toolroll 0.9.71 → 0.9.72

package/dist/store.js

@@ -57,9 +57,10 @@ import { hashSecret, mintLeadToken, parseCredential, secretMatches, tokenPurpose
  * are deferred until after M4, and a column that exists to serve a feature
  * nobody has designed yet is a column that will be wrong when they do.
  */
-import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { existsSync, mkdirSync, statSync, unlinkSync } from "node:fs";
 import { createRequire } from "node:module";
+import { execFileSync } from "node:child_process";
 import { dirname } from "node:path";
 import { hostname } from "node:os";
 import { ownedProcessCount, runOwnerTag } from "./exec.js";
@@ -70,7 +71,8 @@ import { containerEmptiness } from "./container-state.js";
 import { hasDisguisedText, hasForbiddenControls, validateNote } from "./decision.js";
 import { parseReviewContext, reviewContextCustodyProblem } from "./review-context.js";
 import { foldReview, manualReviewOnly } from "./proof.js";
-import { approvalOf, digestOf, canonicalProfileJson, chainFromJson, profileDigestOf, profileFromJson, scopeAuthorityOf, routeParityProblem, parseAcceptanceCriteria, exactAcceptance, exactStringList, exactSafeIntegerOrNull } from "./scope.js";
+import { liveReleaseOf } from "./scope.js";
+import { APPROVAL_BASES, approvalOf, machineActing, personProof, proofDetailOf, quarantinedAuthor, sealOriginOf, digestOf, canonicalProfileJson, chainFromJson, profileDigestOf, profileFromJson, scopeAuthorityOf, routeParityProblem, parseAcceptanceCriteria, exactAcceptance, exactStringList, exactSafeIntegerOrNull } from "./scope.js";
 import { resolveScopeProfile, resolveRouteCandidates, exactPinOf, routeOfTask, agentChoicesFor } from "./agentconfig.js";
 import { canonicalOverridesJson, canonicalRouteJson, isRiskLevel, isTaskSize, headroomFrom, makesNoPlan, legOf, overridesFromJson, phaseOfRole, recommendRoute, routeDigestOf, routeFromJson, routeProblems, routeStampProblem, ROUTE_ERA, PROVIDER_ID_LIST, } from "./phase-routing.js";
 import { readAuthModeStrict } from "./keys.js";
@@ -80,6 +82,8 @@ import {} from "./provider.js";
 import { authenticate as runnerAuthenticate } from "./runner.js";
 import { stampNewProjectLevel } from "./check-levels.js";
 import { parseCheckProgressSnapshot } from "./check-progress.js";
+import { authorityStandsSql } from "./approval-authority.js";
+import { releasePolicyDigest, storedReleaseTerms, readReleaseTerms, readReleasePolicy } from "./contracts/release-terms.js";
 import { accountReachesSql, normalizeProjectAccess, projectAccessAllows, readProjectAccess } from "./project-access.js";
 import { LEDGER_COLUMNS, LEDGER_SCHEMA, LEDGER_TABLE, LEDGER_V99_TABLE, installLedgerTriggers } from "./action-ledger.js";
 import { PLAN_AUTO_SCHEMA } from "./plan-auto.js";
@@ -725,7 +729,15 @@ const REGISTERED_AT_FILING = "again, as it was filed";
 // v133 adds, and changes no saved row: a project's sandbox settings (project_sandbox; project-sandbox.ts,
 // docs/plans/sandbox-parity.md C9) — what its builds may not read, the macOS services and protected files they may — and
 // the fence policy a flow was made under (flow.fence_policy; saved flows read NULL: v1, the home configuration denied).
-export const SCHEMA_VERSION = 133;
+// v134 adds, and changes no saved row: who gave each yes (docs/plans/approval-policy.md) — a protected-work vote's proof
+// (scope_approval_vote.proof) and a flow decision's authority (flow_event.authority), each NULL on saved rows: no proof
+// on record. Saved approvals a machine credential gave are read for what they are (approval-authority.ts), not rewritten.
+// v135 adds, and changes no saved row: one approval per release (docs/plans/release-once.md) — a release's authority
+// record, its carried commits and its deploy and merge operations (release_authority, release_carry,
+// release_operation), each release check attempt's intended mode, sealed before it runs (release_check_attempt), the
+// nightly full check on main and its open failures (nightly_check, main_check_failure), and a scope's release terms
+// (task_scope.release_terms_json; saved rows read NULL: no release terms).
+export const SCHEMA_VERSION = 135;
 /** v118: the tables merged into `credential`, in the order they move (a person's API tokens keep their ids first). */
 export const V118_MERGED_TABLES = Object.freeze({ api_token: "person", coordinator_credential: "coordinator", lead_credential: "lead" });
 /** The foreign keys that named a merged table, exactly as their DDL wrote them; each names `credential(id)` instead. */
@@ -858,7 +870,7 @@ const V115_DROPPED_REFERENCES = /\s+REFERENCES (?:contestant|contest|tournament_
  * unchanged), and adds the nullable column in V125_ADDED_COLUMNS, checked the same way. v126 only adds a new table
  * (task_source) and the columns in V126_ADDED_COLUMNS (null or 0), checked the same way.
  */
-export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133]);
+export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135]);
 /** v119: the columns it adds, by table, with the value every row saved before it reads (toolroll-update's HISTORY_RULES). */
 export const V119_ADDED_COLUMNS = Object.freeze({
     task_ref: { planning_generation: { definition: "INTEGER NOT NULL DEFAULT 0", saved: "0" } },
@@ -969,6 +981,138 @@ export const V129_ADDED_COLUMNS = Object.freeze({
         cache_write_tokens: { definition: "INTEGER CHECK (cache_write_tokens IS NULL OR cache_write_tokens >= 0)", saved: "NULL" },
     },
 });
+/** v134 (approval policy): how each protected-work vote was proved, and who decided a flow card at a decision zone.
+ * Saved rows read NULL: no proof or authority on record, which never counts as a person. */
+export const V134_ADDED_COLUMNS = Object.freeze({
+    scope_approval_vote: { proof: { definition: "TEXT", saved: "NULL" } },
+    flow_event: { authority: { definition: "TEXT", saved: "NULL" } },
+});
+/** v135 (docs/plans/release-once.md): a scope's release terms, part of its digest when present. Saved rows read NULL. */
+export const V135_ADDED_COLUMNS = Object.freeze({
+    task_scope: { release_terms_json: { definition: "TEXT", saved: "NULL" } },
+});
+/**
+ * v135: one approval per release (docs/plans/release-once.md). `release_authority` is the single source of truth for a
+ * release a person approved: one row per generation, changed only by compare-and-swap on `rev`, with a lease whose
+ * epoch goes up on every takeover. `release_carry` records each later commit carried under it, `release_operation` each
+ * deploy or merge that can't be undone. `release_check_attempt` seals a check's intended mode, inventory and context
+ * before it runs. `main_check_failure` keeps one row per item the nightly full check on main found failing, until a
+ * qualifying full pass clears that exact item; `nightly_check` records each nightly firing.
+ */
+export const RELEASE_ONCE_SCHEMA = `
+CREATE TABLE IF NOT EXISTS release_authority (
+  id              INTEGER PRIMARY KEY AUTOINCREMENT,
+  repo            TEXT NOT NULL,
+  generation      INTEGER NOT NULL,
+  previous        INTEGER REFERENCES release_authority(id),
+  version         TEXT NOT NULL,
+  pr              INTEGER NOT NULL,
+  branch          TEXT NOT NULL,
+  base            TEXT NOT NULL,
+  anchor_task     TEXT NOT NULL,
+  anchor_digest   TEXT NOT NULL,
+  approved_sha    TEXT NOT NULL,
+  approved_tree   TEXT NOT NULL,
+  artifact_digest TEXT,
+  tip_sha         TEXT NOT NULL,
+  tip_task        TEXT NOT NULL,
+  policy_json     TEXT NOT NULL,
+  policy_digest   TEXT NOT NULL,
+  verify_command  INTEGER NOT NULL,
+  verify_digest   TEXT NOT NULL,
+  access_digest   TEXT NOT NULL,
+  state           TEXT NOT NULL CHECK (state IN ('open','deploying','merge-reserved','merged','revoked','expired','superseded')),
+  rev             INTEGER NOT NULL DEFAULT 0,
+  lease_owner     TEXT,
+  lease_epoch     INTEGER NOT NULL DEFAULT 0,
+  lease_expires   TEXT,
+  expires_at      TEXT NOT NULL,
+  created_at      TEXT NOT NULL,
+  ended_at        TEXT,
+  ended_by        TEXT,
+  UNIQUE (repo, version, pr, generation)
+);
+CREATE UNIQUE INDEX IF NOT EXISTS release_authority_live ON release_authority (repo, version, pr)
+  WHERE state IN ('open','deploying','merge-reserved');
+CREATE INDEX IF NOT EXISTS release_authority_anchor ON release_authority (anchor_task);
+CREATE TABLE IF NOT EXISTS release_carry (
+  id              INTEGER PRIMARY KEY AUTOINCREMENT,
+  authority       INTEGER NOT NULL REFERENCES release_authority(id),
+  task_id         TEXT NOT NULL UNIQUE,
+  scope_digest    TEXT NOT NULL,
+  request_id      TEXT NOT NULL,
+  from_sha        TEXT NOT NULL,
+  to_sha          TEXT NOT NULL,
+  to_tree         TEXT NOT NULL,
+  artifact_digest TEXT NOT NULL,
+  commits_json    TEXT NOT NULL,
+  changed_lines   INTEGER NOT NULL,
+  files           INTEGER NOT NULL,
+  churn           INTEGER NOT NULL,
+  runtime         TEXT NOT NULL,
+  proved_at       TEXT NOT NULL,
+  UNIQUE (authority, to_sha)
+);
+CREATE TABLE IF NOT EXISTS release_operation (
+  id              TEXT PRIMARY KEY,
+  authority       INTEGER NOT NULL REFERENCES release_authority(id),
+  kind            TEXT NOT NULL CHECK (kind IN ('deploy','merge')),
+  task_id         TEXT NOT NULL,
+  candidate       TEXT NOT NULL,
+  epoch           INTEGER NOT NULL,
+  state           TEXT NOT NULL CHECK (state IN ('reserved','running','succeeded','failed','unknown')),
+  external_ref    TEXT,
+  -- The sha256 of a secret only the reserving coordinator holds: a deploy run adopting this operation proves it.
+  secret_hash     TEXT,
+  -- 1: reserved by a person's own deploy run with no coordinator holding the release (its epoch is the one it found).
+  direct          INTEGER NOT NULL DEFAULT 0,
+  -- The process that reserved, then issued, the call: its pid, its start time and when it was recorded (real time).
+  -- Recovery settles a started operation only once that process is proven gone (review round 2).
+  issuer_pid      INTEGER,
+  issuer_started  TEXT,
+  issued_at       TEXT,
+  -- A person's direct deploy: the staging folder its deployment journals in.
+  stage           TEXT,
+  reserved_at     TEXT NOT NULL,
+  finished_at     TEXT,
+  detail          TEXT
+);
+CREATE INDEX IF NOT EXISTS release_operation_open ON release_operation (authority, state);
+CREATE TABLE IF NOT EXISTS release_check_attempt (
+  run              INTEGER PRIMARY KEY REFERENCES run(id),
+  authority        INTEGER REFERENCES release_authority(id),
+  mode             TEXT NOT NULL CHECK (mode IN ('full','targeted')),
+  base_run         INTEGER REFERENCES run(id),
+  plan_digest      TEXT,
+  snapshot_digest  TEXT,
+  inventory_digest TEXT NOT NULL,
+  context_digest   TEXT NOT NULL,
+  nonce_hash       TEXT NOT NULL,
+  created_at       TEXT NOT NULL,
+  settled_at       TEXT
+);
+CREATE TABLE IF NOT EXISTS main_check_failure (
+  id              INTEGER PRIMARY KEY AUTOINCREMENT,
+  repo            TEXT NOT NULL,
+  sha             TEXT NOT NULL,
+  run             INTEGER NOT NULL,
+  item            TEXT NOT NULL,
+  opened_at       TEXT NOT NULL,
+  cleared_by_run  INTEGER,
+  cleared_at      TEXT,
+  UNIQUE (repo, run, item)
+);
+CREATE INDEX IF NOT EXISTS main_check_failure_open ON main_check_failure (repo) WHERE cleared_at IS NULL;
+CREATE TABLE IF NOT EXISTS nightly_check (
+  id              INTEGER PRIMARY KEY AUTOINCREMENT,
+  repo            TEXT NOT NULL,
+  sha             TEXT NOT NULL,
+  task            TEXT,
+  run             INTEGER,
+  outcome         TEXT,
+  at              TEXT NOT NULL
+);
+`;
 /** v130: a project's network (an approver's setting, egress.ts ProjectNetwork as JSON) and the installation's choice
  * whether an agent may run where no OS confinement exists (one row; 0 until an instance operator turns it on). */
 export const CONFINEMENT_SCHEMA = `
@@ -4064,6 +4208,17 @@ CREATE INDEX IF NOT EXISTS run_checkpoint_by_task ON run_checkpoint (task_ref, i
     convertChatTables(db);
     // v118: every machine credential into the one credential table, after every older step gave the old tables their last shape.
     mergeCredentialsForV118(db);
+    // v134: a vote's proof and a flow decision's authority (V134_ADDED_COLUMNS: saved rows read NULL, no proof on record).
+    for (const [table, columns] of Object.entries(V134_ADDED_COLUMNS)) {
+        for (const [column, { definition }] of Object.entries(columns))
+            addColumn(db, table, column, definition);
+    }
+    // v135: one approval per release (new tables only) and a scope's release terms (V135_ADDED_COLUMNS: saved rows NULL).
+    db.exec(RELEASE_ONCE_SCHEMA);
+    for (const [table, columns] of Object.entries(V135_ADDED_COLUMNS)) {
+        for (const [column, { definition }] of Object.entries(columns))
+            addColumn(db, table, column, definition);
+    }
     // Keep the epoch until reclamation succeeds, including a retry after compaction already committed. A new file has
     // nothing to reclaim.
     if (!fresh)
@@ -6492,6 +6647,8 @@ export class Store {
     // ---- scope --------------------------------------------------------------
     saveScope(scope, mutation = {}, options = {}) {
         this.once(mutation, "saveScope", () => this.transact(() => {
+            // The text's current author mark, read before this write (approval policy §1.4).
+            const prior = this.db.prepare("SELECT proposed_via, release_terms_json FROM task_scope WHERE task_id = ?").get(scope.taskId);
             // THE filing invariant (foundations findings 5/13/19): every scope
             // row leaves this method either RESOLVED (working profile stamped,
             // digest recomputed to bind it, version 2) or UNRESOLVED with its
@@ -6652,6 +6809,9 @@ export class Store {
             const lowered = (one) => { const verdict = underCeiling(orgPolicy, one); return verdict.ok ? verdict.profile : one; };
             if (profile !== null)
                 profile = lowered(profile);
+            // v135: release terms the caller names, else the ones this scope already carries (a refile keeps them bound).
+            const priorTerms = storedReleaseTerms(prior?.["release_terms_json"]);
+            const releaseTerms = options.releaseTerms !== undefined ? options.releaseTerms : priorTerms.ok ? priorTerms.terms : null;
             const digestInput = {
                 goal: scope.goal,
                 outOfScope: scope.outOfScope,
@@ -6660,6 +6820,7 @@ export class Store {
                 acceptance: scope.acceptance,
                 qualityMode,
                 candidate: scope.candidate ?? null,
+                releaseTerms,
             };
             // EVERY route filed since v47 binds into the digest — routine-shaped
             // ones included — so approval freezes exactly which agent runs each
@@ -6689,8 +6850,8 @@ export class Store {
                 .prepare(`INSERT INTO task_scope
              (task_id, goal, out_of_scope, touches, budget_microusd, proposed_at, digest, approved_at, approved_by, approved_digest,
               profile_json, profile_state, unresolved_reason, digest_version, profile_provenance, proposed_chain_json, acceptance_json, quality_mode,
-              risk_level, proposed_route_json, route_era, candidate)
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+              risk_level, proposed_route_json, route_era, candidate, release_terms_json)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
            ON CONFLICT (task_id) DO UPDATE SET
              goal = excluded.goal, out_of_scope = excluded.out_of_scope,
              touches = excluded.touches, budget_microusd = excluded.budget_microusd,
@@ -6702,7 +6863,7 @@ export class Store {
              profile_provenance = excluded.profile_provenance, proposed_chain_json = excluded.proposed_chain_json,
              acceptance_json = excluded.acceptance_json, quality_mode = excluded.quality_mode,
              risk_level = excluded.risk_level, proposed_route_json = excluded.proposed_route_json, route_era = excluded.route_era,
-             candidate = excluded.candidate`)
+             candidate = excluded.candidate, release_terms_json = excluded.release_terms_json`)
                 .run(scope.taskId, scope.goal, scope.outOfScope, JSON.stringify(scope.touches), scope.budgetMicrousd ?? null, scope.proposedAt, boundDigest, scope.approvedAt, scope.approvedBy, scope.approvedDigest, profile === null ? null : canonicalProfileJson(profile), profile === null ? "unresolved" : "resolved", unresolvedReason, profile === null ? 1 : 2, provenance, 
             // Fallback chains (v30-v114) are gone: no filing names one.
             null, scope.acceptance.length === 0 ? null : JSON.stringify(scope.acceptance), qualityMode, 
@@ -6710,10 +6871,13 @@ export class Store {
             // routine risk, the value its signed terms always carried.
             "routine", route === null ? null : canonicalRouteJson(route), 
             // The durable era: every row this method writes is a routed row.
-            ROUTE_ERA, scope.candidate ?? null);
+            ROUTE_ERA, scope.candidate ?? null, releaseTerms === null ? null : serializeReleaseTerms(releaseTerms));
             // Who wrote THIS text (mate arc, ruling 2): set per write, so a human
-            // rewrite clears the lead's mark and a mate rewrite sets it.
-            this.db.prepare("UPDATE task_scope SET proposed_via = ? WHERE task_id = ?").run(options.proposedVia ?? null, scope.taskId);
+            // rewrite clears the lead's mark and a mate rewrite sets it — but only a
+            // person's write clears one (approval policy §1.4): the lead (its token)
+            // or a remote API run keeps any mark already there and never erases a
+            // quarantine by refiling, and the lead's own text is marked `lead`.
+            this.db.prepare("UPDATE task_scope SET proposed_via = ? WHERE task_id = ?").run(provenanceAfter(prior?.["proposed_via"], options.proposedVia ?? null), scope.taskId);
             return null;
         }));
     }
@@ -6744,6 +6908,14 @@ export class Store {
      * scope vanished mid-ceremony. */
     sealScopeApproval(taskId, by, now, mutation = {}, basis, approverKind) {
         return (this.once(mutation, "sealScopeApproval", () => {
+            // ONLY A PERSON'S SEAL HAS NO BASIS (approval policy, phase 1): with none given this is the person's
+            // ceremony (scope.ts approve), so a machine — the lead's token, a remote API run — never mints one, whatever
+            // road it came by.
+            if (basis === undefined && machineActing())
+                return false;
+            // `carried` is written by the carry transaction alone (carryReleaseApproval), never through a seal.
+            if (basis?.kind === "carried")
+                return false;
             // THE COORDINATOR QUARANTINE, enforced in the primitive (MCP spec
             // v6, round-3 f1): mode coverage never admits a coordinator-filed
             // task — console, CLI `task scope`, and direct callers alike hit
@@ -6812,6 +6984,15 @@ export class Store {
                 return false;
             if (routeProblems(authority.route).length > 0)
                 return false;
+            // RELEASE TERMS (release-once.md): only a person's own yes (the ceremony or a paired-chat tap) seals them, and
+            // that yes opens the release's authority record in this same transaction — or the seal doesn't stand.
+            const terms = storedReleaseTerms(working["release_terms_json"]);
+            if (!terms.ok)
+                return false;
+            if (terms.terms !== null && basis !== undefined && basis.kind !== "chat")
+                return false;
+            if (terms.terms !== null && releaseSealProblem(this, terms.terms) !== null)
+                return false;
             const changed = this.db
                 .prepare(`UPDATE task_scope
                 SET approved_at = ?, approved_by = ?, approved_digest = digest,
@@ -6827,6 +7008,10 @@ export class Store {
                     approved_route_json = proposed_route_json
               WHERE task_id = ?`)
                 .run(now.toISOString(), by, basis === undefined ? "password" : basis.kind, basis === undefined ? null : basis.modeDigest, taskId);
+            if (changed.changes > 0 && terms.ok && terms.terms !== null) {
+                if (openReleaseAuthority(this, { taskId, digest: String(working["digest"]), terms: terms.terms, by, now }) === null)
+                    throw new ReleaseSealRefused();
+            }
             if (changed.changes > 0) {
                 // The project's tools this yes saw (v80): a later addition needs a later yes.
                 this.sealProjectTools(taskId, String(working["digest"]), now);
@@ -6849,12 +7034,14 @@ export class Store {
                             taskRef: Number(ref["id"]), kind: "scope-approved", identity: `t${Number(ref["id"])}`,
                             subject: "Scope approved",
                             body: basis === undefined
-                                ? `Approved by ${currentActor()?.lead === true ? "the lead" : lifecycleWords(by, 40)}. A connected worker can take it next.`
+                                ? `Approved by ${lifecycleWords(by, 40)}. A connected worker can take it next.`
                                 : basis.kind === "chat"
                                     ? `Approved by ${lifecycleWords(by, 40)} in chat. A connected worker can take it next.`
                                     : basis.kind === "grant"
                                         ? "Approved automatically: its flow runs on its own. A connected worker can take it next."
-                                        : "Approved automatically under the operating mode. A connected worker can take it next.",
+                                        : basis.kind === "schedule"
+                                            ? "Approved by its standing order. A connected worker can take it next."
+                                            : "Approved automatically under the operating mode. A connected worker can take it next.",
                             link: chatControlHref("task", taskId),
                         }, now);
                     }
@@ -6874,7 +7061,7 @@ export class Store {
     }
     getScope(taskId) {
         const row = this.db.prepare("SELECT * FROM task_scope WHERE task_id = ?").get(taskId);
-        return row === undefined ? null : readScope(row);
+        return row === undefined ? null : sealedAs(this, readScope(row));
     }
     /**
      * The mode-approval belt, as ONE question every consumer asks the same
@@ -6885,20 +7072,23 @@ export class Store {
      * scopes answer true: this belt only ever REMOVES mode authority.
      */
     modeApprovalLive(taskRef, now) {
-        // A flow's "runs on its own" grant (flow-unattended.ts) is held to the same belt.
+        // Approval policy §1.5: an allowlist over the seal that exists. No seal claims no authority (a pre-approval
+        // planner, a scope-free check — the role gates decide those); a seal stands only on an authority that still does
+        // (approval-authority.ts), so a lead seal, a null basis or a word this code doesn't write is dead here.
         const dead = this.db
             .prepare(`SELECT 1 AS dead FROM task_scope
           JOIN task_ref ON task_ref.id = ? AND task_ref.backend = 'built-in' AND task_scope.task_id = task_ref.external_id
          WHERE task_scope.approved_at IS NOT NULL
-           AND ((task_scope.approval_basis = 'mode'
-           AND NOT EXISTS (SELECT 1 FROM operating_mode om
-                            JOIN approver signer ON signer.name = om.signed_by
-                           WHERE om.repo = task_ref.repo AND om.revoked_at IS NULL
-                             AND om.absolute_expiry > ? AND om.digest = task_scope.mode_digest
-                             AND signer.revoked_at IS NULL AND signer.role = 'approver' AND ${accountReachesSql("signer", "task_ref.repo")}))
-             OR (task_scope.approval_basis = 'grant' AND NOT ${grantStandsSql("task_scope.mode_digest", "?", "task_ref.repo")}))`)
-            .get(taskRef, now.toISOString(), now.toISOString());
-        return dead === undefined;
+           AND NOT ${authorityStandsSql("task_scope", "task_ref.repo", "?")}`)
+            .get(taskRef, now.toISOString(), now.toISOString(), now.toISOString());
+        if (dead !== undefined)
+            return false;
+        // A release task (release-once.md): the whole live-release predicate, beyond what the SQL can say.
+        const external = this.db.prepare("SELECT external_id FROM task_ref WHERE id = ? AND backend = 'built-in'").get(taskRef);
+        if (external === undefined)
+            return true;
+        const live = liveReleaseOf(this, String(external["external_id"]), "dispatch", now);
+        return !live.applies || live.ok;
     }
     // ---- approvers ----------------------------------------------------------
     saveApprover(name, credentialHash, now, mutation = {}) {
@@ -7359,7 +7549,8 @@ export class Store {
         // Only people who can still approve here count: a vote from an account since revoked, demoted or moved off the project doesn't.
         const standing = (name) => { const account = this.accountOf(name); return account !== null && account.revokedAt === null && account.role === "approver" && this.accountCanAccess(name, repo); };
         const digest = scope === undefined ? "" : String(scope["digest"]);
-        const voters = new Set(this.db.prepare("SELECT approver FROM scope_approval_vote WHERE task_id = ? AND digest = ?").all(taskId, digest).map(row => String(row["approver"])).filter(standing));
+        // Only a person's vote counts (approval policy §1.3): a machine's, or one with no recorded proof, is history only.
+        const voters = new Set(this.db.prepare("SELECT approver, proof FROM scope_approval_vote WHERE task_id = ? AND digest = ?").all(taskId, digest).filter(row => personVote(this.db, taskId, digest, row)).map(row => String(row["approver"])).filter(standing));
         const already = voters.has(by);
         voters.add(by);
         for (const name of requesters)
@@ -7380,10 +7571,10 @@ export class Store {
         const hits = changed === null ? null : protectedChanges(rules, changed);
         if (hits !== null && hits.length === 0)
             return null;
-        const scope = this.db.prepare("SELECT approved_by, approved_digest FROM task_scope WHERE task_id = ?").get(taskId);
+        const scope = this.db.prepare("SELECT approved_by, approved_digest, approved_at, approval_basis FROM task_scope WHERE task_id = ?").get(taskId);
         const approvedDigest = scope?.["approved_digest"] == null ? "" : String(scope["approved_digest"]);
         const standing = (name) => { const account = this.accountOf(name); return account !== null && account.revokedAt === null && account.role === "approver" && this.accountCanAccess(name, repo); };
-        const voters = new Set(this.db.prepare("SELECT approver FROM scope_approval_vote WHERE task_id = ? AND digest = ?").all(taskId, approvedDigest).map(row => String(row["approver"])).filter(standing));
+        const voters = new Set(this.db.prepare("SELECT approver, proof FROM scope_approval_vote WHERE task_id = ? AND digest = ?").all(taskId, approvedDigest).filter(row => personVote(this.db, taskId, approvedDigest, row)).map(row => String(row["approver"])).filter(standing));
         // Whoever asked for the work never counts as the second pair of eyes on it, whatever the requester rule says.
         const requesters = this.requestersOf(taskId);
         for (const name of requesters)
@@ -7394,13 +7585,35 @@ export class Store {
         const what = hits === null ? "files this project protects (its changed files couldn't be read)" : `protected files (${hits.slice(0, 3).join(", ")}${hits.length > 3 ? ` and ${hits.length - 3} more` : ""})`;
         if (completer === null)
             return `This result changed ${what}, so a person other than its approver marks it complete.`;
-        if (completer === approver || requesters.has(completer) || !standing(completer))
-            return `This result changed ${what}, and ${approver ?? "one person"} approved its scope alone. Someone else has to mark it complete.`;
-        return null;
+        // Two DISTINCT people across the votes, the seal and the completion (approval policy §1.7a): the seal's approver
+        // counts only when a person's proof stands behind that seal (never a lead or other machine credential under their
+        // name, and never a seal with no proof on record: fail closed, as personApprovalOf), a
+        // requester never counts, and someone who already voted is not a second person by also completing.
+        const people = new Set(voters);
+        const basis = scope?.["approval_basis"];
+        // (The approver is the first pair of eyes and may be who asked; the second may not.)
+        if (approver !== null && (basis === "password" || basis === "chat") && scope?.["approved_at"] != null
+            && sealOriginOf(this, taskId, approver, approvedDigest, String(scope["approved_at"])).origin === "person")
+            people.add(approver);
+        const before = people.size;
+        if (!requesters.has(completer) && standing(completer))
+            people.add(completer);
+        // No seal on record at all (nothing to pair with): the completer, if they can still approve here, is the person.
+        if (approver === null && people.size > before && voters.size === 0)
+            return null;
+        // Two distinct people across the votes, the person-made seal and the completer. Each person counts once, so one
+        // person voting and completing is still one; a voter who completes a seal another person made is two.
+        if (people.size >= 2)
+            return null;
+        return `This result changed ${what}, and ${approver ?? "one person"} approved its scope alone. Someone else has to mark it complete.`;
     }
     /** One person's yes to these exact bytes (protected work counts two). */
-    recordApprovalVote(taskId, digest, by, now) {
-        const fresh = this.db.prepare("INSERT OR IGNORE INTO scope_approval_vote (task_id, digest, approver, at) VALUES (?,?,?,?)").run(taskId, digest, by, now.toISOString());
+    recordApprovalVote(taskId, digest, by, now, proof) {
+        // How this yes was proved rides with it (approval policy §1.3): the counters count only a person's.
+        // A person's yes replaces a row a machine credential left for the same person and bytes (or one with no proof).
+        const fresh = this.db.prepare(`INSERT INTO scope_approval_vote (task_id, digest, approver, at, proof) VALUES (?,?,?,?,?)
+      ON CONFLICT (task_id, digest, approver) DO UPDATE SET at = excluded.at, proof = excluded.proof
+      WHERE COALESCE(scope_approval_vote.proof, '') NOT IN ('password-now','sso-now','fresh-password','fresh-sso','session','cli-login','chat','passkey')`).run(taskId, digest, by, now.toISOString(), proof);
         if (fresh.changes > 0) {
             const repo = this.db.prepare("SELECT repo FROM task_ref WHERE backend = ? AND external_id = ?").get(BUILT_IN, taskId)?.["repo"];
             this.recordAction({ at: now.toISOString(), actor: by, repo: repo == null ? null : String(repo), taskId, runId: null, action: "approval recorded", outcome: "recorded", source: "work", detail: `digest ${digest.slice(0, 12)}` });
@@ -11370,7 +11583,7 @@ export class Store {
         if (route === null) {
             return { ok: false, reason: "unreadable", detail: scope.approvedRouteJson == null ? "the approval sealed no agent route — re-file the scope and approve it again" : "the approval's sealed agent route cannot be read — re-file the scope and approve it again" };
         }
-        const fields = { goal: scope.goal, outOfScope: scope.outOfScope, touches: scope.touches, budgetMicrousd: scope.budgetMicrousd, acceptance: scope.acceptance, candidate: scope.candidate ?? null, qualityMode: scope.qualityMode ?? "default" };
+        const fields = { goal: scope.goal, outOfScope: scope.outOfScope, touches: scope.touches, budgetMicrousd: scope.budgetMicrousd, acceptance: scope.acceptance, candidate: scope.candidate ?? null, qualityMode: scope.qualityMode ?? "default", releaseTerms: scope.releaseTerms ?? null };
         const chain = scope.approvalKind === "chain" ? chainFromJson(scope.approvedChainJson ?? null) : null;
         const target = chain !== null ? { chain } : (scope.approvedProfile ?? null);
         if (target === null)
@@ -14775,6 +14988,12 @@ export class Store {
      * an existing row's posture is the reconciler's job, never creation's. */
     createMergeIntent(intent, now) {
         this.transact(() => {
+            // The nightly check of main is a check only (release-once.md, part 3): nothing merges it.
+            if (nightlyPublication(this, intent.publication))
+                throw new Error(NIGHTLY_CHECK_ONLY);
+            // A release's result merges only through its coordinator (release-once.md; security review): no intent for it.
+            if (releasePublication(this, intent.publication))
+                throw new Error(RELEASE_MERGES_ONLY);
             const mode = this.activeMode(intent.repo, now);
             let state = "pending";
             let basis = "grant";
@@ -14881,8 +15100,18 @@ export class Store {
     fireMergeIntent(id, generation, proof, now) {
         return this.transact(() => {
             const row = this.db
-                .prepare("SELECT state, generation, head_sha, grant_terms_hash, authority_basis, mode_digest FROM merge_intent WHERE id = ?")
+                .prepare("SELECT state, generation, head_sha, grant_terms_hash, authority_basis, mode_digest, publication FROM merge_intent WHERE id = ?")
                 .get(id);
+            // The shared merge authority (release-once.md, part 3): a nightly check of main never merges, by any road.
+            if (row !== undefined && nightlyPublication(this, Number(row["publication"]))) {
+                this.settleMergeIntent(id, generation, "refused", now, { error: NIGHTLY_CHECK_ONLY, from: "claimed" });
+                return { ok: false, outcome: "superseded", why: NIGHTLY_CHECK_ONLY };
+            }
+            // Nor does a release's result, whatever intent was planted for it: only `toolroll release` merges it.
+            if (row !== undefined && releasePublication(this, Number(row["publication"]))) {
+                this.settleMergeIntent(id, generation, "refused", now, { error: RELEASE_MERGES_ONLY, from: "claimed" });
+                return { ok: false, outcome: "superseded", why: RELEASE_MERGES_ONLY };
+            }
             if (row === undefined || String(row["state"]) !== "claimed" || Number(row["generation"]) !== generation) {
                 return { ok: false, outcome: "raced", why: "the claim moved" };
             }
@@ -15002,6 +15231,12 @@ export class Store {
      * reach a PR" are one write or neither.
      */
     createPublicationIntent(intent, now) {
+        // The nightly check of main is a check only: it is never published, so no pull request or merge can follow.
+        if (nightlyTaskRef(this, intent.taskRef))
+            throw new Error(NIGHTLY_CHECK_ONLY);
+        // Nor is a release's task: `toolroll release` merges its own pull request, so no publication (and no merge sweep) has it.
+        if (releaseTaskRef(this, intent.taskRef))
+            throw new Error(RELEASE_MERGES_ONLY);
         const inserted = this.db
             .prepare(`INSERT INTO publication
            (run, task_ref, github_repo, remote, base, head, head_sha, body_hash, draft, state, created_at, updated_at)
@@ -15339,7 +15574,7 @@ export class Store {
             const stamp = now.toISOString();
             this.db.prepare("UPDATE flow_card SET stage = ?, entry = entry + 1, task = ?, waiting = NULL, note = COALESCE(?, note), updated_at = ? WHERE id = ?")
                 .run(move.to, move.task ?? null, move.note ?? null, stamp, id);
-            this.db.prepare("INSERT INTO flow_event (card, from_stage, to_stage, outcome, actor, note, at) VALUES (?, ?, ?, ?, ?, ?, ?)").run(id, card.stage, move.to, move.outcome, move.actor, move.historyNote ?? move.note ?? null, stamp);
+            this.db.prepare("INSERT INTO flow_event (card, from_stage, to_stage, outcome, actor, note, at, authority) VALUES (?, ?, ?, ?, ?, ?, ?, ?)").run(id, card.stage, move.to, move.outcome, move.actor, move.historyNote ?? move.note ?? null, stamp, move.authority ?? null);
             return true;
         });
     }
@@ -15367,6 +15602,8 @@ export class Store {
         return this.db.prepare("SELECT * FROM flow_event WHERE card = ? ORDER BY id").all(card).map(row => ({
             fromStage: row["from_stage"] === null ? null : String(row["from_stage"]), toStage: String(row["to_stage"]), outcome: String(row["outcome"]),
             actor: String(row["actor"]), note: row["note"] === null ? null : String(row["note"]), at: String(row["at"]),
+            // A word this code doesn't write (or a move from before v134) is no recorded authority.
+            authority: FLOW_DECISION_AUTHORITIES.find(one => one === row["authority"]) ?? null,
         }));
     }
     /** When a card came into the zone it is in: its latest history line (it is written with every move). */
@@ -19861,7 +20098,7 @@ export function scopeTermsProblem(row) {
     // null for a person) is corruption, never a value that slips past the
     // quarantine because it is not literally 'mate'.
     const via = row["proposed_via"];
-    if (via !== null && via !== undefined && via !== "mate" && via !== "coordinator" && via !== "scout")
+    if (via !== null && via !== undefined && via !== "mate" && via !== "coordinator" && via !== "scout" && via !== "lead")
         return "the proposed-via marker is not one this code writes";
     const era = row["route_era"];
     if (era !== null && era !== undefined && (typeof era !== "number" || !Number.isSafeInteger(era) || era < 1 || era > ROUTE_ERA))
@@ -19870,6 +20107,12 @@ export function scopeTermsProblem(row) {
         if (typeof row[column] !== "string")
             return `${column.replace("_", " ")} is not stored as text`;
     }
+    // v135: release terms read back exactly, or the row states why (a reader that didn't select them skips this).
+    if ("release_terms_json" in row) {
+        const terms = storedReleaseTerms(row["release_terms_json"]);
+        if (!terms.ok)
+            return terms.problem;
+    }
     for (const column of ["approved_at", "approved_by", "approved_digest", "profile_json", "approved_profile_json", "proposed_chain_json", "approved_chain_json", "proposed_route_json", "approved_route_json", "unresolved_reason"]) {
         if (row[column] !== null && row[column] !== undefined && typeof row[column] !== "string")
             return `${column.replace(/_/g, " ")} is not stored as text`;
@@ -19886,9 +20129,10 @@ function readScope(row) {
         proposedAt: String(row["proposed_at"]),
         digest: String(row["digest"]),
         budgetMicrousd: row["budget_microusd"] === null || row["budget_microusd"] === undefined ? null : Number(row["budget_microusd"]),
+        // Only the authorities this code writes; any other stored word reads as `unknown`, which no reader treats as a yes.
         approvalBasis: row["approval_basis"] === null || row["approval_basis"] === undefined
             ? null
-            : String(row["approval_basis"]),
+            : APPROVAL_BASES.find(one => one === row["approval_basis"]) ?? "unknown",
         modeDigest: row["mode_digest"] === null || row["mode_digest"] === undefined ? null : String(row["mode_digest"]),
         approvedAt: row["approved_at"] === null ? null : String(row["approved_at"]),
         approvedBy: row["approved_by"] === null ? null : String(row["approved_by"]),
@@ -19913,7 +20157,8 @@ function readScope(row) {
         approvedRouteJson: row["approved_route_json"] === null || row["approved_route_json"] === undefined ? null : String(row["approved_route_json"]),
         routeEra: row["route_era"] === null || row["route_era"] === undefined ? null : Number(row["route_era"]),
         candidate: typeof row["candidate"] === "string" && row["candidate"] !== "" ? row["candidate"] : null,
-        proposedVia: row["proposed_via"] === "mate" || row["proposed_via"] === "coordinator" || row["proposed_via"] === "scout" ? row["proposed_via"] : null,
+        releaseTerms: (() => { const read = storedReleaseTerms(row["release_terms_json"]); return read.ok ? read.terms : null; })(),
+        proposedVia: row["proposed_via"] === "mate" || row["proposed_via"] === "coordinator" || row["proposed_via"] === "scout" || row["proposed_via"] === "lead" ? row["proposed_via"] : null,
     };
 }
 function readRunner(row) {
@@ -20050,3 +20295,448 @@ function readAcpCheck(row) {
         settledAt: text("settled_at"),
     };
 }
+/**
+ * Who wrote a scope's text after this write (docs/plans/approval-policy.md §1.4), from trusted context only. A person's
+ * write sets what the caller says (null for their own words), as always. A machine's write — the lead's token or a
+ * remote API run — never clears or downgrades a mark: a quarantined author (a chat proposal, a scout, a coordinator)
+ * stays, and otherwise the lead's write is marked `lead` (a remote run's keeps whatever was there).
+ */
+export function provenanceAfter(prior, requested) {
+    if (!machineActing())
+        return requested;
+    const was = prior === "mate" || prior === "coordinator" || prior === "scout" || prior === "lead" ? prior : null;
+    if (quarantinedAuthor(was))
+        return was;
+    if (quarantinedAuthor(requested))
+        return requested;
+    return currentActor()?.lead === true ? "lead" : (requested ?? was);
+}
+export const FLOW_DECISION_AUTHORITIES = ["person", "subagent", "lead", "remote"];
+/** Whether a protected-work vote is a person's (approval policy §1.3): the proof stored with it, or for a vote from
+ * before votes kept one, the approver's own proof row for those bytes. None on record is no person. */
+function personVote(db, taskId, digest, row) {
+    if (typeof row["proof"] === "string")
+        return personProof(row["proof"]);
+    // The approver's newest proof row for these exact bytes, parsed (either form); none is no person.
+    const proof = db.prepare("SELECT outcome, detail FROM action_ledger WHERE task_id = ? AND action = 'approval proved' AND actor = ? ORDER BY id DESC LIMIT 50")
+        .all(taskId, String(row["approver"])).find(one => proofDetailOf(one["detail"])?.digest === digest);
+    return personProof(proof === undefined ? null : String(proof["outcome"]));
+}
+/**
+ * A scope's approval read for what its seal really was (approval policy §1.5): a seal that says `password` or `chat`
+ * but that a machine credential made reads as `lead` (the lead's token) or `unknown` (any other machine credential),
+ * and a standing order's old firing as `schedule`. Nothing is rewritten; every reader of getScope sees the truth.
+ */
+function sealedAs(store, scope) {
+    if (scope.approvedAt === null || scope.approvedBy === null || scope.approvedDigest === null)
+        return scope;
+    if (scope.approvalBasis !== "password" && scope.approvalBasis !== "chat")
+        return scope;
+    const origin = sealOriginOf(store, scope.taskId, scope.approvedBy, scope.approvedDigest, scope.approvedAt);
+    if (origin.origin === "machine")
+        return { ...scope, approvalBasis: origin.lead ? "lead" : "unknown" };
+    if (origin.origin === "automation")
+        return { ...scope, approvalBasis: "schedule" };
+    return scope;
+}
+function readCheckAttempt(row) {
+    const text = (key) => row[key] == null ? null : String(row[key]);
+    return {
+        run: Number(row["run"]), authority: row["authority"] == null ? null : Number(row["authority"]),
+        mode: row["mode"] === "targeted" ? "targeted" : "full", baseRun: row["base_run"] == null ? null : Number(row["base_run"]),
+        planDigest: text("plan_digest"), snapshotDigest: text("snapshot_digest"), inventoryDigest: String(row["inventory_digest"]),
+        contextDigest: String(row["context_digest"]), nonceHash: String(row["nonce_hash"]), createdAt: String(row["created_at"]), settledAt: text("settled_at"),
+    };
+}
+/** Seal a check attempt before its command is spawned. Once written it never changes (bar its settled mark). */
+export function recordCheckAttempt(store, attempt, now) {
+    store.handle.prepare(`INSERT INTO release_check_attempt (run, authority, mode, base_run, plan_digest, snapshot_digest, inventory_digest, context_digest, nonce_hash, created_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(attempt.run, attempt.authority, attempt.mode, attempt.baseRun, attempt.planDigest, attempt.snapshotDigest, attempt.inventoryDigest, attempt.contextDigest, attempt.nonceHash, now.toISOString());
+}
+/** A run's sealed check attempt, or null. */
+export function checkAttemptOf(store, run) {
+    const row = store.handle.prepare("SELECT * FROM release_check_attempt WHERE run = ?").get(run);
+    return row === undefined ? null : readCheckAttempt(row);
+}
+/** Release terms as this code writes them: the contract's own reading of them, serialized. */
+export function serializeReleaseTerms(terms) {
+    const read = readReleaseTerms(terms);
+    if (!read.ok)
+        throw new Error(`The release terms don't match their contract: ${read.issues[0]?.line ?? "invalid"}`);
+    return JSON.stringify(read.value);
+}
+// ---- one approval per release: the authority record (release-once.md, part 1) --------------------------------------
+export { LIVE_RELEASE_STATES, belongsToRelease, newestReleaseGeneration, outstandingReleaseOperations, releaseAuthority, releaseAuthorityOfTask, releaseCarries, releaseCarryTo, releaseOperation, releaseOperations, releaseSealProblem, } from "./release-authority.js";
+import { LIVE_RELEASE_STATES, belongsToRelease, newestReleaseGeneration, outstandingReleaseOperations, releaseAuthority, releaseCarryTo, releaseOperation, releaseSealProblem, } from "./release-authority.js";
+/**
+ * Open a release's authority for a person's seal of its terms (inside the seal's transaction): the next generation,
+ * superseding the live one. False when it can't (releaseSealProblem), which refuses the seal.
+ */
+export function openReleaseAuthority(store, input) {
+    const { terms, now } = input;
+    if (releaseSealProblem(store, terms) !== null)
+        return null;
+    const live = newestReleaseGeneration(store, terms.repo, terms.packageVersion, terms.pr);
+    if (live !== null && LIVE_RELEASE_STATES.includes(live.state)) {
+        store.handle.prepare("UPDATE release_authority SET state = 'superseded', ended_at = ?, ended_by = ?, rev = rev + 1 WHERE id = ? AND rev = ?")
+            .run(now.toISOString(), input.by, live.id, live.rev);
+    }
+    const policyJson = JSON.stringify(terms.policy);
+    const result = store.handle.prepare(`INSERT INTO release_authority (repo, generation, previous, version, pr, branch, base, anchor_task, anchor_digest, approved_sha, approved_tree,
+      artifact_digest, tip_sha, tip_task, policy_json, policy_digest, verify_command, verify_digest, access_digest, state, rev, lease_epoch, expires_at, created_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, ?, ?, ?, ?, ?, ?, ?, 'open', 0, 0, ?, ?)`).run(terms.repo, (live?.generation ?? 0) + 1, live?.id ?? null, terms.packageVersion, terms.pr, terms.branch, terms.base, input.taskId, input.digest, terms.approvedSha, terms.approvedTree, terms.approvedSha, input.taskId, policyJson, releasePolicyDigest(terms.policy), terms.grant.id, terms.grant.digest, terms.access, terms.expiresAt, now.toISOString());
+    const id = Number(result.lastInsertRowid);
+    store.recordAction({ at: now.toISOString(), actor: input.by, repo: terms.repo, taskId: input.taskId, runId: null, action: "release approved", outcome: "open", source: "work",
+        detail: `release ${id} · generation ${(live?.generation ?? 0) + 1} · ${terms.packageVersion} · pull request #${terms.pr} · ${terms.approvedSha}` });
+    return id;
+}
+/** Seal the anchor's artifact digest once (the person's seal authorized building that approved commit). */
+export function sealAnchorArtifact(store, id, digest, now) {
+    return store.transact(() => {
+        const changed = store.handle.prepare("UPDATE release_authority SET artifact_digest = ?, rev = rev + 1 WHERE id = ? AND artifact_digest IS NULL AND state = 'open'").run(digest, id);
+        if (Number(changed.changes) === 1)
+            store.recordAction({ at: now.toISOString(), actor: "toolroll", repo: releaseAuthority(store, id)?.repo ?? null, taskId: releaseAuthority(store, id)?.anchorTask ?? null, runId: null,
+                action: "release artifact sealed", outcome: "ok", source: "work", detail: `release ${id} · ${digest}` });
+        return Number(changed.changes) === 1;
+    });
+}
+/** Take (or keep) a release's lease. A takeover by another owner raises the epoch, which fences every operation the
+ * old owner reserved. */
+export function takeReleaseLease(store, id, owner, now, ttlMs = 10 * 60_000) {
+    return store.transact(() => {
+        const authority = releaseAuthority(store, id);
+        if (authority === null)
+            return { ok: false, why: `No release ${id}.` };
+        const held = authority.leaseOwner !== null && authority.leaseOwner !== owner && authority.leaseExpires !== null && authority.leaseExpires > now.toISOString();
+        if (held)
+            return { ok: false, why: `Release ${id} is being run by ${authority.leaseOwner} until ${authority.leaseExpires}.` };
+        // A person's own deploy still at work holds the release as a lease would: nothing takes it over (review round 2).
+        const direct = outstandingReleaseOperations(store, id).find(op => op.direct && !releaseIssuerGone(op));
+        if (direct !== undefined)
+            return { ok: false, why: `A deploy of this release (operation ${direct.id}, process ${direct.issuer?.pid ?? "unknown"}) is still running.` };
+        const epoch = authority.leaseOwner === owner && authority.leaseExpires !== null && authority.leaseExpires > now.toISOString() ? authority.leaseEpoch : authority.leaseEpoch + 1;
+        const changed = store.handle.prepare("UPDATE release_authority SET lease_owner = ?, lease_epoch = ?, lease_expires = ?, rev = rev + 1 WHERE id = ? AND rev = ?")
+            .run(owner, epoch, new Date(now.getTime() + ttlMs).toISOString(), id, authority.rev);
+        return Number(changed.changes) === 1 ? { ok: true, epoch } : { ok: false, why: "The release changed while taking its lease; try again." };
+    });
+}
+/** Renew a lease this owner still holds at this epoch. */
+export function renewReleaseLease(store, id, owner, epoch, now, ttlMs = 10 * 60_000) {
+    const changed = store.handle.prepare("UPDATE release_authority SET lease_expires = ? WHERE id = ? AND lease_owner = ? AND lease_epoch = ? AND lease_expires > ?")
+        .run(new Date(now.getTime() + ttlMs).toISOString(), id, owner, epoch, now.toISOString());
+    return Number(changed.changes) === 1;
+}
+/**
+ * Reserve a deploy or a merge of the release tip (the freeze happens here, in the store): a deploy moves `open` to
+ * `deploying` (or, already deploying, reserves a new attempt of the same frozen candidate); a merge moves `deploying`
+ * to `merge-reserved`. `epoch` null is a direct deploy by a person: it takes the current epoch, and only while no
+ * coordinator holds a live lease. Refused while any earlier operation is unsettled.
+ */
+export function reserveRelease(store, input) {
+    return store.transact(() => {
+        const a = releaseAuthority(store, input.authority);
+        if (a === null)
+            return { ok: false, why: `No release ${input.authority}.` };
+        const at = input.now.toISOString();
+        // Expiry stops every live state; an operation already reserved settles only through reconciliation.
+        if (a.expiresAt <= at)
+            return { ok: false, why: "The release approval expired." };
+        if (a.tipTask !== input.taskId || a.tipSha !== input.candidate)
+            return { ok: false, why: `Task ${input.taskId} is not the release's current commit.` };
+        const leased = a.leaseOwner !== null && a.leaseExpires !== null && a.leaseExpires > at;
+        if (input.epoch === null ? leased : input.epoch !== a.leaseEpoch || !leased)
+            return { ok: false, why: input.epoch === null ? `A release coordinator (${a.leaseOwner}) holds this release; let it deploy.` : "This coordinator no longer holds the release's lease." };
+        const outstanding = outstandingReleaseOperations(store, a.id);
+        if (outstanding.length > 0)
+            return { ok: false, why: `An earlier ${outstanding[0].kind} (${outstanding[0].id}) hasn't been settled yet.` };
+        // The whole live-release predicate, inside this transaction, at this moment (review round 1): the approver's
+        // standing and access, the grant and the sandbox, the generation and the tip, and open main-check debt.
+        const live = liveReleaseOf(store, input.taskId, input.kind, input.now);
+        if (!live.applies || !live.ok)
+            return { ok: false, why: `The release can't ${input.kind}: ${live.applies && !live.ok ? live.why : "the task isn't part of it"}.` };
+        const next = input.kind === "deploy"
+            ? a.state === "open" || a.state === "deploying" ? "deploying" : null
+            : a.state === "deploying" || a.state === "merge-reserved" ? "merge-reserved" : null;
+        if (next === null)
+            return { ok: false, why: `The release is ${a.state}, so it can't ${input.kind}.` };
+        const changed = store.handle.prepare("UPDATE release_authority SET state = ?, rev = rev + 1 WHERE id = ? AND rev = ?").run(next, a.id, a.rev);
+        if (Number(changed.changes) !== 1)
+            return { ok: false, why: "The release changed while reserving; try again." };
+        const issuer = input.issuer ?? currentReleaseIssuer();
+        store.handle.prepare("INSERT INTO release_operation (id, authority, kind, task_id, candidate, epoch, state, secret_hash, direct, issuer_pid, issuer_started, issued_at, stage, reserved_at) VALUES (?, ?, ?, ?, ?, ?, 'reserved', ?, ?, ?, ?, ?, ?, ?)")
+            .run(input.operationId, a.id, input.kind, input.taskId, input.candidate, a.leaseEpoch, input.secret === undefined ? null : createHash("sha256").update(input.secret).digest("hex"), input.epoch === null ? 1 : 0, issuer.pid, issuer.started, issuer.at, input.stage ?? null, at);
+        store.recordAction({ at, actor: "toolroll", repo: a.repo, taskId: input.taskId, runId: null, action: `release ${input.kind} reserved`, outcome: next, source: "work", detail: `release ${a.id} · operation ${input.operationId} · epoch ${a.leaseEpoch}` });
+        return { ok: true, operation: releaseOperation(store, input.operationId) };
+    });
+}
+/** The external call's own fence, taken immediately before the call is spawned: `reserved` → `running` (issuing) only
+ * at the epoch that reserved it, while that epoch still holds the lease (a direct deploy's epoch is checked as
+ * reserved) and the release stands, recording the process that issues it. False: the call must not start. */
+export function runReleaseOperation(store, id, epoch, now, issuer = currentReleaseIssuer()) {
+    return store.transact(() => {
+        const op = releaseOperation(store, id);
+        const a = op === null ? null : releaseAuthority(store, op.authority);
+        if (op === null || a === null || op.state !== "reserved" || op.epoch !== epoch || a.leaseEpoch !== epoch)
+            return false;
+        // Past the expiry nothing new starts; the reserved operation is settled by reconciliation instead.
+        if (a.expiresAt <= now.toISOString())
+            return false;
+        // The lease that reserved it still holds (a person's direct deploy: still no coordinator holding the release), and
+        // the live-release predicate still accepts it, at this moment (review round 1).
+        const at = now.toISOString();
+        const leased = a.leaseOwner !== null && a.leaseExpires !== null && a.leaseExpires > at;
+        const direct = Number(store.handle.prepare("SELECT direct FROM release_operation WHERE id = ?").get(id)?.["direct"] ?? 0) === 1;
+        if (direct ? leased : !leased)
+            return false;
+        const live = liveReleaseOf(store, op.taskId, op.kind, now);
+        if (!live.applies || !live.ok)
+            return false;
+        const changed = store.handle.prepare("UPDATE release_operation SET state = 'running', issuer_pid = ?, issuer_started = ?, issued_at = ? WHERE id = ? AND state = 'reserved' AND epoch = ?")
+            .run(issuer.pid, issuer.started, issuer.at, id, epoch);
+        if (Number(changed.changes) === 1)
+            store.recordAction({ at: now.toISOString(), actor: "toolroll", repo: a.repo, taskId: op.taskId, runId: null, action: `release ${op.kind} started`, outcome: "running", source: "work", detail: `operation ${id}` });
+        return Number(changed.changes) === 1;
+    });
+}
+/** Settle an operation: `succeeded`, `failed` or `unknown` (reconciled later). A merge that succeeded ends the release
+ * as `merged`; one that failed puts it back to `deploying`. */
+export function finishReleaseOperation(store, id, outcome, facts, now, epoch) {
+    return store.transact(() => {
+        const op = releaseOperation(store, id);
+        if (op === null || op.state === "succeeded" || op.state === "failed")
+            return false;
+        // Fenced by the epoch that holds the release now (review round 1): a coordinator that lost the lease settles nothing.
+        if (releaseAuthority(store, op.authority)?.leaseEpoch !== epoch)
+            return false;
+        store.handle.prepare("UPDATE release_operation SET state = ?, external_ref = COALESCE(?, external_ref), detail = ?, finished_at = ? WHERE id = ?")
+            .run(outcome, facts.externalRef ?? null, facts.detail ?? null, outcome === "unknown" ? null : now.toISOString(), id);
+        const a = releaseAuthority(store, op.authority);
+        if (op.kind === "merge" && outcome === "succeeded")
+            store.handle.prepare("UPDATE release_authority SET state = 'merged', ended_at = ?, ended_by = 'toolroll', rev = rev + 1 WHERE id = ?").run(now.toISOString(), a.id);
+        if (op.kind === "merge" && outcome === "failed" && a.state === "merge-reserved")
+            store.handle.prepare("UPDATE release_authority SET state = 'deploying', rev = rev + 1 WHERE id = ?").run(a.id);
+        store.recordAction({ at: now.toISOString(), actor: "toolroll", repo: a.repo, taskId: op.taskId, runId: null, action: `release ${op.kind} ${outcome}`, outcome, source: "work", detail: `operation ${id}${facts.detail ? ` · ${facts.detail}` : ""}` });
+        return true;
+    });
+}
+/** Stop carrying later commits: any active approver, any time before the merge starts. */
+export function revokeRelease(store, id, by, now) {
+    return store.transact(() => {
+        const a = releaseAuthority(store, id);
+        if (a === null)
+            return { ok: false, why: `No release ${id}.` };
+        if (a.state === "merge-reserved" || a.state === "merged")
+            return { ok: false, why: "The merge already started, so the release can't be stopped now." };
+        if (!LIVE_RELEASE_STATES.includes(a.state))
+            return { ok: false, why: `The release is already ${a.state}.` };
+        store.handle.prepare("UPDATE release_authority SET state = 'revoked', ended_at = ?, ended_by = ?, rev = rev + 1 WHERE id = ? AND rev = ?").run(now.toISOString(), by, id, a.rev);
+        store.recordAction({ at: now.toISOString(), actor: by, repo: a.repo, taskId: a.anchorTask, runId: null, action: "release revoked", outcome: "revoked", source: "work", detail: `release ${id}` });
+        return { ok: true };
+    });
+}
+/**
+ * THE carry transaction (release-carry.ts proveCarry step 4), one BEGIN IMMEDIATE: every mutable fact is proved again
+ * — the authority's `rev` and tip, its state and expiry and the whole live-release predicate (liveReleaseOf), the
+ * anchor's sealed artifact digest equal to the candidate's, and whatever `recheck` re-reads (the policy, grant and
+ * check access as they are now) — then it writes the carried task and its scope (the anchor's approved terms, profile,
+ * route and acceptance verbatim, with candidate `to`), its seal (basis `carried`, reference `<authority>:<carry>`), the
+ * carry row, the new tip with `rev + 1`, and the ledger row. A carry already written for (authority, `to`) is returned
+ * as it is.
+ */
+export function carryReleaseApproval(store, w, now, recheck) {
+    return store.transact(() => {
+        const a = releaseAuthority(store, w.authority);
+        if (a === null)
+            return { ok: false, why: `No release ${w.authority}.` };
+        const already = releaseCarryTo(store, a.id, w.to);
+        if (already !== null)
+            return { ok: true, taskId: already.taskId, carry: already };
+        if (a.rev !== w.expectRev)
+            return { ok: false, why: "The release changed since this carry was checked; check it again." };
+        if (a.tipSha !== w.expectTip)
+            return { ok: false, why: "The release's current commit moved since this carry was checked." };
+        const live = liveReleaseOf(store, a.tipTask, "dispatch", now);
+        if (!live.applies || !live.ok)
+            return { ok: false, why: live.applies && !live.ok ? `The release approval doesn't stand: ${live.why}.` : "The release's current commit isn't part of it." };
+        if (a.artifactDigest === null || a.artifactDigest !== w.artifactDigest)
+            return { ok: false, why: "The production build differs from the approved one." };
+        const problem = recheck();
+        if (problem !== null)
+            return { ok: false, why: problem };
+        if (store.getTask(w.taskId) !== null)
+            return { ok: false, why: `A task ${w.taskId} already exists.` };
+        const anchorRow = store.handle.prepare("SELECT * FROM task_scope WHERE task_id = ?").get(a.anchorTask);
+        if (anchorRow === undefined)
+            return { ok: false, why: "The approved release task has no scope." };
+        const anchor = readScope(anchorRow);
+        const route = routeFromJson(anchor.approvedRouteJson ?? null);
+        if (anchor.approvedProfile == null || route === null || anchor.releaseTerms == null)
+            return { ok: false, why: "The approved release scope can't be read exactly." };
+        const fields = { goal: anchor.goal, outOfScope: anchor.outOfScope, touches: anchor.touches, budgetMicrousd: anchor.budgetMicrousd, acceptance: anchor.acceptance,
+            qualityMode: anchor.qualityMode ?? "default", candidate: w.to, releaseTerms: anchor.releaseTerms };
+        const digest = digestOf(fields, anchor.approvedProfile, route);
+        store.createTask({ id: w.taskId, title: w.title }, now);
+        const ref = store.refFor(BUILT_IN, w.taskId, "ours");
+        if (store.placeTask(ref.id, a.repo, {}, now) !== true)
+            return { ok: false, why: "The carried task couldn't be placed in the project." };
+        // Its checks, as the anchor's: the Full release check.
+        store.recordAction({ at: now.toISOString(), actor: "toolroll", repo: a.repo, taskId: w.taskId, runId: null, action: "task checks chosen", outcome: "full", source: "request", detail: "Checks for this task: Full" });
+        const carryId = Number(store.handle.prepare(`INSERT INTO release_carry (authority, task_id, scope_digest, request_id, from_sha, to_sha, to_tree, artifact_digest, commits_json, changed_lines, files, churn, runtime, proved_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(a.id, w.taskId, digest, w.requestId, a.approvedSha, w.to, w.toTree, w.artifactDigest, JSON.stringify(w.commits), w.changedLines, w.files, w.churn, w.runtime, now.toISOString()).lastInsertRowid);
+        // The anchor's approved row, copied; only the candidate, the digest and the seal differ. Nobody but this
+        // transaction writes basis `carried` (sealScopeApproval refuses it from every caller).
+        store.handle.prepare(`INSERT INTO task_scope (task_id, goal, out_of_scope, touches, budget_microusd, proposed_at, digest, approved_at, approved_by, approved_digest,
+        profile_json, profile_state, unresolved_reason, approved_profile_json, digest_version, profile_provenance, proposed_chain_json, approved_chain_json, acceptance_json,
+        quality_mode, risk_level, approval_basis, mode_digest, approval_kind, proposed_route_json, approved_route_json, route_era, candidate, proposed_via, release_terms_json)
+      SELECT ?, goal, out_of_scope, touches, budget_microusd, ?, ?, ?, approved_by, ?,
+        approved_profile_json, 'resolved', NULL, approved_profile_json, digest_version, profile_provenance, NULL, NULL, acceptance_json,
+        quality_mode, risk_level, 'carried', ?, 'profile', approved_route_json, approved_route_json, route_era, ?, proposed_via, release_terms_json
+      FROM task_scope WHERE task_id = ?`).run(w.taskId, now.toISOString(), digest, now.toISOString(), digest, `${a.id}:${carryId}`, w.to, a.anchorTask);
+        const moved = store.handle.prepare("UPDATE release_authority SET tip_sha = ?, tip_task = ?, rev = rev + 1 WHERE id = ? AND rev = ?").run(w.to, w.taskId, a.id, a.rev);
+        if (Number(moved.changes) !== 1)
+            throw new Error("The release changed under its own transaction.");
+        store.recordAction({ at: now.toISOString(), actor: "toolroll", repo: a.repo, taskId: w.taskId, runId: null, action: "release carried", outcome: "carried", source: "work",
+            detail: `release ${a.id} · carry ${carryId} · ${a.tipSha} → ${w.to} · ${w.files} files · ${w.changedLines} lines · request ${w.requestId}` });
+        // One quiet task notification, no push.
+        store.enqueueNotification({ dedupeKey: `release-carried:${a.id}:${carryId}`, kind: "release-carried", subject: `Carried to ${w.to.slice(0, 7)}`,
+            body: `Release ${a.version} now ships ${w.to.slice(0, 7)} (${w.files} file${w.files === 1 ? "" : "s"}, ${w.changedLines} line${w.changedLines === 1 ? "" : "s"}) under ${anchor.approvedBy ?? "the"} release approval.`,
+            link: chatControlHref("task", w.taskId), source: { taskRef: ref.id } }, now);
+        return { ok: true, taskId: w.taskId, carry: releaseCarryTo(store, a.id, w.to) };
+    });
+}
+/** Thrown inside a seal whose release authority can't open: the whole seal rolls back. */
+export class ReleaseSealRefused extends Error {
+}
+/**
+ * Whether a deploy run may adopt operation `id` (deploy-browser.mjs --operation): it is this release's running deploy of
+ * this candidate, reserved at the epoch that still holds a live lease, and the run proves the secret only the
+ * reserving coordinator holds (handed over on stdin, never in argv).
+ */
+export function adoptReleaseOperation(store, input) {
+    const op = releaseOperation(store, input.id);
+    const a = releaseAuthority(store, input.authority);
+    if (op === null || a === null || op.authority !== a.id || op.kind !== "deploy" || op.candidate !== input.candidate || op.state !== "running")
+        return { ok: false, why: `Operation ${input.id} isn't this release's running deploy.` };
+    if (op.epoch !== a.leaseEpoch || a.leaseOwner === null || a.leaseExpires === null || a.leaseExpires <= input.now.toISOString())
+        return { ok: false, why: "The coordinator that reserved this deploy no longer holds the release." };
+    const row = store.handle.prepare("SELECT secret_hash FROM release_operation WHERE id = ?").get(input.id);
+    const expected = row?.["secret_hash"];
+    const given = createHash("sha256").update(input.secret).digest("hex");
+    if (typeof expected !== "string" || expected.length !== given.length || !timingSafeEqual(Buffer.from(expected), Buffer.from(given)))
+        return { ok: false, why: "This run can't prove it is the coordinator's deploy." };
+    return { ok: true };
+}
+/** The nightly check of main is a check only (release-once.md, part 3). */
+export const NIGHTLY_CHECK_ONLY = "The nightly check of main is only a check; it is never published or merged.";
+/** Whether a task reference is a nightly check of main. */
+export function nightlyTaskRef(store, taskRef) {
+    return store.handle.prepare("SELECT 1 AS hit FROM nightly_check n JOIN task_ref r ON r.external_id = n.task AND r.backend = 'built-in' WHERE r.id = ?").get(taskRef) !== undefined;
+}
+/** Whether a publication belongs to a nightly check of main. */
+export function nightlyPublication(store, publication) {
+    const row = store.handle.prepare("SELECT task_ref FROM publication WHERE id = ?").get(publication);
+    return row !== undefined && nightlyTaskRef(store, Number(row["task_ref"]));
+}
+/** A release's result merges only through its coordinator: every other merge road refuses it. */
+export const RELEASE_MERGES_ONLY = "This result belongs to a release; it merges only through `toolroll release`.";
+/** Whether a task reference is a release's anchor or a carried release task. */
+export function releaseTaskRef(store, taskRef) {
+    const row = store.handle.prepare("SELECT external_id FROM task_ref WHERE id = ? AND backend = 'built-in'").get(taskRef);
+    return row !== undefined && belongsToRelease(store, String(row["external_id"]));
+}
+/** Whether a publication belongs to a release's task. */
+export function releasePublication(store, publication) {
+    const row = store.handle.prepare("SELECT task_ref FROM publication WHERE id = ?").get(publication);
+    return row !== undefined && releaseTaskRef(store, Number(row["task_ref"]));
+}
+/** The ledger act that records a trusted read of a project's recorded remote main (remote-main.ts). */
+export const TRUSTED_MAIN_ACTION = "remote main read";
+/** The identity of a project's recorded remote: its URL and the ledger record that last set it (0: set on admission
+ * with no record). A read of main stands only for the remote identity it was read from (review round 2). */
+export function trustedRemoteIdentity(store, repo) {
+    const url = store.projectRemote(repo);
+    if (url === null)
+        return null;
+    const row = store.handle.prepare("SELECT id FROM action_ledger WHERE repo = ? AND action = 'project remote recorded' ORDER BY id DESC LIMIT 1").get(repo);
+    return { url, record: row === undefined ? 0 : Number(row["id"]) };
+}
+/** Record the commit the project's recorded remote main was at, as Toolroll's own process fetched it just now from
+ * `url`, bound to the remote's identity at this moment. Refused (nothing recorded) when `url` isn't the recorded one. */
+export function recordTrustedMain(store, repo, sha, url, now) {
+    const identity = trustedRemoteIdentity(store, repo);
+    if (identity === null || identity.url !== url || !/^[0-9a-f]{40}$/.test(sha))
+        return false;
+    store.recordAction({ at: now.toISOString(), actor: "toolroll", repo, taskId: null, runId: null, action: TRUSTED_MAIN_ACTION, outcome: sha, source: "work", detail: JSON.stringify({ v: 2, sha, url, record: identity.record }) });
+    return true;
+}
+/** A failed read of the recorded remote: the last read no longer stands. */
+export function forgetTrustedMain(store, repo, why, now) {
+    store.recordAction({ at: now.toISOString(), actor: "toolroll", repo, taskId: null, runId: null, action: TRUSTED_MAIN_ACTION, outcome: "unread", source: "work", detail: JSON.stringify({ v: 2, why: why.slice(0, 300) }) });
+}
+/**
+ * A pull request check failed after the deploy reservation (Alex, 2026-10-25): the candidate froze at deploy, so the
+ * release stops and asks a person again — even for the same commit, a new person-approved generation continues it.
+ */
+export function requireFreshReleaseApproval(store, id, reason, epoch, now) {
+    return store.transact(() => {
+        const a = releaseAuthority(store, id);
+        if (a === null)
+            return false;
+        // Already ended (revoked, expired, superseded, merged): no approval of it stands to carry the commit.
+        if (!LIVE_RELEASE_STATES.includes(a.state))
+            return a.state !== "merged";
+        if (a.leaseEpoch !== epoch || a.state === "merge-reserved")
+            return false;
+        const changed = store.handle.prepare("UPDATE release_authority SET state = 'revoked', ended_at = ?, ended_by = ?, rev = rev + 1 WHERE id = ? AND rev = ?").run(now.toISOString(), `toolroll: ${reason}; a person approves it again`, id, a.rev);
+        if (Number(changed.changes) !== 1)
+            return false;
+        store.recordAction({ at: now.toISOString(), actor: "toolroll", repo: a.repo, taskId: a.tipTask, runId: null, action: "release revoked", outcome: "needs-approval", source: "work", detail: `release ${id}: ${reason}` });
+        return true;
+    });
+}
+/** This process, as a release operation's issuer. Real time, whatever clock a caller passes for the rest. */
+export function currentReleaseIssuer() {
+    const now = Date.now();
+    return { pid: process.pid, started: new Date(now - Math.round(process.uptime() * 1000)).toISOString(), at: new Date(now).toISOString() };
+}
+/**
+ * Whether an operation's issuer is proven gone (review round 2): no process has its pid, or the process that has it
+ * started after the issuer was recorded (so it is another one). Anything unknown — no issuer recorded, a start time
+ * that can't be read — is not proof, and the operation stays for a person.
+ */
+export function releaseIssuerGone(op) {
+    const issuer = op.issuer;
+    if (issuer === null || !Number.isSafeInteger(issuer.pid) || issuer.pid <= 0)
+        return false;
+    try {
+        process.kill(issuer.pid, 0);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ESRCH")
+            return true;
+        if (code !== "EPERM")
+            return false;
+    }
+    const started = processStartedAt(issuer.pid);
+    const recorded = Date.parse(issuer.at);
+    // ps shows whole seconds (a lower bound): a start a full second after the issuer was recorded is another process.
+    return started !== null && Number.isFinite(recorded) && started > recorded + 1000;
+}
+/** A live process's start time from ps (whole seconds, UTC), or null when it can't be read. */
+function processStartedAt(pid) {
+    if (process.platform === "win32")
+        return null;
+    try {
+        const raw = execFileSync("ps", ["-p", String(pid), "-o", "lstart="], { encoding: "utf8", env: { ...process.env, LC_ALL: "C", TZ: "UTC" }, stdio: ["ignore", "pipe", "ignore"], maxBuffer: 1024, timeout: 1_000, killSignal: "SIGKILL" })
+            .trim().replace(/ +/g, " ");
+        const match = /^(?:Sun|Mon|Tue|Wed|Thu|Fri|Sat) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) (\d{1,2}) (\d{2}:\d{2}:\d{2}) (\d{4})$/.exec(raw);
+        if (match === null)
+            return null;
+        const at = Date.parse(`${match[2].padStart(2, "0")} ${match[1]} ${match[4]} ${match[3]} GMT`);
+        return Number.isFinite(at) ? at : null;
+    }
+    catch {
+        return null;
+    }
+}