toolroll 0.9.73 → 0.9.75

package/dist/telegram-status.js

@@ -4,8 +4,8 @@ import { manualReviewOnly } from "./proof.js";
  * No provider calls, repository access, new workflow state, or inferred success. */
 import { diagnoseTaskDispatch, withDispatchDiagnoses } from "./dispatch.js";
 import { familyCompleted } from "./result-completion.js";
-import { assignmentStatusFacts, plainReasonOf, stageOfDispatch, taskStatusOf } from "./task-status.js";
-import { assignmentOf } from "./assignment.js";
+import { approvedCheckOf, approvedCheckStateOf, assignmentStatusFacts, checksFactOf, plainReasonOf, stageOfDispatch, taskStatusOf } from "./task-status.js";
+import { assignmentChecksForRun, assignmentOf } from "./assignment.js";
 import { CHAT_CONTROLS, chatControlHref, chatResultHref } from "./chat-controls.js";
 export function phoneCommand(text) {
     // Slash forms everywhere; the bare words too, because Slack and Discord
@@ -257,7 +257,12 @@ export function phoneTaskView(store, repos, id, now, root) {
             const proof = store.proofVerdictFor(result.id);
             link = taskLinkFor(id, d, { run: result.id, verdict: proof !== null });
             const accepted = store.proofAcceptance(result.id) !== null;
-            const proofWords = { verified: "Checks passed at completion", attested: "Checks reported by the agent, not run by Toolroll", short: "Required saved material is missing", refuted: "The saved result conflicts with the approved scope" };
+            // Did the approved check pass (task-status.ts approvedCheckOf): read with the saved files, else no claim at all.
+            const checkNow = root === undefined || proof?.verdict !== "verified" ? null
+                : approvedCheckStateOf(approvedCheckOf(proof.verdict, proof.reasons, checksFactOf(assignmentChecksForRun(store, root, result.id, now), result.headRevision)));
+            const verifiedWords = root === undefined ? "Open the result to see its checks" : checkNow === "passed" ? "Checks passed at completion"
+                : checkNow === "failed" ? "Checks failed" : checkNow === "running" ? "Checks running" : "The check result couldn't be read";
+            const proofWords = { verified: verifiedWords, attested: "Checks reported by the agent, not run by Toolroll", short: "Required saved material is missing", refuted: "The saved result conflicts with the approved scope" };
             lines.push(`Checks: ${proof === null ? "No completion record saved" : manualReviewOnly(proof) ? accepted ? "Accepted by a person; the recorded checks are unchanged" : "A person must inspect this result; no recorded check failed" : proofWords[proof.verdict]}.`);
             if (manualReviewOnly(proof) && !accepted)
                 lines.push('Reply “Send the result summary” for the checks, notes and screenshots.');

package/dist/tool-secret-store.js

@@ -27,6 +27,7 @@
  * database records which key Toolroll made: a folder, key, link or lock that
  * something else put there first is refused, never used.
  */
+import { inReadOnlyRequest } from "./read-only-request.js";
 import { spawnSync } from "node:child_process";
 import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
 import { closeSync, constants, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeSync } from "node:fs";
@@ -541,6 +542,10 @@ export function secretFolder(state) {
     const known = folders.get(root);
     if (known !== undefined && unchanged(known))
         return known;
+    // A page visit prepares nothing (docs/plans/get-side-effects.md): the console prepares its folder as it starts, and
+    // an action checks a changed one again. Until then the page says secrets can't be read right now.
+    if (inReadOnlyRequest())
+        throw new SecretStoreError(NOT_READY);
     // Changed since it was checked (or never seen): checked against the same record (the database's, for Toolroll's
     // own folder; this process's, for a test's), and refused if it doesn't match.
     const named = pending.get(root);
@@ -797,6 +802,9 @@ export function readHeldSecret(state, name, file) {
     const backend = secretBackend();
     if (backend === null)
         return readOwnFile(path);
+    // A page visit moves nothing and takes no lock (docs/plans/get-side-effects.md): the keychain, else the old file.
+    if (inReadOnlyRequest())
+        return readSealed(backend, folder, heldItem(folder, name)) ?? readOwnFile(path);
     return withSecretLock(folder, `held.${name}`, () => {
         moveHeldIn(backend, folder, name, path);
         return readSealed(backend, folder, heldItem(folder, name));

package/dist/toolroll-update-ui.d.ts

@@ -17,6 +17,8 @@ export type UpdatesView = {
         problem: string;
     } | {
         off: true;
+    } | {
+        pending: true;
     };
     method: InstallMethod;
     journal: RuntimeUpdateJournal | null;

package/dist/toolroll-update-ui.js

@@ -65,9 +65,10 @@ export function updatesHtml(view, notice) {
         : view.method.kind === "source" ? html `<h2>Toolroll ${view.current}</h2><p class="meta">This runs from a source checkout. Update it with git.</p>`
             : newer && view.method.kind === "desktop" ? html `<h2>Toolroll ${latest} is available</h2><p class="meta">You have ${view.current}. Update it from the Toolroll app.</p>`
                 : newer ? html `<h2>Toolroll ${latest} is available</h2><p class="meta">You have ${view.current}. Running work finishes first, and your current version is kept so you can go back.</p>`
-                    : "off" in view.latest ? html `<h2>Toolroll ${view.current}</h2><p class="meta">Update checks are off.</p><form method="get" action="/settings/updates" class="update-actions"><input type="hidden" name="check" value="now"><button type="submit">Check now</button></form>`
-                        : latest === null ? html `<h2>Toolroll ${view.current}</h2><p class="meta">Couldn’t check for a newer release: ${"problem" in view.latest ? view.latest.problem : ""}</p>`
-                            : html `<h2>Toolroll ${view.current} is up to date</h2>`;
+                    : "off" in view.latest ? html `<h2>Toolroll ${view.current}</h2><p class="meta">Update checks are off.</p>${postForm("/settings/updates/check", html `<button type="submit">Check now</button>`, { attrs: { class: "update-actions" } })}`
+                        : "pending" in view.latest ? html `<h2>Toolroll ${view.current}</h2><p class="meta">Not checked for a newer release yet.</p>${postForm("/settings/updates/check", html `<button type="submit">Check now</button>`, { attrs: { class: "update-actions" } })}`
+                            : latest === null ? html `<h2>Toolroll ${view.current}</h2><p class="meta">Couldn’t check for a newer release: ${"problem" in view.latest ? view.latest.problem : ""}</p>`
+                                : html `<h2>Toolroll ${view.current} is up to date</h2>`;
     const form = newer && !["npx", "source", "desktop"].includes(view.method.kind)
         ? postForm("/settings/updates", html `${reauth(html `<label class="step-up">Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label>`)}<div class="update-actions"><button type="submit" name="when" value="now" class="primary">Update now</button><button type="submit" name="when" value="when-idle">When idle</button><button type="submit" name="when" value="tonight">Tonight (03:00)</button></div>`, { hidden: { version: latest } })
         : "";

package/dist/toolroll-update.js

@@ -22,6 +22,7 @@
  * previous runtime and its backups. Every update, rollback, refusal and
  * failure is a ledger entry.
  */
+import { inReadOnlyRequest } from "./read-only-request.js";
 import { createHash, randomUUID, verify as signatureValid, X509Certificate } from "node:crypto";
 import { spawnSync } from "node:child_process";
 import { accessSync, chmodSync, closeSync, constants, copyFileSync, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readdirSync, readFileSync, readlinkSync, realpathSync, renameSync, rmSync, statfsSync, statSync, symlinkSync, writeFileSync } from "node:fs";
@@ -29,7 +30,7 @@ import { homedir, userInfo } from "node:os";
 import { basename, dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { createRequire } from "node:module";
-import { clearWords, durableJson, LINGERING_LIMIT_MS, lingeringRun, lingeringWords, settleLeftoverRecords, sqliteLock, desktopUpdateWaitingOf, stoppedWaitingWords, updateWaitingWords, verifiedDatabaseBackup } from "./desktop-update.js";
+import { clearWords, durableJson, LINGERING_LIMIT_MS, lingeringRun, lingeringWords, settleLeftoverRecords, sqliteLock, lockHeld, desktopUpdateWaitingOf, stoppedWaitingWords, updateWaitingWords, verifiedDatabaseBackup } from "./desktop-update.js";
 import { activeUpdateWork, freezeUpdateGate, installUpdateGate, removeUpdateGate, updateAdmissionPaused, updateGateOwned } from "./desktop-update-gate.js";
 import { processMayBeAlive } from "./process-liveness.js";
 import { removeTerminalUpdateGate } from "./terminal-catalog.js";
@@ -1445,11 +1446,8 @@ export function runtimeUpdateStatus(stateDir) {
         j = null;
     }
     let running = false;
-    if (j && !runtimeUpdateTerminal(j.phase)) {
-        const lock = sqliteLock(join(j.stageDir, "worker.sqlite"));
-        running = lock === null;
-        lock?.close();
-    }
+    if (j && !runtimeUpdateTerminal(j.phase))
+        running = lockHeld(join(j.stageDir, "worker.sqlite"));
     const whatsNew = j && j.kind === "update" && j.phase === "complete" && !j.seen ? { version: j.to.version, notes: j.notes ?? [] } : null;
     let last = null;
     try {
@@ -1525,10 +1523,13 @@ export function releaseStalledUpdate(stateDir, now) {
  * waiting update, `toolroll update`'s or the desktop app's. */
 export function waitingUpdate(databaseFile, inTheWay, now, desktopStates) {
     const stateDir = dirname(databaseFile);
-    try {
-        releaseStalledUpdate(stateDir, now);
+    // A page visit only reads (docs/plans/get-side-effects.md): the console's background pass releases a stalled update.
+    if (!inReadOnlyRequest()) {
+        try {
+            releaseStalledUpdate(stateDir, now);
+        }
+        catch { /* an unreadable record is shown as it is */ }
     }
-    catch { /* an unreadable record is shown as it is */ }
     return updateWaitingOf(stateDir, inTheWay) ?? desktopUpdateWaitingOf(databaseFile, inTheWay, desktopStates);
 }
 export function markWhatsNewSeen(stateDir) {

package/dist/work-index.js

@@ -10,7 +10,7 @@ import { readProjectAccess } from './project-access.js';
 import { pauseOnTaskProviders, providerName, signInReason } from './provider-auth.js';
 import { scopeTermsProblem, stopFactOf } from './store.js';
 import { assignmentChecksForRun } from './assignment.js';
-import { checkBackingOf, completionBlockersOf, leadOnIt, plainReasonOf, replacedWords, requirementsOf, stageOfCode, taskStatusOf, unverifiedWhenRefuted, workToneOf } from './task-status.js';
+import { approvedCheckOf, checkBackingOf, completionBlockersOf, leadOnIt, plainReasonOf, replacedWords, requirementsOf, stageOfCode, taskStatusOf, unverifiedWhenRefuted, workToneOf } from './task-status.js';
 import { releaseCoverageOf } from './release-coverage.js';
 import { buildReviewOf } from './review-switch.js';
 import { shownVerdictOf } from './proof.js';
@@ -429,7 +429,7 @@ function readWorkIndexPage(store, now, access, options, taskId = null) {
     // automatic review and, with checks Off, the release check that covers it.
     const memo = new Map();
     const readiness = (row, checks) => resultReadinessFacts(store, now, options.root, row, checks, memo);
-    return { items: page.map(row => itemOf(row, access.principal, probe, leadName, readiness)), projects, totals: rows[0] === undefined ? { ...EMPTY } : counts(rows[0]),
+    return { items: page.map(row => itemOf(row, access.principal, probe, leadName, readiness, options.root !== undefined)), projects, totals: rows[0] === undefined ? { ...EMPTY } : counts(rows[0]),
         groups: rows[0] === undefined ? { ...NO_GROUPS } : groupCounts(rows[0]), nextCursor, limit, view };
 }
 export function workCountsByProject(store, now, access) {
@@ -489,22 +489,36 @@ function listChecksOf(own, level, follows) {
         return null;
     return { status: read.status, exitCode: null, head: null, level: read.level, running: read.running };
 }
+/** A check as a read without the evidence files may show it: only what never claims a pass it can't prove. */
+function unreadChecksOf(checks) {
+    if (checks === null)
+        return null;
+    return checks.status === 'failed' || (checks.level === 'off' && checks.status !== 'passed' && checks.release == null) ? checks : null;
+}
 /** A ready result's requirements, acceptance and completion blockers from its saved records, as assignmentOf reads them. */
 function resultReadinessFacts(store, now, root, row, recorded, memo) {
     const run = n(row, 'result_id'), repo = s(row, 'repo');
     if (!run)
-        return { checks: recorded };
+        return { checks: root === undefined ? unreadChecksOf(recorded) : recorded };
     const report = s(row, 'result_role') === 'scout';
-    // No recorded check result (a build from before results were recorded, or none ran): read its saved receipt, as the page does.
-    const saved = root !== undefined && (recorded === null || recorded.status === 'not-run') ? assignmentChecksForRun(store, root, run, now) : null;
+    // Read its saved receipt, as the page does: a recorded result (or a verdict alone) is not a check that can still be
+    // read, and the row must never say passed while the task page says the check couldn't be read.
+    const read = root !== undefined && !report ? assignmentChecksForRun(store, root, run, now) : null;
+    // A recorded failure is never lost because its saved files can't be read now (fail closed: negatives stand).
+    const saved = read !== null && recorded?.status === 'failed' && (read.status === 'unavailable' || read.status === 'not-run')
+        ? { ...read, status: 'failed', exitCode: recorded.exitCode } : read;
     const listed = saved === null ? recorded : { status: saved.status, exitCode: saved.exitCode, head: s(row, 'result_head'),
         ...(saved.level == null ? {} : { level: saved.level }), ...(saved.running == null ? {} : { running: saved.running }), ...(saved.batch == null ? {} : { batch: saved.batch }) };
-    const checks = listed?.level === 'off' && listed.status !== 'passed' && listed.status !== 'failed'
+    const covered = listed?.level === 'off' && listed.status !== 'passed' && listed.status !== 'failed'
         ? { ...listed, release: releaseCoverageOf(store, root, repo, s(row, 'result_head'), { memo }) } : listed;
     const proof = store.proofVerdictFor(run), accepted = store.proofAcceptance(run) !== null;
+    // The approved check as the task page reads it (task-status.ts): a recorded pass with no readable check doesn't count.
+    // Without the evidence root nothing can be read, so the row makes no claim about the check at all: a recorded
+    // failure or checks Off still say so; a pass, or a missing check, is the result's own page to say.
+    const checks = report ? covered : root === undefined ? unreadChecksOf(covered) : approvedCheckOf(proof?.verdict ?? null, proof?.reasons ?? [], covered);
     const review = buildReviewOf(store, run);
     const high = review === null || review.sentBackAs !== null || review.state !== 'reviewed' ? 0 : review.high.length;
-    const checkRequired = requiredCheckCommandFor(store, repo, String(row['id']), checks?.level) !== null;
+    const checkRequired = root === undefined && checks === null ? false : requiredCheckCommandFor(store, repo, String(row['id']), checks?.level) !== null;
     const backing = checkBackingOf(checks);
     const requirements = requirementsOf(proof?.matrix, backing);
     const verdict = shownVerdictOf(proof?.verdict ?? null, { checkFailed: !report && checks?.status === 'failed', highFindings: high, reviewPending: review?.state === 'pending',
@@ -512,7 +526,7 @@ function resultReadinessFacts(store, now, root, row, recorded, memo) {
     const blockers = completionBlockersOf({ report, checks, checkRequired, matrix: proof?.matrix, verdict: proof?.verdict ?? null, accepted, high });
     return { checks, requirements: unverifiedWhenRefuted(requirements, verdict), ...(accepted ? { accepted } : {}), ...(blockers.length === 0 ? {} : { blockers }) };
 }
-function itemOf(row, principal, probe, leadName, readiness) {
+function itemOf(row, principal, probe, leadName, readiness, readable = false) {
     const code = String(row['code']), id = String(row['id']);
     const custody = code === 'process-needs-attention' || (code === 'result-needs-attention' && n(row, 'custody_unresolved') === 1);
     const process = custody && probe !== undefined ? processNeedOf(probe(id)) : null;
@@ -624,15 +638,18 @@ function itemOf(row, principal, probe, leadName, readiness) {
             : coded.stage === 'needs-you' && (coded.need === undefined || coded.need === 'other') && INDEX_NEED[code] !== undefined ? { stage: 'needs-you', need: INDEX_NEED[code] } : coded;
     const checkStatus = s(row, 'check_status'), verdict = s(row, 'proof_verdict');
     const finished = reading.stage === 'finished' || reading.stage === 'complete';
-    const own = checkStatus === 'failed' || n(row, 'proof_failed_check') === 1 ? 'failed' : checkStatus === 'passed' || verdict === 'verified' ? 'passed' : null;
-    const listedChecks = !finished ? null : listChecksOf(own, s(row, 'check_level'), row['check_follows']);
-    const ready = reading.stage === 'finished' && readiness !== undefined ? readiness(row, listedChecks) : null;
+    // Only a recorded check is a pass; a verdict alone isn't one (task-status.ts approvedCheckOf reads it with the receipt).
+    const own = checkStatus === 'failed' || n(row, 'proof_failed_check') === 1 ? 'failed' : checkStatus === 'passed' ? 'passed' : null;
+    const recordedChecks = !finished ? null : listChecksOf(own, s(row, 'check_level'), row['check_follows']);
+    // A read without the evidence files claims no pass (unreadChecksOf); the readiness read below says the rest.
+    const listedChecks = readable ? recordedChecks : unreadChecksOf(recordedChecks);
+    const ready = reading.stage === 'finished' && readiness !== undefined ? readiness(row, recordedChecks) : null;
     // Toolroll marked it complete because its work landed: the reason, said once.
     const landed = code === 'complete' ? landedReasonOf(s(row, 'checked_actor'), s(row, 'checked_detail')) : null;
     const shared = taskStatusOf({ stage: reading.stage, ...(reading.need === undefined ? {} : { need: reading.need }), ...(reading.wait === undefined ? {} : { wait: reading.wait }),
         ...(process === null ? {} : { needContext: { build: process.build } }),
         reason: finished ? null : plainReasonOf(reading.stage, code, detail || null), report: s(row, 'result_role') === 'scout',
-        checks: ready?.checks ?? listedChecks,
+        checks: ready !== null ? ready.checks : listedChecks,
         ...(ready === null ? {} : { requirements: ready.requirements ?? null, ...(ready.accepted ? { accepted: true } : {}), ...(ready.blockers === undefined ? {} : { blockers: ready.blockers }) }),
         completedBy: code !== 'complete' || landed !== null ? null : n(row, 'completed_by_lead') === 1 ? 'the lead' : String(row['checked_actor']).replace(/^(?:operator|coordinator|lead):/, ''),
         ...(landed === null ? {} : { landed }),

package/dist/workspace-ui.d.ts

@@ -22,6 +22,7 @@ export { ACCEPT_NEEDS_REASON, cantAcceptYetOf, evidenceProblemOf, type EvidenceP
 import { type ProofVerdict } from "./proof.js";
 import type { ReviewRetryState, TaskState } from "./store.js";
 import type { TaskControlView } from "./task-control.js";
+import { type ChecksFact } from "./task-status.js";
 import { type Html } from "./html.js";
 /** The Work destination's views — shortcuts over the same rows, never a
  * persisted state. All is the default. */
@@ -53,6 +54,10 @@ export type ResultFacts = {
      * per run so an older selected result keeps its own words; undefined
      * when the caller did not read it, null when never requested. */
     review?: ReviewFacts | null;
+    /** The saved approved check as read now (assignmentChecksForRun), for `approvedCheckOf`: the words say the check
+     * passed only when this reading does. Undefined: the caller read no check (a list or dispatch read), so the words
+     * name only what the verdict recorded when the build finished. */
+    checks?: ChecksFact | null;
 };
 /** The result's review facts as `reviewRetryStateOf` records them, plus
  * the one liveness fact the words depend on. */

package/dist/workspace-ui.js

@@ -19,7 +19,7 @@
 import { ACCEPT_NEEDS_REASON, FAILED_CHECK, cantAcceptYetOf, evidenceProblemOf } from "./result-acts.js";
 export { ACCEPT_NEEDS_REASON, cantAcceptYetOf, evidenceProblemOf };
 import { manualReviewOnly, plainReasonWords } from "./proof.js";
-import { OPEN_RESULT, plainReasonOf, stageOfCode, taskStatusOf, workToneOf } from "./task-status.js";
+import { CHECK_COMMAND_CHANGED, CHECK_UNREADABLE, OPEN_RESULT, approvedCheckOf, approvedCheckStateOf, plainReasonOf, stageOfCode, taskStatusOf, workToneOf } from "./task-status.js";
 import { whenUtc } from "./when-html.js";
 import { html, postForm } from "./html.js";
 export const WORK_VIEWS = [
@@ -122,9 +122,15 @@ export function resultStatusOf(result, publication = null) {
     return (result?.role === "builder" ? reviewStatusOf(result.review ?? null) : null) ?? storedResultStatusOf(result, publication);
 }
 /** What the machine itself recorded about a result, in a clause. */
-function machineVerdictWords(result) {
-    if (result.verdict === "verified")
+function machineVerdictWords(result, check) {
+    if (check !== undefined && check?.status === "failed" && evidenceProblemOf(result.verdict, result.reasons) !== "checks-failed") {
+        return `the approved check failed against it${check.exitCode === null ? "" : ` (exit ${check.exitCode})`}`;
+    }
+    if (result.verdict === "verified" && passedNow(check))
         return "it verified the result before the acceptance";
+    // Unread here, or unreadable now: never restated as a pass.
+    if (result.verdict === "verified")
+        return check === undefined ? "open the result for its checks" : "its check result couldn't be read";
     if (result.verdict === "attested")
         return "the checks on record are the agent's own report";
     const problem = evidenceProblemOf(result.verdict, result.reasons);
@@ -136,6 +142,14 @@ function machineVerdictWords(result) {
         return "its evidence did not match the sealed record";
     return "its required evidence was missing";
 }
+/** The approved check passed (task-status.ts approvedCheckStateOf): its own pass, or checks Off covered by a passing
+ * release check. A re-run underway keeps the pass it had. */
+const passedNow = (check) => {
+    const state = approvedCheckStateOf(check);
+    return state === "passed" || (state === "running" && check?.status === "passed");
+};
+/** A result whose check this surface didn't read: no pass is claimed, the result page says. */
+const UNREAD_CHECK = "Open the result to see its checks.";
 function storedResultStatusOf(result, publication) {
     if (result === null || result.runId === null) {
         return {
@@ -151,6 +165,8 @@ function storedResultStatusOf(result, publication) {
     }
     const published = publicationStatusOf(publication);
     const withPublication = (detail) => (published === null ? detail : `${detail} ${published.detail}`);
+    // Did the approved check pass for this result (task-status.ts): the one answer the Checks row and the road read.
+    const check = result.checks === undefined ? undefined : approvedCheckOf(result.verdict, result.reasons, result.checks);
     const humanReview = manualReviewOnly({ verdict: result.verdict ?? "", reasons: result.reasons });
     if (result.accepted && humanReview) {
         return { token: "accepted-exception", label: "Accepted by a person", detail: withPublication("A person accepted this result. The recorded checks are unchanged."), tone: "done", action: { label: "Open the acceptance", kind: "open-review" } };
@@ -162,14 +178,18 @@ function storedResultStatusOf(result, publication) {
             // Acceptance records a person's decision; it neither proves nor
             // disproves anything about the checks. The machine's own verdict is
             // restated as recorded.
-            detail: withPublication(`An approver accepted this result by hand, and the recorded exception says why. The machine's verdict is unchanged: ${machineVerdictWords(result)}.`),
+            detail: withPublication(`An approver accepted this result by hand, and the recorded exception says why. The machine's verdict is unchanged: ${machineVerdictWords(result, check)}.`),
             tone: "done",
             action: { label: "Open the recorded exception", kind: "open-review" },
         };
     }
-    const problem = evidenceProblemOf(result.verdict, result.reasons);
+    const recordedProblem = evidenceProblemOf(result.verdict, result.reasons);
+    // A failed check that a later check on the same commit passed no longer fails the result; a check that failed
+    // since a passing verdict does.
+    const problem = recordedProblem === "checks-failed" && passedNow(check) ? "none"
+        : recordedProblem !== "mismatched" && check?.status === "failed" ? "checks-failed" : recordedProblem;
     if (problem === "checks-failed") {
-        const exit = failedCheckExit(result.reasons);
+        const exit = check?.status === "failed" ? check.exitCode : failedCheckExit(result.reasons);
         return {
             token: "checks-failed",
             label: "Changes saved, but checks failed",
@@ -218,7 +238,14 @@ function storedResultStatusOf(result, publication) {
             action: { label: "See what is missing", kind: "open-review" },
         };
     }
-    if (result.verdict === "attested") {
+    // Any verdict short of a pass the check confirms: never "passed" when the check can't be read now.
+    if (check !== undefined && !passedNow(check) && result.verdict === "verified") {
+        return check?.status === "running"
+            ? { token: "checks-running", label: "Checks running", detail: withPublication("The approved check is running on this result."), tone: "live", action: { label: OPEN_RESULT, kind: "open-result" } }
+            : { token: "check-unreadable", label: "Result saved — check result couldn't be read", detail: withPublication(`${check?.cause === "command-changed" ? CHECK_COMMAND_CHANGED : CHECK_UNREADABLE} This result isn't verified.`),
+                tone: "problem", action: { label: "Open the check", kind: "open-review" } };
+    }
+    if (result.verdict === "attested" && !passedNow(check)) {
         return {
             token: "agent-attested",
             label: "Result saved — checks reported by the agent",
@@ -231,7 +258,7 @@ function storedResultStatusOf(result, publication) {
         return {
             token: published.token,
             label: published.label,
-            detail: `The approved check passed against this result. ${published.detail}`,
+            detail: check === undefined ? `${UNREAD_CHECK} ${published.detail}` : `The approved check passed against this result. ${published.detail}`,
             tone: published.token === "pr-closed" ? "muted" : "done",
             action: published.token === "merge-observed" ? { label: OPEN_RESULT, kind: "open-result" } : { label: "Open the pull request", kind: "open-pr" },
         };
@@ -239,7 +266,8 @@ function storedResultStatusOf(result, publication) {
     return {
         token: "ready-to-review",
         label: "Ready",
-        detail: withPublication("The approved check passed against this result."),
+        // Only a check read here may be called passed; a surface that read none says where to see it.
+        detail: withPublication(check === undefined ? UNREAD_CHECK : "The approved check passed against this result."),
         tone: "ready",
         action: { label: OPEN_RESULT, kind: "open-result" },
     };
@@ -301,7 +329,7 @@ export function dispatchActionLabel(dispatch) {
 }
 /** Result tokens a done task can wear, as the shared stage they mean. A
  * result that is missing its record waits on a person; a failed check fails. */
-const RESULT_NEEDS_YOU = new Set(["no-build-record", "verification-needed", "evidence-mismatch", "record-incomplete", "evidence-damaged"]);
+const RESULT_NEEDS_YOU = new Set(["no-build-record", "verification-needed", "evidence-mismatch", "record-incomplete", "evidence-damaged", "check-unreadable"]);
 /** Result tokens that only follow a passing project check. */
 const VERIFIED_RESULT = new Set(["ready-to-review", "pr-opened", "merge-observed", "pr-closed"]);
 /** A finished result's display status in the shared headline's words: a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.9.73",
+  "version": "0.9.75",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"