toolroll 0.9.71 → 0.9.72

package/dist/release.js

@@ -31,6 +31,7 @@
 import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { dirname, join } from "node:path";
+import { personProof } from "./person-proof.js";
 /** The pull-request checks a release waits for, by exact job name (.github/workflows/ci.yml). Every one must have
  * concluded `success` on the gated commit; src/ci-workflow.test.ts holds the workflow to this list. */
 export const REQUIRED_PR_CHECKS = [
@@ -54,6 +55,21 @@ class Stop extends Error {
         this.reason = reason;
     }
 }
+/** The branch moved before the deploy reservation: carry the approval to the new head, or file it for a person. */
+class Restart extends Error {
+    head;
+    constructor(head) {
+        super(`restart at ${head}`);
+        this.head = head;
+    }
+}
+/** Every commit that landed after the approval, in words: the summary and the merge message list them all. */
+export function landedWords(landed) {
+    if (landed.length === 0)
+        return [];
+    return [`Landed after the approval (${landed.length} commit${landed.length === 1 ? "" : "s"}):`,
+        ...landed.map(one => `- ${one.sha.slice(0, 7)}: ${one.files.map(file => `${file.path} (+${file.added} −${file.deleted})`).join(", ")}`)];
+}
 const branchFile = (branch) => branch.replace(/[^A-Za-z0-9._-]+/g, "_");
 export const journalFile = (stateDir, branch) => join(stateDir, "releases", `${branchFile(branch)}.json`);
 export const resumeCommand = (branch, checkout) => `toolroll release ${branch} --repo ${checkout}`;
@@ -98,12 +114,22 @@ export function ownerApproval(gate, digest) {
         return { ok: false, why: "not approved yet" };
     if (digest === null || approval.digest !== digest)
         return { ok: false, why: "the approval is for different scope text" };
+    if (approval.basis === "lead")
+        return { ok: false, why: "approved by the lead, not by a person" };
     if (approval.basis !== "password" && approval.basis !== "chat")
         return { ok: false, why: `approved by ${approval.basis ?? "an unknown road"}, not by a person` };
     if (/ \(AI\)$/.test(approval.by) || /^mode /.test(approval.by) || /^lead\b/.test(approval.by) || approval.by === "routine")
         return { ok: false, why: `approved as ${approval.by}, not by a person` };
     if (approval.role !== "approver" || !approval.active)
         return { ok: false, why: `approved by ${approval.by}, who is not an active approver` };
+    // A person's proof, recorded for these exact bytes (approval policy §1.5): a lead token or a remote API token sealed
+    // through the person's road before the fix said `password` too. A plane that can't say is not a yes.
+    if (approval.person === undefined)
+        return { ok: false, why: "the plane can't show a person gave this approval; update it first" };
+    if (!approval.person.ok)
+        return { ok: false, why: approval.person.why };
+    if (!personProof(approval.person.method))
+        return { ok: false, why: "approved with a machine credential, not by a person" };
     return { ok: true, by: approval.by, at: approval.at };
 }
 /** Every required check present, and every reported check's newest attempt completed successfully. */
@@ -133,6 +159,8 @@ export async function runRelease(options, adapters) {
     const say = adapters.say;
     let journal = null;
     let step = "preflight";
+    let freshApproval = false;
+    let supersededTask = null;
     const save = () => { journal.updatedAt = adapters.now().toISOString(); writeJournal(file, journal); };
     const advance = (next) => { journal.step = next; journal.stopped = null; save(); };
     const intend = (at) => { journal.intents[at] = adapters.now().toISOString(); save(); };
@@ -175,6 +203,8 @@ export async function runRelease(options, adapters) {
             const aside = file.replace(/\.json$/, `.superseded-${adapters.now().toISOString().replace(/[:.]/g, "-")}.json`);
             renameSync(file, aside);
             say(`Kept the earlier release journal at ${aside}.`);
+            freshApproval = journal.needsApproval === true;
+            supersededTask = journal.task.id;
             journal = null;
         }
         if (journal?.step === "done") {
@@ -183,8 +213,28 @@ export async function runRelease(options, adapters) {
         }
         if (!await adapters.github.authenticated())
             throw new Stop("github-auth", "GitHub CLI is not signed in: run `gh auth login`, then rerun.");
-        if (journal === null)
+        if (journal === null) {
             journal = await begin(options, adapters, adapters.now());
+            // The earlier attempt needs a person's fresh approval (a CI failure after its deploy): this one files a task of its
+            // own for the same commit, so the old approval can't carry it.
+            // Only an id that has never existed, numbered after the superseded one: never a task whose approval still stands.
+            if (freshApproval) {
+                const base = journal.task.id;
+                const suffix = supersededTask === null ? null : supersededTask === base ? 1 : supersededTask.startsWith(`${base}-`) ? Number(supersededTask.slice(base.length + 1)) : null;
+                let picked = null;
+                for (let n = suffix !== null && Number.isInteger(suffix) && suffix > 0 ? suffix + 1 : 2; n < 1000; n++) {
+                    const id = `${base}-${n}`;
+                    if (!(await adapters.toolroll.gate(id)).exists) {
+                        picked = id;
+                        break;
+                    }
+                }
+                if (picked === null)
+                    throw new Stop("approval", `No unused task id is left for a fresh approval of ${base}.`);
+                journal.task = { id: picked, scopeDigest: null };
+                journal.freshTask = true;
+            }
+        }
         else
             say(`Resuming the release of ${journal.tag} (${journal.candidate.sha.slice(0, 7)}) at ${journal.step}.`);
         const j = journal;
@@ -201,9 +251,169 @@ export async function runRelease(options, adapters) {
                 throw new Stop("drift", `Pull request #${j.pr} no longer has ${j.candidate.sha.slice(0, 7)} at its head.`);
             return pr;
         };
-        const approved = (gate) => {
+        // ---- one approval per release (release-once.md) -------------------------------------------------------------
+        const rel = adapters.release;
+        let epoch = null;
+        // This invocation's own lease owner (review round 1): two runs of the same journal never share an epoch.
+        const owner = `${j.id}:${randomUUID()}`;
+        /** Take the release's lease (a takeover raises its epoch), then settle every operation still open before any new work. */
+        const hold = async () => {
+            if (rel === undefined || !j.authority)
+                return;
+            const lease = await rel.lease(j.authority.id, owner);
+            if (!lease.ok)
+                throw new Stop("lease", lease.why);
+            epoch = lease.epoch;
+            await reconcile();
+        };
+        const reconcile = async () => {
+            if (rel === undefined || !j.authority)
+                return;
+            for (const op of (await rel.operations(j.authority.id)).filter(one => one.state === "reserved" || one.state === "running" || one.state === "unknown")) {
+                // A started call whose issuer may still be alive may still land (review round 2): nothing is settled for it on
+                // elapsed time. It stays as it is, and a person looks.
+                const inFlight = () => new Stop("operation-in-flight", `An earlier ${op.kind} (operation ${op.id}) was started by a process that may still be running. Nothing was settled: check that process, then rerun.`);
+                if (op.kind === "deploy") {
+                    // Reserved and never started: nothing to undo (a start after this takeover is refused: its epoch moved).
+                    if (op.state === "reserved") {
+                        await rel.finish(op.id, "failed", { detail: "the call never started" }, epoch);
+                        continue;
+                    }
+                    if (await served(adapters, builtHead()) !== null) {
+                        await rel.finish(op.id, "succeeded", { detail: "reconciled: the services run the candidate" }, epoch);
+                        continue;
+                    }
+                    if (!op.issuerGone)
+                        throw inFlight();
+                    if (op.direct) {
+                        // A person's own deploy: its process is gone; its lock, update pause and journal must say nothing is half done.
+                        if (!await adapters.toolroll.deploymentIdle(op.stage))
+                            throw new Stop("deploy-recovery", `A person's deploy of this release (operation ${op.id}) ended without finishing${op.stage === null ? "" : `; its journal is in ${op.stage}`}. Recover it, then rerun.`);
+                        await rel.finish(op.id, "failed", { detail: "reconciled: the deploy's process ended, and nothing is deployed or half done" }, epoch);
+                        continue;
+                    }
+                    await recoverDeploy();
+                    await rel.finish(op.id, "failed", { detail: "reconciled: recovered the previous build" }, epoch);
+                }
+                else {
+                    // The pull request decides an unknown merge: merged from the gated head is a success, whoever issued it.
+                    const pr = await adapters.github.pullRequest(j.github, j.branch);
+                    if (pr?.state === "merged" && pr.number === j.pr && pr.head === op.candidate && pr.mergeCommit !== null)
+                        await rel.finish(op.id, "succeeded", { externalRef: pr.mergeCommit, detail: "reconciled: the pull request is merged from the gated head" }, epoch);
+                    else if (op.state === "reserved")
+                        await rel.finish(op.id, "failed", { detail: "reconciled: the merge never started" }, epoch);
+                    else if (!op.issuerGone)
+                        throw inFlight();
+                    else if (pr?.state === "open" && pr.number === j.pr && pr.head === op.candidate)
+                        await rel.finish(op.id, "failed", { detail: "reconciled: the merge's process ended and the pull request is still open at the gated head" }, epoch);
+                    else
+                        throw new Stop("merge-unknown", `The merge of pull request #${j.pr} can't be reconciled: it is ${pr?.state ?? "gone"}. Check it on GitHub before rerunning.`);
+                }
+            }
+        };
+        /**
+         * Who and what the release is, read again: the repository, the pull request (open, its number, base main) and its
+         * head, and the live-release predicate for the coming action. Before the deploy reservation a moved head restarts
+         * the release for the new commit; after it, it stops, and the new commit needs a person.
+         */
+        const identity = async (action, beforeReservation) => {
+            if (rel === undefined) {
+                await pinned();
+                return;
+            }
+            if (await adapters.repo.github() !== j.github)
+                throw new Stop("drift", `The release's repository is no longer ${j.github}.`);
+            const head = await adapters.repo.remoteHead(j.branch);
+            const pr = await adapters.github.pullRequest(j.github, j.branch);
+            if (pr === null || pr.number !== j.pr || pr.state !== "open")
+                throw new Stop("drift", `Pull request #${j.pr} is no longer the open pull request of ${j.branch}; the release stops.`);
+            if (pr.base !== "main")
+                throw new Stop("drift", `Pull request #${j.pr} now merges into ${pr.base}, not main; the release stops.`);
+            if (head !== j.candidate.sha || pr.head !== j.candidate.sha) {
+                if (beforeReservation && head !== null && pr.head === head)
+                    throw new Restart(head);
+                throw new Stop("drift", `${j.branch} moved from ${j.candidate.sha.slice(0, 7)} to ${head?.slice(0, 7) ?? "nothing"} after the deploy began. The new commit needs a person's approval: run \`toolroll release ${j.branch} --repo ${j.checkout} --new\`.`);
+            }
+            if (j.authority) {
+                const live = await rel.live(j.task.id, action);
+                // Fail closed: once the release has an authority, its task must be one the predicate applies to AND accepts.
+                if (!live.applies || !live.ok)
+                    throw new Stop("release", `Task ${j.task.id} can't ${action === "dispatch" ? "go on" : action}: ${live.applies ? live.why ?? "its release approval doesn't stand" : "it belongs to no release approval this plane can find"}.`);
+                if (epoch !== null && !await rel.renew(j.authority.id, owner, epoch))
+                    throw new Stop("lease", "Another release coordinator took over this release.");
+            }
+        };
+        /** The head moved before the deploy reservation: carry the approval to it, or file it for a person. Nothing kept from
+         * the old step is used afterwards: the journal is rewritten and the state machine runs again. */
+        /**
+         * A pull request check failed after the deploy reservation (Alex, 2026-10-25): the candidate froze at deploy, so the
+         * release needs a person's fresh approval, even for the same commit. It is persisted (the authority stops; the
+         * journal says so) before the release stops; `--new` files the commit for a person again.
+         */
+        const ciFailedAfterDeploy = async (what) => {
+            j.needsApproval = true;
+            save();
+            // Fail closed: the authority must have stopped; otherwise its approval could still carry the commit.
+            if (rel !== undefined && j.authority && (epoch === null || !await rel.needsApproval(j.authority.id, "a pull request check failed after the deploy", epoch))) {
+                throw new Stop("lease", `${what}. Nothing was merged, but this release's approval couldn't be stopped (another coordinator holds it, or a merge is reserved). Check it with \`toolroll release ${j.branch} --repo ${j.checkout}\` before going on.`);
+            }
+            throw new Stop("ci-failed", `${what}. Nothing was merged. The deploy had already started, so this commit needs a person's approval again: run \`toolroll release ${j.branch} --repo ${j.checkout} --new\`.`);
+        };
+        /** identity(), on a plane that keeps release authority; a legacy plane keeps the old rules. */
+        const watch = async (action) => { if (rel !== undefined)
+            await identity(action, true); };
+        const restart = async (head) => {
+            const tree = await adapters.repo.tree(head);
+            if (rel !== undefined && j.authority && epoch !== null) {
+                say(`  ${j.branch} moved to ${head.slice(0, 7)}: checking whether the approval carries`);
+                const carried = await rel.carry(j.authority.id, head, randomUUID(), epoch);
+                if (carried.ok) {
+                    const view = await rel.authority(carried.taskId);
+                    j.candidate = { sha: head, tree };
+                    j.task = { id: carried.taskId, scopeDigest: (await adapters.toolroll.gate(carried.taskId)).scopeDigest };
+                    j.check = null;
+                    j.completion = null;
+                    j.landed = view?.landed ?? j.landed ?? [];
+                    delete j.intents.check;
+                    delete j.intents.complete;
+                    j.step = "check";
+                    j.stopped = null;
+                    save();
+                    say(`  carried the approval to ${head.slice(0, 7)} (task ${carried.taskId})`);
+                    return;
+                }
+                say(`  ${head.slice(0, 7)} needs a person's approval: ${carried.message}`);
+            }
+            else
+                say(`  ${j.branch} moved to ${head.slice(0, 7)}: filing it for approval`);
+            j.candidate = { sha: head, tree };
+            j.task = { id: gateTaskId(j.packageVersion, head), scopeDigest: null };
+            j.approval = null;
+            j.check = null;
+            j.completion = null;
+            j.authority = null;
+            epoch = null;
+            delete j.intents.gate;
+            delete j.intents.check;
+            delete j.intents.complete;
+            j.step = "gate";
+            j.stopped = null;
+            save();
+        };
+        /**
+         * The task is approved for `action`: a release task (a carried commit, or any task once the release has an
+         * authority) only when the live-release predicate applies to it AND accepts it — fail closed, whatever its own seal
+         * says. Anything else needs the owner's own approval of these exact words (which a carried seal never is).
+         */
+        const approved = async (gate, action = "dispatch") => {
             if (gate.candidate !== j.candidate.sha || gate.scopeDigest !== j.task.scopeDigest)
                 throw new Stop("scope-changed", `Task ${j.task.id}'s candidate or scope changed after approval.`);
+            if (rel !== undefined && (j.authority || gate.approval?.basis === "carried")) {
+                const live = await rel.live(j.task.id, action);
+                if (live.applies && live.ok)
+                    return;
+                throw new Stop("release", `Task ${j.task.id} can't ${action === "dispatch" ? "go on" : action}: ${live.applies ? live.why ?? "its release approval doesn't stand" : "it belongs to no release approval this plane can find"}.`);
+            }
             const owner = ownerApproval(gate, j.task.scopeDigest);
             if (!owner.ok)
                 throw new Stop("approval", `Task ${j.task.id}: ${owner.why}. An active approver must approve the release scope.`);
@@ -216,277 +426,385 @@ export async function runRelease(options, adapters) {
         };
         /** The commit the passing build recorded: what the deployed runtime is stamped with. */
         const builtHead = () => j.check?.head ?? j.candidate.sha;
-        const checked = (gate) => {
-            approved(gate);
+        const checked = async (gate, action = "dispatch") => {
+            await approved(gate, action);
             if (gate.result?.head !== builtHead() || gate.result?.receipt !== j.check?.receipt)
                 throw new Stop("drift", `Task ${j.task.id}'s result changed since its check passed.`);
             fullCheck(gate);
         };
+        if (j.needsApproval === true)
+            throw new Stop("ci-failed", `A pull request check failed after the deploy, so ${j.candidate.sha.slice(0, 7)} needs a person's approval again: run \`toolroll release ${j.branch} --repo ${j.checkout} --new\`.`);
+        // A resumed release that already has an authority takes its lease and settles every open operation first.
+        await hold();
         while (j.step !== "done") {
             step = j.step;
             say(`• ${j.step}`);
-            switch (j.step) {
-                case "gate": {
-                    await pinned();
-                    const existing = await adapters.toolroll.gate(j.task.id);
-                    if (existing.exists) {
-                        if (existing.candidate !== j.candidate.sha)
-                            throw new Stop("conflict", `Task ${j.task.id} exists for a different commit (${existing.candidate?.slice(0, 7) ?? "none"}).`);
-                        j.task.scopeDigest = existing.scopeDigest;
+            try {
+                switch (j.step) {
+                    case "gate": {
+                        await pinned();
+                        // The same commit's earlier gate belongs to a release that no longer stands (a CI failure after its deploy, a
+                        // revoke): a fresh task asks a person again, and their yes opens a new generation.
+                        if (rel !== undefined && j.freshTask !== true) {
+                            const base = gateTaskId(j.packageVersion, j.candidate.sha);
+                            for (let n = 1; n < 50; n++) {
+                                const id = n === 1 ? base : `${base}-${n}`;
+                                const live = await rel.live(id, "dispatch");
+                                if (!live.applies || live.ok) {
+                                    if (j.task.id !== id) {
+                                        j.task = { id, scopeDigest: null };
+                                        save();
+                                    }
+                                    break;
+                                }
+                            }
+                        }
+                        const existing = await adapters.toolroll.gate(j.task.id);
+                        // A fresh task this journal never filed has appeared under its id: it isn't ours, and isn't a fresh approval.
+                        if (existing.exists && j.freshTask === true && j.intents.gate === undefined)
+                            throw new Stop("approval", `Task ${j.task.id} appeared before this release filed it; rerun with --new.`);
+                        if (existing.exists) {
+                            if (existing.candidate !== j.candidate.sha)
+                                throw new Stop("conflict", `Task ${j.task.id} exists for a different commit (${existing.candidate?.slice(0, 7) ?? "none"}).`);
+                            j.task.scopeDigest = existing.scopeDigest;
+                        }
+                        else {
+                            intend("gate");
+                            await adapters.repo.sync(j.branch);
+                            const filed = await adapters.toolroll.fileGate({
+                                taskId: j.task.id, title: `Release ${j.packageVersion}`, checkout: j.checkout, candidate: j.candidate.sha,
+                                goal: `Verify ${j.packageName} ${j.packageVersion} (${j.branch} at ${j.candidate.sha}) passes the approved release check before it is deployed, merged, tagged and published.`,
+                                acceptance: "The approved release check passes on the candidate commit|check",
+                                ...(rel === undefined ? {} : { release: { version: j.packageVersion, pr: j.pr, branch: j.branch, noCarry: options.noCarry === true } }),
+                            });
+                            j.task.scopeDigest = filed.scopeDigest;
+                        }
+                        advance("approval");
+                        break;
                     }
-                    else {
-                        intend("gate");
-                        await adapters.repo.sync(j.branch);
-                        const filed = await adapters.toolroll.fileGate({
-                            taskId: j.task.id, title: `Release ${j.packageVersion}`, checkout: j.checkout, candidate: j.candidate.sha,
-                            goal: `Verify ${j.packageName} ${j.packageVersion} (${j.branch} at ${j.candidate.sha}) passes the approved release check before it is deployed, merged, tagged and published.`,
-                            acceptance: "The approved release check passes on the candidate commit|check",
+                    case "approval": {
+                        say(`  The release scope needs your approval: \`toolroll task approve ${j.task.id} --digest ${j.task.scopeDigest}\`, or open the task in the console.`);
+                        const approved = await waitFor("approval", `a person to approve task ${j.task.id}`, async () => {
+                            await watch("dispatch");
+                            const gate = await adapters.toolroll.gate(j.task.id);
+                            if (gate.scopeDigest !== j.task.scopeDigest)
+                                throw new Stop("scope-changed", `The scope of ${j.task.id} changed after it was filed; the release only runs on the scope it filed.`);
+                            const owner = ownerApproval(gate, j.task.scopeDigest);
+                            if (!owner.ok && gate.approval !== null && owner.why !== "the approval is for different scope text")
+                                throw new Stop("approval", `Task ${j.task.id} was ${owner.why}; the release needs a person to approve it.`);
+                            return owner.ok ? owner : null;
                         });
-                        j.task.scopeDigest = filed.scopeDigest;
+                        j.approval = { by: approved.by, at: approved.at };
+                        say(`  approved by ${approved.by}`);
+                        // The person's yes to release terms opened the release's authority: hold its lease from here on.
+                        if (rel !== undefined) {
+                            const view = await rel.authority(j.task.id);
+                            if (view !== null) {
+                                j.authority = { id: view.id, generation: view.generation };
+                                j.landed = view.landed;
+                                save();
+                                await hold();
+                                say(`  later test-only commits on #${j.pr} carry this approval (release ${view.id})`);
+                            }
+                        }
+                        advance("check");
+                        break;
                     }
-                    advance("approval");
-                    break;
-                }
-                case "approval": {
-                    say(`  The release scope needs your approval: \`toolroll task approve ${j.task.id} --digest ${j.task.scopeDigest}\`, or open the task in the console.`);
-                    const approved = await waitFor("approval", `a person to approve task ${j.task.id}`, async () => {
-                        const gate = await adapters.toolroll.gate(j.task.id);
-                        if (gate.scopeDigest !== j.task.scopeDigest)
-                            throw new Stop("scope-changed", `The scope of ${j.task.id} changed after it was filed; the release only runs on the scope it filed.`);
-                        const owner = ownerApproval(gate, j.task.scopeDigest);
-                        if (!owner.ok && gate.approval !== null && owner.why !== "the approval is for different scope text")
-                            throw new Stop("approval", `Task ${j.task.id} was ${owner.why}; the release needs a person to approve it.`);
-                        return owner.ok ? owner : null;
-                    });
-                    j.approval = { by: approved.by, at: approved.at };
-                    say(`  approved by ${approved.by}`);
-                    advance("check");
-                    break;
-                }
-                case "check": {
-                    const result = await waitFor("check", `the release check of ${j.candidate.sha.slice(0, 7)}`, async () => {
+                    case "check": {
+                        const result = await waitFor("check", `the release check of ${j.candidate.sha.slice(0, 7)}`, async () => {
+                            // Before acting on an old candidate's failure: a moved head restarts the release first.
+                            await watch("dispatch");
+                            const gate = await adapters.toolroll.gate(j.task.id);
+                            await approved(gate);
+                            if (gate.failed !== null)
+                                throw new Stop("check-failed", `The release build of ${j.task.id} failed: ${gate.failed}. Fix it and release the new commit with --new.`);
+                            if (gate.result === null || gate.result.check === "running" || gate.result.check === "pending")
+                                return null;
+                            // The build records a prepared candidate as a commit of its own (its message names the task): it must hold
+                            // exactly the candidate's tree, or it isn't the release.
+                            const head = gate.result.head;
+                            if (head === null || (head !== j.candidate.sha && await adapters.repo.tree(head) !== await adapters.repo.tree(j.candidate.sha))) {
+                                throw new Stop("drift", `The release result is for ${head?.slice(0, 7) ?? "no commit"}, which doesn't hold exactly ${j.candidate.sha.slice(0, 7)}'s files.`);
+                            }
+                            fullCheck(gate);
+                            if (gate.result.worktree === null)
+                                throw new Stop("worktree", `Run ${gate.result.run} names no checkout to deploy from.`);
+                            return { run: gate.result.run, receipt: gate.result.receipt, worktree: gate.result.worktree, head };
+                        });
+                        j.check = result;
+                        say(`  run ${result.run} passed on ${j.candidate.sha.slice(0, 7)}`);
+                        advance("complete");
+                        break;
+                    }
+                    case "complete": {
+                        await watch("complete");
+                        const check = j.check;
                         const gate = await adapters.toolroll.gate(j.task.id);
-                        approved(gate);
-                        if (gate.failed !== null)
-                            throw new Stop("check-failed", `The release build of ${j.task.id} failed: ${gate.failed}. Fix it and release the new commit with --new.`);
-                        if (gate.result === null || gate.result.check === "running" || gate.result.check === "pending")
-                            return null;
-                        // The build records a prepared candidate as a commit of its own (its message names the task): it must hold
-                        // exactly the candidate's tree, or it isn't the release.
-                        const head = gate.result.head;
-                        if (head === null || (head !== j.candidate.sha && await adapters.repo.tree(head) !== await adapters.repo.tree(j.candidate.sha))) {
-                            throw new Stop("drift", `The release result is for ${head?.slice(0, 7) ?? "no commit"}, which doesn't hold exactly ${j.candidate.sha.slice(0, 7)}'s files.`);
+                        await checked(gate, "complete");
+                        if (gate.completion?.digest !== check.receipt) {
+                            intend("complete");
+                            const done = await adapters.toolroll.complete(j.task.id, check.receipt);
+                            if (!done.ok)
+                                throw new Stop("complete", `Couldn't mark task ${j.task.id} complete: ${done.message} Mark that exact result complete in the console, then rerun.`);
                         }
-                        fullCheck(gate);
-                        if (gate.result.worktree === null)
-                            throw new Stop("worktree", `Run ${gate.result.run} names no checkout to deploy from.`);
-                        return { run: gate.result.run, receipt: gate.result.receipt, worktree: gate.result.worktree, head };
-                    });
-                    j.check = result;
-                    say(`  run ${result.run} passed on ${j.candidate.sha.slice(0, 7)}`);
-                    advance("complete");
-                    break;
-                }
-                case "complete": {
-                    const check = j.check;
-                    const gate = await adapters.toolroll.gate(j.task.id);
-                    checked(gate);
-                    if (gate.completion?.digest !== check.receipt) {
-                        intend("complete");
-                        const done = await adapters.toolroll.complete(j.task.id, check.receipt);
-                        if (!done.ok)
-                            throw new Stop("complete", `Couldn't mark task ${j.task.id} complete: ${done.message} Mark that exact result complete in the console, then rerun.`);
+                        const after = await adapters.toolroll.gate(j.task.id);
+                        if (after.completion?.digest !== check.receipt)
+                            throw new Stop("complete", `Task ${j.task.id} is not marked complete for result ${check.receipt.slice(0, 12)}.`);
+                        j.completion = { actor: after.completion.actor, at: after.completion.at };
+                        advance("quiet");
+                        break;
                     }
-                    const after = await adapters.toolroll.gate(j.task.id);
-                    if (after.completion?.digest !== check.receipt)
-                        throw new Stop("complete", `Task ${j.task.id} is not marked complete for result ${check.receipt.slice(0, 12)}.`);
-                    j.completion = { actor: after.completion.actor, at: after.completion.at };
-                    advance("quiet");
-                    break;
-                }
-                case "quiet": {
-                    await waitFor("quiet", "running work to finish", async () => {
-                        const busy = await adapters.toolroll.busy();
-                        return busy.running === 0 ? true : null;
-                    });
-                    advance("deploy");
-                    break;
-                }
-                case "deploy": {
-                    const check = j.check;
-                    await recoverDeploy();
-                    checked(await adapters.toolroll.gate(j.task.id));
-                    // A deployment that finished but whose answer was lost: the services already run a runtime of this commit.
-                    let runtime = await served(adapters, builtHead());
-                    if (runtime === null) {
-                        await pinned();
-                        j.deployAttempt = { stage: join(options.stateDir, "staged-upgrades", `browser-${j.candidate.sha.slice(0, 7)}-${randomUUID()}`) };
-                        intend("deploy");
-                        const result = await adapters.toolroll.deploy({ run: check.run, worktree: check.worktree, stage: j.deployAttempt.stage });
-                        if (!result.ok)
-                            throw deployStop("deploy", `The deployment of run ${check.run} stopped: ${result.message}`, result);
-                        if (!/[\\/]dist$/.test(result.runtime))
-                            throw new Stop("deploy", `The deployment named ${result.runtime} as its runtime, which is not a dist folder.`);
-                        runtime = result.runtime;
-                        // Saved at once: everything after this (relinking, a rerun) uses the runtime the deployer named.
-                        j.deploy = { runtime, at: adapters.now().toISOString() };
-                        save();
+                    case "quiet": {
+                        await waitFor("quiet", "running work to finish", async () => {
+                            await watch("complete");
+                            const busy = await adapters.toolroll.busy();
+                            return busy.running === 0 ? true : null;
+                        });
+                        advance("deploy");
+                        break;
                     }
-                    const want = runtime;
-                    await waitFor("deploy", `the console and worker to run the gated commit from ${want}`, async () => (await served(adapters, builtHead())) === want ? true : null);
-                    j.deploy = { runtime: want, at: j.deploy?.runtime === want ? j.deploy.at : adapters.now().toISOString() };
-                    j.deployAttempt = null;
-                    delete j.intents.deploy;
-                    say(`  the service runs ${j.packageVersion} from ${want}`);
-                    advance("link");
-                    break;
-                }
-                case "link": {
-                    const runtime = j.deploy.runtime;
-                    if (await served(adapters, builtHead()) !== runtime)
-                        throw new Stop("drift", `The console and worker no longer run ${runtime}; the CLI names were not moved.`);
-                    if (j.links === undefined || j.links === null) {
-                        j.links = await adapters.toolroll.cliLinks();
-                        intend("link");
+                    case "deploy": {
+                        const check = j.check;
+                        await recoverDeploy();
+                        await checked(await adapters.toolroll.gate(j.task.id), "deploy");
+                        // A deployment that finished but whose answer was lost: the services already run a runtime of this commit.
+                        let runtime = await served(adapters, builtHead());
+                        // Already running this candidate (a new generation after a CI failure, or a lost answer): the release still
+                        // reserves its deploy, so its merge has a deploy to stand on.
+                        if (runtime !== null && rel !== undefined && j.authority && epoch !== null) {
+                            const authority = await rel.authority(j.task.id);
+                            if (authority !== null && authority.state === "open") {
+                                await watch("deploy");
+                                const reserved = await rel.reserve({ authority: j.authority.id, kind: "deploy", taskId: j.task.id, candidate: j.candidate.sha, epoch });
+                                if (!reserved.ok)
+                                    throw new Stop("release", `The deploy couldn't be reserved: ${reserved.why}`);
+                                if (!await rel.start(reserved.operation, epoch))
+                                    throw new Stop("lease", "Another release coordinator took over this release.");
+                                await rel.finish(reserved.operation, "succeeded", { detail: "the services already run this candidate" }, epoch);
+                            }
+                        }
+                        if (runtime === null) {
+                            // The last moment a moved head restarts; then the deploy reservation freezes the candidate in the store.
+                            await watch("deploy");
+                            await pinned();
+                            let operation, secret = "";
+                            if (rel !== undefined && j.authority && epoch !== null) {
+                                const reserved = await rel.reserve({ authority: j.authority.id, kind: "deploy", taskId: j.task.id, candidate: j.candidate.sha, epoch });
+                                if (!reserved.ok)
+                                    throw new Stop("release", `The deploy couldn't be reserved: ${reserved.why}`);
+                                operation = reserved.operation;
+                                secret = reserved.secret ?? "";
+                                j.operations = { ...j.operations, deploy: operation };
+                                save();
+                            }
+                            j.deployAttempt = { stage: join(options.stateDir, "staged-upgrades", `browser-${j.candidate.sha.slice(0, 7)}-${randomUUID()}`) };
+                            intend("deploy");
+                            // The issuing fence, immediately before the deploy is spawned (review round 2): lease, epoch and the live
+                            // release again, in one transaction that marks the operation as issued by this process.
+                            if (operation !== undefined && !await rel.start(operation, epoch))
+                                throw new Stop("lease", "Another release coordinator took over this release; the deploy didn't start.");
+                            const result = await adapters.toolroll.deploy({ run: check.run, worktree: check.worktree, stage: j.deployAttempt.stage, ...(operation === undefined ? {} : { operation: { id: operation, secret } }) });
+                            if (operation !== undefined)
+                                await rel.finish(operation, result.ok ? "succeeded" : "failed", { detail: result.ok ? result.runtime : result.message.slice(0, 500) }, epoch);
+                            if (!result.ok)
+                                throw deployStop("deploy", `The deployment of run ${check.run} stopped: ${result.message}`, result);
+                            if (!/[\\/]dist$/.test(result.runtime))
+                                throw new Stop("deploy", `The deployment named ${result.runtime} as its runtime, which is not a dist folder.`);
+                            runtime = result.runtime;
+                            // Saved at once: everything after this (relinking, a rerun) uses the runtime the deployer named.
+                            j.deploy = { runtime, at: adapters.now().toISOString() };
+                            save();
+                        }
+                        const want = runtime;
+                        await waitFor("deploy", `the console and worker to run the gated commit from ${want}`, async () => (await served(adapters, builtHead())) === want ? true : null);
+                        j.deploy = { runtime: want, at: j.deploy?.runtime === want ? j.deploy.at : adapters.now().toISOString() };
+                        j.deployAttempt = null;
+                        delete j.intents.deploy;
+                        say(`  the service runs ${j.packageVersion} from ${want}`);
+                        advance("link");
+                        break;
                     }
-                    try {
-                        await adapters.toolroll.switchLinks(j.links, join(runtime, "bin.js"), j.packageVersion);
+                    case "link": {
+                        const runtime = j.deploy.runtime;
+                        if (await served(adapters, builtHead()) !== runtime)
+                            throw new Stop("drift", `The console and worker no longer run ${runtime}; the CLI names were not moved.`);
+                        if (j.links === undefined || j.links === null) {
+                            j.links = await adapters.toolroll.cliLinks();
+                            intend("link");
+                        }
+                        try {
+                            await adapters.toolroll.switchLinks(j.links, join(runtime, "bin.js"), j.packageVersion);
+                        }
+                        catch (error) {
+                            throw new Stop("link", `The CLI names were not moved to ${runtime} (they point where they did): ${error.message}. The service already runs the new build; rerun to try again.`);
+                        }
+                        const everywhere = await deployed(adapters, builtHead());
+                        if (everywhere !== runtime)
+                            throw new Stop("mixed-runtime", `After relinking, the console, worker and both CLI names don't all run ${runtime} at ${j.candidate.sha.slice(0, 7)}.`);
+                        say(`  toolroll and standing-orders run ${join(runtime, "bin.js")}`);
+                        advance("ci");
+                        break;
                     }
-                    catch (error) {
-                        throw new Stop("link", `The CLI names were not moved to ${runtime} (they point where they did): ${error.message}. The service already runs the new build; rerun to try again.`);
+                    case "ci": {
+                        await waitFor("ci", `the pull request checks on ${j.candidate.sha.slice(0, 7)}`, async () => {
+                            await pinned();
+                            const verdict = checksVerdict(await adapters.github.checks(j.github, j.candidate.sha), REQUIRED_PR_CHECKS);
+                            if (verdict.state === "failed")
+                                await ciFailedAfterDeploy(`Pull request checks failed on ${j.candidate.sha.slice(0, 7)}: ${verdict.failed.join(", ")}`);
+                            return verdict.state === "passed" ? true : null;
+                        });
+                        j.ci = { checks: [...REQUIRED_PR_CHECKS], at: adapters.now().toISOString() };
+                        advance("merge");
+                        break;
                     }
-                    const everywhere = await deployed(adapters, builtHead());
-                    if (everywhere !== runtime)
-                        throw new Stop("mixed-runtime", `After relinking, the console, worker and both CLI names don't all run ${runtime} at ${j.candidate.sha.slice(0, 7)}.`);
-                    say(`  toolroll and standing-orders run ${join(runtime, "bin.js")}`);
-                    advance("ci");
-                    break;
-                }
-                case "ci": {
-                    await waitFor("ci", `the pull request checks on ${j.candidate.sha.slice(0, 7)}`, async () => {
-                        await pinned();
-                        const verdict = checksVerdict(await adapters.github.checks(j.github, j.candidate.sha), REQUIRED_PR_CHECKS);
-                        if (verdict.state === "failed")
-                            throw new Stop("ci-failed", `Pull request checks failed on ${j.candidate.sha.slice(0, 7)}: ${verdict.failed.join(", ")}. Nothing was merged. Rerun the failed job on GitHub, then rerun this command.`);
-                        return verdict.state === "passed" ? true : null;
-                    });
-                    j.ci = { checks: [...REQUIRED_PR_CHECKS], at: adapters.now().toISOString() };
-                    advance("merge");
-                    break;
-                }
-                case "merge": {
-                    const pr = await adapters.github.pullRequest(j.github, j.branch);
-                    if (pr?.state === "merged" && pr.number === j.pr && pr.mergeCommit !== null) {
-                        if (pr.head !== j.candidate.sha || pr.base !== "main")
-                            throw new Stop("drift", `Merged pull request #${j.pr} does not match the gated commit and base.`);
-                        if (j.intents.merge === undefined)
+                    case "merge": {
+                        const pr = await adapters.github.pullRequest(j.github, j.branch);
+                        if (pr?.state === "merged" && pr.number === j.pr && pr.mergeCommit !== null) {
+                            if (pr.head !== j.candidate.sha || pr.base !== "main")
+                                throw new Stop("drift", `Merged pull request #${j.pr} does not match the gated commit and base.`);
+                            if (j.intents.merge === undefined)
+                                intend("merge");
+                            j.merge = { sha: pr.mergeCommit, tree: null };
+                        }
+                        else {
+                            // After the deploy reservation a moved head, a changed pull request or a stopped release stops it here.
+                            if (rel !== undefined && j.authority)
+                                await identity("merge", false);
+                            await pinned();
+                            // A squash merge only reproduces the gated tree when main hasn't moved past the branch's base.
+                            await adapters.repo.sync(j.branch);
+                            const main = await adapters.repo.mainHead();
+                            if (!await adapters.repo.contains(j.candidate.sha, main))
+                                throw new Stop("base-moved", `main moved to ${main.slice(0, 7)}, which ${j.branch} doesn't contain, so the merge wouldn't be the gated tree. Nothing was merged: update the branch and release the new commit with --new.`);
+                            // The checks again, at the moment of merging: a rerun that failed since must not merge.
+                            const verdict = checksVerdict(await adapters.github.checks(j.github, j.candidate.sha), REQUIRED_PR_CHECKS);
+                            if (verdict.state !== "passed")
+                                await ciFailedAfterDeploy(`Pull request checks are no longer all passing on ${j.candidate.sha.slice(0, 7)}`);
+                            let operation;
+                            if (rel !== undefined && j.authority && epoch !== null) {
+                                const reserved = await rel.reserve({ authority: j.authority.id, kind: "merge", taskId: j.task.id, candidate: j.candidate.sha, epoch });
+                                if (!reserved.ok)
+                                    throw new Stop("release", `The merge couldn't be reserved: ${reserved.why}`);
+                                operation = reserved.operation;
+                                j.operations = { ...j.operations, merge: operation };
+                                save();
+                            }
                             intend("merge");
-                        j.merge = { sha: pr.mergeCommit, tree: null };
+                            const message = landedWords(j.landed ?? []).join("\n");
+                            // The issuing fence, immediately before gh is spawned (review round 2).
+                            if (operation !== undefined && !await rel.start(operation, epoch))
+                                throw new Stop("lease", "Another release coordinator took over this release; the merge didn't start.");
+                            let merged;
+                            try {
+                                merged = await adapters.github.merge(j.github, j.pr, j.candidate.sha, ...(message === "" ? [] : [message]));
+                            }
+                            catch (error) {
+                                if (operation !== undefined)
+                                    await rel.finish(operation, "unknown", { detail: String(error?.message ?? error).slice(0, 500) }, epoch);
+                                throw error;
+                            }
+                            if (operation !== undefined)
+                                await rel.finish(operation, "succeeded", { externalRef: merged }, epoch);
+                            j.merge = { sha: merged, tree: null };
+                        }
+                        save();
+                        // This also runs after discovering a merge whose response was lost. Never delete a reused branch.
+                        await adapters.repo.deleteBranch(j.branch, j.candidate.sha);
+                        advance("tree");
+                        break;
                     }
-                    else {
-                        await pinned();
-                        // A squash merge only reproduces the gated tree when main hasn't moved past the branch's base.
+                    case "tree": {
+                        const merge = j.merge;
                         await adapters.repo.sync(j.branch);
-                        const main = await adapters.repo.mainHead();
-                        if (!await adapters.repo.contains(j.candidate.sha, main))
-                            throw new Stop("base-moved", `main moved to ${main.slice(0, 7)}, which ${j.branch} doesn't contain, so the merge wouldn't be the gated tree. Nothing was merged: update the branch and release the new commit with --new.`);
-                        // The checks again, at the moment of merging: a rerun that failed since must not merge.
-                        const verdict = checksVerdict(await adapters.github.checks(j.github, j.candidate.sha), REQUIRED_PR_CHECKS);
-                        if (verdict.state !== "passed")
-                            throw new Stop("ci-failed", `Pull request checks are no longer all passing on ${j.candidate.sha.slice(0, 7)}; nothing was merged.`);
-                        intend("merge");
-                        j.merge = { sha: await adapters.github.merge(j.github, j.pr, j.candidate.sha), tree: null };
-                    }
-                    save();
-                    // This also runs after discovering a merge whose response was lost. Never delete a reused branch.
-                    await adapters.repo.deleteBranch(j.branch, j.candidate.sha);
-                    advance("tree");
-                    break;
-                }
-                case "tree": {
-                    const merge = j.merge;
-                    await adapters.repo.sync(j.branch);
-                    const tree = await adapters.repo.tree(merge.sha);
-                    merge.tree = tree;
-                    if (tree !== j.candidate.tree)
-                        throw new Stop("tree-mismatch", `Main's merge commit ${merge.sha.slice(0, 7)} has tree ${tree.slice(0, 12)}, not the gated ${j.candidate.tree.slice(0, 12)}: main changed what was checked. Nothing was tagged; the deployed build stays as it is.`);
-                    advance("tag");
-                    break;
-                }
-                case "tag": {
-                    const merge = j.merge;
-                    const at = await adapters.github.tag(j.github, j.tag);
-                    if (at !== null && at !== merge.sha)
-                        throw new Stop("conflict", `${j.tag} already points at ${at.slice(0, 7)}, not the merge ${merge.sha.slice(0, 7)}.`);
-                    if (at === null) {
-                        intend("tag");
-                        await adapters.github.createTag(j.github, j.tag, merge.sha);
+                        const tree = await adapters.repo.tree(merge.sha);
+                        merge.tree = tree;
+                        if (tree !== j.candidate.tree)
+                            throw new Stop("tree-mismatch", `Main's merge commit ${merge.sha.slice(0, 7)} has tree ${tree.slice(0, 12)}, not the gated ${j.candidate.tree.slice(0, 12)}: main changed what was checked. Nothing was tagged; the deployed build stays as it is.`);
+                        advance("tag");
+                        break;
                     }
-                    j.tagged = { sha: merge.sha };
-                    advance("publish");
-                    break;
-                }
-                case "publish": {
-                    if (j.intents.publish === undefined)
-                        intend("publish");
-                    await waitFor("publish", `npm, the GitHub release and the tag's checks for ${j.tag}`, async () => {
-                        if (await adapters.github.tag(j.github, j.tag) !== j.tagged.sha)
-                            throw new Stop("conflict", `${j.tag} no longer points at the verified merge commit. Homebrew was not updated.`);
-                        const verdict = checksVerdict(await adapters.github.checks(j.github, j.tagged.sha), RELEASE_TAG_CHECKS);
-                        if (verdict.state === "failed")
-                            throw new Stop("publish-failed", `The release tag's checks failed: ${verdict.failed.join(", ")}. Homebrew was not updated.`);
-                        if (verdict.state === "pending")
-                            return null;
-                        return await adapters.registry.published(j.packageName, j.packageVersion) && await adapters.github.release(j.github, j.tag) ? true : null;
-                    });
-                    j.published = { at: adapters.now().toISOString() };
-                    advance("homebrew");
-                    break;
-                }
-                case "homebrew": {
-                    const brew = adapters.homebrew;
-                    let state = await brew.state(j.packageVersion);
-                    if (state.kind === "missing") {
-                        intend("homebrew");
-                        const proposed = await brew.propose(j.packageVersion);
-                        state = { kind: "proposed", ...proposed };
+                    case "tag": {
+                        const merge = j.merge;
+                        const at = await adapters.github.tag(j.github, j.tag);
+                        if (at !== null && at !== merge.sha)
+                            throw new Stop("conflict", `${j.tag} already points at ${at.slice(0, 7)}, not the merge ${merge.sha.slice(0, 7)}.`);
+                        if (at === null) {
+                            intend("tag");
+                            await adapters.github.createTag(j.github, j.tag, merge.sha);
+                        }
+                        j.tagged = { sha: merge.sha };
+                        advance("publish");
+                        break;
                     }
-                    if (state.kind === "proposed") {
-                        const proposed = state;
-                        j.homebrew = { pr: proposed.pr, head: proposed.head, merged: false };
-                        save();
-                        // Whatever checks do register are always judged; an empty set passes only for a tap whose workflows never run
-                        // on a change, and only when it's still empty a poll later.
-                        const checked = await brew.checked(proposed.head);
-                        let emptyLooks = 0;
-                        await waitFor("homebrew", `the Homebrew change's checks (${brew.repo} #${proposed.pr})`, async () => {
-                            // Check runs and commit statuses are judged apart, so neither stands in for the other or hides its failure.
-                            // Two apps may name a check alike; each app's attempts stand for themselves.
-                            const runs = (await adapters.github.checks(brew.repo, proposed.head)).map(run => ({ ...run, name: `${run.app ?? "unknown app"}: ${run.name}` }));
-                            const statuses = await brew.statuses(proposed.head);
-                            const verdicts = [runs, statuses].filter(one => one.length > 0).map(one => checksVerdict(one, [...new Set(one.map(run => run.name))]));
-                            const failed = verdicts.flatMap(one => one.state === "failed" ? one.failed : []);
-                            if (failed.length > 0)
-                                throw new Stop("homebrew-failed", `The Homebrew change's checks failed: ${failed.join(", ")}.`);
-                            if (verdicts.some(one => one.state === "pending"))
-                                return null;
-                            // GitHub registers checks asynchronously; an empty set says nothing about success.
-                            // A workflow is owed: only its own run counts, not another app's green check.
-                            if (checked && !runs.some(run => run.app === "github-actions"))
+                    case "publish": {
+                        if (j.intents.publish === undefined)
+                            intend("publish");
+                        await waitFor("publish", `npm, the GitHub release and the tag's checks for ${j.tag}`, async () => {
+                            if (await adapters.github.tag(j.github, j.tag) !== j.tagged.sha)
+                                throw new Stop("conflict", `${j.tag} no longer points at the verified merge commit. Homebrew was not updated.`);
+                            const verdict = checksVerdict(await adapters.github.checks(j.github, j.tagged.sha), RELEASE_TAG_CHECKS);
+                            if (verdict.state === "failed")
+                                throw new Stop("publish-failed", `The release tag's checks failed: ${verdict.failed.join(", ")}. Homebrew was not updated.`);
+                            if (verdict.state === "pending")
                                 return null;
-                            if (runs.length === 0 && statuses.length === 0)
-                                return ++emptyLooks >= 2 ? true : null;
-                            return true;
+                            return await adapters.registry.published(j.packageName, j.packageVersion) && await adapters.github.release(j.github, j.tag) ? true : null;
                         });
-                        await brew.merge(proposed.pr, proposed.head);
+                        j.published = { at: adapters.now().toISOString() };
+                        advance("homebrew");
+                        break;
+                    }
+                    case "homebrew": {
+                        const brew = adapters.homebrew;
+                        let state = await brew.state(j.packageVersion);
+                        if (state.kind === "missing") {
+                            intend("homebrew");
+                            const proposed = await brew.propose(j.packageVersion);
+                            state = { kind: "proposed", ...proposed };
+                        }
+                        if (state.kind === "proposed") {
+                            const proposed = state;
+                            j.homebrew = { pr: proposed.pr, head: proposed.head, merged: false };
+                            save();
+                            // Whatever checks do register are always judged; an empty set passes only for a tap whose workflows never run
+                            // on a change, and only when it's still empty a poll later.
+                            const checked = await brew.checked(proposed.head);
+                            let emptyLooks = 0;
+                            await waitFor("homebrew", `the Homebrew change's checks (${brew.repo} #${proposed.pr})`, async () => {
+                                // Check runs and commit statuses are judged apart, so neither stands in for the other or hides its failure.
+                                // Two apps may name a check alike; each app's attempts stand for themselves.
+                                const runs = (await adapters.github.checks(brew.repo, proposed.head)).map(run => ({ ...run, name: `${run.app ?? "unknown app"}: ${run.name}` }));
+                                const statuses = await brew.statuses(proposed.head);
+                                const verdicts = [runs, statuses].filter(one => one.length > 0).map(one => checksVerdict(one, [...new Set(one.map(run => run.name))]));
+                                const failed = verdicts.flatMap(one => one.state === "failed" ? one.failed : []);
+                                if (failed.length > 0)
+                                    throw new Stop("homebrew-failed", `The Homebrew change's checks failed: ${failed.join(", ")}.`);
+                                if (verdicts.some(one => one.state === "pending"))
+                                    return null;
+                                // GitHub registers checks asynchronously; an empty set says nothing about success.
+                                // A workflow is owed: only its own run counts, not another app's green check.
+                                if (checked && !runs.some(run => run.app === "github-actions"))
+                                    return null;
+                                if (runs.length === 0 && statuses.length === 0)
+                                    return ++emptyLooks >= 2 ? true : null;
+                                return true;
+                            });
+                            await brew.merge(proposed.pr, proposed.head);
+                        }
+                        j.homebrew = { pr: j.homebrew?.pr ?? null, head: j.homebrew?.head ?? null, merged: true };
+                        advance("done");
+                        break;
                     }
-                    j.homebrew = { pr: j.homebrew?.pr ?? null, head: j.homebrew?.head ?? null, merged: true };
-                    advance("done");
-                    break;
                 }
             }
+            catch (error) {
+                if (!(error instanceof Restart))
+                    throw error;
+                await restart(error.head);
+            }
         }
         say(`Released ${j.tag}: deployed, merged as ${j.merge.sha.slice(0, 7)}, tagged, published and on Homebrew.`);
+        for (const line of landedWords(j.landed ?? []))
+            say(line);
         return { ok: true, journal: j, file };
     }
     catch (error) {