason, approved.reason === "policy" ? `${draftId}: ${approved.message}` : describeApproveFailure(approved.reason, draftId), EXIT.refused);
-    }
     return succeed(write, json, "task repair", { run: runId, draft: draftId, approvedBy: acting.name }, () => [
         `Approved: ${draftId} (attempt ${chain.attempt}) will build on the next dispatch.`,
     ]);
@@ -9538,19 +9258,16 @@ async function repairTaskCommand(positional, flags, context) {
 async function stateTask(positional, flags, context) {
     const { store, write, json, now } = context;
     const [id, state] = positional;
-    if (id === undefined || state === undefined) {
+    if (id === undefined || state === undefined)
         return fail(write, json, "task state", "usage", "`toolroll task state <id> <state>`", EXIT.usage);
-    }
-    if (!STATES.includes(state)) {
+    if (!STATES.includes(state))
         return fail(write, json, "task state", "usage", `state is one of ${STATES.join(", ")}`, EXIT.usage);
-    }
     const backendName = text(flags, "backend") ?? BUILT_IN;
     if (backendName !== BUILT_IN) {
         const repo = repoFrom(flags);
         const backend = openBackend(backendName, store, repo);
-        if (backend === null) {
+        if (backend === null)
             return fail(write, json, "task state", "usage", `no backend \`${backendName}\``, EXIT.usage);
-        }
         const moved = await backend.setState(id, state);
         if (!moved.ok) {
             const code = moved.reason === "denied" || moved.reason === "unsupported" ? EXIT.refused : EXIT.failed;
@@ -9601,9 +9318,8 @@ function askTask(positional, flags, context) {
     const { store, write, json, now } = context;
     const [id, ...extra] = positional;
     const person = text(flags, "person"), why = text(flags, "why")?.trim();
-    if (id === undefined || extra.length > 0 || person === undefined || why === undefined || why === "") {
+    if (id === undefined || extra.length > 0 || person === undefined || why === undefined || why === "")
         return fail(write, json, "task ask", "usage", "`toolroll task ask <id> --person <name> --why \"what they need to do\"`", EXIT.usage);
-    }
     if (why.length > 500 || /[\u0000-\u001f\u007f]/.test(why))
         return fail(write, json, "task ask", "usage", "--why is at most 500 plain characters on one line", EXIT.usage);
     noteActingPerson(flags, context);
@@ -9632,9 +9348,8 @@ async function leadCommand(positional, flags, context) {
         return fail(write, json, command, "refused", "A lead cannot mint lead tokens. The person it acts for runs this with their password.", EXIT.refused);
     const acting = await askCredentials(flags, context);
     const verified = acting === null ? null : (flags.has("revoke") ? authenticateApprover(store, acting.name, acting.token) : credentialApprover(store, acting.name, acting.token));
-    if (acting === null || verified === null || !verified.ok) {
+    if (acting === null || !verified?.ok)
         return fail(write, json, command, "unauthenticated", "A lead token is minted behind your password: pass --as and --token (or use the remembered login).", EXIT.refused);
-    }
     const now = context.clock();
     if (flags.has("revoke")) {
         const ended = store.revokeLeadCredentials(acting.name, acting.name, now);
@@ -9688,13 +9403,11 @@ function blockTask(positional, flags, context) {
     const { store, write, json } = context;
     const id = positional[0];
     const on = text(flags, "on");
-    if (id === undefined || on === undefined) {
+    if (id === undefined || on === undefined)
         return fail(write, json, "task block", "usage", "`toolroll task block <id> --on <id>`", EXIT.usage);
-    }
     for (const each of [id, on]) {
-        if (store.getTask(each) === null) {
+        if (store.getTask(each) === null)
             return fail(write, json, "task block", "unknown-task", `no task \`${each}\``, EXIT.refused);
-        }
     }
     const result = store.addEdge(id, on, mutationFrom(flags, context.now));
     if (!result.ok)
@@ -9712,20 +9425,17 @@ async function steerTask(positional, flags, context) {
     const { store, write, json } = context;
     const id = positional[0];
     const note = text(flags, "note");
-    if (id === undefined || note === undefined) {
+    if (id === undefined || note === undefined)
         return fail(write, json, "task steer", "usage", "`toolroll task steer <id> --note \"...\" --as <you> --token <t>` — steering speaks with the operator's voice, so it takes your credential; a running build's agent reads the note when it next checks for notes, otherwise the next attempt's brief quotes it, fenced, inside the approved scope", EXIT.usage);
-    }
     // Ruling 11: authorship derives from a VERIFIED principal, never a flag.
     // Missing credentials are usage (the invocation is incomplete); present
     // but wrong is not-an-approver — the same taxonomy as every ceremony.
     const acting = await askCredentials(flags, context);
-    if (acting === null) {
+    if (acting === null)
         return fail(write, json, "task steer", "usage", "steering takes `--as <you> --token <t>` — anonymous notes never reach an agent's brief", EXIT.usage);
-    }
     const authed = authenticateApprover(store, acting.name, acting.token);
-    if (!authed.ok) {
+    if (!authed.ok)
         return fail(write, json, "task steer", "not-an-approver", "that is not an approver, or the token does not match", EXIT.refused);
-    }
     // --now: Pause and steer — the running Claude build's turn stops, then this note continues it.
     if (flags.get("now") === true)
         return pauseRunningBuild("task steer", id, note, verifiedAuthor(acting.name), flags, context);
@@ -9828,16 +9538,13 @@ function unblockTask(positional, flags, context) {
     const { store, write, json } = context;
     const id = positional[0];
     const on = text(flags, "on");
-    if (id === undefined || on === undefined) {
+    if (id === undefined || on === undefined)
         return fail(write, json, "task unblock", "usage", "`toolroll task unblock <id> --on <id>`", EXIT.usage);
-    }
-    if (store.getTask(id) === null) {
+    if (store.getTask(id) === null)
         return fail(write, json, "task unblock", "unknown-task", `no task \`${id}\``, EXIT.refused);
-    }
     const result = store.removeEdge(id, on, mutationFrom(flags, context.now));
-    if (!result.ok) {
+    if (!result.ok)
         return fail(write, json, "task unblock", "not-waiting", `${id} was not waiting on ${on}`, EXIT.refused);
-    }
     return succeed(write, json, "task unblock", { blocked: id, blocker: on }, () => [
         `${id} no longer waits for ${on}.`,
     ]);
@@ -9850,9 +9557,8 @@ function unblockTask(positional, flags, context) {
 function nextTask(positional, flags, context) {
     const { store, write, json } = context;
     const id = positional[0];
-    if (id === undefined) {
+    if (id === undefined)
         return fail(write, json, "task next", "usage", "`toolroll task next <id> [--undo]`", EXIT.usage);
-    }
     if (flags.has("undo")) {
         const cleared = store.clearTaskPriority(id, mutationFrom(flags, context.now));
         if (!cleared.ok)
@@ -9886,9 +9592,8 @@ function assignTask(positional, flags, context) {
     const id = positional[0];
     const runner = text(flags, "runner");
     const anyone = flags.has("anyone");
-    if (id === undefined || (runner === undefined && !anyone) || (runner !== undefined && anyone)) {
+    if (id === undefined || (runner === undefined && !anyone) || (runner !== undefined && anyone))
         return fail(write, json, "task assign", "usage", "`toolroll task assign <id> --runner <name> | --anyone`", EXIT.usage);
-    }
     const moved = store.moveTask({ taskId: id, toRunner: runner ?? null, beforeTaskId: null }, context.clock(), mutationFrom(flags, context.now));
     if (!moved.ok) {
         const message = moved.reason === "unknown-task"
@@ -9918,13 +9623,11 @@ function assignTask(positional, flags, context) {
 async function reopenTask(positional, flags, context) {
     const { store, write, json } = context;
     const id = positional[0];
-    if (id === undefined) {
+    if (id === undefined)
         return fail(write, json, "task reopen", "usage", "`toolroll task reopen <id> --as <you> --token <t>`", EXIT.usage);
-    }
     const acting = await askCredentials(flags, context);
-    if (acting === null) {
+    if (acting === null)
         return fail(write, json, "task reopen", "usage", "reopening takes `--as <you> --token <t>` — who resumed external work is recorded, not asserted", EXIT.usage);
-    }
     const reopened = store.reopenMirror(id, acting.name, context.clock());
     if (!reopened.ok) {
         const said = {
@@ -9957,9 +9660,8 @@ async function syncCommand(flags, context) {
         .listGrants()
         .filter(grant => grant.dispatch === true && grant.remoteRepo != null)
         .filter(grant => only === undefined || grant.repo === resolve(only));
-    if (grants.length === 0) {
+    if (grants.length === 0)
         return fail(write, json, "sync", "no-grant", "no tracker has a dispatch grant — `toolroll enroll <repo> --backend github-issues --github <owner/name> --allow-dispatch` states the terms", EXIT.refused);
-    }
     const adapter = ghDispatchAdapter();
     const reports = [];
     for (const grant of grants) {
@@ -9992,12 +9694,10 @@ async function scopeTask(positional, flags, context) {
     const { store, write, json, now } = context;
     const id = positional[0];
     const goal = text(flags, "goal");
-    if (id === undefined || goal === undefined) {
+    if (id === undefined || goal === undefined)
         return fail(write, json, "task scope", "usage", "`toolroll task scope <id> --goal <what success is> --acceptance <rubric> [--not <text>] [--touches a,b] [--candidate <commit>] [--budget-usd <n>]`", EXIT.usage);
-    }
-    if (store.getTask(id) === null) {
+    if (store.getTask(id) === null)
         return fail(write, json, "task scope", "unknown-task", `no task \`${id}\``, EXIT.refused);
-    }
     // v39: this road bypasses proposeGuarded (a trusted local operator, not a
     // web form re-authenticating staleness) but not the rubric requirement —
     // every scope-producing road signs one, this one included.
@@ -10012,12 +9712,10 @@ async function scopeTask(positional, flags, context) {
     // v69: a prepared commit. The machine checks it out as the attempt and
     // runs the gate and the review; no agent is dispatched for it.
     const candidateGiven = text(flags, "candidate");
-    if (candidateGiven !== undefined && !isCommitSha(candidateGiven)) {
+    if (candidateGiven !== undefined && !isCommitSha(candidateGiven))
         return fail(write, json, "task scope", "usage", "--candidate is the full 40-character commit hash the machine will check out", EXIT.usage);
-    }
-    if (acceptanceParse.criteria.length === 0) {
+    if (acceptanceParse.criteria.length === 0)
         return fail(write, json, "task scope", "acceptance-required", "--acceptance named no valid criteria", EXIT.usage);
-    }
     const touches = (text(flags, "touches") ?? "").split(",").map(one => one.trim()).filter(Boolean);
     const badText = validateScopeText({ goal, outOfScope: text(flags, "not") ?? null, touches });
     if (badText !== null)
@@ -10029,9 +9727,8 @@ async function scopeTask(positional, flags, context) {
         : defaults?.buildPerRunMicrousd != null
             ? defaults.buildPerRunMicrousd / 1_000_000
             : null;
-    if (budgetGiven !== undefined && (!Number.isFinite(Number(budgetGiven)) || Number(budgetGiven) <= 0)) {
+    if (budgetGiven !== undefined && (!Number.isFinite(Number(budgetGiven)) || Number(budgetGiven) <= 0))
         return fail(write, json, "task scope", "bad-budget", "--budget-usd is a positive dollar amount", EXIT.usage);
-    }
     // v24 routing flags (foundations finding 5 — these used to be silently
     // swallowed by the global parser): explicit flags resolve HERE, and an
     // explicit ask that cannot resolve refuses rather than filing unresolved.
@@ -10040,9 +9737,8 @@ async function scopeTask(positional, flags, context) {
     if (routingAsked) {
         const scopeRef = store.lookupRef(id);
         const resolvedRouting = resolveScopeProfile(store, scopeRef?.repo ?? null, scopeRef === null ? undefined : { agentProvider: scopeRef.agentProvider, agentModel: scopeRef.agentModel }, { provider: text(flags, "provider"), model: text(flags, "model"), repairModel: text(flags, "repair-model") });
-        if (!resolvedRouting.ok) {
+        if (!resolvedRouting.ok)
             return fail(write, json, "task scope", resolvedRouting.reason, resolvedRouting.problem, EXIT.usage);
-        }
         explicitProfile = resolvedRouting.profile;
     }
     // C1/M3, the credentialed-CLI road: when --as/--token authenticate the
@@ -10118,9 +9814,8 @@ async function scopeTask(positional, flags, context) {
         }
         return { ok: true, scope: proposed, sealedUnderMode, modeRefusedCoordinator };
     }));
-    if (!filed.ok) {
+    if (!filed.ok)
         return fail(write, json, "task scope", filed.reason, filed.message, EXIT.refused);
-    }
     const scope = filed.scope;
     if (filed.modeRefusedCoordinator === true) {
         return succeed(write, json, "task scope", { scope, approvedUnderMode: false, quarantined: true }, () => [
@@ -10170,12 +9865,10 @@ async function scopeTask(positional, flags, context) {
 async function routeTaskCommand(positional, flags, context) {
     const { store, write, json, clock } = context;
     const id = positional[0];
-    if (id === undefined) {
+    if (id === undefined)
         return fail(write, json, "task route", "usage", "`toolroll task route <id> [--size <s>] [--risky yes|no] [--phase <p> --provider <p> --model <m> | --clear-phase <p>] [--digest <d>] --as <you> --token <t>`", EXIT.usage);
-    }
-    if (store.getTask(id) === null) {
+    if (store.getTask(id) === null)
         return fail(write, json, "task route", "unknown-task", `no task \`${id}\``, EXIT.refused);
-    }
     const ref = store.refFor(BUILT_IN, id);
     const phaseGiven = text(flags, "phase");
     const clearGiven = text(flags, "clear-phase");
@@ -10221,36 +9914,29 @@ async function routeTaskCommand(positional, flags, context) {
     if (!editing)
         return show();
     const acting = await askCredentials(flags, context);
-    if (acting === null) {
+    if (acting === null)
         return fail(write, json, "task route", "usage", "changing a route takes `--as <you> --token <t>` — it reroutes spend", EXIT.usage);
-    }
-    if (sizeGiven !== undefined && !isTaskSize(sizeGiven)) {
+    if (sizeGiven !== undefined && !isTaskSize(sizeGiven))
         return fail(write, json, "task route", "usage", `--size is one of ${TASK_SIZES.join(", ")}`, EXIT.usage);
-    }
-    if (riskyGiven !== undefined && riskyGiven !== "yes" && riskyGiven !== "no") {
+    if (riskyGiven !== undefined && riskyGiven !== "yes" && riskyGiven !== "no")
         return fail(write, json, "task route", "usage", "--risky is yes or no", EXIT.usage);
-    }
     // A person's size outranks the classifier's; an unnamed half keeps what the task has.
     const sizeEdit = sizeGiven === undefined && riskyGiven === undefined ? undefined : {
         size: sizeGiven ?? ref.sizing?.size ?? "medium",
         risky: riskyGiven === undefined ? ref.sizing?.risky ?? false : riskyGiven === "yes",
     };
-    if (phaseGiven !== undefined && clearGiven !== undefined) {
+    if (phaseGiven !== undefined && clearGiven !== undefined)
         return fail(write, json, "task route", "usage", "say --phase … --provider … --model … OR --clear-phase …, not both", EXIT.usage);
-    }
     const phase = phaseGiven ?? clearGiven;
-    if (phase !== undefined && !ROUTE_PHASES.includes(phase)) {
+    if (phase !== undefined && !ROUTE_PHASES.includes(phase))
         return fail(write, json, "task route", "usage", `--${phaseGiven !== undefined ? "phase" : "clear-phase"} is one of ${ROUTE_PHASES.join(", ")}`, EXIT.usage);
-    }
     if (phaseGiven === "review")
         return fail(write, json, "task route", "model-review-retired", "Separate model review has been removed; no reviewer route is needed.", EXIT.refused);
     if (phaseGiven !== undefined) {
-        if (providerGiven === undefined || !isProviderId(providerGiven)) {
+        if (providerGiven === undefined || !isProviderId(providerGiven))
             return fail(write, json, "task route", "usage", `--provider is one of ${PROVIDER_IDS.join(", ")}`, EXIT.usage);
-        }
-        if (modelGiven === undefined || modelGiven === "") {
+        if (modelGiven === undefined || modelGiven === "")
             return fail(write, json, "task route", "usage", "an override names an exact --model — approvals bind exact routing", EXIT.usage);
-        }
         const valid = validateSpec({ provider: providerGiven, model: modelGiven });
         if (!valid.ok)
             return fail(write, json, "task route", "invalid", valid.problem, EXIT.usage);
@@ -10268,9 +9954,8 @@ async function routeTaskCommand(positional, flags, context) {
         ...(digestGiven === undefined ? {} : { expectDigest: digestGiven === "none" ? null : digestGiven }),
     }, clock());
     if (!edited.ok) {
-        if (edited.reason === "unauthenticated") {
+        if (edited.reason === "unauthenticated")
             return fail(write, json, "task route", edited.detail, describeApproveFailure(edited.detail, id), EXIT.refused);
-        }
         const code = { "no-task": "unknown-task", "live-claim": "claimed", changed: "changed", nothing: "usage", "not-configured": "not-configured" };
         return fail(write, json, "task route", code[edited.reason], `${id}: ${edited.detail}`, edited.reason === "nothing" ? EXIT.usage : EXIT.refused);
     }
@@ -10286,18 +9971,15 @@ async function routeTaskCommand(positional, flags, context) {
 async function approveTask(positional, flags, context) {
     const { store, write, json, now } = context;
     const id = positional[0];
-    if (id === undefined) {
+    if (id === undefined)
         return fail(write, json, "task approve", "usage", "which task?", EXIT.usage);
-    }
     const scope = store.getScope(id);
-    if (scope === null) {
+    if (scope === null)
         return fail(write, json, "task approve", "no-scope", `${id} has no scope to approve — write one first`, EXIT.refused);
-    }
     // Console parity (v47): a plan leg changed after a draft asks for a real
     // re-plan — nothing approves the obsolete draft while the planner is owed.
-    if (store.lookupRef(id)?.plan === "requested") {
+    if (store.lookupRef(id)?.plan === "requested")
         return fail(write, json, "task approve", "planning", `${id} is waiting on a planner — approval is blocked until the drafted plan lands`, EXIT.refused);
-    }
     let saw = text(flags, "digest");
     let { name: asWho, token } = credentialsFrom(flags, context);
     let confirmedAloud = false;
@@ -10346,9 +10028,8 @@ async function approveTask(positional, flags, context) {
         // Unconfirmed is "no, not yet" — exit 3 in both modes (round-4 finding 10).
         return EXIT.refused;
     }
-    if (saw === undefined || asWho === undefined || token === undefined) {
+    if (saw === undefined || asWho === undefined || token === undefined)
         return fail(write, json, "task approve", "usage", "approving non-interactively takes --yes --digest <d> --as <you> --token <t>", EXIT.usage);
-    }
     // The digest is named rather than assumed, so an operator who read one scope
     // cannot approve a different one that replaced it while they were reading.
     // The credential is required for a different reason: an agent that can run
@@ -10409,9 +10090,8 @@ export const PROPOSALS_ACTIONS = ["list", "confirm", "dismiss"];
 async function proposalsCommand(positional, flags, context) {
     const { store, write, json, now } = context;
     const [action = "list", idGiven] = positional;
-    if (!PROPOSALS_ACTIONS.includes(action)) {
+    if (!PROPOSALS_ACTIONS.includes(action))
         return fail(write, json, "proposals", "usage", `unknown \`proposals ${action}\` — try ${PROPOSALS_ACTIONS.join(", ")}`, EXIT.usage);
-    }
     store.sweepCoordinatorProposals(now);
     let repos;
     if (context.repoList !== undefined && context.repoList.length > 0) {
@@ -10488,9 +10168,8 @@ async function chatCommand(flags, context) {
     if (flags.has("follow") && flags.has("no-follow"))
         return fail(write, json, "chat", "usage", "Choose --follow or --no-follow.", EXIT.usage);
     const credentials = await askCredentials(flags, context);
-    if (credentials === null) {
+    if (credentials === null)
         return fail(write, json, "chat", "usage", "the lead takes your name and password — `--as <you>` and the hidden prompt; `--token <t>` only where a script must (it lands in shell history)", EXIT.usage);
-    }
     const ceilingGiven = text(flags, "ceiling-usd");
     // The ceiling: the `--repo` list, or the ENROLLED registry beside the
     // database (slice-2 review, finding 5) — never the opened-project history.
@@ -10646,9 +10325,8 @@ async function flowsCommand(positional, flags, context) {
 async function approverCommand(positional, flags, context) {
     const { store, write, json, now } = context;
     const [action, name] = positional;
-    if (action !== undefined && !APPROVER_ACTIONS.includes(action)) {
+    if (action !== undefined && !APPROVER_ACTIONS.includes(action))
         return fail(write, json, "approver", "usage", `unknown \`approver ${action}\` — try ${APPROVER_ACTIONS.join(", ")}`, EXIT.usage);
-    }
     if (action === "list" || action === undefined) {
         const approvers = store.listApprovers();
         if (json) {
@@ -10665,9 +10343,8 @@ async function approverCommand(positional, flags, context) {
         return EXIT.ok;
     }
     if (action === "add") {
-        if (name === undefined) {
+        if (name === undefined)
             return fail(write, json, "approver add", "usage", "an approver needs a name", EXIT.usage);
-        }
         let password = text(flags, "password");
         const bootstrap = store.listApprovers().length === 0;
         let by;
@@ -10680,9 +10357,8 @@ async function approverCommand(positional, flags, context) {
             const chosen = await askHidden(`password for ${name} (enter to auto-generate): `);
             if (chosen !== "") {
                 const again = await askHidden("again: ");
-                if (again !== chosen) {
+                if (again !== chosen)
                     return fail(write, json, "approver add", "mismatch", "the two passwords did not match", EXIT.refused);
-                }
                 password = chosen;
             }
         }
@@ -10719,17 +10395,14 @@ function holdTask(positional, flags, context) {
     const { store, write, json, now } = context;
     const id = positional[0];
     const reason = text(flags, "reason");
-    if (id === undefined || reason === undefined) {
+    if (id === undefined || reason === undefined)
         return fail(write, json, "task hold", "usage", "`toolroll task hold <id> --reason <why>`", EXIT.usage);
-    }
-    if (store.getTask(id) === null) {
+    if (store.getTask(id) === null)
         return fail(write, json, "task hold", "unknown-task", `no task \`${id}\``, EXIT.refused);
-    }
     const untilText = text(flags, "until");
     const until = untilText === undefined ? null : new Date(untilText);
-    if (until !== null && Number.isNaN(until.getTime())) {
+    if (until !== null && Number.isNaN(until.getTime()))
         return fail(write, json, "task hold", "usage", "--until takes a date, e.g. 2026-08-12T09:00:00Z", EXIT.usage);
-    }
     store.hold(store.refFor(BUILT_IN, id).id, reason, until, now, mutationFrom(flags, now));
     return succeed(write, json, "task hold", { id, reason, until: until?.toISOString() ?? null }, () => [
         `${id} is on hold${until === null ? "" : ` until ${until.toISOString()}`}: ${reason}`,
@@ -10740,9 +10413,8 @@ function unholdTask(positional, flags, context) {
     const id = positional[0];
     if (id === undefined)
         return fail(write, json, "task unhold", "usage", "which task?", EXIT.usage);
-    if (store.getTask(id) === null) {
+    if (store.getTask(id) === null)
         return fail(write, json, "task unhold", "unknown-task", `no task \`${id}\``, EXIT.refused);
-    }
     const lifted = store.unhold(store.refFor(BUILT_IN, id).id, mutationFrom(flags, context.now));
     if (!lifted)
         return fail(write, json, "task unhold", "not-held", `${id} was not on hold`, EXIT.refused);
@@ -10762,19 +10434,14 @@ async function stopTaskCommand(positional, flags, context) {
     const id = positional[0];
     const runText = text(flags, "run");
     const runId = Number(runText ?? "");
-    if (id === undefined || runText === undefined || !Number.isInteger(runId) || runId < 1) {
+    if (id === undefined || runText === undefined || !Number.isInteger(runId) || runId < 1)
         return fail(write, json, "task stop", "usage", "`toolroll task stop <id> --run <run-id> --as <you> --token <t>` — the stop names one exact attempt", EXIT.usage);
-    }
     if (store.getTask(id) === null)
         return fail(write, json, "task stop", "unknown-task", `no task \`${id}\``, EXIT.refused);
     const acting = await askCredentials(flags, context);
-    if (acting === null) {
-        return fail(write, json, "task stop", "usage", "stopping takes `--as <you> --token <t>` — it is an operator's act and is recorded against your name", EXIT.usage);
-    }
-    const authenticated = authenticateApprover(store, acting.name, acting.token);
-    if (!authenticated.ok) {
-        return fail(write, json, "task stop", authenticated.reason, describeApproveFailure(authenticated.reason, id), EXIT.refused);
-    }
+    const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
+    if (acting === null || !verified?.ok)
+        return refuseApprover(context, "task stop", verified, "stopping takes `--as <you> --token <t>` — it is an operator's act and is recorded against your name", id);
     const asked = requestTaskStop(store, { taskId: id, runId, by: acting.name, via: "cli" }, clock());
     if (!asked.ok)
         return fail(write, json, "task stop", asked.reason, asked.detail, EXIT.refused, { run: runId });
@@ -10802,26 +10469,20 @@ async function resumeTaskCommand(positional, flags, context) {
     const id = positional[0];
     const runText = text(flags, "run");
     const runId = Number(runText ?? "");
-    if (id === undefined || runText === undefined || !Number.isInteger(runId) || runId < 1) {
+    if (id === undefined || runText === undefined || !Number.isInteger(runId) || runId < 1)
         return fail(write, json, "task resume", "usage", "`toolroll task resume <id> --run <run-id> --as <you> --token <t>` — the resume names the exact stopped attempt", EXIT.usage);
-    }
     if (store.getTask(id) === null)
         return fail(write, json, "task resume", "unknown-task", `no task \`${id}\``, EXIT.refused);
     const acting = await askCredentials(flags, context);
-    if (acting === null) {
-        return fail(write, json, "task resume", "usage", "resuming takes `--as <you> --token <t>` — it lets the next pass spend again", EXIT.usage);
-    }
-    const authenticated = authenticateApprover(store, acting.name, acting.token);
-    if (!authenticated.ok) {
-        return fail(write, json, "task resume", authenticated.reason, describeApproveFailure(authenticated.reason, id), EXIT.refused);
-    }
+    const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
+    if (acting === null || !verified?.ok)
+        return refuseApprover(context, "task resume", verified, "resuming takes `--as <you> --token <t>` — it lets the next pass spend again", id);
     const pool = text(flags, "pool") ?? join(dirname(databasePath(process.env, homedir())), "worktrees");
     const worktrees = new WorktreePool(store, { root: pool });
     const resumed = resumeTaskStop(store, { taskId: id, runId, by: acting.name, via: "cli", occupied: path => worktrees.inUse(path) }, clock());
     if (!resumed.ok) {
-        if (resumed.reason === "review") {
+        if (resumed.reason === "review")
             return fail(write, json, "task resume", "review", `${resumed.detail} — separate model review has been removed; inspect the saved source result`, EXIT.refused, { run: runId });
-        }
         return fail(write, json, "task resume", resumed.reason, resumed.detail, EXIT.refused, { run: runId });
     }
     const control = taskControlOf(store, store.refFor(BUILT_IN, id).id, clock());
@@ -10850,21 +10511,18 @@ async function runCommand(positional, flags, context) {
     const why = text(flags, "why")?.trim();
     if (id === undefined || extra.length > 0 || !/^[1-9]\d*$/.test(id) || !Number.isSafeInteger(runId))
         return fail(write, json, command, "usage", usage, EXIT.usage);
-    if (why === undefined || why === "" || why.length > 300 || /[\x00-\x1f\x7f]/.test(why)) {
+    if (why === undefined || why === "" || why.length > 300 || /[\x00-\x1f\x7f]/.test(why))
         return fail(write, json, command, "usage", "say why in one line with --why (at most 300 characters) — it is kept in the ledger", EXIT.usage);
-    }
     const run = store.getRun(runId);
     if (run === null)
         return fail(write, json, command, "unknown-run", `no run #${runId}`, EXIT.refused);
     const acting = await askCredentials(flags, context);
-    if (acting === null) {
+    if (acting === null)
         return fail(write, json, command, "usage", "settling takes `--as <you> --token <t>` — it is an approver's act and is recorded against your name", EXIT.usage);
-    }
     const authenticated = authenticateApprover(store, acting.name, acting.token);
     const repo = store.refById(run.taskRef)?.repo ?? null;
-    if (!authenticated.ok || !store.accountCanAccess(acting.name, repo)) {
+    if (!authenticated.ok || !store.accountCanAccess(acting.name, repo))
         return fail(write, json, command, "not-an-approver", "that is not an approver for this run's project, or the token does not match", EXIT.refused);
-    }
     const settled = store.settleRunWitnessesByApprover({ runId, by: acting.name, why }, clock());
     if (!settled.ok)
         return fail(write, json, command, settled.reason, settled.detail, EXIT.refused, { run: runId });
@@ -10891,9 +10549,7 @@ async function projectRulesCommand(positional, flags, context) {
     if (positional.length > 1 || repoFlag === undefined)
         return fail(context.write, context.json, command, "usage", "Use project rules --repo <project path> [--not-requester on|off] [--protect none|project] [--protect-paths \"infra/**,migrations/**\"].", EXIT.usage);
     // The projects Settings shows: those with work, and those registered (enrolled) with none yet.
-    const registered = await loadRepos(registryPathOf(context)).catch(() => ({ error: "unreadable" }));
-    const known = [...new Set([...context.store.knownRepos(), ...("error" in registered ? [] : registered.repos)])];
-    const repo = known.find(one => one === repoFlag || one === resolve(repoFlag));
+    const repo = await knownProject(context, repoFlag, { listed: false, canonical: false });
     if (repo === undefined)
         return fail(context.write, context.json, command, "not-found", "That isn't a project Toolroll knows.", EXIT.refused);
     const current = context.store.approvalRules(repo);
@@ -10913,9 +10569,8 @@ async function projectRulesCommand(positional, flags, context) {
         return fail(context.write, context.json, command, "usage", paths.problem, EXIT.usage);
     const acting = await askCredentials(flags, context);
     const verified = acting === null ? null : authenticateApprover(context.store, acting.name, acting.token);
-    if (acting === null || verified === null || !verified.ok || !context.store.isInstanceOperator(acting.name)) {
+    if (acting === null || !verified?.ok || !context.store.isInstanceOperator(acting.name))
         return fail(context.write, context.json, command, "refused", "An instance operator changes approval rules: pass --as and --token (or use the remembered login).", EXIT.refused);
-    }
     const next = {
         notRequester: onOff === undefined ? current.notRequester : onOff === "on",
         protectProject: protect === undefined ? (paths !== null && paths.ok ? false : current.protectProject) : protect === "project",
@@ -10938,12 +10593,9 @@ async function projectNetworkCommand(positional, flags, context) {
             return fail(context.write, context.json, command, "usage", `--${name} is not a project network option.`, EXIT.usage);
     const repoFlag = text(flags, "repo");
     const local = flags.get("local");
-    if (positional.length > 1 || repoFlag === undefined || (flags.has("open") && flags.has("allowlist")) || (local !== undefined && local !== "any" && local !== "none")) {
+    if (positional.length > 1 || repoFlag === undefined || (flags.has("open") && flags.has("allowlist")) || (local !== undefined && local !== "any" && local !== "none"))
         return fail(context.write, context.json, command, "usage", "Use project network --repo <project path> [--allow host,…] [--remove host,…] [--open | --allowlist] [--local any|none].", EXIT.usage);
-    }
-    const registered = await loadRepos(registryPathOf(context)).catch(() => ({ error: "unreadable" }));
-    const known = [...new Set([...context.store.knownRepos(), ...context.store.listProjects().map(one => one.path), ...("error" in registered ? [] : registered.repos)])];
-    const repo = known.find(one => one === repoFlag || one === resolve(repoFlag) || one === canonicalProject(repoFlag));
+    const repo = await knownProject(context, repoFlag, { listed: true, canonical: true });
     if (repo === undefined)
         return fail(context.write, context.json, command, "not-found", "That isn't a project Toolroll knows.", EXIT.refused);
     const current = context.store.projectNetwork(repo);
@@ -10973,9 +10625,8 @@ async function projectNetworkCommand(positional, flags, context) {
         return fail(context.write, context.json, command, "usage", `A project lists at most ${MAX_NETWORK_HOSTS} hosts.`, EXIT.usage);
     const acting = await askCredentials(flags, context);
     const verified = acting === null ? null : credentialApprover(context.store, acting.name, acting.token, repo);
-    if (acting === null || verified === null || !verified.ok || !context.store.accountCanAccess(acting.name, repo)) {
+    if (acting === null || !verified?.ok || !context.store.accountCanAccess(acting.name, repo))
         return fail(context.write, context.json, command, "refused", "An approver for this project changes what its builds may reach, with their password: pass --as and --token.", EXIT.refused);
-    }
     const changed = context.store.setProjectNetwork(repo, next, acting.name, context.clock());
     return succeed(context.write, context.json, command, { repo, before: changed.before, network: changed.after }, () => [
         ...words(changed.after),
@@ -10996,12 +10647,9 @@ async function projectWritesCommand(positional, flags, context) {
             return fail(context.write, context.json, command, "usage", `--${name} is not a project writes option.`, EXIT.usage);
     const repoFlag = text(flags, "repo");
     const wanted = positional[1];
-    if (positional.length > 2 || repoFlag === undefined || (wanted !== undefined && !isWritesMode(wanted))) {
+    if (positional.length > 2 || repoFlag === undefined || (wanted !== undefined && !isWritesMode(wanted)))
         return fail(context.write, context.json, command, "usage", "Use project writes --repo <project path> [workspace | anywhere].", EXIT.usage);
-    }
-    const registered = await loadRepos(registryPathOf(context)).catch(() => ({ error: "unreadable" }));
-    const known = [...new Set([...context.store.knownRepos(), ...context.store.listProjects().map(one => one.path), ...("error" in registered ? [] : registered.repos)])];
-    const repo = known.find(one => one === repoFlag || one === resolve(repoFlag) || one === canonicalProject(repoFlag));
+    const repo = await knownProject(context, repoFlag, { listed: true, canonical: true });
     if (repo === undefined)
         return fail(context.write, context.json, command, "not-found", "That isn't a project Toolroll knows.", EXIT.refused);
     const words = (one) => [`${repo}: builds write ${writesWords(one)}.`];
@@ -11010,9 +10658,8 @@ async function projectWritesCommand(positional, flags, context) {
         return succeed(context.write, context.json, command, { repo, writes: current }, () => words(current));
     const acting = await askCredentials(flags, context);
     const verified = acting === null ? null : credentialApprover(context.store, acting.name, acting.token, repo);
-    if (acting === null || verified === null || !verified.ok || !context.store.accountCanAccess(acting.name, repo)) {
+    if (acting === null || !verified?.ok || !context.store.accountCanAccess(acting.name, repo))
         return fail(context.write, context.json, command, "refused", "An approver for this project changes where its builds may write, with their password: pass --as and --token.", EXIT.refused);
-    }
     const changed = context.store.setProjectWrites(repo, wanted, acting.name, context.clock());
     return succeed(context.write, context.json, command, { repo, before: changed.before, writes: changed.after }, () => [
         ...words(changed.after),
@@ -11025,9 +10672,8 @@ async function unconfinedAgentsCommand(positional, flags, context) {
     const command = "config unconfined-agents";
     const { store, write, json } = context;
     const wanted = positional[1];
-    if (positional.length > 2 || (wanted !== undefined && wanted !== "allow" && wanted !== "refuse")) {
+    if (positional.length > 2 || (wanted !== undefined && wanted !== "allow" && wanted !== "refuse"))
         return fail(write, json, command, "usage", "Use config unconfined-agents [allow|refuse].", EXIT.usage);
-    }
     const words = (allowed) => [allowed
             ? "Builds run even where this machine can't confine them (each such run says \"Not confined\")."
             : "Builds this machine can't confine at the OS don't start."];
@@ -11035,9 +10681,8 @@ async function unconfinedAgentsCommand(positional, flags, context) {
         return succeed(write, json, command, { allowed: store.unfencedAgentsAllowed() }, () => words(store.unfencedAgentsAllowed()));
     const acting = await askCredentials(flags, context);
     const verified = acting === null ? null : credentialApprover(store, acting.name, acting.token);
-    if (acting === null || verified === null || !verified.ok || !store.isInstanceOperator(acting.name)) {
+    if (acting === null || !verified?.ok || !store.isInstanceOperator(acting.name))
         return fail(write, json, command, "refused", "An instance operator changes this, with their password: pass --as and --token.", EXIT.refused);
-    }
     store.setUnfencedAgentsAllowed(wanted === "allow", acting.name, context.clock());
     return succeed(write, json, command, { allowed: wanted === "allow" }, () => words(wanted === "allow"));
 }
@@ -11051,9 +10696,7 @@ async function projectConcurrencyCommand(positional, flags, context) {
     const repoFlag = text(flags, "repo");
     if (positional.length > 2 || repoFlag === undefined)
         return fail(context.write, context.json, command, "usage", "Use project concurrency [<n>] --repo <project path>.", EXIT.usage);
-    const registered = await loadRepos(registryPathOf(context)).catch(() => ({ error: "unreadable" }));
-    const known = [...new Set([...context.store.knownRepos(), ...("error" in registered ? [] : registered.repos)])];
-    const repo = known.find(one => one === repoFlag || one === resolve(repoFlag) || one === canonicalProject(repoFlag));
+    const repo = await knownProject(context, repoFlag, { listed: false, canonical: true });
     if (repo === undefined)
         return fail(context.write, context.json, command, "not-found", "That isn't a project Toolroll knows.", EXIT.refused);
     const workers = context.store.listRunners().filter(one => one.retiredAt === null && one.repos.includes(repo));
@@ -11069,9 +10712,8 @@ async function projectConcurrencyCommand(positional, flags, context) {
         return fail(context.write, context.json, command, "usage", `Builds at once is a whole number from 1 to ${RUNNER_CAPACITY_MAX}.`, EXIT.usage);
     const acting = await askCredentials(flags, context);
     const verified = acting === null ? null : authenticateApprover(context.store, acting.name, acting.token);
-    if (acting === null || verified === null || !verified.ok || !context.store.accountCanAccess(acting.name, repo)) {
+    if (acting === null || !verified?.ok || !context.store.accountCanAccess(acting.name, repo))
         return fail(context.write, context.json, command, "refused", "An approver for this project changes how many tasks build at once: pass --as and --token (or use the remembered login).", EXIT.refused);
-    }
     const changed = saveProjectConcurrency(context.databaseFile, repo, n);
     context.store.recordProjectConcurrency(acting.name, repo, changed.before, changed.after, context.clock());
     context.store.bumpWake();
@@ -11090,12 +10732,9 @@ async function projectChecksCommand(positional, flags, context) {
             return fail(context.write, context.json, command, "usage", `--${name} is not a project checks option.`, EXIT.usage);
     const repoFlag = text(flags, "repo");
     const wanted = flags.get("batch");
-    if (positional.length > 1 || repoFlag === undefined || (wanted !== undefined && wanted !== "on" && wanted !== "off")) {
+    if (positional.length > 1 || repoFlag === undefined || (wanted !== undefined && wanted !== "on" && wanted !== "off"))
         return fail(context.write, context.json, command, "usage", "Use project checks [--batch on|off] --repo <project path>.", EXIT.usage);
-    }
-    const registered = await loadRepos(registryPathOf(context)).catch(() => ({ error: "unreadable" }));
-    const known = [...new Set([...context.store.knownRepos(), ...context.store.listProjects().map(one => one.path), ...("error" in registered ? [] : registered.repos)])];
-    const repo = known.find(one => one === repoFlag || one === resolve(repoFlag) || one === canonicalProject(repoFlag));
+    const repo = await knownProject(context, repoFlag, { listed: true, canonical: true });
     if (repo === undefined)
         return fail(context.write, context.json, command, "not-found", "That isn't a project Toolroll knows.", EXIT.refused);
     const level = projectCheckLevel(context.store, repo).level;
@@ -11109,9 +10748,8 @@ async function projectChecksCommand(positional, flags, context) {
     }
     const acting = await askCredentials(flags, context);
     const verified = acting === null ? null : authenticateApprover(context.store, acting.name, acting.token, repo);
-    if (acting === null || verified === null || !verified.ok || !context.store.accountCanAccess(acting.name, repo)) {
+    if (acting === null || !verified?.ok || !context.store.accountCanAccess(acting.name, repo))
         return fail(context.write, context.json, command, "refused", "An approver for this project changes batch checks: pass --as and --token (or use the remembered login).", EXIT.refused);
-    }
     const on = wanted === "on";
     const changed = setProjectBatchChecks(context.store, repo, on, acting.name, context.clock());
     return succeed(context.write, context.json, command, { repo, batch: on, before: changed.before, changed: changed.changed, windowMinutes: BATCH_WINDOW_MS / 60_000, level }, () => [
@@ -11130,9 +10768,7 @@ async function projectDemoCommand(positional, flags, context) {
     const repoFlag = text(flags, "repo");
     if (positional.length > 2 || repoFlag === undefined)
         return fail(context.write, context.json, command, "usage", "Use project demo [<url>|off] --repo <project path>.", EXIT.usage);
-    const registered = await loadRepos(registryPathOf(context)).catch(() => ({ error: "unreadable" }));
-    const known = [...new Set([...context.store.knownRepos(), ...("error" in registered ? [] : registered.repos)])];
-    const repo = known.find(one => one === repoFlag || one === resolve(repoFlag) || one === canonicalProject(repoFlag));
+    const repo = await knownProject(context, repoFlag, { listed: false, canonical: true });
     if (repo === undefined)
         return fail(context.write, context.json, command, "not-found", "That isn't a project Toolroll knows.", EXIT.refused);
     const words = (url) => url === null ? `${repo}: no demo; scouts screenshot public pages only.` : `${repo}: scouts may also screenshot ${url}.`;
@@ -11146,9 +10782,8 @@ async function projectDemoCommand(positional, flags, context) {
         return fail(context.write, context.json, command, "usage", "The demo is an http or https address without a sign-in, or off.", EXIT.usage);
     const acting = await askCredentials(flags, context);
     const verified = acting === null ? null : authenticateApprover(context.store, acting.name, acting.token);
-    if (acting === null || verified === null || !verified.ok || !context.store.accountCanAccess(acting.name, repo)) {
+    if (acting === null || !verified?.ok || !context.store.accountCanAccess(acting.name, repo))
         return fail(context.write, context.json, command, "refused", "An approver for this project sets its demo: pass --as and --token (or use the remembered login).", EXIT.refused);
-    }
     const changed = saveProjectDemo(context.databaseFile, repo, url);
     context.store.recordProjectDemo(acting.name, repo, changed.before, changed.after, context.clock());
     return succeed(context.write, context.json, command, { repo, before: changed.before, demoUrl: changed.after }, () => [words(changed.after)]);
@@ -11188,9 +10823,8 @@ async function projectDeleteCommand(positional, flags, context) {
     const store = context.store;
     const acting = await askCredentials(flags, context);
     const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
-    if (acting === null || verified === null || !verified.ok || !store.isInstanceOperator(acting.name)) {
+    if (acting === null || !verified?.ok || !store.isInstanceOperator(acting.name))
         return fail(context.write, context.json, command, "refused", "An instance operator deletes projects: pass --as and --token (or use the remembered login).", EXIT.refused);
-    }
     const holdings = projectHoldings(store, repo);
     const running = projectRunning(store, repo, context.clock());
     if (running.length > 0)
@@ -11293,9 +10927,8 @@ async function restoreCommand(file, positional, flags, write, json, now) {
     catch (error) {
         return fail(write, json, command, "failed", `The restore failed: ${describe(error)}. The database is unchanged.`, EXIT.failed);
     }
-    if (!report.ok) {
+    if (!report.ok)
         return fail(write, json, command, report.refusals[0]?.reason ?? "refused", ["Nothing was restored.", ...report.refusals.map(one => `  ${one.words}`)].join("\n"), EXIT.refused, { report });
-    }
     const checked = `schema ${report.schemaVersion}, ledger chain verified (${report.ledger?.entries ?? 0} entries)`;
     return succeed(write, json, command, { report }, () => dryRun
         ? [`Dry run: ${report.file} can be restored (${checked}). Nothing was changed.`]
@@ -11356,9 +10989,8 @@ async function budgetCommand(positional, flags, context) {
     const target = chosen[0];
     const acting = await askCredentials(flags, context);
     const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
-    if (acting === null || verified === null || !verified.ok || !store.isInstanceOperator(acting.name)) {
+    if (acting === null || !verified?.ok || !store.isInstanceOperator(acting.name))
         return fail(context.write, context.json, command, "refused", "An instance operator sets budgets: pass --as and --token (or use the remembered login).", EXIT.refused);
-    }
     const known = target.scope === "installation" || (target.scope === "project" ? store.knownRepos().includes(target.key)
         : target.scope === "person" ? store.accountFacts().some(one => one.name === target.key && one.revokedAt === null)
             : store.handle.prepare("SELECT 1 FROM subagent WHERE id = ?").get(Number(target.key)) !== undefined);
@@ -11389,18 +11021,16 @@ async function notificationsCommand(positional, flags, context) {
             return fail(context.write, context.json, command, "usage", `--${name} is not a notifications option.`, EXIT.usage);
     const usage = "Use notifications quiet, notifications all, notifications digest <HH:MM>|off, notifications screenshots off|first|all, or notifications mute|unmute --repo <project>.";
     const valued = action === "digest" || action === "screenshots";
-    if (extra.length > 0 || (action !== undefined && !["quiet", "all", "digest", "screenshots", "mute", "unmute"].includes(action)) || valued !== (value !== undefined) || (muting && (value !== undefined || text(flags, "repo") === undefined))) {
+    if (extra.length > 0 || (action !== undefined && !["quiet", "all", "digest", "screenshots", "mute", "unmute"].includes(action)) || valued !== (value !== undefined) || (muting && (value !== undefined || text(flags, "repo") === undefined)))
         return fail(context.write, context.json, command, "usage", usage, EXIT.usage);
-    }
     if (action === "screenshots" && !RESULT_SCREENSHOTS.includes(value))
         return fail(context.write, context.json, command, "usage", "Screenshots with results is off, first (the first one) or all (up to 4).", EXIT.usage);
     if (action === "digest" && value !== "off" && !isDigestTime(value))
         return fail(context.write, context.json, command, "usage", "The digest time is HH:MM on a 24-hour clock, like 18:30, or off.", EXIT.usage);
     const acting = await askCredentials(flags, context);
     const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
-    if (acting === null || verified === null || !verified.ok) {
+    if (acting === null || !verified?.ok)
         return fail(context.write, context.json, command, "refused", "Notifications are set per person: pass --as and --token (or use the remembered login).", EXIT.refused);
-    }
     const now = context.clock();
     if (muting) {
         const typed = text(flags, "repo");
@@ -11458,17 +11088,15 @@ async function retentionCommand(positional, flags, context) {
     if (action !== "set")
         return fail(context.write, context.json, command, "usage", "Use retention show, retention preview or retention set <kind> <period>.", EXIT.usage);
     const [kind, period, ...extra] = rest;
-    if (kind === undefined || !isRetentionKind(kind) || period === undefined || extra.length > 0) {
+    if (kind === undefined || !isRetentionKind(kind) || period === undefined || extra.length > 0)
         return fail(context.write, context.json, command, "usage", `Use retention set <${RETENTION_KINDS.map(one => one.kind).join("|")}> <days, like 1d, 90d or 1y, or forever>.`, EXIT.usage);
-    }
     const days = parsePeriod(period);
     if (days === undefined)
         return fail(context.write, context.json, command, "usage", `A period is forever, or ${MIN_DAYS} day to 10 years (1d, 90d, 12w, 1y).`, EXIT.usage);
     const acting = await askCredentials(flags, context);
     const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
-    if (acting === null || verified === null || !verified.ok || !store.isInstanceOperator(acting.name)) {
+    if (acting === null || !verified?.ok || !store.isInstanceOperator(acting.name))
         return fail(context.write, context.json, command, "refused", "An instance operator sets retention: pass --as and --token (or use the remembered login).", EXIT.refused);
-    }
     const periods = store.setRetentionPeriod(kind, days, acting.name, context.clock());
     return succeed(context.write, context.json, command, { periods }, () => [`${label(kind)}: kept ${days === null ? "forever" : `for ${periodWords(days)}`}.`]);
 }
@@ -11757,9 +11385,8 @@ async function policyCommand(positional, flags, context) {
         return fail(context.write, context.json, command, "usage", "Say what to set: --providers, --models, --tools or --ceiling.", EXIT.usage);
     const acting = await askCredentials(flags, context);
     const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
-    if (acting === null || verified === null || !verified.ok || !store.isInstanceOperator(acting.name)) {
+    if (acting === null || !verified?.ok || !store.isInstanceOperator(acting.name))
         return fail(context.write, context.json, command, "refused", "An instance operator sets the policy: pass --as and --token (or use the remembered login).", EXIT.refused);
-    }
     const current = store.orgPolicy();
     const listFlag = (name, now) => {
         if (!flags.has(name))
@@ -11797,9 +11424,8 @@ async function ledgerCommand(positional, flags, context) {
     for (const name of flags.keys())
         if (!allowed.has(name))
             return fail(context.write, context.json, command, "usage", `--${name} is not a ${command} option.`, EXIT.usage);
-    if (extra.length > 0 || (action !== "verify" && action !== "checkpoint" && action !== "export")) {
+    if (extra.length > 0 || (action !== "verify" && action !== "checkpoint" && action !== "export"))
         return fail(context.write, context.json, command, "usage", "Use ledger verify, ledger checkpoint or ledger export --from <day> --to <day>.", EXIT.usage);
-    }
     const store = context.store;
     if (action === "verify") {
         // The command walks the whole chain, every time.
@@ -11819,9 +11445,8 @@ async function ledgerCommand(positional, flags, context) {
     if (action === "checkpoint") {
         const acting = await askCredentials(flags, context);
         const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
-        if (acting === null || verified === null || !verified.ok || !store.isInstanceOperator(acting.name)) {
+        if (acting === null || !verified?.ok || !store.isInstanceOperator(acting.name))
             return fail(context.write, context.json, command, "refused", "An instance operator makes checkpoints: pass --as and --token (or use the remembered login).", EXIT.refused);
-        }
         const made = store.ledgerCheckpoint(acting.name, context.clock());
         if (made === null)
             return fail(context.write, context.json, command, "empty", "The ledger has no entries yet.", EXIT.refused);
@@ -11925,6 +11550,23 @@ function databaseFailure(write, json, command, file, error) {
         return fail(write, json, command, "database", describe(error), EXIT.failed);
     return fail(write, json, command, "database-busy", `The database ${file} stayed busy for ${CONCURRENT_WRITER_WAIT_MS / 1_000} seconds. Wait for the other Toolroll process to finish, then try again.`, EXIT.failed);
 }
+/**
+ * The refusal every password-checked CLI act shares: no name or password given is a usage error with the act's own
+ * hint; a check that failed says why, about `subject`. The check itself stays at each call site.
+ */
+function refuseApprover(context, command, verified, usage, subject) {
+    if (verified === null)
+        return fail(context.write, context.json, command, "usage", usage, EXIT.usage);
+    const reason = verified.ok ? "" : verified.reason;
+    return fail(context.write, context.json, command, reason, describeApproveFailure(reason, subject ?? ""), EXIT.refused);
+}
+/** The project `--repo` names among those Toolroll knows: the database's, the listed projects' (when `listed`) and the
+ * registry's, matched as given, resolved, or (when `canonical`) canonical. */
+async function knownProject(context, repoFlag, match) {
+    const registered = await loadRepos(registryPathOf(context)).catch(() => ({ error: "unreadable" }));
+    const known = [...new Set([...context.store.knownRepos(), ...(match.listed ? context.store.listProjects().map(one => one.path) : []), ...("error" in registered ? [] : registered.repos)])];
+    return known.find(one => one === repoFlag || one === resolve(repoFlag) || (match.canonical && one === canonicalProject(repoFlag)));
+}
 // Last in the file, so the password tripwire's function positions (password-freshness.test.ts) stay as reviewed.
 /** The value flags a verb reads under a global switch's name, for parseOperateArgs. */
 export function ownValueFlags(command, argv) {
@@ -11934,3 +11576,67 @@ export function ownValueFlags(command, argv) {
         return PROJECT_NETWORK_VALUE_FLAGS;
     return undefined;
 }
+// Last in the file, so the password tripwire's function positions (password-freshness.test.ts) stay as reviewed.
+/**
+ * `project check-access --repo <p> [sandboxed|sign-ins|unsandboxed]` (check-access.ts): how far the project's setup
+ * and check commands reach beyond the check fence. Widening is an instance operator's act with a password typed now
+ * (never a remembered sign-in or a single sign-on recheck); any approver for the project may narrow it back to
+ * sandboxed. New scopes seal it; approved ones keep theirs. The ledger keeps before → after.
+ */
+async function projectCheckAccessCommand(positional, flags, context) {
+    const command = "project check-access";
+    const allowed = new Set(["repo", "as", "token", "token-file", "token-env", "db", "json"]);
+    for (const name of flags.keys())
+        if (!allowed.has(name))
+            return fail(context.write, context.json, command, "usage", `--${name} is not a project check-access option.`, EXIT.usage);
+    const repoFlag = text(flags, "repo");
+    const wanted = positional[1];
+    if (positional.length > 2 || repoFlag === undefined || (wanted !== undefined && !isCheckAccess(wanted)))
+        return fail(context.write, context.json, command, "usage", "Use project check-access --repo <project path> [sandboxed | sign-ins | unsandboxed].", EXIT.usage);
+    const repo = await knownProject(context, repoFlag, { listed: true, canonical: true });
+    if (repo === undefined)
+        return fail(context.write, context.json, command, "not-found", "That isn't a project Toolroll knows.", EXIT.refused);
+    const current = context.store.projectCheckAccess(repo);
+    const platform = context.platform ?? process.platform;
+    // How it actually runs here: with no OS fence and unconfined running allowed, without a sandbox whatever is saved; on
+    // a saved sign-ins level (off for now) runs sandboxed. Said, never hidden.
+    const fenced = context.fenceAvailable?.() ?? (macosFenceAvailable() || linuxFenceAvailable());
+    const runsAs = (one) => checkAccessRunsAs(one, { platform, fenced, unconfinedAllowed: context.store.unfencedAgentsAllowed() });
+    const here = runsAs(current);
+    const words = (one) => {
+        if (runsAs(one) === "unsandboxed" && one !== "unsandboxed")
+            return [`${repo}: saved as ${checkAccessWords(one)}, but this machine can't sandbox checks, so they run without a sandbox.`];
+        if (runsAs(one) !== one)
+            return [`${repo}: saved with model and GitHub sign-ins, but its checks run sandboxed: sign-ins can't be shared with checks safely yet.`];
+        const missing = one === "sign-ins" ? signInHostsMissing(context.store.projectNetwork(repo)) : [];
+        return [`${repo}: checks run ${checkAccessWords(one)}.`, ...(one === "sandboxed" ? [] : [CHECK_ACCESS_WARNINGS[one]]),
+            // Never added for it: the operator widens the network separately, with their own password.
+            ...(missing.length === 0 ? [] : [`Model sign-ins need these hosts in this project's network allowlist: ${missing.join(", ")}. Add them with: toolroll project network --repo ${repo} --allow ${missing.join(",")}`])];
+    };
+    if (wanted === undefined)
+        return succeed(context.write, context.json, command, { repo, checkAccess: current, ...(here === current ? {} : { runsAs: here }), ...(here === "sign-ins" ? { missingHosts: signInHostsMissing(context.store.projectNetwork(repo)) } : {}) }, () => words(current));
+    // Not available yet (check-access.ts signInsAvailable): refused before any password is asked for, nothing written.
+    const unavailable = wanted === "sign-ins" ? signInsUnavailableWords(platform) : null;
+    if (unavailable !== null)
+        return fail(context.write, context.json, command, "refused", unavailable, EXIT.refused);
+    const widening = widerThan(wanted, current);
+    const acting = await askCredentials(flags, context);
+    const proved = acting === null ? null : authenticateApprover(context.store, acting.name, acting.token, repo);
+    if (widening) {
+        // Wider reach exposes the operator's own sign-ins or machine: an instance operator, with a password typed for this.
+        if (acting === null || proved === null || !proved.ok || proved.method !== "password-now" || !context.store.isInstanceOperator(acting.name)) {
+            return fail(context.write, context.json, command, "refused", "An instance operator widens what a project's checks reach, with their password typed now: pass --as and --token.", EXIT.refused);
+        }
+    }
+    else if (acting === null || proved === null || !proved.ok || !credentialProof(proved.method) || !context.store.accountCanAccess(acting.name, repo)) {
+        return fail(context.write, context.json, command, "refused", "An approver for this project narrows what its checks reach, with their password: pass --as and --token.", EXIT.refused);
+    }
+    // The level is compared again inside the write: a change made while the password was asked for can't widen it here.
+    const changed = context.store.setProjectCheckAccess(repo, wanted, acting.name, context.clock(), { may: widening ? "widen" : "narrow" });
+    if (changed === null)
+        return fail(context.write, context.json, command, "refused", "The project's check access changed meanwhile, and this would now widen it: an instance operator widens it, with their password typed now.", EXIT.refused);
+    return succeed(context.write, context.json, command, { repo, before: changed.before, checkAccess: changed.after }, () => [
+        ...words(changed.after),
+        "Scopes written from now on use this; scopes already approved keep what they were approved with.",
+    ]);
+}